Background checks protect customers, colleagues and the organisation, but the rules on how you run them are strict and differ between countries, states and cities. This free pre-employment background check checklist puts the steps in a fixed order for hires in the United States and the United Kingdom. It starts with a risk-based choice of checks for the role, then covers notice and consent, running the checks, reviewing the results, a fair process when something comes back that concerns you, and the decision and record-keeping at the end. Once a candidate is cleared, the Employee Onboarding Checklist takes over.
The checks should match the job. A blanket policy of running every check on every hire is expensive, slow and, in parts of both countries, unlawful. The UK Information Commissioner’s Office says employers should vet only where the law requires it or where the role carries a significant and particular risk. US regulators take a similar line on criminal records: a check should be relevant to the duties of the job.
The order of steps matters as much as the checks. In the US, the Fair Credit Reporting Act (FCRA) controls any check bought from a background screening company, and many states and cities add fair-chance rules on when you may ask about criminal history. In the UK, criminal record checks are made through the Disclosure and Barring Service (DBS) in England and Wales, and the level of check you may request depends on the role. Scotland and Northern Ireland have their own services, Disclosure Scotland and AccessNI.
Process is not the same as advice. This template makes sure each step is done and recorded. Where a result is borderline or a candidate challenges a decision, take advice from an employment lawyer on the specific case.
Main rules: the FCRA, plus state and local fair-chance and credit-check laws.
Before the check: a standalone written disclosure and the candidate’s written authorisation.
Before rejecting: a pre-adverse action notice with a copy of the report and the FCRA summary of rights.
Also required: Form I-9 employment eligibility verification, which is part of onboarding.
Main rules: the Rehabilitation of Offenders Act 1974, DBS eligibility rules, UK GDPR and the Data Protection Act 2018.
Before the check: confirm the role is eligible for the DBS level and tell the candidate what will be checked.
Before the start date: a prescribed right-to-work check, which gives you a statutory excuse.
Afterwards: keep criminal record information only as long as you need it.
Six phases run from the check plan to the final record. US and UK tasks appear according to the jurisdiction chosen at the start, and Phase 5 appears only when a result raises a concern.
Shown only when a result raises a concern. No decision is final until the candidate has had a chance to respond.
Start from the duties of the role, not from a list of everything a screening company sells. The matrix below is a starting point for Phase 1. Write down why each check is needed for the role, because that reason is what you will rely on if the check, or a decision based on it, is ever questioned.
| Role profile | United States | United Kingdom | Why |
|---|---|---|---|
| Every hire | Identity, Form I-9, references | Identity, right-to-work check, references | Legal duty to confirm the person can work, and that they are who they say they are |
| Office and customer-facing roles | Employment and education verification; criminal record only if job-related | Basic DBS only if a clear reason exists | Low risk: verify claims on the CV, not the person’s past |
| Cash, payments or financial authority | Criminal record; credit report only where state and city law allow it | Basic DBS; financial checks where the role justifies them | Opportunity for fraud or theft |
| Driving for work | Motor vehicle record from the state | DVLA licence check with a check code from the candidate | Road safety and insurance cover |
| Children, patients or vulnerable adults | State-mandated checks for the sector, licence verification | Enhanced DBS, with barred list checks for regulated activity | Safeguarding duties set by law |
| Privileged systems or sensitive data | Criminal record, employment and education verification | Basic DBS, employment history, qualifications | Access to systems, data or money that could cause serious harm |
The waiting period. The FCRA says a candidate must get the pre-adverse action notice before you act, but neither the statute nor the Federal Trade Commission sets a number of days. The point is to give the candidate a real chance to correct a wrong report. Five business days is a common working minimum, and it is the legal minimum under the California and New York City fair-chance laws. Wait longer if the candidate says they are disputing the report.
The EEOC guidance. The Equal Employment Opportunity Commission’s 2012 guidance on arrest and conviction records is still published and has not been formally rescinded, though federal enforcement of disparate-impact claims has been deprioritised since an April 2025 executive order. Its three factors, the nature of the offence, the time elapsed and the nature of the job, are the same ones many state and city fair-chance laws write into their individualised assessments, so the assessment in Phase 5 is worth doing either way.
UK filtering. Standard and enhanced DBS certificates do not show every old conviction. Some older convictions and cautions are filtered out after a set period, unless the offence is on the list that is never filtered or led to a custodial sentence. A basic check shows only unspent convictions and conditional cautions. The rules are in the DBS filtering guidance.
Choose the jurisdiction on the first task and conditional logic shows the FCRA steps for a US hire or the DBS and right-to-work steps for a UK hire. Recruiters stop working from a generic list and skipping the parts that seem not to apply.
Answer “Does any result raise a concern?” with Yes and the individualised assessment phase appears, with the notices and the response period, before the decision task. The decision is an approval assigned to a named person, so it cannot be ticked off by whoever happens to be in the hiring channel.
Signed consent forms are uploaded to the task, due dates run back from the planned start date, and the audit trail shows who completed each step. If a candidate later challenges the process, the dates and the order of events are already written down.
Background checks sit between the offer and the first day. CheckFlow’s HR checklist software runs the whole hiring lifecycle from templates, from the HR Recruitment Process Checklist to onboarding, with assignments and handoffs between HR, recruiters and hiring managers.
The clearance decision is a formal sign-off. CheckFlow’s approval software shows how approvals hold a checklist until the named approver decides, and our employee onboarding checklist guide covers what happens once a candidate is cleared.
It depends on the role. Every hire needs identity and right-to-work checks, and most employers take up references and verify employment history. Criminal record, credit, driving and professional licence checks should be added only where the duties of the role justify them. In the UK, the level of DBS check you may request is set by law according to the role, so the choice is not entirely yours.
When you use a background screening company, the FCRA requires a clear written disclosure in a document that consists only of the disclosure, and the candidate’s written authorisation before you order the report. Before rejecting someone because of the report, you must give them a copy of it and the FCRA summary of rights. After the decision, the adverse action notice must name the screening company, say it did not make the decision, and explain the candidate’s right to a free copy within 60 days and to dispute the report. The FTC’s guidance for employers sets out each step.
It depends on where the job is. By the National Employment Law Project’s count, 37 states and more than 150 cities and counties have some form of ban-the-box or fair-chance policy, though many apply only to public employers. California’s Fair Chance Act covers employers with five or more employees and New York City’s covers employers with four or more; both bar criminal history questions until after a conditional offer. The federal Fair Chance to Compete for Jobs Act applies the same timing to federal agencies and to federal contractors for work under the contract. Asking after the conditional offer is the safest default everywhere.
A basic check shows unspent convictions and conditional cautions, and any employer can request one. A standard check adds spent convictions and cautions that have not been filtered, and is available only for roles listed in the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975. An enhanced check adds relevant information held by local police, and an enhanced check with barred lists also shows whether the person is barred from working with children or adults. DBS guidance says that knowingly asking for a higher level than the role allows is unlawful.
Up to £60,000 for each illegal worker, according to the Home Office. A correct check carried out before the person starts work gives you a statutory excuse against the penalty. Use the Home Office online service for anyone with an eVisa. From 1 October 2026 the scheme also reaches some workers and individual subcontractors, not only employees, and any digital provider you use must be registered. Keep a copy of the check for the length of employment and for two years afterwards.
As briefly as the purpose allows. In the UK, the ICO says vetting information should be destroyed once recruitment is over, and the DBS code of practice says certificate information should usually be kept for no more than six months after the decision. Record only that the check was done and whether it was satisfactory. In the US, EEOC rules require hiring records to be kept for one year, or longer if a charge is filed, and the FCRA requires secure disposal of reports when you no longer need them. State laws can set longer periods.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
