The previous piece set out how US background checks are shrinking under Clean Slate laws, credit bans and fair chance rules. This one is for the employer who runs US hiring from somewhere else.
That describes a large population. Indian IT and engineering services firms with US delivery centres. Gulf conglomerates with American subsidiaries. Global capability centres whose parent sits in the US and whose HR operations sit in India. Staffing firms placing Indian talent into US roles.
For all of them, the US is one market among several, handled by an HR operations team that is competent, busy, and not based in the jurisdiction whose rules keep changing. The habits that work in Chennai or Dubai are, increasingly, the habits that create exposure in Virginia or New York.
Here is how to rebuild.
Habit one to break: the global package
The single most common structural problem is a single check package applied across all countries. Identity, education, employment, address, criminal, credit, reference. Run on everyone, everywhere.
In the US, that package is now wrong in at least three ways.
The credit check is prohibited for most roles in eleven states, including New York as of April. Running it by default means the vendor is supplying, and the employer is receiving, a report that both are barred from using.
The criminal check, run nationally with a seven-year or longer lookback, will surface records that specific jurisdictions bar from consideration: misdemeanours older than four years in Philadelphia, out-of-state convictions for lawful-in-California conduct in San Francisco, anything sealed under a Clean Slate law.
And the timing is often wrong. Fair chance laws in Washington State, New York City, Philadelphia and many others prohibit criminal history inquiries until after a conditional offer. A global package that runs all checks at the application stage violates that sequencing.
The fix is a US-specific package, layered by state. At minimum, three layers.
A base layer that runs everywhere in the US: identity, education, employment, and a criminal search confined to what federal law and the least restrictive states allow.
A jurisdiction layer that adjusts the criminal check by state and city: lookback caps, sealed-record suppression, out-of-state conduct filters, and timing.
A role layer that adds checks only where a statutory exemption or a documented job-related need exists: credit for bonded or fiduciary roles, licence verification for regulated positions, motor vehicle records for driving roles.
The package is built once, maintained quarterly, and documented. The documentation matters as much as the package, because the first question in a dispute is why a given check was run.
Habit two to break: keeping every file
In India and the Gulf, verification reports are kept indefinitely. Storage is cheap, and a historic file has always been seen as an asset: if the candidate returns, the old report saves time.
In the US, a historic file is now a liability for a specific reason. Records in it may have been sealed, aged out, or placed off limits since the report was run. Acting on the old file means acting on information the law has removed from consideration.
Virginia has written this directly into its screening-company rules: records disseminated after 1 July 2026 must carry a received date and a notice that they may have been sealed since. The employer is being told, in statute, that the report has a shelf life.
The fix is a retention policy with a defined retirement point for US verification reports. A reasonable structure is this. The report is retained for the period needed to defend the hiring decision, commonly two to three years given federal and state limitation periods. After that, the report is retired: not necessarily destroyed, since some record of the decision may need to be kept, but removed from any system that a hiring manager or recruiter can query.
And, critically, a retired report is never reused. A returning candidate gets a fresh check. The old file is not consulted, because its contents may no longer be lawful to see.
For firms that also operate under India’s DPDP framework, which requires erasure once the purpose is served, this policy aligns the two regimes rather than creating a separate one.
Habit three to break: the raw report to the hiring manager
The third habit is the most consequential, because it is where the actual violation happens.
In most Indian and Gulf hiring workflows, the vendor’s report goes to the recruiter, who forwards it to the hiring manager, who reads it and decides. The report contains everything the vendor found.
In the US, that workflow means the person making the decision sees records they are not permitted to consider. A sealed Virginia misdemeanour. A Philadelphia conviction outside the lookback. A credit score for a New York candidate in a non-exempt role. Once the hiring manager has seen it, the employer cannot credibly claim the decision was uninfluenced by it.
The fix is an adjudication step between the report and the decision. Someone, in HR operations or compliance, reviews the raw report against the jurisdiction rules and produces an adjudicated summary for the hiring manager. The summary contains only what the manager may lawfully consider. The raw report stays with the adjudicator, under access controls.
This is not a new concept. Large US employers have run adjudication for years, often with vendor support. What is new is that employers outside the US now need it too, and that the gap between the raw report and the usable report has widened enough that skipping the step is a material risk.
The vendor conversation
None of the above works without a vendor whose systems match the map. Five questions to put to any screening partner for US hires.
Are you registered with the Virginia State Police for sealing-order notifications, and with equivalent mechanisms in other Clean Slate states where they exist? A vendor that is not registered will continue to report sealed records, and the employer will carry the consequence.
Do your reports distinguish between what was found and what the employer may consider, by jurisdiction? If the answer is a single undifferentiated list, the adjudication burden falls entirely on the employer.
Do you suppress credit history for non-exempt roles in the eleven credit-ban states by default, or does the employer have to remember to exclude it? Default suppression is the safer configuration.
How do you handle lookback limits that differ by city within a state? Philadelphia’s rules are stricter than Pennsylvania’s. New York City’s are stricter than New York State’s. A state-level rule set is not enough.
What is your process when a record’s status changes after the report is delivered? Virginia requires prompt deletion on knowledge of sealing. The employer needs to know how that knowledge reaches them.
A vendor that answers all five clearly is doing much of the employer’s compliance work. One that does not is adding to it.
Sequencing: when each check runs
Fair chance laws turn the order of checks into a compliance matter. The pattern that works across the most restrictive jurisdictions is this.
Before the conditional offer: identity, education, employment and reference verification. These confirm the candidate is who they say and has done what they claim. They do not touch criminal history.
At the conditional offer: the offer letter is issued, stating that it is conditional on satisfactory completion of a criminal background check, and, where applicable, any role-based additional checks.
After the conditional offer: the criminal search, scoped to the jurisdiction layer. For roles with a credit-check exemption, the credit check, with the exemption documented.
Before any adverse decision: the individualised assessment required by most fair chance laws, considering the nature of the offence, the time elapsed, and its relationship to the role. The pre-adverse action notice under federal FCRA, with a copy of the report and the summary of rights. A reasonable period for the candidate to respond. Then the final decision and the adverse action notice.
Each of those steps generates a record. Together they form the evidence that the decision was lawful.
The two-regime employer
Many of the firms this piece addresses operate under two tightening regimes at once: the US map described here, and India’s DPDP framework, with its consent, purpose-limitation and erasure duties landing in May 2027.
The temptation is to treat them as separate projects. The better approach is to notice that they push the same direction. Both require role-scoped packages rather than blanket ones. Both require defined retention and erasure. Both require that the person who decides sees only what they may lawfully consider. Both place liability on the employer regardless of what the vendor did.
An employer who builds one verification governance model, with jurisdiction-specific rule sets plugged into it, will meet both regimes with one programme. An employer who builds two will maintain two, and will eventually find they conflict.
The practical sequence
For an HR operations team starting now, the order that works is this.
First, inventory US hiring by state and city, so the jurisdiction layer is built for the places you actually hire.
Second, redesign the US package into base, jurisdiction and role layers, and document the reasoning for each check.
Third, put the five questions to the vendor and act on the answers.
Fourth, write the retention and retirement policy, and run the first archive sweep to retire reports older than the defined period.
Fifth, stand up the adjudication step, with a named owner and an access-controlled store for raw reports.
Sixth, align the check sequence to the conditional-offer model.
That is a quarter’s work for a mid-sized team. It replaces a programme that was built for a country where the background check only ever grew, with one built for a country where it now shrinks.
What the Hyderabad client did
The client whose Virginia candidate opened this week’s package did four things in September.
They retired every US verification report older than two years. They split their global package into a US-specific one with a Virginia rule set. They asked their vendor for confirmation of State Police registration, and got it. And they inserted an adjudication step, so that the hiring manager who asked whether he could use the 2024 file will not see the next one.
The candidate was hired. The 2015 misdemeanour, sealed by law, played no part. That is the outcome the statute intended, and the employer’s job was simply not to get in its way.
