Virginia is implementing a new Business Screening Services (BSS) program that will significantly change how private background screening companies handle Virginia criminal and traffic history records.

Effective July 1, 2026, Virginia Code § 19.2-392.16 will govern businesses that collect, assemble, evaluate, or disseminate Virginia criminal history or traffic history records. Under § 19.2-392.16, background screening companies must:

• Register with the Virginia State Police (VSP) to receive electronic copies of sealing orders;
• Promptly delete records known to have been sealed;
• Pay an annual licensing fee of $30,000 for access to electronic sealing information;
• Include specified disclosures in each criminal history or traffic history report, including the date the record was collected and a notice that records may have been sealed since that date;
• Implement and follow reasonable procedures to ensure accuracy and completeness of records and to investigate disputed records at no cost to the individual, correcting inaccurate records and deleting any records found to have been sealed; and
• Establish procedures for individuals to request and obtain their own criminal and traffic history record information maintained by the company and any other information about them that may be sold to another entity.

Starting July 1, 2026, the VSP must provide electronic copies of sealing orders to registered businesses and develop a secure portal by October 1, 2026, so government agencies can determine whether a record has been sealed.

Mandatory Deletion of Sealed Records and Required Disclosures on Reports

A central requirement of Va. Code § 19.2-392.16 is that screening companies must remove sealed records from their products. The statute defines “business screening service” as a person engaged in the business of collecting, assembling, evaluating, or disseminating Virginia criminal history records or traffic history records on individuals, not including government agencies or the media.

If a screening company knows that a criminal history or traffic history record is sealed or is a sealed possession of marijuana record, it must promptly delete the record, regardless of its source. Notably, “delete” means that the record may not be disseminated in any manner, except to entities authorized to receive and use such information by law, although the record may be retained to resolve disputes or to comply with the federal Fair Credit Reporting Act (FCRA) and Gramm-Leach-Bliley Act (GLBA).

Any screening company that disseminates a criminal history or traffic history record on or after July 1, 2026, must include the date when the record was collected by the service, and must provide notice that the information may include records that have been sealed since that date.

Registration and Licensing with the Virginia State Police

The BSS program is structured around a registration and licensing relationship with the VSP, so screening companies must register with the VSP to electronically receive notifications of sealing orders. Further, businesses must pay the VSP’s annual licensing fee of $30,000 to gain access to electronic sealing notifications.

Va. Code § 19.2-392.16 also requires a contract between the VSP and each business that accesses electronic notifications of sealing orders. The contract must prohibit dissemination of the sealing orders and require that they be used only for the purpose of deleting sealed criminal history records, and business screening services must delete the notifications after use.

The statute also mandates that the VSP require that screening companies identify themselves, certify the purpose for which sealing information is sought, confirm that the information will be used for no other purpose, and acknowledge receipt of all electronic copies of sealing orders. The VSP must also maintain and publicly post on its website a list of business screening service companies licensed to receive sealing notifications.

Registration with the BSS program will include completing a BSS User Agreement via DocuSign, submitting required documentation such as a W-9 and business license, paying the annual licensing fee, designating authorized users for BSS portal access, implementing required data security measures, and setting up procedures for record management and dispute resolution.

Accuracy, Dispute Procedures, and Consumer Access

Va. Code § 19.2-392.16 requires screening companies to implement and follow reasonable procedures to ensure they do not maintain or sell criminal history or traffic history records that are inaccurate or incomplete. If an individual disputes the completeness or accuracy of a record, the business must investigate the disputed record without charge and, if the investigation shows the record does not accurately reflect the content of the official record, the business screening service must correct the disputed record accordingly. If the disputed record is found to have been sealed, the record must be promptly deleted.

A screening company may terminate an investigation if it reasonably determines that a dispute is frivolous, including where the individual fails to provide sufficient information, but it must inform the individual of the specific reasons for that determination and describe what information would be required to investigate. Further, individuals must be notified of the outcome of the investigation within 30 days.

Enforcement and Litigation Risk

A background screening company that disseminates criminal or traffic history records in Virginia without registering with the VSP may be sued by any injured person and may be subject to enforcement actions by the Virginia Attorney General.

If a business violates Va. Code § 19.2-392.16, it is liable to the person who is the subject of the record for a penalty of $1,000 or actual damages caused by the violation, whichever is greater, plus costs and reasonable attorney’s fees.

If the court finds that a business willfully violated the statute, the Attorney General may recover up to $2,500 per violation, as well as the Commonwealth’s investigation costs and attorney’s fees.

For screening companies that are also consumer reporting agencies, compliance with applicable provisions of the FCRA and GLBA is deemed compliance with comparable provisions of Va. Code § 19.2-392.16. However, the statute provides that these companies remain subject to state remedies if their actions violate both the state statute and federal law.

Next Steps for Businesses and Screening Providers

Businesses that collect, assemble, evaluate, or disseminate Virginia criminal or traffic history records should begin preparing now, ahead of July 1, 2026. Specifically, background screening companies should plan to register with the VSP by entering into the required contract, paying the annual licensing fee, and meeting any programmatic requirements such as those described in the BSS registration materials.

Providers should also build or refine matching and deletion procedures so that sealed records can be promptly identified and removed when electronic sealing notifications are received or when disputes reveal that a record has been sealed. Report formats should also be updated to include the required collection date and the notice that information may include records that have been sealed since that date.

Dispute-handling procedures must also be aligned with the statute’s requirements, including no-cost investigations, correction of inaccurate records, prompt deletion of sealed records, timelines for notice, and standards for identifying and communicating about frivolous disputes.

Finally, businesses should establish or refine processes for individuals to access their own criminal and traffic history records and any other personal information that the business may sell.
By taking these steps in advance, business screening services and their clients can better position themselves to comply with Virginia’s new requirements and reduce enforcement and litigation risk once Va. Code § 19.2-392.16 takes effect.