Employment and reference verification between agents

How it works today

Three related requests reach employers every day:

• Employment verification: confirming that a person works or worked there, since when, and in what role, for a lender, landlord or new employer.
• Reference checks: asking a former manager for an opinion of the person’s work, usually for a hiring decision.
• Background screening: a third-party company assembles a report for an employer, which can include verifications and reference interviews.

Most of this runs by phone, email and fax forms to HR, or through employment verification vendors that employers use to answer on their behalf.

A concrete example: mortgage lending. Fannie Mae’s Selling Guide requires a verbal verification of employment within 10 business days before the note date for employment income, and within 120 calendar days for self-employment. The lender must obtain the employer’s phone number, and if possible its address, independently, using a directory, the internet or a licensing bureau, and must record who confirmed the employment for the employer, who did it for the lender, the date, and where the phone number came from. If the employer uses a third-party verification vendor, the lender gets written confirmation from the vendor instead, and the vendor’s data must be no more than 35 days old as of the note date.

United States: the FCRA. When an employer uses a background report from a consumer reporting company, the FTC’s guidance sets out the steps. The employer tells the person in a stand-alone written notice that a report may be used, gets written permission, and certifies its compliance to the reporting company. Before taking adverse action it sends a copy of the report and “A Summary of Your Rights Under the Fair Credit Reporting Act”. After adverse action it sends a notice naming the reporting company, saying that company did not make the decision, and explaining the right to dispute and to a free report within 60 days. Reference interviews by a screening company can fit the statutory definition of an investigative consumer report: information on character, general reputation, personal characteristics or mode of living, obtained through interviews with people who know the person. Under 15 U.S.C. 1681d, the person must be told in writing within three days after such a report is first requested, and may ask about its nature and scope. Section 1681a(y) excludes certain communications about suspected employee misconduct from the definition of a consumer report.

Canada: privacy law by sector and province. PIPEDA covers private-sector organizations in commercial activity and the employee information of federally regulated businesses such as banks, airlines and telecommunications companies. Alberta, British Columbia and Quebec have private-sector privacy laws deemed substantially similar to PIPEDA. Alberta’s PIPA lets an organization disclose a current or former employee’s personal employee information to a potential or current employer without consent, if the information was collected as personal employee information and the disclosure is reasonable to help that employer decide the person’s eligibility or suitability. Ontario’s Consumer Reporting Act defines employment purposes, requires written notice to the person before certain consumer reports are requested, and requires telling the person, on request, which agency supplied the report.

The agent-to-agent version

Illustrative. A lender’s verification agent asks an employer’s HR agent to confirm three fields, carrying the employee’s signed authorization, in A2A v1.0 shapes:

{
  "jsonrpc": "2.0",
  "id": "voe-6620",
  "method": "SendMessage",
  "params": {
    "message": {
      "messageId": "msg-voe-6620-01",
      "role": "ROLE_USER",
      "parts": [
        { "text": "Verification of employment for a mortgage application. The employee's signed authorization is attached." },
        {
          "data": {
            "verificationId": "VOE-6620",
            "purpose": "mortgage-underwriting",
            "employeeName": "A. Example",
            "employeeNumber": "E-10482",
            "fieldsRequested": ["employment-status", "start-date", "job-title"],
            "authorizationRef": "AUTH-6620"
          },
          "mediaType": "application/json"
        },
        {
          "url": "https://files.lender.example/voe/VOE-6620/authorization.pdf",
          "filename": "authorization.pdf",
          "mediaType": "application/pdf"
        }
      ]
    }
  }
}

Then:

1. The lender’s agent found the employer’s endpoint itself, from the employer’s own domain or a registry, never from a link the applicant supplied. This is the agent version of Fannie Mae’s independent phone number rule.
2. The employer’s agent checks the authorization and returns only the three fields requested, as a completed task with a structured artifact.
3. The lender’s agent records which agent confirmed, which HR contact stands behind it, the time, and how the endpoint was found.
4. A reference request works the same way up to the opinion. The employer’s agent can confirm dates and title under the employer’s policy. Questions about performance go to a person.

What has to be true

Identity. Both sides must be who they claim. An employer answering for thousands of staff must know it is talking to a real lender or screening company, and the verifier must know it reached the real employer. An applicant-supplied contact could lead to a fake employer that confirms a fake job, and an independent lookup closes that path.

Authority. The employee’s consent is the key credential. It should name the verifier, the purpose and the fields, and expire. A2A leaves the form of such credentials to implementations and extensions (section 7.6.4). Where the FCRA applies, the employer that orders a report must hold the person’s written permission.

Record. Every disclosure of employee information should be logged with purpose and recipient. Lenders need the fields Fannie Mae lists. Employers need proof they disclosed only what the authorization allowed.

Minimum disclosure. The employer’s agent should answer the fields asked, and nothing else. An open-ended “tell me about this person” is a reference request and follows different rules.

Where Emissar fits

• Resolve (In development): turns an employer’s domain, name or phone number into a verified agent endpoint, the independent lookup a verifier needs.
• Verify (In development): checks whether the requesting agent belongs to a known lender or screening company before HR data leaves.
• Mandate (Spec in progress): a proposal for carrying the employee’s consent as a scoped, revocable credential bound to one verifier.
• Ledger (Spec in progress): a signed record of what was disclosed, to whom and when.
• Handoff (In development): passes reference questions that need a manager’s judgment to a person.

Open questions

• If an employer’s agent answers verification requests at scale for many verifiers, when does its operator start to look like a consumer reporting agency?
• Will mortgage investors accept an agent-to-agent confirmation where their guides still describe a verbal verification by phone?
• How should consent be carried: a signed PDF, an OAuth grant, or a verifiable credential the employee holds?
• In Canada, which law applies depends on whether the employer is federally regulated and where it operates. How should an agent know which rules to follow for a given request?