The background check system is a mammoth matrix of databases and human screeners that vet millions of gun buyers every year, a safeguard meant to make sure only responsible, law-abiding citizens acquire firearms. But there are big holes in many places that are easy for people who are prohibited from owning a gun to exploit. The largest gap: Federal law does not require background checks on the private sale or transfer of firearms. According to a 2017 study by researchers at Harvard University, 22 percent of the country’s gun owners who acquired a firearm within the past two years reported doing so without a background check.

Twenty-one states and the District of Columbia have expanded background checks to private sales.

Here is a primer on how the background checks system works to prevent prohibited possessors from obtaining guns — and some of the many ways it falls short.

First, what’s a background check?

Every federally-licensed gun dealer is required by law to run a background check on most gun purchases and transfers through the National Instant Criminal Background Check System, or NICS. In nearly half of the states, people who underwent a background check to obtain a specific type of permit — often a concealed carry permit — don’t have to go through another check each time they buy a weapon.

NICS runs a prospective buyer through several federal databases to determine if they are banned from buying or possessing firearms.

Depending on the state, background checks are conducted either by the Federal Bureau of Investigation or a state or local office, or a combination of the two. If a state or local office performs the check, examiners will run the customer’s information through state databases in addition to NICS.

The number of NICS checks has ballooned since launching in November 1998. In 1999, NICS’s first full year in operation, the system processed more than 9.1 million checks. Last year, it processed more than 26 million.

Ok, so who doesn’t pass a background check?

People fail background checks because they fall into what’s known as a “federal prohibited purchaser” category. This designation means they have been convicted of a felony, have an outstanding warrant for their arrest, have convictions for certain misdemeanor domestic violence offenses, have used or been addicted to illegal drugs, or have been adjudicated mentally ill, among other things.

Tens of thousands of potential transactions are also blocked every year because the customer falls into a prohibited category created by their state. South Carolina, for example, denies gun sales to people who abuse alcohol. Alaska, Arizona, California, and several other states bar would-be gun buyers convicted of certain juvenile offenses.

Despite these safeguards, the background check system is riddled with gaps that prohibited purchasers have exploited to obtain guns. We’ll go through some of them in turn:

Private sales and transfers, otherwise known as the “gun show loophole”

While FFLs are required to conduct background checks, gun owners who only sell occasionally and aren’t trying to turn a profit are not. In 29 states, people can buy firearms from unlicensed sellers without disclosing anything about their past, according to Giffords.

A 2012 study of prison inmates convicted of gun crimes in 13 states found that almost all of those who were legally prohibited from owning firearms — 96 percent — obtained them from someone who didn’t conduct a background check.

Critics have dubbed this workaround the “gun show loophole,” but that term has drawn criticism for being too narrow, as weapons change hands under a variety of circumstances. Online sales have become increasingly popular.

If the online seller is a digital extension of brick-and-mortar licensed gun store, the buyer still must submit to a background check. But there are hundreds of thousands of private individuals who advertise and arrange sales online. These sellers use a number of websites designed specifically to facilitate in-person transactions, usually without a background check.

In 2013, Mayors Against Illegal Guns, a precursor to Everytown for Gun Safety, investigated one of the biggest online gun marketplaces for private sellers, The advocacy group examined 13,000 listings on the site and found that one in 30 of the prospective buyers had felony or domestic abuse records that barred them from buying guns. (Everytown provides grants to The Trace through its nonpolitical arm. Here’s our list of major donors and our policy on editorial independence.)

Default proceed sales, recently dubbed the “Charleston loophole”

Gun sales are legally allowed to go forward if a background check hasn’t been completed by FBI examiners within three business days. The sale proceeds by default.

Examiners complete most background checks within a few minutes. But their decisions get delayed when they spot a red flag and need more time to investigate. Examiners, for example, could notice that a customer was charged with a felony, but the records are too incomplete to tell whether he or she was convicted. In that situation, examiners might have to contact the courthouse to learn the outcome of the case. If resolving the case takes more than three days, the sale is allowed to go through without a completed check.

The loophole became a flashpoint after it came to light that perpetrator of the Charleston church shooting obtained his handgun through a default proceed sale. The man should have failed the background check he underwent at a local gun store because of a previous admission to possessing illegal drugs, but an examiner didn’t unearth the record fast enough to block the sale.

The default proceed problem is exacerbated by the fact that many states don’t catalogue all of their conviction records. A 2010 survey by The National Consortium for Justice Information and Statistics found that only 12 states had recorded the outcome of at least 80 percent of felony charges in their criminal history databases.

If the FBI determines after a default proceed sale that the buyer was a prohibited purchaser, it sends what’s called a retrieval order to the Bureau of Alcohol, Tobacco, Firearms and Explosives, which is then responsible for getting the gun back. But as The Trace has reported, such orders are hobbled by staffing issues and interagency rivalries, and it’s not clear how many guns are actually retrieved.

The narrow definition of domestic abuse, i.e., “the boyfriend loophole”

In most states, batterers will fail a background check if they have been convicted of domestic abuse charges or come under a restraining order — but typically only if the abuse was committed against a current or former spouse, someone they live with, or someone with whom they share a child. The gun prohibition doesn’t apply to abusers in many dating relationships, even though more victims are killed by a boyfriend or a girlfriend than a spouse.

California, Delaware, and more than a dozen other states have plugged the “boyfriend loophole” by extending the ban on guns sales to abusive dating partners. But federal legislation to do the same has stalled, leaving this loophole open in the majority of states.

Temporary restraining orders, aka the “restraining order gap”

People subject to permanent restraining orders will fail a background check in most states. But it can take weeks to obtain those orders. That’s why many abuse victims initially request temporary orders of protection, which can be issued before a judge decides — following a hearing — whether a permanent or final restraining order is warranted.

As The Trace has reported, the period immediately after a temporary restraining order is issued is especially dangerous because the order itself can trigger an attack. Despite the heightened threat, in many states abusers under temporary restraining orders may still buy and possess guns.

Shoddy mental health reporting

People who have been adjudicated mentally ill or been involuntarily committed for treatment should fail background checks. But privacy concerns and lackluster reporting have meant that this information is not always submitted to NICS, crippling examiners’ attempts to determine whether prospective gun buyers should be turned away.

There has been progress. In 2007, the perpetrator of the Virginia Tech massacre passed a background check for the guns he used even after a judge declared him a threat to himself and ordered him to seek treatment. In the years since, many have passed laws authorizing or requiring courts and hospitals to send mental health records to NICS.