The scenario I have may be a type of edge case because of the nature of the site I'm working on. This site (note: the site is not e-commerce, it is not about generating revenue; essentially, non-profit, quasi-government, and needs to make sure users are who they say they are) requires potential users to complete a number of fields in a registration form. After submitting the form, an admin reviews the submission, and performs a background check on the submitter using external resources. The background check can take a few days. If the submitter passes the background check and is accepted, then the admin activates the submitter's account.
My question is this: at what point in this process is the ideal time to ask the user to create a password? Should the user create a password at the time of their filling out the registration form, or should the user create a password after they have been accepted as a user?