Employer Immigration Compliance Risks and Audits

Employer immigration compliance has moved from a paperwork obligation into a live enforcement target, and the shift is structural, not cyclical. Notice of Inspection volume in the first half of 2025 ran at least ten times the 2024 rate, with an estimated 12,000 to 15,000 I-9 audits conducted over the year. Physical worksite raids climbed alongside the paper audits: at least 40 enforcement actions produced more than 1,100 arrests in just the first seven months of 2025. The closest precedent is 2017-2018, when worksite investigations jumped 405% and ICE arrests at job sites rose sevenfold to 2,304 in a single fiscal year. This year is on pace to beat that, and a compliance program built for the old, low-audit era is now the wrong tool for the job.

The funding engine behind the surge: what the One Big Beautiful Bill Act means for employers

Signed into law on July 4, 2025, the One Big Beautiful Bill Act isn't a memo or a shift in enforcement priorities that a future administration can quietly reverse. It's a statute, and it comes with $170 billion for immigration enforcement between 2025 and 2029. ICE's annual budget goes from roughly $10 billion to nearly $30 billion. The agent force triples on paper, growing from about 6,000 to more than 16,000, with 10,000 new hires in the pipeline.

For employers, the money translates into more frequent reverification demands, heavier administrative load, and a real chance that a single enforcement action disrupts a whole shift, department, or site. The part worth sitting with: this is capacity, not a spike. Congress built the staffing and the budget into law, which means the surge doesn't fade when headlines move on.

Why I-9 audits are the government's easiest enforcement tool and how they begin

I-9 compliance goes back to the Immigration Reform and Control Act of 1986, a rule so old that plenty of employers still treat it like a filing chore rather than a legal exposure. That's the mistake. A Notice of Inspection needs no warrant and no probable cause; it's about as close to a walk-in enforcement action as the federal government has. Once it lands, the employer has a short, legally defined window to produce Form I-9 records, a deadline that catches a lot of HR departments flat-footed. In one two-phase operation alone, ICE sent out more than 5,200 audit notices as of February 2025.

Homeland Security Investigations runs three tracks off the same audit: compliance (fines, debarment referrals), enforcement (arrests), and outreach through its IMAGE program. The audit is the front door to all three.

Violations fall into three buckets, and the distinction matters more than most HR teams realize. Technical violations are minor form errors that don't touch someone's actual work authorization; they're correctable given at least 10 business days' notice. Procedural violations, errors in how the form was filled out or handled, are also fixable inside that cure window. Substantive violations, meaning a failure to verify eligibility or actively employing someone unauthorized, are not curable after the fact. Here's the detail that trips up otherwise careful employers: a company can be fined for paperwork errors even when every single worker on the payroll is authorized to work. The documentation duty stands on its own, independent of whether anyone actually did anything wrong.

What the penalties actually look like at scale

The I-9 penalty schedule was reset in January 2025 as part of a routine inflation adjustment, and the new numbers apply to any violation assessed after that date. Paperwork violations run $288 to $2,861, and that's per form, not per audit. Knowingly hiring or continuing to employ someone unauthorized to work carries a fine up to $28,619 per offense. Repeat offenders, meaning a third violation or beyond, face fines between $8,586 and $28,619 per offense, plus the possibility of criminal referral and loss of business licenses.

Do the arithmetic on a large employer with a modest error rate spread across a few thousand employees, and the number climbs into seven figures fast, before legal fees, before reputational fallout, before anyone starts asking questions about executive liability. That's the design, not a side effect. The fine schedule exists to make sloppy paperwork cost more than an actual compliance program would have.

How payroll data became an audit trigger: the IRS-ICE data-sharing agreement

On April 7, 2025, the IRS and ICE signed a memorandum of understanding that lets ICE request taxpayer identity data, names, addresses, W-2 records, without a court order. Under that agreement, ICE requested data tied to roughly 1.28 million taxpayer records. The mechanism is straightforward and a little chilling: ICE can cross-reference an employer's payroll data against its own records directly, no informant required, no tip needed. A routine payroll correction can now be the thing that puts a company on a list.

Employers running large workforces with the ordinary churn of mismatches, corrections, and ITINs carry audit-selection risk that simply didn't exist under the old model. Worth noting: the legal footing under this agreement is contested, and ongoing litigation has challenged its validity. Still, none of that makes the underlying posture go away. Treat the mechanism as disputed, not dead.

H-1B-specific scrutiny: FDNS site visits and DOL's Project Firewall

The Department of Labor launched Project Firewall to sharpen oversight of H-1B compliance, with the Secretary holding full discretion over which employers get investigated. By November 2025, 175 investigations were already underway. Separately, USCIS has formalized the Fraud Detection and National Security directorate's authority to run unannounced site visits, with employer cooperation expected, with non-cooperation carrying real consequences for the underlying petition.

Remote and hybrid arrangements are a specific soft spot. Employers are under increasing pressure to document precisely where the job is actually performed, and FDNS site visits have extended to locations where remote work is performed. Third-party placements draw their own scrutiny: if an H-1B worker is stationed at a client site, the actual duties performed have to match what was filed on the petition, no daylight allowed.

The real risk is that these tracks aren't siloed. An FDNS visit that turns up an H-1B discrepancy can trigger a full I-9 audit, and an I-9 audit that surfaces systemic documentation problems can escalate into a visa fraud referral. For any employer sponsoring international talent, compliance isn't a box checked at hire and revisited later; it's continuous, and it runs across programs at the same time.

Which employers face the highest audit exposure and why

Restaurants, construction, and agriculture together account for roughly half of all ICE worksite audits. Staffing agencies, hospitality, landscaping, car washes, and healthcare aren't far behind. Federal contractors start from a higher baseline of scrutiny simply because of the government relationship. High-turnover industries generate their own risk mechanically: more hiring volume means more form errors and more reverification events stacking up.

Social Security number mismatches remain a known trigger, and the IRS-ICE data agreement just turned that trigger into a system instead of a coincidence. Multi-site employers face a coordination problem on top of the legal one: a single Notice of Inspection can turn into an enterprise-wide scramble, pulling records out of multiple HRIS platforms and filing cabinets at once, on a three-day clock. Companies sponsoring H-1B or L-1 workers carry elevated I-9 risk as a byproduct of visa-program attention, one enforcement track feeding the other. Employee complaints, whether about wages, HR disputes, or organizing activity, still function as a straightforward path onto ICE's radar.

TPS terminations and the reverification burden employers didn't anticipate

DHS wound down several humanitarian protections through 2025, with multiple Temporary Protected Status designations terminated or set to expire on staggered schedules, cutting off the authorization that a lot of workers relied on.

None of this is optional for employers. When a worker's authorization expires, the employer has to reverify, and skipping that step doesn't produce a technical violation; it produces a substantive one, the kind that isn't curable after the fact. Because the terminations land on different timelines by country, employers with a mixed workforce have to track, individually, which employee was authorized under which program and when that authorization runs out. Here's the trap: an employer who did everything right at the point of hire can still end up in violation months later, simply by failing to reverify when the clock ran out. Getting it right once doesn't carry forward, and this isn't a future problem to plan around; it's already active.

What a defensible compliance posture actually requires in this environment

Three business days is not enough time to build a compliance program from scratch, which means the program has to already exist before the Notice of Inspection ever arrives. At minimum, that means running internal I-9 self-audits on a regular schedule, catching technical and procedural errors before ICE does, because an error a company finds itself is correctable and an error ICE finds is a fine. It means centralized, organized I-9 storage, physical or electronic, reachable from every location the company operates. And it means one trained person owns the I-9 process, not whoever happened to be doing onboarding that particular week.

For H-1B sponsors, the list gets longer. Public Access Files need to be current and organized, since they're the first thing an FDNS officer asks for. Job duty documentation has to match the actual work being done, particularly for remote employees and anyone placed at a client site. LCA posting requirements apply everywhere the job is performed, home offices included.

E-Verify isn't universally required, but it's increasingly mandatory for federal contractors and a growing list of states, and voluntary enrollment now reads as a real compliance signal even where it isn't required. Reverification needs a calendar, not a memory, especially as humanitarian program wind-downs add new expiration dates into workforces that didn't have them before. Someone also needs to already know, before the notice ever shows up, who pulls the records, who makes the call, and who brings in counsel. Figuring that out during the three-day window is how companies lose the three-day window.

The employers who come out of an audit clean are the ones who were already running compliance as daily operations, not as a fire drill triggered by getting caught.

How this environment changes the calculus for employers sponsoring international workers

Sponsoring a foreign worker was never purely an HR decision, and it's less so now. It's a compliance commitment that widens a company's audit surface across I-9 records, H-1B filings, and DOL wage obligations, all at once. The employers who can sustain sponsorship programs through this environment are the ones that already built the infrastructure: organized records, a trained coordinator, job duties documented accurately, and a rapid-response plan sitting on a shelf, ready to go.

Sponsorship track record is itself a signal worth reading. Companies with a long history of visa sponsorship generally built that compliance infrastructure out of necessity, and it's not a coincidence that the employers who've sponsored consistently for years tend to be the same ones with mature, functioning compliance operations. For a foreign professional evaluating an offer, that history says more than a company's stated openness to sponsorship ever will. An employer that's filed petitions successfully before has demonstrated it can execute, not just promise.

The stakes for getting this wrong land on both sides of the employment relationship, and that's the part easy to overlook. When an I-9 audit surfaces violations and a petition gets revoked, the employer's compliance failure becomes the worker's immigration status problem overnight, through no fault of the worker's own. Because of that asymmetry, seeking out employers with a documented, active sponsorship history, rather than ones simply willing to consider it, is the more reliable way to find a durable employment relationship. Platforms that surface sponsorship history, employer contact information, and verified filing records give both sides a clearer picture of where that relationship actually holds up.