Immigration Compliance Obligations for US Employers

Immigration compliance for U.S. employers has always demanded real attention, but 2025 made that fact impossible to ignore. ICE ran an estimated 12,000 to 15,000 I-9 audits in 2025, roughly ten times the 2024 count, backed by new data sharing between ICE and the IRS. Worksite raids followed the same curve: at least 40 enforcement actions and over 1,100 arrests in the first seven months of the year, including a raid at a Hyundai plant in Georgia that made clear no industry gets a pass. The good-faith compliance efforts that used to buy leniency carry far less weight under the current enforcement posture, and employers still betting on that leniency are the ones about to get audited.

The legal foundation every employer obligation builds on

Everything traces back to one law. The Immigration Reform and Control Act of 1986 set two duties that still anchor the whole system: employers cannot knowingly hire, or knowingly keep employing, a worker who isn't authorized to work in the U.S., and employers have to complete and keep a Form I-9 for every person they hire. That's the floor, and it doesn't move.

Everything that came after, I-9 mechanics, E-Verify, Labor Condition Applications, EAD tracking, is either a direct piece of IRCA or a rule bolted onto it. The law doesn't care about company size or industry. A five-person diner and a multinational chipmaker answer to the same baseline. IRCA doesn't require sponsorship; nobody has to sponsor a visa. The moment an employer decides to, though, a second, far more detailed set of obligations switches on, and it stacks on top of the IRCA floor rather than replacing it.

Form I-9: what the current version requires and when each step must happen

USCIS put out a new Form I-9 on April 2, 2025, carrying a January 20, 2025 edition date. Employers can keep using the older August 1, 2023 version through its May 31, 2027 expiration, so this is a transition window, not a hard cutover. Anyone running an electronic I-9 system needs to be on the version tied to that 2027 expiration by July 31, 2026, a deadline close enough on the calendar that plenty of employers haven't clocked it yet.

The sequence itself hasn't changed, and it's worth restating because the timing is where mistakes happen. The employee fills out Section 1 on or before day one of employment, never before accepting the job. Employers then have three business days from the start date to finish the rest. Somewhere in there, the employee hands over documents proving identity and work authorization, and the employer's job is to look at what's presented and record it, not to pick and choose which documents it prefers. During an inspection, Homeland Security Investigations can ask for more than the I-9 itself; payroll records and business licenses come up often. For employers sponsoring visa holders, the document review step is exactly where immigration status becomes visible to whoever runs onboarding, so the process needs to look identical for every new hire, sponsored or not. Anything else invites a discrimination claim.

How long to keep I-9 records and what a compliant retention system looks like

The retention math is simple to state and easy to botch in practice. I-9s stay on file for the length of employment plus a set period after separation. E-Verify records need three years minimum, or one year past termination, whichever runs longer.

Paper or electronic, both are fine, but electronic systems carry their own checklist: audit trails, electronic signature protocols, security documentation, all measured against DHS standards. This is where the March 2026 ICE reclassification lands hardest. A missing audit trail or a signature protocol that doesn't meet spec used to read as a fixable paperwork problem. Now it counts as a substantive violation with penalties attached immediately. Employers who moved to electronic filing to cut down on administrative work may have quietly built themselves a new liability if the system wasn't set up right from the start. Retention functions as the evidence file an employer hands over during an audit, and any inconsistency in it is a violation on its own, no matter how the rest of the file looks.

Remote and distributed workforces: how virtual I-9 verification works and where liability still sits

DHS made remote I-9 verification permanent starting August 1, 2023, so distributed employers can build it into standard onboarding instead of treating it as some special exception. Three paths exist. An authorized representative, a local manager, a notary, someone designated for the job, does the physical document check in person on the employer's behalf. There's a DHS live-video alternative, but it only works if the employer is enrolled in E-Verify in good standing at every hiring site using it. A third-party managed verification service can also handle the physical inspection instead.

Here's the part that trips people up: if the authorized representative botches the I-9, the employer still owns that error. Delegating the task doesn't delegate the responsibility, and treating a notary's mistake as somebody else's problem is how a routine hire turns into a fine. Under the permanent live-video procedure, employers also have to keep clear front-and-back copies of every document shown, an extra retention duty on top of the usual one. For employers with H-1B or OPT workers working remotely, there's a second wrinkle: where that worker physically sits matters for LCA worksite compliance, so the remote I-9 process and the LCA rules have to be managed as one problem, not two.

What I-9 violations actually cost under the current penalty schedule

DHS adjusts civil penalties for inflation every year. Under the schedule running from January 2, 2025 through 2026, a paperwork error on a single I-9 runs $288 to $2,861. Document fraud starts at $590 to $4,730 for a first offense and climbs to $11,823 for repeat offenses. Prohibited fee-shifting or indemnity bonds cost $2,861 per occurrence. A third or subsequent violation for knowingly employing unauthorized workers runs $8,586 to $28,619 per worker, and that per-worker clause is where the math turns brutal fast: it compounds across a workforce, not an incident.

Criminal charges can follow if violations add up to a pattern, and those charges reach the people running the company, not just the entity. A Denver company found this out in 2025 the expensive way: $6.18 million in fines for I-9 violations and knowingly employing unauthorized workers, a figure that only makes sense once the per-form math gets applied across a large payroll. The March 2026 reclassification changes the calculus further. Errors that used to sit inside a 10-day cure window are now substantive violations that can trigger penalties immediately. Employers still operating on the old rulebook don't realize how much the ground has shifted underneath them. Appeals also route differently now, to a DHS supervisory officer instead of the DOJ's Board of Immigration Appeals, and ICE can hand unpaid penalties to the Treasury faster than before.

What happens during an I-9 audit and how employers should prepare before one starts

An inspection starts with a Notice of Inspection, and from there employers get at least three business days to produce the requested I-9 forms. Three business days is not much time to locate, sort, and check a filing cabinet's worth of records, let alone find the ones that were never filed correctly to begin with. Technical errors caught during an audit used to come with a 10-day correction window; the March 2026 reclassification narrowed that window for a lot of error types, which means the real preparation has to happen before the notice ever shows up, not after. HSI can widen the request beyond I-9s to payroll records and business licenses, so the audit's actual scope runs broader than the form itself suggests.

Good preparation looks concrete, not aspirational. Assign one person to own I-9 records and document the chain of custody before any notice arrives. Run internal audits on a regular schedule so technical errors get caught and fixed on the company's own timeline instead of the government's. Check that the electronic filing system's audit trails, signature protocols, and security documentation meet current DHS standards, not the standards from three years ago. Train everyone who touches an I-9, including any authorized representative handling remote hires, and keep a running list of who's on time-limited work authorization and when it expires; reverification is a legal obligation that deserves more than a routine calendar reminder. For sponsoring employers specifically, H-1B program files, LCA paperwork, and Public Access Files can all get pulled into a worksite enforcement action, so the audit's real footprint extends well past the I-9 drawer.

E-Verify: which employers are required to use it and what enrollment actually involves

E-Verify is still federally voluntary for most private employers. It's mandatory for federal contractors and subcontractors whose contracts carry the FAR E-Verify clause. Over 1.4 million employers were enrolled as of mid-2025, a scale large enough that E-Verify enrollment has become increasingly relevant to how inspections are planned. Usage isn't spread evenly across industries: professional, scientific, and technical services make up 26.5% of users, food and beverage another 10.7%, and that concentration shapes where enforcement attention tends to fall.

State law adds another layer entirely, and the states have split into two camps that aren't converging anytime soon. Alabama, Arizona, Florida, Georgia, Mississippi, and North Carolina require E-Verify for both public and private employers. Florida goes further, requiring any private employer with 25 or more employees to use it, with penalties of $1,000 per day and possible license suspension for skipping it. Colorado, Idaho, and Indiana require it for public employers or state contractors. California and Illinois limit or actively discourage E-Verify use beyond the federal minimum; misuse in California, prescreening candidates, verifying improperly, skipping required notices, can cost $10,000 per violation. The Dignity Act of 2025, still under congressional review, would make E-Verify mandatory nationwide on a phased schedule by company size, so employers operating across state lines should watch where that bill goes.

One detail employers miss constantly: E-Verify enrollment is a prerequisite for using the DHS live-video remote I-9 option, not a separate feature to pick or skip. USCIS also rolled out E-Verify+ in April 2025 alongside updated I-9 instructions, so it's worth confirming which version of the program a given enrollment actually runs on.

H-1B sponsorship obligations: what employers commit to when they file a petition

The H-1B cap sits at 65,000 new visas a year, plus another 20,000 reserved for people holding a U.S. master's degree or higher. Demand outstrips that supply every year, which means the compliance obligations start well before a visa is ever issued. Starting with FY2027, a DHS final rule effective February 27, 2026 weights the lottery by wage level. Level I registrations, roughly the 17th wage percentile, get one shot at selection. Level IV, the 67th percentile, gets four shots. Employers paying higher wages now hold a structural edge in a process that used to run on pure chance, and that shift structurally advantages employers paying higher wages in what used to be a purely random selection process.

The Labor Condition Application is the first binding promise an employer makes, filed with the Department of Labor before the petition even reaches USCIS. The employer attests to paying at least the prevailing wage for the role and location, or whatever it pays comparable workers already on staff, whichever number is higher. It also attests to working conditions and confirms there's no active strike or lockout tied to the job. U.S. workers need to be told about the intent to hire an H-1B worker on or within 30 days of the LCA filing.

Then there's the Public Access File, which has to exist promptly after filing the LCA, not after approval, and that tight window is not a lot of runway if nobody owns the task. At minimum it needs the certified LCA and supporting wage documentation. Investigators look at the PAF first in any compliance review, so an incomplete or missing one is an immediate flag before anyone looks at the rest of the file. DOL's Wage and Hour Division has maintained an active enforcement focus on H-1B obligations. LCA notice compliance, wage requirements, and working conditions are areas regulators scrutinize closely, and they should be early checkpoints for employers reviewing their own files.

Obligations don't end at termination, either. An employer that ends an H-1B worker's job before the authorized period runs out may still face obligations tied to that early termination. Sponsors should stay current on any evolving USCIS application requirements and communicate changes to workers before filing, not after.

Tracking employment authorization expiration dates and the EAD change that eliminated a safety net

Every employee on time-limited work authorization needs their expiration date tracked, reverified, and acted on before it lapses. That was always true. What changed is the margin for error around it, and that margin used to come from something specific: the old automatic extension safety net for EAD renewals, which gave employers and workers a cushion while a renewal application sat in the government's queue.

That cushion is gone. Without it, a missed renewal date turns into a gap in authorization, and a gap in authorization is exactly what an I-9 audit is built to catch. Employers who used to treat expiration tracking as a background HR task now need to treat it as a front-line compliance function; the government stopped giving anyone the benefit of the doubt on timing, and the calendar reminder that used to be optional is now the whole ballgame.