An employer with 200 active Form I-9s, each containing a single common error, used to face a paperwork problem that was annoying but cheap to fix. The agency would issue a Notice of Technical or Procedural Failures, give HR ten business days to make corrections, and the matter usually ended there. Under ICE's revised inspection fact sheet published on March 16, 2026, that same employer can now face $57,600 to $572,200 in paperwork penalties for the exact same errors — with no cure period, no second chance, and no opportunity to remediate before the fines hit. The compliance bar for new-hire verification just moved, and most HR teams have not yet adjusted their processes.
Form I-9 has been a quiet corner of HR compliance for nearly forty years. It rarely produces splashy headlines, it does not require employees to receive a paycheck, and it usually goes into a file cabinet (or an HRIS module) and never comes out again — until an Immigration and Customs Enforcement (ICE) auditor knocks on the door. When that happens, every form becomes a potential five-figure liability. This guide walks through what employers must do to stay compliant in 2026, what changed in March, and how to run a self-audit before an outside auditor does it for you.
What Form I-9 Actually Does
Form I-9, Employment Eligibility Verification, is the federal record that documents two facts about every person an employer hires in the United States: that the person is who they claim to be, and that they are legally authorized to work in this country. The Immigration Reform and Control Act of 1986 made it illegal to knowingly hire or continue to employ a person who lacks work authorization, and the I-9 is the paperwork mechanism Congress chose to enforce that prohibition.
Every employer, regardless of size, must complete a Form I-9 for every individual hired for employment in the United States after November 6, 1986. That includes U.S. citizens, lawful permanent residents, refugees, asylees, temporary visa holders, and anyone else paid for work performed within U.S. borders. Volunteers, unpaid interns, and independent contractors are excluded — but misclassifying an employee as a contractor does not exempt the employer from the I-9 requirement, and it adds a misclassification problem on top of an immigration problem.
The form itself has two main sections plus two supplements. Section 1 is completed by the employee. Section 2 is completed by the employer (or an authorized representative acting on the employer's behalf). Supplement A is for use when a preparer or translator helps the employee fill out Section 1, and Supplement B handles reverification when work authorization documents expire and rehires within three years.
The Timing Rules That Trip Up Most Employers
Two deadlines control I-9 completion, and missing either one is a substantive violation under the new ICE framework.
Section 1 must be completed by the employee no later than the first day of employment for pay. The employee can fill it out the moment they accept the offer letter, but they cannot start performing paid work without having completed Section 1.
Section 2 must be completed by the employer within three business days of the employee's first day of employment for pay. Note that the clock starts on the first day of paid work, not on the offer date, the orientation date, or any signing of paperwork that preceded the start. If an employee starts on Monday, Section 2 must be done by close of business Thursday.
There is one exception to the three-day rule: if employment lasts less than three business days (a one-day temp assignment, for example), Section 2 must be completed by the end of the employee's first working day. There is no exception for remote workers, busy HR managers, missing documents, or onboarding software glitches.
Acceptable Documents: Lists A, B, and C
When the employee shows up for Section 2 — physically, virtually under the alternative procedure, or through an authorized representative — they get to choose what they present. The employer cannot demand a specific document or refuse to accept a valid one. Doing so is document abuse, which is a separate violation enforced by the Department of Justice's Immigrant and Employee Rights Section.
The employee must present either one document from List A, or one document from each of List B and List C. There are 25 acceptable documents in total.
List A documents establish both identity and work authorization. The most common are a U.S. passport or passport card, a Permanent Resident Card (Form I-551, often called a green card), an Employment Authorization Document (Form I-766) with a photograph, and certain foreign passports with a valid I-551 stamp.
List B documents establish identity only. A state driver's license or ID card with a photograph is by far the most common, but school IDs with photos, voter registration cards, and several other documents qualify.
List C documents establish work authorization only. The most common are an unrestricted Social Security card, a certified birth certificate, a Native American tribal document, and the Department of Homeland Security's Form I-94 for certain non-immigrants.
Document examination is supposed to be a reasonable-person test. If the document reasonably appears to be genuine and to relate to the person presenting it, the employer must accept it. Employers are not document experts and are not expected to detect sophisticated forgery. They are, however, expected not to accept expired documents or documents that obviously do not match the person standing in front of them.
Retention: Three Years, One Year, Whichever Is Later
Form I-9 retention has a deceptively simple rule that catches employers off guard during audits. You must retain each Form I-9 for three years after the date of hire, or one year after the date employment ends, whichever date is later.
In practice this means:
- An employee who works for two months: keep the I-9 for three years after the hire date.
- An employee who works for two years: keep the I-9 for one year after the termination date (three years from hire equals the second anniversary; one year after termination is later).
- An employee who works for twenty years: keep the I-9 for one year after the termination date.
The form must be producible within three business days of an inspection request. That means storing I-9s in a single deceased executive's locked filing cabinet, or on an HRIS system that nobody on the current staff knows how to query, will not satisfy the requirement.
Best practice is to maintain I-9s separately from personnel files. Co-mingling I-9s with disciplinary records, medical information, or performance reviews creates discovery problems if an outside agency reviews the file and increases the risk of inadvertent disclosure of protected information. A separate "Active I-9s" binder or HRIS folder, plus a separate "Terminated I-9s pending purge" folder organized by purge-eligible date, keeps the retention rule manageable.
Electronic storage is permitted, but electronic I-9 systems must create a secure, permanent audit trail every time a form is accessed, created, modified, or corrected. The system must restrict access to authorized personnel and maintain reliable backups. Spreadsheet-based "tracking logs" that lack audit trails are not compliant electronic I-9 systems.
E-Verify: When It Is Required and When It Is Optional
E-Verify is a free, web-based system operated by U.S. Citizenship and Immigration Services that compares I-9 information against records held by USCIS and the Social Security Administration. It returns either an Employment Authorized result, a Tentative Nonconfirmation that requires resolution, or a Final Nonconfirmation.
At the federal level, E-Verify is mandatory for two groups: federal contractors and subcontractors with contracts containing the FAR E-Verify clause, and any employer in a state that requires it. Federal contractors must enroll in E-Verify within 30 days of contract award and must verify covered employees within 90 days of enrollment.
As of 2026, eleven states require E-Verify for all or most private employers: Alabama, Arizona, Florida, Georgia, Louisiana, Mississippi, Montana, North Carolina, South Carolina, Tennessee, and Utah. Several additional states require E-Verify for public employers and public contractors. State penalties vary widely — in North Carolina, for example, repeated noncompliance can result in civil penalties of more than $10,000 per infraction, on top of federal penalties for any underlying I-9 errors.
Employers that operate in multiple states often choose to enroll in E-Verify voluntarily everywhere, even where it is not required, both for consistency and to unlock the alternative procedure for remote document examination.
The Alternative Procedure for Remote Verification
In 2023, DHS made permanent a long-awaited remote verification option, formally called the alternative procedure. Under this procedure, an employer or authorized representative can examine an employee's documents during a live video interaction rather than in person, provided four conditions are met:
- The employer is enrolled in E-Verify and is in good standing.
- The employee transmits copies of front and back of all documents (where applicable) to the employer before the video review.
- A live video review occurs in which the employer can see the documents and the employee at the same time.
- The employer creates an E-Verify case for the employee and retains the document copies.
Critically, the alternative procedure box on Section 2 of Form I-9 (and on Supplement B for reverifications) must be checked. Under the March 2026 ICE update, failure to check that box is a substantive violation. The video review itself must also be properly documented; procedural failures in connection with remote verification — including the failure to retain copies, conduct a true live review, or properly mark the form — are all now substantive.
Employers not enrolled in E-Verify can still verify remote workers, but only by using an authorized representative. An authorized representative is anyone the employer designates to complete Section 2 in person on its behalf — commonly a notary public, an attorney, a UPS Store employee, or a friend or family member of the new hire. The employer remains fully liable for any errors the representative makes.
The March 2026 ICE Policy Shift
The single biggest change in I-9 enforcement in 2026 was not a statute or a regulation but a fact sheet update. On March 16, 2026, ICE quietly published a revised version of Form I-9 Inspection Under Immigration and Nationality Act § 274A, the agency document that auditors use to classify violations. Where the prior version treated many common errors as technical or procedural failures eligible for a ten-business-day cure period, the new version classifies them as substantive violations subject to immediate per-form fines.
Errors that are now substantive include:
- Missing the employee's date of birth in Section 1
- Missing the date of hire in Section 2
- Missing the name or title of the employer or authorized representative in Section 2
- Missing or incorrect List A, B, or C document data in Section 2 — regardless of whether copies of the documents were retained
- Failure to mark the alternative procedure checkbox in Section 2 or Supplement B when remote verification was used
- Most procedural failures in connection with remote verification
The penalty range for paperwork violations under the current Federal Register adjustment is $288 to $2,861 per form. The range tracks the percentage of forms with errors and the employer's history. Knowingly hiring or continuing to employ an unauthorized worker carries far higher penalties — up to $28,619 per violation for repeat offenders.
The financial math is unforgiving. A 500-employee company with a 40% error rate (which is common in self-audits of employers who have never run one) is looking at 200 problem forms. At the midpoint of the new penalty range, that's roughly $315,000 in exposure. At the high end, it's over half a million dollars. None of those penalties can be reduced by a quick fix after the Notice of Inspection arrives.
The Inspection Process
An ICE I-9 audit starts when an agent serves a Notice of Inspection (NOI). The notice typically gives the employer three business days to produce its Forms I-9, plus supporting documents such as payroll records, a list of current employees, articles of incorporation, and business licenses. Three business days is not three weeks. It is not enough time to find missing forms, complete forms that were never done, or run a meaningful self-audit. The work has to have been done long before.
After ICE reviews the forms, it will issue one or more notices. A Notice of Suspect Documents identifies employees whose work authorization the agency does not believe is valid; the employer must give those employees an opportunity to respond before terminating them. A Notice of Technical or Procedural Failures lists technical errors that can still be cured within 10 business days — though that category is now much smaller. A Notice of Intent to Fine lays out the proposed penalties for substantive violations and for knowing-hire violations. Employers have 30 days to request a hearing before an administrative law judge.
The new I-9 form version with an expiration date of 05/31/2027 must be in use, and electronic I-9 systems must be updated to support it no later than July 31, 2026. Continuing to use the prior version after that date is itself a paperwork violation.
Running a Self-Audit Before ICE Does
The defensive posture for every employer is to assume an NOI could arrive next quarter and to run an internal self-audit accordingly. A good self-audit covers four steps.
1. Inventory. Match the I-9 file against a current payroll roster. Every active employee hired after November 6, 1986, must have a Form I-9. Every terminated employee whose retention window has not yet expired must also have one. Missing forms are the most serious finding because there is no way to retroactively create a compliant I-9 — the form must be dated when it was completed, and an obviously back-dated form is itself a separate violation.
2. Review. Read every form looking for the substantive violations listed above. Note the errors but do not erase or write over the original entries. Corrections must be made by drawing a single line through the incorrect information, entering the correct information, and dating and initialing the correction. The person making the correction should be the person who originally completed that section if possible, or the employee for Section 1 entries.
3. Reverify. Pull a list of employees with expiring work authorization documents (excluding U.S. citizens, lawful permanent residents, and certain other categories who cannot be reverified). Use Supplement B to reverify on or before the expiration date. Late reverification is one of the most heavily penalized findings in ICE audits because it strongly suggests an employer continued to employ someone after authorization lapsed.
4. Document the audit. Keep a memo describing the date, scope, methodology, findings, and corrective actions. A documented good-faith self-audit can support a mitigation argument if ICE later imposes penalties, and it provides evidence that the employer maintained an ongoing compliance program rather than discovering errors only under audit pressure.
A standing schedule of self-audits — annually for stable workforces, quarterly for high-turnover industries — moves I-9 compliance from a panic project into a manageable HR operations task.
How Bookkeeping Connects to I-9 Compliance
I-9 compliance and payroll bookkeeping are tightly linked. ICE auditors do not just review I-9s in isolation; they compare them to payroll records. An employee who shows up on quarterly Form 941 filings, on state unemployment reports, or in the general ledger as a wage expense but has no corresponding I-9 is a red flag that triggers further scrutiny. Conversely, a clean reconciliation between payroll, the general ledger, and the I-9 file shortens audits dramatically.
The same goes for independent contractor classification. If your books include payments to a person who looked, walked, and quacked like an employee — same hours, same supervision, same exclusive engagement — and you treated them as a 1099 contractor with no I-9, you have layered an immigration problem on top of a misclassification problem. Both agencies talk to each other. A clean bookkeeping system that tracks employee versus contractor relationships consistently, ties wages to specific employee IDs, and maintains an audit trail of when someone moved between statuses is one of the best defenses against compounding compliance failures.
Keep Your HR and Financial Records Audit-Ready
I-9 compliance, payroll accuracy, and contractor classification all depend on disciplined record-keeping that an auditor can follow without ambiguity. Beancount.io gives you plain-text accounting that is transparent, version-controlled, and easy to reconcile against payroll registers, employee rosters, and quarterly tax filings — so when an outside agency starts asking questions about who you paid, when, and how, your books answer cleanly the first time. Get started for free and bring the same rigor to your financial records that you bring to your HR files.