Summary. The Form I-9 is one page and generates more employer penalties than any other document in immigration practice, because the violations are technical, countable, and multiplied across every employee. This guide walks the form section by section with the timing and document rules that generate most errors, then reverification, the retention formula employers miscalculate, and the remote examination alternative procedure. It addresses E-Verify and tentative nonconfirmations, then the internal audit and correction protocol, the ICE inspection from notice through fine, how penalties are computed, and the anti-discrimination provisions that make overcorrection its own offense.

A restaurant group with 240 employees receives a Notice of Inspection on a Wednesday. It has three business days to produce its I-9s.

It produces 240 forms. ICE identifies 187 violations across 143 forms.

None of the 240 employees is unauthorized to work. Not one. The violations are:

  • 61 forms where the employee did not check a status box in Section 1.
  • 44 forms where Section 2 was completed more than three business days after the hire date.
  • 38 forms missing the employer's business address in the certification block.
  • 22 forms where the preparer entered a document title but no document number or expiration date.
  • 15 forms with no date in Section 2's certification.
  • 7 forms for employees hired in 2019 that could not be located at all.

Every one of these is a substantive or uncorrected technical violation, each is counted separately, and the penalty is assessed per violation on a schedule that scales with the violation rate. A company that hired only authorized workers faces a six-figure exposure entirely from paperwork.

This is the ordinary shape of I-9 enforcement. It is a documentation regime, and the defense is built years before the notice arrives.

The requirement

The Immigration Reform and Control Act of 1986, codified at 8 U.S.C. § 1324a, makes it unlawful to knowingly hire or continue to employ an unauthorized alien, and requires every employer to verify the identity and employment authorization of every person hired after November 6, 1986 — citizens and non-citizens alike.

Who must complete a Form I-9: every new employee. Not independent contractors, not casual domestic workers, and not employees hired before the effective date. Rehires may in some circumstances be handled by updating the existing form rather than completing a new one, within the applicable period.

The current form. USCIS revises the form periodically, and an outdated edition is itself a violation. Confirm the current edition and expiration date on the USCIS website before every hiring cycle, and note the M-274 Handbook for Employers, which is the operational reference.

Section 1: the employee

Who completes it. The employee, personally — or a preparer/translator who then completes the certification block.

When. No later than the first day of employment, meaning the first day the employee works for pay. It may be completed after acceptance of an offer but not before.

What the employee must provide: full legal name, other last names used, address (not a post office box), date of birth, Social Security number (optional unless the employer participates in E-Verify, where it is required), email and telephone (optional), the attestation of status, the signature, and the date.

The status attestation — the employee checks one of four boxes:

  1. A citizen of the United States
  2. A noncitizen national of the United States
  3. A lawful permanent resident, with the alien registration or USCIS number
  4. A noncitizen authorized to work, with the expiration date if applicable and one identifying number

The most common Section 1 errors:

  • No box checked, or more than one — a substantive violation.
  • Missing signature or date.
  • The employee signs but the preparer/translator block is not completed where someone assisted.
  • A post office box as the address.
  • Section 1 completed after the first day of employment.
  • An A-number or admission number entered by the employer based on a document rather than by the employee.

The employer's role in Section 1 is limited. Review it for completeness on the first day, and ask the employee to correct omissions. Do not complete it for them, and do not correct it yourself.

Section 2: the employer

Who completes it. The employer or its authorized representative, who must physically examine the original documents in the employee's presence — or use the alternative procedure described below.

When. Within three business days of the first day of employment. Where employment is for fewer than three business days, Section 2 must be completed by the first day.

The document rules, and this is where employers most often go wrong:

  • The employee presents either one document from List A (establishing both identity and employment authorization) or one document from List B (identity) and one from List C (employment authorization).
  • The choice is the employee's. The employer may not specify which documents to present, may not request more or different documents than the minimum, and may not reject documents that reasonably appear genuine and relate to the person. Doing any of these is document abuse under 8 U.S.C. § 1324b, discussed below.
  • The employer records the document title, issuing authority, document number, and expiration date for each document, plus the first day of employment, and signs and dates the certification with the employer's business name and address.
  • Genuineness. The standard is whether the document reasonably appears on its face to be genuine and to relate to the person presenting it. The employer is not a forensic examiner, and a good-faith acceptance of a facially valid document is a defense to a knowing-hire charge.
  • Photocopies. Retaining copies is optional in most cases but must be applied uniformly if done — copying documents for some employees and not others is evidence of discrimination. Copies are required for employers using E-Verify when certain documents are presented.
  • Receipts for a lost, stolen, or damaged document are acceptable for 90 days, with the actual document to be presented thereafter. Certain receipts have their own rules and periods.

The most common Section 2 errors:

  • Late completion — beyond three business days. Substantive.
  • Missing document number or expiration date.
  • Missing employer signature, title, business name, or address.
  • Missing first day of employment.
  • Recording documents in the wrong list column — a driver's license under List A, for instance.
  • Accepting a document that is not on the lists.
  • Over-documentation — recording a List A document and also a List B and C, which is document abuse.

Section 3, reverification, and retention

Reverification is required when an employee's temporary employment authorization expires. On the current form this is handled in the Supplement B.

Reverify: employment authorization documents with an expiration date, on or before the expiration.

Do not reverify:

  • US citizens and noncitizen nationals, ever.
  • Lawful permanent residents — a Permanent Resident Card's expiration does not affect employment authorization, and reverifying an LPR because their card expired is a common and serious error that constitutes document abuse.
  • List B identity documents — an expired driver's license does not trigger reverification.

On reverification, the employee may present any acceptable List A or List C document, including a different document than originally presented. The employer may not require the same document or a specific one.

Automatic extensions of employment authorization documents in defined categories are announced by USCIS and are frequently extended by Federal Register notice; the M-274 explains how to record them. Reverifying an employee whose EAD is automatically extended, or terminating them, is both an error and a discrimination exposure.

Rehires within three years of the original form's completion may be handled by updating Supplement B rather than completing a new form, provided the employee remains authorized and the original form is on the current-acceptable edition.

Name changes may be recorded but are not required.

The retention rule, and employers get this wrong constantly. Retain the I-9 for:

Three years after the date of hire, or one year after the date employment ends, whichever is LATER.

Compute both, take the later. For an employee who worked six months, the form is retained for three years from hire. For an employee who worked twelve years, it is retained for one year after termination. Purging on a flat three-year rule destroys forms that must still be produced; retaining everything forever means producing forms for long-departed employees whose errors are still countable.

Storage. Paper, microfilm, microfiche, or electronic, subject to the electronic storage requirements at 8 C.F.R. § 274a.2 — a reasonable system for indexing, retrieval, and reproduction; controls ensuring integrity, accuracy, and reliability; an audit trail; and the ability to produce legible hard copies.

Store I-9s separately from personnel files. Two reasons: producing personnel files to ICE is unnecessary and unwise, and the documents attached to an I-9 reveal national origin and citizenship status that should not be in the file a hiring manager reads.

Remote examination: the alternative procedure

Following the pandemic-era flexibilities, DHS adopted an alternative procedure permitting remote examination of documents — but only for E-Verify participants in good standing, and only under defined conditions.

The conditions:

  • The employer must be enrolled in E-Verify at the hiring site and be a participant in good standing.
  • The employer must examine copies (front and back, as applicable) of the documents to ensure they reasonably appear genuine.
  • The employer must conduct a live video interaction with the employee, who must present the same documents to ensure they reasonably appear genuine and relate to the person.
  • The employer must retain copies of all documents examined.
  • The employer must create an E-Verify case for the employee.
  • The employer must indicate on the Form I-9 that the alternative procedure was used, by checking the box in the certification area.
  • The employer must offer the alternative procedure consistently to all employees at a site, or to remote employees only, without treating employees differently based on citizenship status or national origin.

Employers not enrolled in E-Verify must examine documents physically, in the employee's presence. An authorized representative — anyone the employer designates, including a notary, an attorney, a manager at another location, or a trusted third party — may perform the examination, but the employer remains liable for that person's errors. Choose representatives who will be trained and reachable, and note that in some states a notary acting in this capacity may have licensing constraints.

E-Verify

E-Verify is an internet-based system comparing information from the Form I-9 against DHS and SSA records. It is voluntary federally, with three categories of mandate:

  • Federal contractors with contracts containing the FAR E-Verify clause.
  • State mandates — a number of states require E-Verify for all employers, for employers above a size threshold, for public employers, or for public contractors. The requirements and thresholds differ substantially.
  • Immigration benefit conditions — for example, employers relying on the STEM OPT extension must be enrolled.

How it works. A case is created no later than the third business day after the employee's first day of work. The system returns:

  • Employment Authorized — the case is closed.
  • Tentative Nonconfirmation (mismatch) — a discrepancy requiring action.
  • Case in Continuance or DHS/SSA verification in process.
  • Final Nonconfirmation — after an unresolved mismatch.

The mismatch process is where liability arises:

  • Notify the employee promptly and privately, using the Further Action Notice.
  • The employee decides whether to take action to resolve it, and must be given the opportunity.
  • The employee has a defined number of federal government working days to contact the relevant agency.
  • The employer may not terminate, suspend, withhold pay or training, delay the start date, or take any adverse action against an employee because of a mismatch while the case is pending.
  • If the mismatch is resolved, the case closes as authorized.
  • On a Final Nonconfirmation, the employer may terminate — and if it continues to employ the person, it must notify DHS and loses the good-faith presumption.

E-Verify obligations that accompany enrollment: display the required notices, use the system for all new hires at participating sites, never use it to pre-screen applicants, never use it selectively, retain the case verification number with the I-9, and comply with the memorandum of understanding.

The trade-off. E-Verify provides a rebuttable presumption that the employer has not knowingly hired an unauthorized worker, and it is the gateway to the remote examination procedure. It also creates a new set of countable obligations and a documented record of every hire.

The internal audit

The single most valuable compliance investment is a self-audit conducted before ICE arrives, because errors corrected in advance are not violations.

Scope and structure.

  • Audit all I-9s, or a neutral, non-discriminatory sample — by hire date, by location, or randomly. Never select by name, appearance, national origin, or citizenship status.
  • Conduct it under counsel where the volume or the findings warrant privilege.
  • Use a checklist and record findings per form.

What to check on each form:

  • Correct and current form edition.
  • Section 1 completed by the employee no later than the first day: name, address, date of birth, status box checked (one), A-number or USCIS number where required, signature, and date. Preparer/translator block completed if used.
  • Section 2 completed within three business days: documents recorded in the correct list columns with title, issuing authority, number, and expiration; first day of employment; employer signature, printed name, title, business name, and address.
  • Supplement B reverification where required, and no reverification where prohibited.
  • Retention — is this form still required, and are any required forms missing?
  • Consistency — copies retained uniformly if retained at all.

The correction protocol. Corrections are permitted and expected, and doing them wrong creates new problems.

  • Only the employee may correct Section 1; only the employer may correct Sections 2 and Supplement B.
  • To correct: draw a single line through the incorrect information, enter the correct information, and initial and date the correction with the actual current date.
  • Never use correction fluid or tape, never erase, never obliterate, and never backdate. Backdating is a federal crime and is the most damaging thing an employer can do in an audit.
  • Where a form is missing entirely, complete a new one now, using the current date in the certification — do not date it as of the hire date — and attach a signed, dated memorandum explaining that the form was missing and when it was completed.
  • Where a form has so many errors that line-item correction is impractical, complete a new form, attach it to the original, and attach an explanatory memorandum. Never destroy the original.
  • Attach a memorandum to any corrected form explaining what was corrected, by whom, and when.

What corrections accomplish. A technical or procedural failure corrected before an inspection is not a violation. A substantive violation — a missing form, a form completed after the fact, or an unchecked status box — is generally not curable, but a documented good-faith self-audit and correction effort is a significant mitigating factor in the penalty calculation, and it demonstrates the good faith that ICE weighs.

Do not treat the audit as a pretext to review employees' immigration status or to re-examine documents that were properly examined at hire. Requesting documents again during a self-audit, absent a genuine deficiency, is document abuse.

The ICE inspection

The Notice of Inspection (NOI) is served by Homeland Security Investigations, typically by hand, sometimes with an administrative subpoena. It requires production of I-9s and, usually, supporting documents within three business days.

On receipt:

  1. Do not produce anything immediately. The three business days are yours to use.
  2. Engage immigration counsel the same day.
  3. Request an extension if needed. Extensions are frequently granted for a reasonable request made promptly.
  4. Do not correct, alter, or complete forms after the NOI arrives. Corrections after service are worthless at best and are evidence of falsification at worst.
  5. Copy every form before producing it, and produce copies with a detailed inventory. Never surrender originals without retaining a complete copy set.
  6. Identify what else is requested — payroll records, quarterly wage reports, a list of current employees with hire and termination dates, articles of incorporation, business licenses, and E-Verify records are typical. Produce what the notice or subpoena requires and no more.
  7. Notify employees carefully, on counsel's advice. Some jurisdictions require employer notice to employees of an inspection.
  8. Do not discuss the inspection with employees in a way that suggests anyone should conceal anything.

Note that a subpoena or NOI is not a search warrant. Absent a judicial warrant or consent, agents generally may not search non-public areas. Designate in advance who responds, what they say, and who is called.

After review, ICE issues one or more notices:

  • Notice of Inspection Results ("compliance letter") — the employer is in compliance.
  • Notice of Suspect Documents — ICE believes specified employees are unauthorized. The employer must give those employees an opportunity to present valid documentation, and must terminate those who cannot. Do not terminate immediately on receipt; the employee is entitled to respond, and terminating without that opportunity is a discrimination claim.
  • Notice of Discrepancies — ICE cannot determine status from the documents; the employer must inform the employee, who may contact DHS or SSA.
  • Notice of Technical or Procedural Failures — the employer has ten business days to correct. Corrected, these are not violations; uncorrected, they become substantive.
  • Warning Notice — violations found, no fine, with an expectation of future compliance.
  • Notice of Intent to Fine (NIF) — the penalty assessment. The employer has 30 days to request a hearing before an administrative law judge at the Office of the Chief Administrative Hearing Officer, or the fine becomes final.

Penalties. Civil penalties are assessed per violation — meaning per form, and in some cases per error — on a matrix that scales with the violation rate (the percentage of forms with substantive violations) and with prior offenses. The statutory amounts are adjusted annually for inflation; confirm the current figures. Separate, higher penalty ranges apply to knowingly hiring or continuing to employ unauthorized workers, escalating for repeat offenses.

The five statutory factors in setting a penalty, 8 U.S.C. § 1324a(e)(5): the size of the business, the good faith of the employer, the seriousness of the violations, whether the individual was an unauthorized alien, and the employer's history of previous violations. ICE applies enhancement and mitigation adjustments to a baseline derived from the violation rate.

Criminal exposure for a pattern or practice of knowing violations, harboring, document fraud, or false statements, and asset forfeiture in serious cases.

Knowing hire and constructive knowledge

The paperwork violations are countable; the knowing hire violations are the serious ones.

Actual knowledge is straightforward. Constructive knowledge — knowledge that may fairly be inferred through notice of certain facts and circumstances that would lead a person, through the exercise of reasonable care, to know about a certain condition — is where employers get into trouble. The regulation, 8 C.F.R. § 274a.1(l), gives examples: failing to complete or improperly completing the I-9; acting on information indicating the employee is not authorized, such as a DHS notice or a labor certification revocation; and acting with reckless disregard.

Facts that have supported constructive knowledge findings: ignoring a Notice of Suspect Documents; continuing to employ someone after learning their document was invalid; multiple employees using the same Social Security number; an employee who admits to a supervisor that they are not authorized; and a pattern of accepting documents that are obviously not genuine.

What is not constructive knowledge: an SSA "no-match" letter alone. A discrepancy between an employee's name or SSN and SSA records has many innocent causes, and treating a no-match letter as grounds for termination is both an error and a discrimination claim. Respond by checking your own records for a clerical error, asking the employee to check with SSA, and giving them a reasonable period — without adverse action.

Contractors and staffing agencies. An employer may be liable for knowingly using a contract, subcontract, or exchange to obtain the labor of an unauthorized worker, 8 U.S.C. § 1324a(a)(4). Where a staffing agency supplies workers, the agency completes the I-9 as the employer of record — but the client should require compliance representations, audit rights, and indemnity, and should not direct the agency's verification practices in a way that creates joint employer exposure.

Successor liability. A buyer in an asset transaction may either accept the seller's I-9s (assuming the liability with them) or complete new forms for retained employees, treating them as new hires. Diligence should include an I-9 sample audit, and the choice should be deliberate rather than default.

The other side: discrimination

The most counterintuitive risk in this area is that excessive compliance is itself unlawful.

8 U.S.C. § 1324b, enforced by the Immigrant and Employee Rights Section of the Department of Justice, prohibits:

  • Citizenship status discrimination against protected individuals — US citizens, lawful permanent residents, refugees, and asylees.
  • National origin discrimination by employers with 4 to 14 employees (larger employers fall under Title VII).
  • Document abuse (unfair documentary practices) — requesting more or different documents than required, rejecting documents that reasonably appear genuine, specifying which documents an employee must present, or requiring a specific document for reverification.
  • Retaliation for asserting rights under the section.

The practices that generate these claims:

  • Requiring a specific document — "we need to see your green card."
  • Requesting documents from non-citizens but not from citizens.
  • Rejecting a valid EAD because it has an expiration date, or requiring a "permanent" document.
  • Reverifying a lawful permanent resident when their card expires.
  • Reverifying an EAD that has been automatically extended.
  • Requiring more documents than the lists require — a List A document plus a Social Security card.
  • Job postings and screening that exclude work-authorized non-citizens without a legal basis. Advertising a position as open only to US citizens, or requiring permanent work authorization, violates the section unless a law, regulation, executive order, or government contract requires citizenship — and the ITAR and export control justification is narrower than employers assume.
  • Refusing to sponsor as a blanket policy, applied inconsistently or communicated in a way that screens out protected individuals.
  • Conducting a self-audit targeted at employees perceived to be foreign-born.

Penalties are civil, per individual discriminated against, adjusted annually, plus back pay and hiring or reinstatement orders. IER settlements frequently include training, policy changes, and monitoring.

The lawful screening formulation for recruiting: ask whether the applicant is authorized to work in the United States, and whether they will now or in the future require sponsorship, and apply the answers consistently. Do not ask about citizenship, national origin, or immigration status.

A compliance program

Assign an owner. One person responsible for I-9 compliance, with a trained backup.

Train everyone who touches a form. HR, hiring managers who complete Section 2 at remote sites, and any authorized representative. Training should cover the timing, the document rules, the prohibition on requesting specific documents, the reverification rules and exceptions, and the correction protocol.

Centralize where possible. Distributed completion by untrained managers is the source of most errors. Where forms must be completed at a site, use a standard packet, a checklist, and a same-week review by the central owner.

Use a calendar. Section 1 by day one, Section 2 by day three, E-Verify case by day three, reverification before expiration, and the retention purge date computed correctly.

Consider electronic I-9 software, which enforces the timing and completeness rules and eliminates most technical errors — provided the system satisfies the electronic storage regulation and the vendor's audit trail is adequate.

Store I-9s separately from personnel files, in a single, retrievable location, with terminated employees' forms filed by purge date.

Purge on schedule. Forms retained beyond the requirement are still producible and their errors are still countable.

Self-audit annually, under counsel where warranted, with corrections made properly and documented.

Have a response protocol for a Notice of Inspection: who is called, who accepts service, what the receptionist says, who assembles the production, and the instruction that nothing is corrected after service.

Document the good faith. Training records, audit reports, correction memoranda, and the compliance policy are what establish the good-faith factor when penalties are calculated.

A worked example

Halverson Foods, 310 employees across four sites, conducts a self-audit under counsel.

Findings across 310 forms: 84 with at least one error. Of those: 31 missing an employer signature or business address; 22 with a missing document number or expiration date; 14 with Section 2 completed late; 9 with no status box checked in Section 1; 5 reverifications of lawful permanent residents; 3 forms missing entirely for current employees.

Corrections:

  • The 31 signature and address omissions are corrected by the employer with a single line, correction, initials, and the current date, with a memorandum attached to each.
  • The 22 document field omissions are corrected the same way, using the retained copies where available; where no copy exists, counsel advises against completing the field from memory and instead documents the deficiency.
  • The 14 late completions cannot be cured; a memorandum documents the finding and the corrective training.
  • The 9 Section 1 omissions are corrected by the employees, with their initials and current dates.
  • The 5 improper reverifications are documented with a memorandum acknowledging the error, and the affected employees are informed in writing that no further documentation is needed and that the error will not affect them — because those five are also a document abuse exposure.
  • The 3 missing forms are completed now, with the current date in the certification and a signed memorandum explaining when and why.

Program changes: a single trained owner with a backup; electronic I-9 software with timing enforcement; Section 2 completion moved from site managers to the central HR team via live video under the alternative procedure, which the company can use because it enrolls in E-Verify; a corrected retention calculation with a purge calendar; and training for all hiring managers on the document rules and the prohibition on requesting specific documents.

Eighteen months later, a Notice of Inspection arrives. The company produces 296 forms with an inventory, having retained copies. ICE issues a Notice of Technical or Procedural Failures identifying 11 items, all corrected within the ten business days, and a warning notice. No fine.

The difference between that outcome and the restaurant group in the opening example is a self-audit, conducted while corrections still counted.

Frequently asked questions

Do we need an I-9 for US citizens? Yes. Every employee hired after November 6, 1986, regardless of citizenship.

Can we ask to see a green card? No. The employee chooses which acceptable documents to present. Requesting a specific document is document abuse.

Do we have to reverify a lawful permanent resident when their card expires? No, and doing so is a violation. LPR status does not expire with the card.

What if we find missing forms? Complete them now, with the current date, and attach a memorandum explaining the circumstance. Never backdate.

Can we make copies of documents? Optional in most cases, but the practice must be uniform. Copies are required for certain documents when using E-Verify and for the remote examination procedure.

How long do we keep I-9s? Three years from hire or one year from termination, whichever is later. Compute both.

Can we verify remotely? Only if you are an E-Verify participant in good standing and follow the alternative procedure — copies, live video, retention, E-Verify case, and the box checked on the form. Otherwise, physical examination by an authorized representative.

What do we do with an SSA no-match letter? Check your own records for a clerical error and ask the employee to resolve it with SSA. Do not terminate, suspend, or take adverse action on the basis of a no-match alone.

How long do we have after a Notice of Inspection? Three business days, extendable on request. Use the time; do not correct forms after service.

Conclusion

I-9 enforcement is not about immigration status. It is about a one-page form completed thousands of times by people who received no training, under a set of rules that includes a three-day deadline, a retention formula with two prongs, a list of documents the employer may not request, and a category of employees who must never be reverified.

Two facts govern the outcome. Errors corrected before an inspection are not violations, and errors discovered after service cannot be cured. And the penalty is per form, which means a modest error rate across a large workforce produces an exposure disproportionate to any actual harm.

The entire defense is therefore an annual self-audit, conducted properly, documented, and paired with training for the people completing the forms. It costs a few days of work. Its absence is the reason companies that never hired an unauthorized worker write six-figure checks.

Related articles

This guide is provided for general informational purposes and does not constitute legal advice. Form editions, penalty amounts, automatic extension periods, and E-Verify requirements change frequently. Consult qualified immigration counsel before conducting a self-audit or responding to a Notice of Inspection.