I-9 and E-Verify for New Hires: A Small Employer's Field Guide

Why this boring form has teeth

Form I-9 verifies that the people you hire are authorized to work in the United States. It feels like paperwork, and it is — but it's paperwork the federal government audits, and the penalties are assessed per form. A small employer with sloppy I-9s isn't looking at one fine; they're looking at a fine multiplied by their headcount. Paperwork violations alone (a missing signature, a blown deadline, the wrong document recorded) start in the hundreds of dollars per form and climb fast for repeat or knowing violations.

The good news: I-9 compliance is almost entirely about process discipline, not legal judgment. If you get the deadlines and the document rules right and apply them identically to every hire, you've handled 95% of the risk. This is a recruiter-and-HR working guide, not legal advice — when you hit a genuinely ambiguous case, talk to counsel.

The two sections and the two deadlines

Every I-9 has two halves, and each has its own clock:

• Section 1 — the employee fills it out. Their legal name, address, date of birth, and attestation of work-authorization status. This must be completed no later than the employee's first day of work for pay. Not the first week — the first day.
• Section 2 — you (the employer) fill it out. You physically or remotely examine the employee's documents and record them. This must be completed within three business days of the first day of work.

If someone starts on a Monday, Section 1 is due Monday and Section 2 is due by Thursday. Miss those windows and you have a violation even if the employee is perfectly authorized. The single most common small-employer mistake is letting Section 2 slide because "we'll get to it" — and then never getting to it.

The document rules that trip everyone up

The I-9 has three lists of acceptable documents:

• List A — documents that prove both identity and work authorization (a US passport, a Permanent Resident Card, certain employment authorization documents).
• List B — identity only (a driver's license, a state ID).
• List C — work authorization only (a Social Security card, a birth certificate).

The rule: the employee gives you either one List A document, or one List B document plus one List C document. That's it.

Here's where well-meaning employers create legal exposure: the employee chooses which documents to present, not you. You cannot demand a passport. You cannot insist on "more" documents because something "looks off." You cannot refuse a document that reasonably appears genuine and relates to the person in front of you. Over-documentation and specifying documents are forms of document abuse, and they're independently illegal — the Department of Justice enforces them. Treat every new hire identically: hand them the list, let them choose, examine what they bring.

Remote and distributed hires

For years, examining documents required someone physically in the room with the new hire — a real headache for remote teams. There is now a permitted alternative procedure that lets qualified employers (those participating in E-Verify in good standing) examine documents over a live video call and retain copies, rather than meeting in person. If you hire remotely, this is worth setting up deliberately rather than improvising. Build the document-exam step into your onboarding checklist as an owned, dated task — the same way you'd track equipment shipping — so it never falls through the cracks for a hire you never meet face to face.

Where E-Verify fits (and where it doesn't)

E-Verify is a separate, mostly voluntary federal system that electronically checks the information from a completed I-9 against Social Security Administration and Department of Homeland Security records. Two things to keep straight:

• E-Verify does not replace the I-9. You still complete the I-9 first; E-Verify runs on top of it. You can't skip the form.
• It's voluntary for most employers — until it isn't. Federal contractors with the FAR E-Verify clause are required to enroll, and several states mandate E-Verify for some or all employers. If you do GovCon work, assume you'll need it; the requirement often rides along with the contract. (For how clearance and contract requirements stack onto a hire, see the security clearance hiring process.)

If E-Verify returns a Tentative Nonconfirmation (a "mismatch"), you cannot fire, suspend, or penalize the employee while they contest it. You must give them the referral notice and the chance to resolve it with the agency. Acting on a mismatch prematurely is its own violation.

Retention, reverification, and purging

Two dates govern how long you keep an I-9:

• Three years after the date of hire, or
• One year after the date employment ends —

whichever is later. Keep I-9s in a separate file from the rest of the personnel record, ideally a single binder or folder (paper or digital) you can hand an auditor without exposing unrelated HR data. Don't bury them in individual employee folders; if you're audited, you want to produce I-9s and only I-9s.

Reverification: if an employee's work authorization has an expiration date, you must reverify before it lapses. US citizens and lawful permanent residents are not reverified — re-running them is another flavor of document abuse. And once an I-9 is past its retention window, purge it. Holding old I-9s forever just gives an auditor more forms to find errors on.

A small-team checklist that actually prevents fines

You don't need software to be compliant, but you do need a repeatable flow:

• Trigger Section 1 the moment an offer is accepted, so it's done on or before day one.
• Calendar the three-business-day Section 2 deadline for every single hire — automatically, not from memory.
• Use one current version of the form. USCIS revises it; an expired edition is a finding.
• Treat every candidate identically at the document step — same script, same lists, free choice. This is the same anti-bias discipline that makes knockout questions defensible.
• Store I-9s separately, set retention reminders, and purge on schedule.

In Hosting HR, the I-9 and its deadlines live as dated tasks inside the same onboarding workflow as equipment and accounts, so the three-day clock is something the system tracks for you instead of something you hope someone remembered. The form is boring. The fine isn't.