I-9 Reverification: When You Must Do It, How to Do It Right, and the Penalties for Missing It
Read the article
"When a buyer receives pristine PDFs but no audit trail, they essentially don't have valid I-9s," says Morgan Lewis partner Eric Bord, who advises employers nationally on workforce compliance and M&A diligence. That observation captures why I-9 compliance has moved from HR housekeeping to a deal-readiness requirement.
Buyers, private equity funds, lenders, and internal audit teams now treat workforce-authorization compliance as a core diligence category. Three things changed the math in the past 18 months: U.S. Immigration and Customs Enforcement (ICE)'s March 2026 reclassification of nine common paperwork errors as substantive (no 10-day cure), the 2025 inflation adjustment that doubled the top of the paperwork-violation range, and a joint Department of Justice (DOJ) and ICE memo confirming that electronic I-9s must hold up to retention, audit-trail, and retrieval requirements on the employer's books — not the vendor's.
This article walks through what M&A teams actually find in I-9 diligence in 2026, how the new rules amplify exposure, and where buyers (and sellers preparing for sale) can reduce risk before a letter of intent (LOI) is signed.
In any asset or stock acquisition, the buyer assumes workforce-related liabilities of the acquired entity unless the purchase agreement explicitly carves them out. Historical I-9 violations — missing forms, late reverifications, undocumented remote verification, or electronic records with no audit trail — flow through to the buyer and materially affect:
I-9 problems also signal deeper issues — inconsistent onboarding, weak document retention controls, and a Human Resources Information System (HRIS) that wasn't built for compliance. Lenders financing the transaction increasingly require I-9 audit validation as a closing condition, alongside the more familiar wage-and-hour and benefits diligence.
"When a seller hands over a clean PDF of every I-9 but no system audit trail, the buyer effectively inherits an unverifiable record," says Patricia Duarte, Director of Compliance at i9 Intelligence. "Federal regulations require that electronic I-9s carry user identification, timestamps, and the ability to reproduce the form exactly as it was completed. Without that, the form is presumed unreliable on inspection — and the buyer is the one who owns the exposure."
Across the deals our team has supported, the same patterns surface in nearly every diligence:
On March 16, 2026, ICE reissued its Form I-9 inspection fact sheet and reclassified nine common paperwork errors from technical (correctable within 10 business days of a Notice of Inspection) to substantive (fineable on first inspection, no cure window). The reclassified errors include:
For M&A, the practical effect is straightforward: errors that used to be "we'll fix that in the 10-day window" are now priced exposure. A blank employer title on 200 forms is no longer a paperwork correction — it's 200 substantive violations at $288 to $2,861 per form under the 2025 schedule. Buyers' counsel are already adjusting reps & warranties language and increasing escrow holdbacks to account for the new line.
For the full historical comparison and the prior memos that established the original classifications, see our regulatory companion article.
Per the Jan. 2, 2025 Federal Register adjustment amending 8 CFR § 274a.10, civil penalties for Form I-9 violations are:
| Violation type | Minimum | Maximum | Unit |
|---|---|---|---|
| Paperwork violations (substantive or uncorrected technical) | $288 | $2,861 | Per Form I-9 |
| Knowing hire / continuing to employ — 1st offense | $716 | $5,724 | Per worker |
| Knowing hire — 2nd offense | $5,724 | $14,308 | Per worker |
| Knowing hire — 3rd+ offense | $8,586 | $28,619 | Per worker |
ICE adjusts the base fine ±25% under the five statutory factors in 8 CFR § 274a.10(b)(2): business size, good faith, seriousness, involvement of unauthorized workers, and prior violations. As of this writing, DHS has not published a 2026 inflation adjustment; the January 2025 amounts remain current in the Code of Federal Regulations. For a full breakdown of each tier and the calculation method ICE uses, see I-9 Penalties in 2026.
One clarification frequently mis-stated in M&A diligence memos: the $28,619 figure is the upper end of the third-or-more-offense knowing-hire tier, not the per-form paperwork ceiling. A buyer's exposure on a paperwork-heavy file maxes at $2,861 per form. Reserve the higher tiers for files with evidence of knowing or continued employment of unauthorized workers.
Before your audit team spends a week pulling files, run the numbers. Our I-9 Risk Calculator takes the target's headcount and an estimated error rate and returns a penalty range using the current Federal Register amounts. Two minutes, no signup — useful as a pre-LOI sanity check and as a working number for reps & warranties negotiation. Pair it with the I-9 Retention Calculator when scoping which forms have to be produced and which can be destroyed.
Almost every acquired company we audit has I-9s split across at least two systems. The pattern is consistent: Section 1 was completed in an HCM (Workday, UKG, ADP, SAP) using its built-in onboarding module; Section 2 was completed elsewhere — a separate compliance tool, a video-verification vendor, or on paper at the work site. Records from before the current HCM live in a third place. Terminated-employee files are in a fourth.
This violates the regulatory framework for electronic I-9s even when no single system is non-compliant on its own. Under 8 CFR § 274a.2(e)–(i), electronic I-9 systems must produce a single, continuous, auditable record per employee, retrievable for inspection. A December 2023 joint memo from the DOJ Civil Rights Division and ICE Homeland Security Investigations explicitly reminds employers that responsibility for compliance does not transfer to the software vendor.
For a deeper read on why the practice creates audit-trail and retrieval risk specifically, see Patricia Duarte's recent article: Why Storing Form I-9s in More Than One System Is a Compliance Risk.
In diligence, the dual-system problem shows up three ways:
If the acquired entity is a federal prime contractor or subcontractor on covered contracts, Federal Acquisition Regulation (FAR) clause 52.222-54 (Employment Eligibility Verification) likely applies. The clause requires enrollment in E-Verify and E-Verify use for new hires assigned to the contract and for the existing workforce (with some exceptions). For a deeper look at FAR's E-Verify reach — including 1099 and subcontractor scope questions — see the FAR E-Verify Clause and Federal Contractors. Three points buyers should confirm in diligence:
The same scrutiny applies in reverse: a buyer with federal contracts acquiring a non-FAR target may need to bring the acquired workforce into E-Verify within the contract's compliance window post-close.
Private equity diligence teams and internal audit functions evaluate I-9 compliance as a proxy for operational maturity. They look for:
These findings drive decisions on valuation, closing timelines, reps & warranties scope, integration cost, and — increasingly — the existence and size of the I-9 escrow holdback.
Yes, with two important caveats. Technical errors can be corrected on the form itself, in a different color ink, initialed and dated by the person making the correction — never erased, never whited out. Missing fields can be added late. A missing Form I-9 cannot be created retroactively as if it had been completed on day one; the form must reflect when it was actually completed, and the gap remains on the record.
For acquired workforces, the practical playbook is: (1) inventory everything immediately post-close, (2) correct technical errors and document each correction, (3) complete any missing I-9s now with today's date and an attached memo explaining the circumstances, (4) consolidate to a single system of record with full audit trail, and (5) document the entire remediation effort. Good-faith remediation is one of the five factors ICE uses to adjust penalties under 8 CFR § 274a.10(b)(2). It doesn't erase violations — it reduces fines.
Most M&A engagements we run fall into three windows. Pre-LOI, sellers commission an audit to clean up before buyers see the file. During diligence, buyers commission an audit to size exposure and inform reps & warranties. Post-close, integration teams commission a remediation audit. We support all three. Start with our I-9 Audit Services page, or talk to our team about an M&A-specific scope.
In a stock purchase, yes — the buyer steps into the target's I-9 history, including any unremediated violations. In an asset purchase, liability can be carved out in the purchase agreement, but the practical reality is that the workforce comes with the assets and, with it, the I-9 file. ICE looks at who is currently employing the worker at the time of inspection. The buyer holds the operational obligation from day one regardless of how the contract allocates pre-close liability.
The most common single finding is missing employer titles in Section 2 — easy to overlook because the rest of the section looks complete, and now substantive under the March 2026 reclassification. Close behind: missing or late reverifications, retired form versions still embedded in HCM templates, and I-9s split across multiple systems with no continuous audit trail. Across the audits our team has run, double-digit error rates on acquired files are the rule rather than the exception — payroll-heavy industries that grew through prior roll-ups tend to land on the higher end.
Technical errors can be corrected in a different color ink, initialed, and dated. Missing fields can be added late. A missing Form I-9 cannot be backdated — the form must reflect when it was actually completed. Good-faith post-close remediation is a statutory mitigating factor under 8 CFR § 274a.10(b)(2) but does not eliminate the violation.
Nine common paperwork errors that previously qualified for a 10-day cure window on inspection are now fineable on first inspection. For diligence, that means errors that used to be priced as "remediation cost" are now priced as "penalty exposure." Buyers' counsel are increasing reps & warranties scope and escrow holdbacks accordingly. See ICE Redefines Substantive I-9 Violations for the full list and source memos.
Yes, increasingly as a standard diligence item — particularly in workforce-heavy sectors (staffing, hospitality, healthcare services, manufacturing, agriculture, construction). PE diligence teams treat I-9 hygiene as a proxy for operational maturity. The funds we work with commission an I-9 audit as part of HR/workforce diligence on most deals over $25M enterprise value.
ICE looks at the current employer on the date of inspection. If the buyer is the employer of record, the buyer owns the violation regardless of who completed the form. The five statutory factors under 8 CFR § 274a.10(b)(2) — business size, good faith, seriousness, involvement of unauthorized workers, and prior violations — can adjust the base fine ±25%. Documented post-close remediation and a clean go-forward process help on the good-faith factor. They don't erase the pre-close violation.
Our team supports M&A diligence and post-close integration directly — pre-LOI seller audits, buyer-side diligence audits, and post-close remediation. Reach us at: