What Is an Unrestricted Social Security Card? Employer Rules for Form I-9
Read the article
The sentence we hear most on calls with mid-market HR teams is some version of "Workday handles I-9 for us." Sometimes it is ADP, UKG, SAP SuccessFactors, or whichever payroll platform came bundled with onboarding. The person saying it is usually right that the system captured a form at onboarding and stored it somewhere. They are usually wrong that this means the I-9s would survive an audit, and that gap is the most common reason well-resourced companies still pay per-form fines.
An HRIS is built to run payroll, benefits, and the employee record. Form I-9 is governed by a separate federal standard, and the places where the two do not line up are exactly where liability collects. Since ICE's March 16, 2026 fact sheet, an electronic I-9 system that fails the federal storage standards is itself a substantive violation: $288 to $2,861 per form, no correction window. This playbook walks through what Workday, ADP, and UKG tend to leave open, in the order we find it when we review a configuration, then the gaps that show up on every HRIS regardless of logo, and ends with the checklist we use to do that review. If your platform is not named here, the checklist still applies. The pattern does not change much from vendor to vendor.
Form I-9 liability is assessed per form, against the employer as a single legal entity. It never lands on the software vendor. When ICE serves a Notice of Inspection, you have three business days to produce a complete, defensible Form I-9 for every employee in scope. "The system did it that way" is not a defense, and nothing in your HRIS contract transfers the penalty.
The math is what makes the gap expensive. Paperwork penalties run $288 to $2,861 per Form I-9 under the January 2, 2025 Federal Register adjustment, still in force for 2026 (current figures in our I-9 penalties guide). An employer with 200 forms carrying errors is looking at roughly $57,600 to $572,200 in paperwork exposure before any knowing-hire findings. A large HRIS does not reduce that count. It standardizes whatever process was configured, so one misconfiguration repeats across every hire the system touched.
Any electronic I-9 system, native module or bolt-on, is measured against the electronic storage standards in 8 CFR § 274a.2. USCIS says a compliant system must include all of the following:
The March 2026 fact sheet made the stakes explicit. Failing these standards is a substantive violation, in the same category as a missing date of birth or a missing hire date. The question is no longer whether your HRIS stored a form. It is whether the form was stored to this standard, with an audit trail and an index an inspector can actually use. We wrote up what happens to each of these requirements when I-9s are split across systems in Why Storing Form I-9s in More Than One System Is a Compliance Risk.
Workday runs I-9 as part of onboarding and integrates E-Verify, which covers the common path well. The gaps show up at the edges of the standard, not the center.
Reverification is the one we find first. Expiring work authorization on Supplement B is a date-driven obligation. Two Workday customers told us this year, in nearly the same words, that they had to build a report to find expiring documents and did not know they needed to until someone asked. If reverification alerts are not configured, or live in a report nobody owns, a missed Supplement B is a substantive violation no matter how clean onboarding was.
Remote verification is the second. The DHS alternative procedure is only valid if you are an active E-Verify participant in good standing and the alternative-procedure box is checked in Section 2. A configuration that lets recruiters examine documents over video without enforcing both conditions produces substantive violations at scale. If you offer remote examination, you also have to retain clear front-and-back copies of every document examined, stored with the form and retrievable, not attached to a requisition that gets archived.
Then there are the records from before go-live. Migrated I-9s often lose their audit trail or land as flat images with no index. Those forms are still in scope in an audit.
The fastest way to know whether your HRIS is covering I-9 or just storing it is to test it against the federal standard before ICE does. Estimate your current exposure with our I-9 Risk Calculator, or book a free compliance call and we will walk your Workday, ADP, UKG, or other HRIS configuration against the 8 CFR § 274a.2 checklist and the March 2026 substantive-violation list. To see how a purpose-built I-9 layer sits alongside your HRIS, with new hires triggered from the HRIS and the I-9 itself held to the standard, see how the HRIS integration works or book a demo.
ADP spans several products, and I-9 coverage varies by module and configuration. The recurring gaps are less about whether a form exists and more about whether it meets the standard.
Start with the audit trail. Storing a completed PDF is not the same as maintaining the change-level record the regulation requires. Confirm the system records who changed what and when, on every field, including the electronic signature. Then look at Section 2 timing. The employer must examine documents and complete Section 2 within three business days of the first day of work for pay. If the workflow allows Section 2 to sit open past that window, late completion is a substantive violation with no cure.
Corrections are where ADP configurations surprise people. Only Section 2 and Supplement B may be corrected by the employer, using the line-through, initial, and date method, never by overwriting the record. A system that silently overwrites a field destroys the audit trail rather than correcting the form. And companies running ADP across several FEINs often split I-9 records by entity. An inspection consolidates them, and inconsistent configuration across entities becomes visible all at once.
UKG is the platform where we most often hear a version of "the form filler is the problem." Two HR teams on UKG Pro came to us this year for the same reason. One had already run an internal audit and found date-of-birth fields with the day and month swapped, missing signatures, and Section 1 entries typed by the wrong person, and was correcting them by hand every week. The other put it plainly: it is too easy to enter whatever you want. Nothing in the form stops a wrong DOB, a document number that does not match the document, or an incomplete field.
The audit trail is the deeper problem. In the configurations we have reviewed, UKG stores the most recent update date on an I-9, not the history of who changed which field and when. That is the requirement in 8 CFR § 274a.2(g), and the December 2023 DOJ and ICE joint guidance on electronic I-9 software says the system must "uniquely identify each person accessing, correcting, or changing a Form I-9." A last-modified stamp does not meet that bar, and an inspector who asks for the change history of one form will find out quickly.
Two smaller items compound it. UKG's E-Verify Connector has a documented behavior of sending "Yes" in the Verified field for every employee regardless of actual E-Verify case status, so downstream reports can show verified employees who never had a case opened. And the Social Security number field cannot be made mandatory on the form even though E-Verify requires it at submission, so Section 1 can be completed and the E-Verify case fail afterward. Remote verification exists only as the employer-run DHS alternative procedure, with document copies uploaded by hand.
The three platforms above are where we see the most volume. The same failure modes turn up on SAP SuccessFactors, Paycom, Paylocity, Paycor, Rippling, Gusto, BambooHR, Oracle HCM, and every other system that captures an I-9 as part of onboarding. A few are worth checking on any of them.
Employee-entered data is still your liability. Platforms that put Section 1 in the new hire's hands shift where errors originate, not who owns them. A missing date of birth or an unsigned attestation is a substantive violation, whoever typed it. On the SAP side, one large employer ran for years believing the module tracked reverifications when it did not; the gap was found in a migration, not an audit, which is the lucky version of that story.
The form edition. Since August 1, 2026, only the 01/20/25 edition (05/31/2027 expiration) is acceptable for new completions. Your vendor's update timeline became your compliance deadline. If nobody confirmed in writing that the edition switched, confirm it now. Our current Form I-9 edition guide covers what changed.
E-Verify may not be there at all. Some payroll platforms capture the I-9 but do not submit E-Verify cases; Gusto is the common example (details here). In an E-Verify state, that means a second system, a second three-day clock, and hand-keyed data.
Retention and purge logic. The rule is fixed: keep each Form I-9 for three years after the date of hire, or one year after employment ends, whichever is later. Many platforms either never purge or purge on the wrong trigger. Purging too early is a violation; keeping forms indefinitely is unnecessary exposure.
The three-day export test. Ask for a complete, indexed export of every I-9 with audit trails. If it cannot be produced within three business days, the storage does not meet the standard, whatever the marketing says. This is the single fastest test of any platform on this page.
This is the list we run when someone asks us to look at their HRIS setup. It works on a native module or an integration. If your platform cannot demonstrate every line, that is a gap an auditor can find.
"When I ask an HR team to pull up the audit trail on one migrated I-9, the room usually goes quiet. Not because anyone did anything wrong. The onboarding system captured the form and that felt like the end of it. Nobody told them the reverification queue, the alternative-procedure box, and the three-day production test were their problem and not the vendor's. That is the gap. The employer owns it," says Patricia Duarte, Director of Compliance at i9 Intelligence.
No single platform makes you compliant on its own. These systems capture and store I-9s, and some integrate E-Verify, but compliance depends on configuration and on the gaps the platform may not cover: reverification tracking, remote-verification prerequisites, audit-trail depth, correction workflow, and retention logic. The employer is liable for any violation.
Only if the system meets the electronic storage standards in 8 CFR § 274a.2: integrity and access controls, prevention of unauthorized alteration or deletion, a complete audit trail of every change, a quality-assurance program, a detailed index for immediate retrieval, and high-legibility reproduction. Under ICE's March 2026 fact sheet, failing these standards is a substantive violation.
Reverification, almost every time. After that: remote-verification prerequisites (E-Verify participation and the alternative-procedure box), a change-level audit trail rather than a stored PDF, Section 2 timing, and retention or purge logic tied to the wrong trigger.
Yes. The DHS alternative procedure for remote document examination is only available to employers enrolled in E-Verify in good standing, applied consistently at each participating site, with the alternative-procedure box checked in Section 2 and clear copies of documents retained. An HRIS that allows remote examination without enforcing these conditions creates substantive violations.
Within three business days of a government request. If you cannot export a complete, indexed set of I-9s with audit trails in that window, the storage does not meet the federal standard. Testing an export is the simplest way to find out before an inspection.
No. The common pattern for employers on Workday or SAP is to keep onboarding in the HRIS and run I-9s in a dedicated layer connected to it: the HRIS triggers the I-9 when a hire is created, status flows back, and the I-9 record itself is held to the 8 CFR § 274a.2 standard. The reasons that pattern exists are covered in Why Most HRIS Systems Fail at I-9 Compliance.
If your team assumes the HRIS "has I-9 covered," the fastest way to find out is to test it against the federal standard before an audit does. Our US-based compliance team has 28 years of I-9 and E-Verify experience and can review your Workday, ADP, UKG, or other HRIS configuration, map the gaps, and help you close them, including remote verification via video call for distributed hiring.