What Is E-Verify? Rules, States, and Employer Duties
E-Verify checks work authorization electronically after the I-9. Which states require it, the three-day rule, and what to do with a mismatch.
Two things about E-Verify, the federal online check of a new hire's work authorization, surprise employers who have just been told they need it. The first is that it does not replace the Form I-9, the eligibility form every employer completes for each hire; it sits on top of it, so an obligation was added and none was removed.
The second is where much of the real risk lives. Trouble rarely starts with the electronic check itself. It starts with what an employer did in the weeks after the check came back with a mismatch, because the correct answer during that period is to change absolutely nothing, and the instinct is to do something.
This guide covers who is required to use it, the state mandates that catch most small businesses, the fixed order of operations, the three business day rule, and the mismatch process.
I build the people and records tooling for businesses without an HR department at FirstHR. This is general information rather than legal advice, and immigration compliance is an area where a mistake is expensive enough to justify professional input.
What E-Verify Is
E-Verify is a federal internet-based system that checks the information from a completed Form I-9 against government records to confirm that a newly hired employee is authorized to work in the United States.
The legal obligation behind it is the requirement that employers verify the identity and work authorization of everyone they hire (8 U.S.C. 1324a). E-Verify is a way of adding an electronic check to that process, not a substitute for it.
E-Verify also applies only to new hires. Enrolling does not create a duty to run existing staff through the system, and doing so retroactively is generally not permitted outside specific federal contractor circumstances. That distinction matters because employers newly required to enroll frequently assume their whole workforce has to go through it.
Reverification and Rehires
Reverification does not happen in E-Verify at all. When a work authorization document somebody presented is close to expiring, the system shows an alert as a reminder, and no case may be created from it. The reverification itself is done on the Form I-9, by completing Supplement B and attaching it to the original form (E-Verify user manual).
Rehires split two ways. Where the earlier case came back confirmed and the rehire falls within three years of the original Form I-9, you may complete Supplement B on that form and create nothing new.
Every other rehire is handled as a new hire: a new I-9, and a case inside the same three business day window (E-Verify rehire rules).
Is It Required?
Federally, for most private employers, no. The two main routes to a mandate are federal contracting and state law, and the second is what reaches most small businesses.
A narrower third route is student employment. An employer that wants an F-1 student (an international student on a student visa) to keep working on a STEM OPT extension, the added work period for science, technology, engineering, and math graduates, must be enrolled.
The practical consequence is that whether you need E-Verify depends first on your address and any federal contracts, and size or industry matters only where a state's own rule makes it count. A small business in one state may have no obligation at all; the same business across a state line may have had one from its first employee.
The State Requirements
Ten states require E-Verify for some or all private employers, and the conditions differ enough that a national summary is only a starting point. Louisiana and Montana appear in the table below but not in that count, because they let an employer keep specified documents instead.
Florida shows how specific the conditions get: section 448.095 has applied to private employers with 25 or more employees since July 1, 2023.
| Pattern | States following it | What it means in practice |
|---|---|---|
| All private employers, no threshold | Alabama, Arizona, Mississippi, South Carolina | The obligation attaches from your first employee |
| Above an employee threshold | Florida (25), Georgia (more than 10), North Carolina (25), Tennessee (35), Utah (150, scheduled to lapse by July 1, 2027) | The obligation attaches once your headcount crosses the state’s own count |
| E-Verify or retain specified documents | Louisiana, Montana | An alternative compliance route exists, with its own recordkeeping |
| Sector-specific requirements | Ohio (nonresidential construction, since March 20, 2026) | Can attach to an industry rather than to all employers in the state |
| Public employers and contractors only | Numerous states | Reaches private businesses through public contracts rather than directly |
| No state requirement | The remaining states | Federal contractor status can still create one |
Two features of this landscape make it harder than the table suggests. Thresholds are counted differently between states, so a business at the edge of one may need to check how its own state counts part-time and seasonal staff. And the requirements change: legislatures revisit them regularly, and a state that had no mandate two years ago may have one now.
Montana is one recent example of a state changing its rules. Since July 1, 2025, its Legal Employment and Government Accountability Law has required every employer to keep an E-Verify result or a completed Form I-9 with its documents, within the federal I-9 timelines.
The Montana Department of Labor and Industry says verification comes before a new employee begins work, which is the cautious course.
Change runs both ways. Ohio added an industry rule that took effect on March 20, 2026: nonresidential construction contractors, subcontractors, and labor brokers must verify each employee hired for a nonresidential construction project through E-Verify.
Utah is moving the other way. Its statute repeals the 150-employee requirement by July 1, 2027, unless the legislature moves that date first.
For a business operating across state lines the safe posture is usually to verify the same way everywhere rather than to run a different process per location, and to do it for genuinely every new hire at each participating site.
Federal Contractors
Federal contractors whose contracts contain the E-Verify clause must enroll and use the system, and their timeline is more demanding than a state mandate. According to E-Verify, the clause reaches contracts awarded on or after September 8, 2009 that exceed $150,000, run for 120 days or longer, and are performed at least partly in the United States.
Enrollment is required within 30 calendar days of contract award. After that, E-Verify gives you 90 calendar days from the enrollment date to begin verifying every new hire, and each case then follows the same three business day window that any other participating employer works to.
Existing employees assigned to the covered contract are the exception to the new-hires-only rule. They are verified within 90 calendar days of enrollment or 30 calendar days of assignment, whichever is later, and this is the one situation where the system reaches backwards into staff you already have.
The clause flows down to subcontracts over $3,500 for services or construction performed in the United States, so a subcontractor can inherit the obligation without having any direct relationship with the federal government. Checking whether the clause is in your subcontract is a bid-time question rather than an onboarding-time one.
Confirming that another business is enrolled is a public lookup rather than a phone call. The E-Verify employer search lists employers currently in the program, with account status, the date they joined, and the number of hiring sites, which is enough to check what a subcontractor or a staffing firm has told you.
The listing needs careful reading, because a large company appearing there does not mean every one of its locations participates.
The Order of Operations
Three steps in a fixed sequence, and none of them can be reordered or skipped.
The first step is where employers create serious problems for themselves. Running a case on somebody you have not hired is prohibited, and the reason it is tempting is exactly the reason it is prohibited: it lets an employer make a hiring decision on the basis of an immigration status check rather than on the job.
The second step is where the quality problem sits. E-Verify draws its data from the I-9, so a transposed number or a mis-entered name on the form becomes a mismatch downstream. Getting the I-9 documentation right first is what keeps the electronic step uneventful (I-9 Central).
The third step, creating the case itself, is the one with a deadline.
The Three-Day Rule
The case must be created no later than the third business day after the employee starts work for pay, per the E-Verify user manual. The clock runs from the first day of employment, not from the offer, the acceptance, or the day the paperwork was finished.
Late cases are permitted but not free: the system requires you to select a reason for the delay, and that record sits in your own account. A pattern of late cases is exactly the sort of thing that gets noticed during a review, and the usual cause is administrative rather than deliberate, which makes it fixable.
The fix is to attach case creation to the start date in whatever process already tracks new hires, rather than to a person remembering. A first-day checklist that includes the I-9 and the E-Verify case together removes the entire category of problem, and it belongs with the rest of the new hire paperwork.
The log below is what makes the timing visible rather than remembered. One row per new hire at a participating site, with the start date and the case creation date sitting next to each other, so a case drifting past the third business day shows up while it can still be explained.
| A | B | C | D | E | F | G | H | I | J | K | L | M | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Employee | Participating site | Offer accepted on | First day of work | I-9 section 1 completed | I-9 section 2 completed | Case created on | Business days after the start date | Reason selected if the case was late | Case number | Result | Case closed on | Where the records are filed |
| 2 | |||||||||||||
| 3 | |||||||||||||
| 4 | |||||||||||||
| 5 | |||||||||||||
| 6 | |||||||||||||
| 7 | |||||||||||||
| 8 | |||||||||||||
| 9 | |||||||||||||
| 10 | |||||||||||||
| 11 | |||||||||||||
| 12 | |||||||||||||
| 13 |
When There Is a Mismatch
A mismatch means the data did not match the records checked, which is a very different statement from a finding that somebody is not authorized to work. It is also where much of the enforcement risk lives.
Of those four rules, the second matters most. While a contested case is open you treat the employee exactly as you would have if the case had come back clear: same hours, same duties, same pay, same training. Reducing somebody's shifts while waiting is the action that converts an administrative process into a claim (E-Verify mismatch guidance).
The mismatch timeline runs on defined windows rather than vague ones. According to E-Verify referral guidance, the employer refers the case within ten federal government working days, the employee then has eight working days to call DHS or visit a Social Security office, and the agency has ten more to update the result.
Mismatches can come from mundane causes: a name change never updated with an agency, or a typing error at your end. Treating one as an accusation is both wrong and the first step toward handling it badly.
Because handling one well is mostly a matter of doing a short sequence in order, the record below walks that sequence: what the notice said, how it was given, what the employee decided, and the confirmation that nothing about their employment changed while the case stayed open.
Kelly KapoorCustomer ServiceUp to Date
Darryl PhilbinWarehouseNeeds Attention
Ryan HowardSalesUp to DateThe Discrimination Trap
The common thread in E-Verify discrimination problems is uneven application. The system is designed to be applied identically to every new hire, and any deviation from that reads as discrimination on national origin or citizenship status.
There are five behaviors to avoid. Do not verify some new hires and not others. Do not specify which acceptable documents somebody must produce. Do not request additional documents because a name, an accent, or an appearance prompted a question. Do not re-verify people whose documents have not expired. And do not pre-screen applicants.
The uncomfortable part for a small business is that these decisions are usually made by one person acting on instinct in a busy moment, without any policy in the room. Writing down that every new hire goes through the identical process, and putting the sequence on a checklist, removes the moment where instinct gets to operate.
Enrolling and Running It
Enrollment is free and takes an afternoon. The commitments that come with it are the part to read rather than skim.
Enrollment also brings one practical benefit. According to USCIS, an employer enrolled in E-Verify and in good standing may use the DHS alternative procedure for the I-9: review copies of the documents, confirm them with the employee over live video, and retain legible copies rather than examining originals in person.
Where Small Employers Get This Wrong
Six patterns, and the first two are the most serious.
Acting on a contested mismatch is first. Cutting hours, delaying a start, or quietly moving somebody off the schedule while a case is open breaks the one rule the whole mismatch process depends on: change nothing.
Pre-screening applicants is second. It is prohibited outright, and it is the clearest possible evidence for a discrimination complaint.
Treating E-Verify as replacing the I-9 is third. The form obligation is unchanged, the retention rules are unchanged, and the inspection exposure is unchanged.
Verifying selectively is fourth. Enrollment is a commitment to run every new hire at the site through the same process, without exception and without judgment about who looks like they need it.
Missing the three-day window habitually is fifth. One late case is easy to explain; a run of them becomes a pattern that shows in your own account record.
And assuming the state position is static is last. Legislatures revisit these mandates often, thresholds move, and a business that checked two years ago and concluded it was exempt may no longer be. An annual check costs ten minutes.
Nick Anisimov, FirstHR founder
Frequently Asked Questions
What is E-Verify?
E-Verify is a federal online system run by the Department of Homeland Security together with the Social Security Administration. Once you have hired someone and completed their Form I-9, you enter the I-9 details, and the system tests them against government records to see whether the person may legally work in the United States. The result is either a confirmation or a mismatch that needs follow-up. E-Verify adds to the I-9 process rather than replacing it, so an enrolled employer still completes and keeps an I-9 for every new hire.
Is E-Verify mandatory?
Not for most private employers under federal law. Federal contractors are the main exception: a contract that carries the E-Verify clause obliges the contractor to enroll and use the system. That clause covers contracts awarded on or after September 8, 2009, worth more than $150,000 and lasting 120 days or longer, and subcontracts worth over $3,500 inherit it. An employer that wants an F-1 student to keep working on a STEM OPT extension must also be enrolled. For small businesses, though, state law is usually what decides. Ten states impose E-Verify on at least some private employers: four cover every employer whatever its size, five apply once headcount passes a threshold somewhere between 10 and 150, and Ohio limits its rule to nonresidential construction.
Which states require E-Verify?
Ten states make it compulsory for at least part of the private sector: Alabama, Arizona, Florida, Georgia, Mississippi, North Carolina, Ohio, South Carolina, Tennessee, and Utah. The conditions differ substantially. Alabama, Arizona, Mississippi, and South Carolina reach every employer regardless of headcount. Florida applies at 25 employees, Georgia above 10, North Carolina at 25, Tennessee at 35, and Utah at 150, although Utah’s statute repeals that requirement by July 1, 2027. Ohio’s rule is limited to construction firms and labor brokers working on nonresidential projects. Louisiana and Montana treat E-Verify as one option, letting an employer keep specified work authorization documents instead. Many states also impose it on public employers and their contractors, so confirm your own state and industry rather than relying on a national list.
When do you have to run an E-Verify check?
No later than the third business day after the employee’s first day of work, and the case may never be created before a job offer has been accepted. Because the case is built from the completed I-9, the order is fixed: accepted offer, finished I-9, then the E-Verify case. If you miss the deadline you can still create the case, but the system requires you to give a reason for the delay, and that reason stays in your account record. Checking an applicant before hiring them is prohibited outright, not just discouraged.
Does E-Verify replace the I-9?
No, and this is the most consequential misunderstanding about it. Every employer, enrolled or not, must complete and retain a Form I-9 for each employee, and an enrolled employer remains subject to I-9 inspection exactly as before. E-Verify is an additional electronic check drawing on the information already recorded on the I-9. An employer who treats the electronic confirmation as the compliance step and lets I-9 quality slip has added an obligation without removing one.
What happens if E-Verify returns a mismatch?
Notify the employee promptly and in private, hand over the notice the system generates, and leave the decision to contest with them. A mismatch, officially a tentative nonconfirmation, means the details you entered did not line up with the records the system checked. It does not mean the person lacks work authorization, and typos, a name change, or an agency record that was never updated can all cause one. Until a contested case is resolved, you cannot fire the employee, suspend them, cut their hours, delay their training, or withhold their pay.
Can you use E-Verify to screen job applicants?
No. Creating a case before a job offer has been made and accepted is prohibited, and pre-screening applicants is one of the clearest misuses of the system. The reasoning is straightforward: E-Verify draws on a completed I-9, and the I-9 process itself does not begin until somebody has been hired. Employers occasionally try to use it as a shortcut for evaluating candidates, and it produces both a system violation and a strong basis for a discrimination complaint.
Can you verify only some employees?
No. Once enrolled, you verify every new hire at the participating site, consistently, regardless of how they look, what they sound like, what documents they present, or where you believe they were born. Selective verification is discrimination and is treated as such. The same principle governs documents: you may not specify which acceptable documents an employee must produce for the I-9, and you may not demand extra documentation because a name or an accent prompted a question.
Make HR the easy part of running your business
Onboarding, e-signatures, training and core HR in one place. Up and running in 5 minutes.
- 7-day free trial
- No credit card required
- Cancel anytime