An I-9 must be completed for every employee: Section 1 by their first day of work, Section 2 by the employer within three business days of hire. Federal law then requires keeping the form for three years after hire or one year after termination, whichever is later. Multi-location employers miss this most on remote hires and retention timing.
Reviewed by Randy Powelson, founder of CertiFlow · Last updated 2026-09-15 against the USCIS Handbook for Employers (M-274) and 8 CFR §274a.2 retention requirements
This is general information, not legal advice. Form I-9 rules are federal, but some states and localities add their own requirements (mandatory E-Verify enrollment, for example), and immigration and employment law both change. Confirm your obligations with employment counsel, especially before disciplining or terminating over an I-9 issue.
The two I-9 deadlines
Section 1 is completed by the employee, no later than their first day of work — it can be done any time after they accept the offer.
Section 2 is completed by the employer, based on the employee's original documents, within three business days of that first day of work. There is no grace period built in for a busy opening shift or a manager who is out sick.
The retention window
Federal law requires keeping a completed I-9 for whichever is later of three years after the date of hire or one year after the date of termination. For most employees that means the file outlives the person by at least a year. A manager who deletes an I-9 the day someone leaves is very often deleting it early.
The window runs the other direction too: once it closes, holding the form and its copied documents indefinitely is its own unnecessary exposure, not a safer default.
Where multi-location operators get it wrong
01Section 2 completed late at a location with a new or untrained manager
Why it matters: The three-business-day clock doesn't pause for a manager who doesn't know the form. A late Section 2 is one of the most commonly cited paperwork violations in an I-9 audit, and it's the mistake most tied to who happens to be running a given location that week.
The fix: Give every location manager a single source of truth for the hire date and a due date on the I-9 itself, not a mental deadline that resets with staff turnover.
02Remote or off-site hires verified inconsistently
Why it matters: Physical document examination is still the federal default. The E-Verify alternative procedure that allows a live-video document check has been available since August 2023, but only for employers enrolled in E-Verify and in good standing — outside that, a remote hire still needs an in-person exam, sometimes through an authorized representative.
The fix: Decide, in writing, which of your locations are E-Verify-enrolled and eligible for remote verification, and which still require an in-person look at the original documents.
03Retention calculated off a single rule instead of two
Why it matters: The federal retention rule is whichever is later of three years after hire or one year after termination — not a flat three years. A long-tenured employee who leaves after ten years still needs their I-9 kept for a full year past their last day.
The fix: Calculate the actual retention date at termination, using both the hire date and the termination date, and don't purge a file until that later date has passed.
04No tracking for employees whose work authorization document expires
Why it matters: An employee hired on a document with a future expiration date — some visa categories, some employment authorization documents — needs Supplement B (Section 3) reverification before that date, not after. The I-9 itself doesn't expire; the underlying document can.
The fix: Track that document's expiration date the same way you'd track any other credential, with a reminder before it lapses, not a manual tickler file per location.
05I-9s filed in the employee's personnel file
Why it matters: Standard guidance is to keep I-9s separate from the general personnel file. A personnel file is more likely to be pulled in full for an unrelated reason, and a broader pull is also a bigger exposure if it surfaces identity or immigration-status information out of context.
The fix: Keep I-9s in their own access-controlled set of records, on paper or electronically, not mixed into the general HR file — for every location, not just headquarters.
06No purge process once the retention window closes
Why it matters: The rule cuts both ways. Keeping I-9s indefinitely past the required window is its own needless exposure of sensitive documents — Social Security numbers, identity and immigration documents — with no compliance reason left to hold them.
The fix: Set a review cadence tied to termination dates, not a keep-everything-forever default, and confirm the review actually happens at every location.
Where CertiFlow fits — and where it doesn't
CertiFlow is a document store and expiry-alert engine, not an immigration-law or E-Verify service. It can hold the I-9 and its supporting documents as a tracked record per employee and location without forcing an expiration date onto a form that doesn't have one. For employees whose underlying work-authorization document does carry an expiration date, that date can be tracked and alerted on like any other credential, so Supplement B reverification doesn't get missed. And because CertiFlow's own retention floor for employee compliance records is at least four years past termination — longer than the federal I-9 minimum — a record kept in CertiFlow isn't at risk of being purged before your legal window closes. It does not run E-Verify, verify document authenticity, or replace legal advice on a specific case.
For multi-location operators
Keep onboarding records straight without chasing them
CertiFlow tracks every employee credential and required document across all your locations — including onboarding paperwork and any work-authorization documents with an expiration date — with escalating email alerts as each date approaches, so nothing lapses unnoticed.
- Every record, every location, one view
- Escalating alerts from 30 days out
- Each manager sees only their location
Frequently asked questions
How long do I have to complete a new hire's I-9?
Section 1 should be completed by the employee no later than their first day of work (it can be done any time after they accept the offer). Section 2 must be completed by the employer, based on the employee's original documents, within three business days of that first day.
How long do we have to keep an I-9 after someone leaves?
Whichever is later of three years after their hire date or one year after their termination date — not a flat three years. A long-tenured employee's I-9 can still need to be kept for a full year after they leave.
Can we verify a remote hire's documents over video instead of in person?
Only if you're enrolled in E-Verify and in good standing, using the alternative procedure available since August 2023. Outside of that, physical document examination — in person or through an authorized representative — is still the default.
Should I-9s be stored with the rest of an employee's personnel file?
No — the standard guidance is to keep them separate, in their own access-controlled set of records, since a personnel file is more likely to be pulled in full for an unrelated reason.
Does CertiFlow verify I-9 documents or run E-Verify?
No. CertiFlow stores the I-9 and its supporting documents as a tracked record and can alert you before a work-authorization document's expiration date, but it doesn't examine documents, run E-Verify, or make legal determinations — pair it with your own verification process and counsel.