Legislation and penalties for employing workers without legal right to work
Three pieces of legislation govern this area: the Migration Act 1958 as the foundation, the Migration Amendment (Strengthening Employer Compliance) Act 2024 which introduced new employer sanctions, prohibition powers, and increased penalties from 1 July 2024, and the Migration Amendment (Combatting Migrant Exploitation) Act 2026. This latest Act represents a significant shift in the 2026 market by introducing public transparency measures that allow the Department of Home Affairs to publicly name non-compliant sponsors. This effectively moves compliance from a private regulatory matter to a public reputational risk, compelling organisations to treat work rights verification as a core pillar of their ESG and corporate governance frameworks.
This article explains what employers must do, what happens when they don’t, and the penalties that apply in 2026.
Legal Obligations Under the Migration Act 1958
The Migration Act 1958 places strict requirements on employers to verify that all workers hold valid work rights before they start. This applies to Australian citizens, permanent residents, and temporary visa holders. Section 245AB sets out the offence for allowing an unlawful non-citizen to work, and Section 245AC covers allowing a lawful non-citizen to work in breach of a work-related visa condition.
Since 1 July 2024, the Migration Amendment (Strengthening Employer Compliance) Act 2024 has expanded these obligations. Employers now face criminal liability if they coerce or unduly pressure a non-citizen worker into breaching visa conditions or accepting an exploitative work arrangement. The Department of Home Affairs also now holds the power to declare an employer “prohibited,” which bars them from hiring any new temporary migrants for a defined period.
Checking Work Rights for All Employees
Verifying Citizenship for Australian Citizens
Employers must confirm an employee’s right to work via Australian Citizenship by sighting an original Australian passport, an Australian birth certificate, or a citizenship certificate together with photo identification. It is critical to note that documents such as Medicare cards, Tax File Numbers, library cards, or driver’s licences cannot be used alone as evidence of Australian Citizenship. While citizens have unrestricted work rights, the failure to correctly verify status using the prescribed documents can lead to accidental non-compliance.
VEVO Checks for Visa Holders
For non-citizens, employers must check visa validity and conditions using the VEVO system, the government-mandated Visa Entitlement Verification Online tool, which connects directly to Department of Home Affairs records and provides current visa status and work conditions in real time. VEVO checks can be run manually, or through software that runs automated VEVO checks via direct API connection to the Department of Home Affairs, on hire and at a regular cadence throughout employment.
Consent and Record Keeping
Employers must obtain consent before running a VEVO check on a worker’s behalf. They must also retain copies of all documents used to confirm work rights. These records matter during audit and the absence of documentation is treated as failure to verify, regardless of whether the worker actually held valid work rights at the time.
Employers should also be aware of the reverse burden of proof under the Migration Act; once a regulator establishes a prima facie case, the burden shifts to the employer to demonstrate that they took reasonable steps to verify work rights. This highlights the importance of comprehensive documentation as a critical defence.
Penalties for Non-Compliance in 2026
Penalties are calculated using the Commonwealth penalty unit, currently set at $330 per unit following the most recent indexation under the Crimes Act 1914. Penalty amounts below reflect this rate.
Most employers encounter an Illegal Worker Warning Notice on a first breach, followed by audit activity from Australian Border Force or Fair Work Inspectors. Employers who fail subsequent audits, or who are found to have deliberately or repeatedly breached their obligations, face escalating consequences.
The following penalties reflect an escalating framework of enforcement, ranging from infringement notices to civil and criminal penalties for serious or repeated breaches.
Infringement Notices
Up to $15,840 for individuals and $79,200 for body corporates per illegal worker.
Civil Penalties
Up to $79,200 for individuals and $396,000 for body corporates per illegal worker.
Criminal Penalties
Up to $118,800 and/or two years imprisonment for individuals. Up to $594,000 for body corporates per illegal worker.
Prohibition Declarations (from 1 July 2024)
Where the Department of Home Affairs finds that an employer has seriously, deliberately, or repeatedly breached migration or Fair Work laws, the Minister can issue a prohibition declaration. A prohibited employer cannot allow any new temporary migrant workers to begin work for the duration of the prohibition. Breaching a prohibition is itself a criminal offence, carrying up to two years imprisonment or 360 penalty units.
Sponsorship Sanctions
Businesses that hold business sponsorship approval status (primarily used for the subclass 482 visa) risk having that status suspended or cancelled. A sponsorship suspension bars an organisation from future nominations for the duration of any sanction. While organisations often associate these risks primarily with compliance with standard sponsorship obligations, it is important to clarify that any breach of the Migration Act can affect an organisations’ ongoing ability to access the sponsorship program.
Public Naming (new from 2026)
Under the Migration Amendment (Combatting Migrant Exploitation) Act 2026, the Department of Home Affairs Secretary may publish prescribed information about approved work sponsors on the department’s website. This can include the sponsor’s name, ABN, postcode, number of nominations, and occupation types. Organisations should treat this transparency measure as an additional reputational risk alongside the financial penalties.
Other Consequences of Non-Compliance
Financial penalties are the most visible risk, but employers who are found non-compliant face several downstream consequences.
Reputational damage: Media coverage of non-compliance investigations severely damages an employers brand. In sectors like hospitality and retail, where competition for talent is high, this damage directly impacts hiring capacity and operational stability.
Lost contracts and business relationships: Enterprise customers and procurement teams increasingly require suppliers to demonstrate employment compliance. A finding of non-compliance can trigger contract review or termination clauses.
Operational disruption: Investigations, audits, and legal proceedings pull HR, legal, and executive teams away from normal operations. The administrative burden of responding to a Border Force audit is significant even where no penalty ultimately results.
Ongoing scrutiny: Employers who receive a warning notice or infringement become subject to follow-up audit activity. The first notice is rarely the last interaction.
What Employers Should Do
Verify before hiring: Run VEVO checks for all visa holders and sight original citizenship or residency documents for all other workers before their start date. Document what was checked and when.
Collect and record consent: Written consent is a legal requirement before running a VEVO check. Keep these records.
Recheck throughout employment: Visas expire and conditions change. Employers have an ongoing obligation to confirm that workers continue to hold valid work rights. Automated VEVO checking at regular intervals through the employment lifecycle is the most reliable way to manage this.
Apply privacy principles: Secure collected documents. Delete or de-identify records you no longer need. Unauthorised access to or misuse of work rights data creates additional liability.
Stay current with legislative changes: The migration compliance framework has changed materially in the past two years. The 2024 employer compliance amendments and the 2026 transparency measures both affect how obligations are defined and enforced. Treat compliance as an ongoing process, not a one-time check.
Get professional advice: A Registered Migration Agent can assess whether your current process meets legal requirements. CheckWorkRights offers free Right to Work Process and Visa Compliance Health Checks with a Registered Migration Agent for HR teams that want an independent review. Book here.
A Note on Automated Compliance
Managing right to work obligations manually through document collection spreadsheets, calendar reminders for visa expiries, and ad-hoc VEVO checks creates gaps. Workers change roles. Visas are granted with conditions that vary by occupation. The volume of checks required in a large workforce makes manual processes unreliable at scale.
Software that connects directly to the Department of Home Affairs VEVO API automates this process: running checks on hire, rechecking at defined intervals, and alerting HR teams when a worker’s visa status changes. This approach removes the risk of a visa expiry going unnoticed and creates an audit trail that demonstrates compliance if an investigation occurs.
Given the severity of these legislative changes and the increasing complexity of monitoring diverse visa conditions, manual tracking is no longer a viable risk management strategy. To ensure your organisation remains protected and meets the “reasonable steps” threshold for compliance, book a demo of CheckWorkRights.
