The Dealer's Playbook for Employment I-9 Compliance: Protect Your License and Avoid FTC Scrutiny

The One Compliance Mistake That Could Cost You Your Dealer License

Back in 1986, the Immigration Reform and Control Act became law. It required employers across the country to verify that their workers were legally authorized to work in the United States. For decades, most businesses—including car dealerships—treated I-9 compliance like a checkbox. Get the form signed, file it, move on.

Then the FTC started paying attention.

Over the last five years, federal regulators have shifted focus. The FTC now treats employment verification failures as part of broader compliance issues that touch on privacy, data safeguards, and even dealer license renewal. We're not talking about a warning letter anymore. We're talking about fines, investigations, and the real possibility of losing your dealer license.

This matters. Especially in a dealership group with multiple rooftops.

Why I-9 Compliance Isn't Just HR's Problem Anymore

Let's be honest. Most dealership GMs and dealer principals aren't losing sleep over I-9 verification. That's what HR is for, right?

Wrong.

Here's what's changed. The FTC now views employment verification as part of the broader Safeguards Rule, which requires businesses to protect personal information and maintain reasonable security practices. When an employee's I-9 is mishandled, incomplete, or not properly stored, that's a data safeguard failure. Add in the fact that I-9 documents contain Social Security numbers, dates of birth, and identification data, and suddenly you've got a privacy violation on your hands.

The state licensing board notices. Your dealer license becomes vulnerable.

A typical scenario: A dealership group with four rooftops uses a shared file server for HR documents. No access controls. No encryption. HR keeps I-9 forms on that server for "easy access." One of those forms is accessed by someone who shouldn't see it. That's not just an I-9 problem,that's a Safeguards Rule violation. Regulators see it. They see the dealer license renewal coming up. Things get complicated fast. (And yes, I've seen this happen at real dealerships.)

The point is simple: I-9 compliance is now a legal risk issue that touches your entire dealership operation, not just your HR folder.

The Playbook: Five Steps to I-9 compliance Done Right

Step 1: Establish a Single, Documented I-9 Process Across All Rooftops

Start here. Write it down.

Your process should cover these exact elements:

• Who is responsible for collecting the I-9 at each location (usually HR, but designate someone by name)
• When the I-9 must be completed (within three business days of hire, per federal law)
• Which documents qualify as acceptable ID (passport, state driver's license, or a combination of documents,consult the current USCIS Form I-9 handbook)
• How the form will be stored and who has access
• How long the form will be retained (three years from hire date, or one year from termination, whichever is later)
• What happens when an employee's work authorization expires

If you're running multiple rooftops, this process must be consistent everywhere. Not "pretty close." Not "close enough." Exactly the same. A service director at your downtown location should follow the same steps as the HR person at your suburban store.

Why? Because regulators will check more than one location. If they find inconsistencies, you look careless. And careless leads to fines.

Step 2: Secure Your I-9 Storage (This Is Where Privacy Meets Compliance)

I-9 documents contain sensitive personal information. The FTC takes this seriously under its Safeguards Rule requirements. Here's what proper storage looks like:

• Physical storage: Keep I-9 forms in a locked cabinet or safe. Only HR and management should have keys or access codes. Not every employee who walks past.
• Digital storage: If you digitize I-9s (which many dealerships do), use encrypted file storage. Cloud services like Microsoft 365 or Google Workspace with proper access controls are acceptable. A basic shared network drive with no password protection is not.
• Access logging: For digital files, enable audit logs so you can see who accessed what and when. This shows regulators you're monitoring your own compliance.
• No cross-company sharing: If you're part of a dealer group, each rooftop should maintain its own I-9 records. Don't store rooftop B's employee files on rooftop A's server unless there's a documented business reason and access controls are in place.

This is exactly the kind of workflow Dealer1 Solutions was built to handle. A centralized platform gives you document storage with role-based access control, so your service director at one store can't accidentally access HR files from another location. But whether you use software or manual processes, the principle is the same: lock it down.

Step 3: Create a Verification Checklist and Use It Every Single Time

When an HR person sits down with a new hire to complete an I-9, they need a checklist. Not a memory. Not a habit. A checklist.

Here's what should be on it:

• Employee completed Section 1 (their information) in their own handwriting
• You examined the original documents (not copies) in at least two acceptable categories
• You recorded the document numbers, expiration dates, and issuing state exactly as they appear
• You completed Section 2 with the hire date, title, and daily pay rate
• You signed Section 2 with your name, title, and today's date
• Employee signed Section 3 (if they have an expiration date on their work authorization)
• You made a copy and filed the original safely

A common mistake happens here. An HR person accepts a photocopy of an ID instead of the original document. That's a violation. Or they record the document number wrong. That's a violation too. A checklist stops these mistakes from becoming a pattern that regulators will find during an audit.

Step 4: Run Annual Audits and Document Everything

Once a year (preferably every six months if you're managing multiple rooftops), pull a sample of I-9 forms from each location and review them. Check for completeness, proper signatures, and acceptable documents. Keep a record of what you reviewed and what you found.

Why? Because if the FTC or your state licensing board audits you, you can show them that you conduct internal reviews. That's a disclosure of your compliance practices. It's a safeguard in itself. Regulators look favorably on dealerships that audit themselves rather than waiting to be caught.

Track this in a spreadsheet or use a dedicated system. Note the date of the audit, which forms you reviewed, any issues found, and how you corrected them. This documentation protects you. It shows diligence.

Step 5: Train Your Team and Update Training Every Two Years

Your HR team changes. New people get hired. Even experienced staff forget details. Every two years, bring everyone together for an I-9 training session.

Cover these points:

• What documents are acceptable (use the current USCIS list,it does change)
• The three-day hiring window
• What to do if an employee's work authorization is expiring
• Where I-9 forms are stored and who can access them
• What happens if you discover an error in an existing I-9

Document the training. Keep a sign-in sheet. Saves proof that you took this seriously.

The Special Risk for Multi-Rooftop Groups

If you're running a dealer group, your legal risk multiplies. One store's careless I-9 process doesn't just affect that rooftop. It affects your entire group's license renewal and your relationship with state regulators.

Centralize oversight. Assign one person (usually your corporate HR manager) to oversee I-9 compliance across all locations. Give them authority to audit, correct, and enforce. Make sure each rooftop's general manager knows that I-9 compliance is a metric they'll be evaluated on, just like CSI or front-end gross.

And yes, tools matter here. Managing I-9 compliance manually across four or five stores is exhausting and error-prone. Tools like Dealer1 Solutions give your team a single view of compliance status and document storage, so you're not hunting through file cabinets at 10 p.m. looking for missing forms.

One More Thing: What to Do If You Discover an Error

You just realized an I-9 from three years ago is missing the employee's signature in Section 1. Don't panic. Don't hide it.

Correct it immediately. Contact the employee, have them sign the correction, and note the date of correction on the form. Keep the original and the corrected version together. This shows regulators you found the problem and fixed it, not that you covered it up.

Unreported errors are what kill dealer licenses. Reported errors you corrected? Those are manageable.

Bottom Line

I-9 compliance isn't complicated. It's not expensive. It just requires consistency, documentation, and a little discipline. The alternative,a federal investigation, a licensing board inquiry, or a fine,costs a lot more than setting up a proper process today.

Start with your process. Secure your storage. Use a checklist. Audit annually. Train your team. Do this right, and you'll sleep better knowing your dealer license isn't at risk because someone filed an I-9 wrong.