Staying Aligned with H-1B Public Access File Rules in 2026

The H‑1B Public Access File is a one‑working‑day deliverable on a multi‑year retention clock. And PAFs aren’t limited to H‑1B, DOL requires employers filing H‑1B, H‑1B1, or E‑3 LCAs to create and maintain a PAF for each LCA. In 2026, the Wage and Hour Division is opening it earlier in the audit cycle than at any point in the prior decade. Specifically, under 20 CFR 655.760(a), the certified Labor Condition Application and its supporting documentation must be available for public examination “within one working day after” the LCA filing date. Furthermore, the file must sit at the principal place of business or the place of employment. Additionally, the September 19, 2025 launch of Project Firewall raised the cost of arriving at that one-working-day mark with an incomplete PAF (DOL News Release, Project Firewall). In practice, that cost is materially higher than twelve months ago.

In practice, this guide covers three things. First, what the H-1B Public Access File must contain in 2026. Second, where Project Firewall has shifted the enforcement posture. Third, the operational checklist corporate immigration teams use to stay aligned with 20 CFR 655.760 across distributed and hybrid worksites.

Key Takeaways

What the Regulation Requires

The plain text of 20 CFR 655.760

For context, the H-1B Public Access File is the public-inspection portion of the recordkeeping regime that 20 CFR Part 655 Subpart H imposes on every LCA-filing employer. The regulation reads precisely. Specifically, the certified LCA “and necessary supporting documentation” must be available “for public examination” within one working day of LCA filing (eCFR via LII, 20 CFR 655.760). Furthermore, the file must sit at the principal place of business or the place of employment.

The three regulatory anchors that govern the file

In particular, three regulatory anchors govern the file across its life cycle. First, 20 CFR 655.760 specifies what the PAF must contain and where it must sit. Second, 20 CFR 655.734 controls the LCA notice posting that becomes part of the PAF. Specifically, physical notice in two conspicuous locations (or an approved electronic alternative) must run for ten days (eCFR via LII, 20 CFR 655.734). In particular, the notice must post “on or within 30 days before the date the labor condition application is filed.” Third, 20 CFR 655.810 sets the civil money penalty bands. As a result, those bands apply when the file is missing, incomplete, or contradicted by underlying records (eCFR via LII, 20 CFR 655.810).

Why Project Firewall changed the audit cadence

In 2026, the operational pressure on this regulatory architecture comes from Project Firewall. Notably, the same enforcement posture appears across worksite-compliance updates. For example, the March 2026 ICE Form I-9 reclassification expanded the substantive-violation list for Form I-9 audits.

The DOL announced Project Firewall on September 19, 2025. The Secretary of Labor now personally certifies the initiation of H-1B investigations. Furthermore, the announcement commits the DOL to interagency coordination (DOL News Release, Project Firewall). The partner agencies are the Department of Justice’s Civil Rights Division, the EEOC, and USCIS.

In practice, the PAF is typically the first document set the WHD investigator requests in an opening conference. An incomplete, mis-located, or out-of-date file hands the investigator a documented foundation. That foundation supports a substantial-violation finding before the underlying wage and notice questions arise.

What Goes in the H-1B Public Access File

The six core documents (and four more for dependent employers)

Under 20 CFR 655.760(a), every PAF must contain six categories of documents. Additionally, H-1B-dependent and willful-violator employers carry four further categories (eCFR via LII, 20 CFR 655.760).

The two documents that most often fail inspection

In practice, the wage-rate documentation and the actual-wage explanation are the two items that most often fail closer inspection. Specifically, the actual-wage explanation must show the system the employer uses to set wages for other workers in the occupation. Furthermore, it must also cover periodic increases. As a result, an investigator should be able to reproduce the calculation from the file alone.

By contrast, the prevailing-wage documentation only requires “a general description of the source and methodology” for public examination (eCFR via LII, 20 CFR 655.760). However, in practice the source citation must point to a real, dated wage source. For example, acceptable sources include OFLC OES, an independent authoritative wage survey, or a CBA. Additionally, the methodology must reflect the level and area of intended employment that the LCA actually claims.

Where the PAF Lives and How Long It Stays There

Where the file must sit (and what counts as a place of employment)

Generally, the PAF must be available within one working day of LCA filing (eCFR via LII, 20 CFR 655.760). In particular, the file must sit “at the employer’s principal place of business in the U.S. or at the place of employment.” For employers running hybrid or distributed teams, this is where the compliance effort lives. Notably, the “place of employment” is the geographic area on the LCA. For example, when an H-1B worker is regularly assigned to a home office, that home address area becomes a place of employment. As a result, the LCA — and therefore the PAF — must cover it.

Short-term placement and the 30/60-workday envelope

By contrast, the regulation permits short-term placement at a worksite outside the LCA’s intended area. However, the placement must stay inside the 20 CFR 655.735 envelope. Specifically, the rule allows up to 30 workdays per year, and extends to 60 workdays in qualifying cases (eCFR via LII, 20 CFR 655.735). In particular, the extension applies when the employer can document three conditions. Specifically, the H-1B nonimmigrant must maintain a permanent worksite, spend substantial time there, and reside in that area. As a result, past those thresholds, a new LCA — and a new PAF — is required for the new area.

Two retention clocks that get conflated

Notably, retention is two-track and a frequent source of confusion. Specifically, the employer must keep the PAF for one year beyond the last date any H-1B nonimmigrant works under the LCA. If no nonimmigrants were ever employed under it, retention runs one year from the date the LCA expired or was withdrawn (eCFR via LII, 20 CFR 655.760). Additionally, payroll records under 20 CFR 655.731 carry a separate three-year retention from the date of creation. As a result, treating the two as the same clock is a common documented error in WHD investigations. Conversely, destroying payroll backup at the one-year PAF mark is the same error in reverse.

Practical Application: Building an Audit-Ready PAF Workflow

Four operational beats: assemble, post, file, retain

In practice, a program-grade PAF workflow has four operational beats: assemble, post, file, retain. Importantly, each beat carries its own deadline.

• Assemble (Day 0 to one working day after LCA filing). First, pre-stage every required document at LCA submission. That way the file is ready when the certification arrives. Specifically, the certified LCA, the cover pages, the actual-wage memo, the prevailing-wage source citation, and the benefits summary should already exist in template form. Then, add the signed, certified LCA the day OFLC certifies. Importantly, the one-working-day clock starts on the LCA filing day, not the certification day, under 20 CFR 655.760(a).
• Post (within 30 days before LCA filing; remains 10 days). Second, hard-copy posting in two conspicuous locations, or the approved electronic alternative, must run for ten days under 20 CFR 655.734 (eCFR via LII, 20 CFR 655.734). The posted notice belongs in the PAF. Additionally, so does a record of where and when it was posted. For remote-only worksites, electronic notice — a dedicated intranet page or direct email to affected employees — is the operative compliance path.

Filing the PAF and starting the retention clock

• File (one PAF per LCA). Third, every certified LCA carries its own PAF. In practice, practitioners typically organize by LCA case number with a per-employee subindex, since an LCA can cover multiple H-1B nonimmigrants. Additionally, the file must be producible to any member of the public who requests it — by phone, email, or in-person walk-in — without redaction beyond what the regulation permits.
• Retain (one year past last day of employment under that LCA). Finally, when the last H-1B nonimmigrant covered by an LCA leaves, the PAF retention clock starts. Mark the disposal date the same day. By contrast, payroll records remain on a separate three-year clock.

Pitfalls Project Firewall Audits Surface First

Generally, five categories of error consistently appear in WHD H-1B investigations. Notably, each has moved earlier in the audit cycle since Project Firewall. As a result, the penalty bands referenced below sit at the inflation-adjusted amounts under 20 CFR 655.810. The January 10, 2025 DOL adjustment rule set those amounts (eCFR via LII, 20 CFR 655.810; Federal Register, 2025 DOL Inflation Adjustment).

The five recurring PAF audit failures

• First, a missing or stale prevailing-wage source citation. Specifically, the PAF accepts a “general description of the source and methodology” under 20 CFR 655.760(a)(4)(i). However, the source must be real and dated. For example, an OES citation that points at a year prior to the LCA’s prevailing-wage validity is a substantive defect, not a clerical one.
• Second, an actual-wage memo that does not reproduce. Specifically, the memo must explain the system used to set the wage paid to other workers in the occupation, including periodic increases. By contrast, a one-paragraph narrative without underlying compensation data fails the “full, clear explanation” standard that the regulation imposes (eCFR via LII, 20 CFR 655.760).
• Third, posting documentation that does not match the place of employment. For instance, common examples include notice posted at headquarters when the worker is at a client site, or notice posted at a closed office when the worker is remote. As a result, this procedural defect often coincides with a more serious place-of-employment issue under 20 CFR 655.734.

Dependency-status and retention-clock failures

• Fourth, the H-1B-dependency PAF gap. Notably, employers that meet the dependency thresholds under 20 CFR 655.736 carry the additional PAF documents under 20 CFR 655.760(a)(7)–(10). Additionally, Project Firewall investigations are surfacing more dependency-status questions, because the WHD now uses interagency data signals to test employer self-classification. Similarly, the same data-sharing posture has reshaped green card sponsorship risk modeling for corporate immigration programs. As a result, an employer that flips into H-1B-dependent status mid-year and never updates its PAFs is exposed.
• Fifth, the retention/disposal mismatch. Specifically, this shows up two ways. Either the PAF is kept too short (under one year past last day of employment). Or the file is destroyed alongside payroll at the three-year mark, even though some H-1Bs worked under that LCA past the one-year cutoff.

How the penalty bands stack across one inspection

Importantly, the penalty pyramid for these errors begins at the substantial-violation band — up to $2,364 per violation under 20 CFR 655.810(b)(1). However, the pyramid stacks quickly. For example, willful violations rise to $9,624 per violation. Furthermore, willful violations involving displacement of a U.S. worker reach $67,367 per violation (eCFR via LII, 20 CFR 655.810). Additionally, backwage liability and debarment from the H-1B program for up to three years sit alongside the civil money penalty.

How ImmiOne Supports H-1B PAF Compliance

In practice, ImmiOne covers the operational beats of PAF assembly and retention. With one click, automated PAF generation pulls the certified LCA PDF and assembles all supporting documentation into the regulation’s six‑category structure — while giving HR and legal teams a holistic view of which LCAs are compliant and which are not. Additionally, LCA management with ePosting handles the 20 CFR 655.734 posting timeline. It also produces the dated posting documentation that joins the PAF. As a result, the same case record carries the retention clock. Furthermore, the platform anchors the disposal date to the last day any nonimmigrant works under that LCA, not to a calendar default.

Notably, Project Firewall has changed the cadence. As noted earlier, the PAF moves earlier in the audit cycle. Furthermore, the investigator at the opening conference is more sophisticated. As a result, the practical advantage of automated assembly is recovery time and data accuracy. For example, a PAF that the WHD (Wage and Hour Division investigator) investigator requests in an opening conference is producible in minutes when the workflow is platform-driven. Conversely, reconstructing the file from email threads and shared drives costs hours that the audit timeline does not accommodate.

Frequently Asked Questions

Contents, location, and timing of the PAF

Retention rules and the 2026 enforcement context

Penalty bands under 20 CFR 655.810

References

• 20 CFR 655.760 — What records are to be made available to the public, and what records are to be retained? — Operative regulation governing H-1B Public Access File contents, location, public-examination obligations, and retention. Accessed 2026-05-07.
• 20 CFR 655.734 — What is the fourth LCA requirement, regarding notice? — LCA notice posting rule that produces the posting documentation included in the PAF; defines the 30-day-before-filing window and the 10-day posting duration. Source date: regulatory text; consulted 2026-05-07.
• 20 CFR 655.735 — Special provisions for short-term placement of H-1B nonimmigrants — Defines the 30-workday short-term placement envelope (extendable to 60 workdays) for placement outside the LCA’s area of intended employment. Verified 2026-05-07.
• 20 CFR 655.810 — What remedies may be ordered if violations are found? — Civil money penalty bands for H-1B LCA violations, including substantial, willful, and willful-with-displacement tiers. Confirmed against current text on 2026-05-07.
• Federal Register — Federal Civil Penalties Inflation Adjustment Act Annual Adjustments for 2025 (January 10, 2025) — DOL final rule that set the 2025 inflation-adjusted civil money penalty amounts in effect during 2026. Source date: 2025-01-10; consulted 2026-05-07.
• DOL News Release — U.S. Department of Labor Launches Project Firewall (September 19, 2025) — Official announcement of Project Firewall, the H-1B enforcement initiative under which the Secretary of Labor personally certifies the initiation of investigations. Source date: 2025-09-19; consulted 2026-05-07.
• DOL News Release — WHD $259M Recovery (Jan 8, 2026) — FY 2025 WHD enforcement scale.