What does a visa compliance breach actually cost in Australia?

For most HR teams, checking work rights before someone’s first day is second nature, because it’s baked into onboarding and it always gets done. But what about six months later, when a visa is about to expire or the conditions change? That’s where things get a bit murky. Re-checks tend to fall somewhere between HR, payroll and line managers, and in most organisations nobody really owns them.

A right to work check only tells you the truth on the day you ran it. By next month, a visa could have expired, been cancelled or had its conditions changed, and if nobody checks again, you won’t find out until someone else does.

So if an auditor knocked tomorrow, could you prove that every visa holder on your payroll still has the right to work?

For a lot of Australian employers, the honest answer is “I’m not sure”, and that’s not unusual. But under the Migration Act, not knowing doesn’t protect you from civil penalties, and one expired visa can now cost a company $87,360 per worker (and that’s the cheapest fine on the list).

This guide is for the people who’d be answering the questions if that happened: HR and people leaders, global mobility and compliance managers, and anyone whose name sits next to “workforce compliance” on the risk register. We’ll break down what a breach actually costs, what the law expects of you after day one, and how to weigh the cost of ongoing checks against the cost of getting it wrong.

In this guide:

• Can the Australian government detect visa compliance breaches?
• How much does it cost an Australian business if an employee’s visa expires without them knowing?
• Will my business be publicly named for a visa breach?
• What penalties can Australian employers face beyond fines?
• Is it worth paying for ongoing visa compliance software or is manual checking enough?
• What triggers a Migration Act investigation for an Australian employer?
• How often should Australian employers re-check an employee’s visa status?
• What’s the ROI of workforce compliance software vs the cost of a breach?
• Protecting your business from non-compliance penalties

Can the Australian government detect visa compliance breaches?

Yes, and it’s getting easier. Enforcement no longer relies only on tip-offs and audits. Home Affairs and the ATO now share data, so a mismatch between a sponsored worker’s visa and their pay can be flagged without anyone making a complaint.

Here’s how it works:

• Visa and payroll data matching. Home Affairs compares sponsored (subclass 482) visa holders’ records with ATO income and Single Touch Payroll data. It looks for workers in a different occupation from the one nominated, working for an employer who isn’t their sponsor, or being paid less than approved.
• A flag leads to a review, not an automatic fine. A mismatch can trigger a compliance review, and you’ll be asked to respond. That’s when your records matter most.
• Sponsor monitoring. The Australian Border Force (ABF) can request documents and visit workplaces to check that sponsors are meeting their obligations.

Data matching currently focuses on sponsored workers. For other visa holders, such as students, working holiday makers and bridging visa holders, breaches usually come to light through worker complaints, tip-offs, or joint operations between the ABF and the Fair Work Ombudsman.

So, even companies who’ve done the right thing with a right to work check at onboarding may still find themselves audited or caught in breach without ongoing compliance checks that stay on top of expiring or changing visas and licences.

How much does it cost an Australian business if an employee’s visa expires without them knowing?

Most visa breaches don’t start with anyone cutting corners. Someone joins on a temporary visa, you check their work rights on day one, save the VEVO result and get on with things. Then a year or two later the visa expires, nobody catches it, and they keep coming to work as normal, until someone asks to see your records.

If that happens, an infringement notice (a fine issued without going to court) will cost a company $87,360 per worker, or $17,472 for an individual. If it goes to court as a civil penalty, that can climb to $436,800 per worker, and whether or not you knew the visa had expired doesn’t change the outcome.

What does help is being able to show you took “reasonable steps at reasonable times” to check that person’s right to work. In practice, that means regular VEVO checks and a dated record of each one, which is why a single check at onboarding won’t cover you for long.

The cost doesn’t stop at the business, either. Directors and other senior officers can be held personally liable, and so can anyone involved in a breach. Below are the penalties under the Migration Act 1958 for allowing someone without a valid visa to work, or letting a visa holder work outside their conditions.

‍

Figures are per worker and current as at October 2026, based on the Commonwealth penalty unit of $364 (from 1 July 2026). Source: Migration Act 1958, Part 2, Division 12; Home Affairs, work-related contraventions.

Will my business be publicly named for a visa breach?

It can be. Sanctioned sponsors and “prohibited employers” are already listed on the Australian Border Force website, with business names and details there for clients, candidates and journalists to find. For a brand built on trust, that can cost more than the fine.

Visibility is growing even when nothing goes wrong. Under the Migration Amendment (Combatting Migrant Exploitation) Act 2026, Home Affairs can publish details of approved work sponsors, which may include the business name, ABN, postcode, number of nominations and the occupations it sponsors for. Your sponsorship activity is becoming public record, and more people will be paying attention to it.

What penalties can Australian employers face beyond fines?

Fines get most of the attention, but they’re only part of what’s on the table. Under the Migration Act 1958, it’s against the law to let someone without a valid visa work for you, or to let a visa holder work outside their conditions. That applies whether you employ them directly or through a labour hire provider; as Home Affairs puts it, using labour hire “does not free you from your obligations”.

If you’re found in breach, Home Affairs says you could also:

• be directed to take specific action, or to stop doing something
• be declared a “prohibited employer”, which bans you from hiring new visa holders, for up to five years, or up to 10 years after a criminal conviction, and puts your business name on the ABF website
• face criminal prosecution, with up to two years’ jail for individuals who knowingly or recklessly allowed the breach

The most serious cases, where a worker is being exploited, carry up to five years’ jail and fines of up to $327,600 for individuals and $1,638,000 for companies.

For a lot of businesses, the ban would hurt more than the fine. If you rely on visa holders to staff sites in hospitality, aged care or agriculture, or to fill specialist roles, losing the ability to hire them can throw your workforce plans out quickly.

Is ongoing visa compliance software worth it, or is manual checking enough?

Start with a few simple questions. Who’s checking your visa holders’ work rights after their first day, and how often? Where does that get recorded? In a lot of businesses the answer is spread across an HRIS, a spreadsheet someone set up years ago, and a site manager who has a hundred other things to do. It holds together until the person who keeps track goes on leave or moves on, a visa expires in between checks, or someone asks you to prove it all happened.

That’s where manual checking falls down. It isn’t that nobody cares; it’s that the process relies on people remembering to do it, with nothing stopping an expiry from slipping through. With one missed expiry costing a company $87,360 per worker, the real question is whether your current system would stand up as evidence that you took “reasonable steps at reasonable times”.

There’s also a cost that never shows up on an invoice. Every month, someone in HR spends hours running checks, chasing documents and updating spreadsheets, and that’s time taken away from work that actually moves the business forward.

If you’re weighing up your options, look for:

• Scheduled re-checks, not just a check at onboarding
• Alerts before a visa expires, sent to someone who can act on them
• A dated record of every check that you can export when asked
• One view across your whole workforce, including multiple sites and labour hire
• Coverage beyond visas, because licences, registrations and other checks expire too

What triggers a Migration Act investigation for an Australian employer?

‍

Any business with workers in Australia can be investigated under the Migration Act at any time, whether you know you employ visa holders or not. If you sponsor workers, the ABF can also monitor you directly to check you’re meeting your sponsorship obligations. The most common triggers for an investigation are:

• Tip-offs and complaints from workers, former employees or the public, often through Border Watch
• Data matching, when a sponsored worker’s visa details don’t line up with their pay or tax records (see above)
• Industry operations, when the ABF targets sectors with a history of breaches, such as hospitality, often working alongside the Fair Work Ombudsman
• Sponsor monitoring, the ABF’s routine checks that sponsors are meeting their obligations

If an investigation starts, you’ll usually be asked for records. For sponsors, that means contracts and pay records that match what you nominated. For every employer, it means proof that you checked each worker’s right to work, and when.

The time to get those records in order is before anyone asks. Every so often, check that your contracts, pay records and work rights checks line up, and keep a dated record of every check, because that record is your best evidence that you took reasonable steps.

How often should Australian employers re-check an employee’s visa status?

We recommend re-checking at least every three months, and always before a known expiry date. The law doesn’t set a fixed interval, but it expects you to take “reasonable steps at reasonable times”. Because visas and their conditions can change between checks, staying across those changes is up to the employer.

Some visas need closer attention than others:

• Bridging visas often don’t have a set expiry date and can end soon after a decision on the person’s visa application, so a reminder based on an expiry date won’t catch them
• Student visas are capped at 48 hours a fortnight during study periods, so check both their status and how many hours they’re working
• Anyone with a visa application in progress may be granted a new visa with different conditions from the one you checked

Outside your regular schedule, re-check whenever:

• an employee tells you their visa situation has changed
• someone changes roles, hours or work location
• you extend a contract or move someone from casual to permanent
• a visa is due to expire in the next few weeks

Doing this by hand for a large workforce adds up quickly. That’s why a dated record of every check matters as much as the check itself.

What’s the ROI of workforce compliance software vs the cost of a breach?

One breach can wipe out years of software costs. A single infringement notice costs a company $87,360 per worker, so if three workers are affected you’re looking at $262,080. If it goes to court as a civil penalty, the same three workers could cost up to $1,310,400. Neither figure includes legal fees, the hours your team spends pulling records together for an investigation, or what happens to your workforce plans if you’re banned from hiring visa holders.

On the other side of the ledger is what manual checking already costs you. Say you have 200 visa holders and check each one every three months, at around 10 minutes a check once you’ve logged in, searched, saved the result and updated the spreadsheet. That’s more than 130 hours of HR time a year, and that’s when everything goes smoothly, without chasing anyone or fixing gaps.

The return doesn’t stop at visas either. Most workforces have other checks that expire, such as licences, registrations and qualifications. Bringing them into the same system means one process, one audit trail and fewer gaps for anything to fall through.

Protecting your business from non-compliance penalties

If questions are ever asked, it’s up to you to show you took reasonable steps at reasonable times. In practice, that means re-checking on a schedule that suits each visa type, acting quickly when something changes, and keeping a dated record of every check.

That’s what Checkmate’s Ongoing Compliance is built for. Once someone is hired, they’re automatically added to monitoring, and their visa status is re-checked on a regular schedule using the details you already collected at screening. You can set different schedules for different visa types, so a bridging visa gets checked more often than a permanent one, and nobody has to keep a watchlist by hand.

‍