Project Firewall: The H-1B Enforcement Campaign to Track

Most H-1B compliance advice focuses on getting a filing right the first time. A newer risk sits on the other side of that: what happens after approval, once a federal agency decides to go looking for problems on purpose.

The Department of Labor announced the launch of Project Firewall in September 2025. The name alone signals the intent. This is not a routine audit program; it is a named, public enforcement campaign with its own identity and its own momentum. A named campaign is different from a background compliance function. It comes with its own leadership attention, its own referral pipeline, and its own incentive for investigators to close visible cases rather than let them sit in a queue.

What the campaign has actually found

By November, the numbers were no longer theoretical. Officials reported at least 175 ongoing H-1B investigations and had assessed $15 million in back wages owed to workers.

The violations behind those numbers follow familiar patterns: pay that fell short of what a job description promised, worksite information that did not match reality, and terminations nobody bothered to log on time. One recurring practice, sometimes called benching, involves an employer with no work to assign an H-1B worker for a stretch of time while still withholding pay rather than paying as required. The effort is not confined to one office. Wage and Hour takes the lead, working alongside the Department's Employment and Training Administration, with the Justice Department's Civil Rights Division, the Equal Employment Opportunity Commission, and USCIS coordinating from outside the agency.

Why the program can reach so much further than before

The most consequential change is not the enforcement itself, it is who gets to start it. Investigators used to be constrained in a specific way: WHD would only investigate cases that derived from a complaint by a worker.

That constraint mattered because a worker whose visa status depends on their employer has an obvious reason to stay quiet even when something is wrong. Project Firewall changes the trigger. The Department can now open a case on its own initiative rather than waiting for a worker willing to risk their job, and sometimes their status, to come forward first. Complaint-driven enforcement has an obvious blind spot: it only catches employers unlucky enough, or careless enough, to be flagged by someone with everything to lose. Self-initiated cases close that gap by design.

H-1B is not a niche program most companies can treat as someone else's problem. There are close to 600,000 total H-1B workers in the United States, making it the country's largest employment-based visa category by a wide margin.

A campaign built to reach a program that size does not need to visit every sponsor to change behavior. It only needs enough visible cases to make every compliance officer wonder whether their own files would hold up under the same scrutiny.

What is actually on the table if something is found

The penalties are not abstract either. Available remedies include the collection of back wages owed to affected workers, the assessment of civil money penalties, and debarment from future use of the H-1B program.

Debarment is the outcome that should worry a sponsor most, because it does not just close one case, it can close the door on hiring through the program entirely for a period of time. A company that treats a single violation as a routine cost of doing business is underestimating what a repeat pattern can trigger. None of these penalties require a company to have acted with malice. Sloppy recordkeeping and genuine wrongdoing can trigger the same remedies once an investigation actually starts, which is exactly why the paperwork side of compliance deserves as much attention as the legal side.

What a sponsor should actually do with this

None of this calls for a crisis response. It calls for the same discipline the program is designed to test: pay that matches what was promised, worksite records that match reality, and terminations logged on schedule rather than discovered later by someone else.

A short internal audit against those three points, done before anyone comes asking, costs a fraction of what an actual investigation costs once it starts. Firewalls, after all, are built before the fire, not during it. A sponsor that has never been investigated is not necessarily a sponsor with clean files. It may simply be a sponsor nobody has looked at yet, and that is a different thing to rely on.