The Hidden Compliance Bomb In OMB's May 29 Rewrite: §200.303's Universal E-Verify Mandate Reaches Every Federal Grantee And Subrecipient

The provision that may end up touching more federal grantees than any other change in OMB's May 29 rewrite of 2 CFR Part 200 sits in a single paragraph in proposed §200.303, the standards for financial management. Under the heading "Internal controls," OMB proposes to require that "recipients and subrecipients of Federal financial assistance must enroll in and use the Department of Homeland Security's E-Verify program to confirm the employment eligibility of all individuals working on or supporting a Federal award." The recipient must report every E-Verify Final Nonconfirmation — the determination that an employee is not authorized to work in the United States — to the federal awarding agency within a window the rule does not specify.

For federal contractors, this is familiar territory. Executive Order 12989, as amended by Executive Order 13465 in 2008, has required E-Verify use on federal contracts over $150,000 for the better part of two decades. For federal grantees, it is not. The Uniform Guidance has never required E-Verify enrollment as a condition of receiving federal financial assistance. Some states require it for state contractors, and a handful of agencies have imposed it as a programmatic condition in specific grant streams. But a government-wide E-Verify mandate covering every nonprofit, every state and local government recipient, every university, and every subrecipient down the chain is a structural change of a different order.

This piece complements our comprehensive analysis of the OMB rewrite. The headline provisions — political pre-issuance review under §200.205, termination-for-convenience under §200.340, the publication-cost ban under §200.461 — have absorbed the public attention. The E-Verify provision in §200.303 has not, in part because it sits in the financial-management subpart that grants offices read but that program staff and executive directors often do not.

What §200.303 actually requires

The proposed text obligates the recipient — and, through the pass-through entity language in §200.332, every subrecipient — to do four things. First, enroll the organization in E-Verify before the first drawdown on a federal award. Second, run every "individual working on or supporting" a federally funded activity through E-Verify within three business days of hire. Third, retain E-Verify case records for the longer of three years or the federal award retention period. Fourth, report every Final Nonconfirmation to the federal awarding agency.

The phrase "working on or supporting" is the operational hinge. A federal contractor, under the FAR clause that implements EO 12989, runs the entire workforce assigned to the contract — and the entire new-hire population on cost-reimbursable indirect — through E-Verify. The proposed grant clause borrows that scope without acknowledging it. A nonprofit with a $200,000 federal subaward and 40 employees, only six of whom touch the federally funded program, would on plain reading owe E-Verify confirmation on all six and would owe new-hire E-Verify checks on any indirect-cost-paid administrative staff that "support" the award.

In practice, the rule will likely be read to require E-Verify enrollment of the entire organization, with employer compliance on every new hire post-enrollment. That is how the FAR clause functions for contractors. It is also how E-Verify works as a system: the employer either uses it or does not. Once enrolled, an employer must run every new hire, not a federally-funded subset, because partial use is the leading audit finding DHS uses to terminate enrollment.

The Final Nonconfirmation reporting requirement is the second-order operational lift. Under current E-Verify use, an employer who receives a Final Nonconfirmation terminates the worker and documents the determination internally. The proposed §200.303 layers a new obligation: the recipient must report the Final Nonconfirmation to the federal awarding agency. The rule does not specify what the agency will do with the report, but the natural read is that the report becomes one of the risk factors §200.206 directs agencies to weigh in pre-issuance review. An organization with a string of Final Nonconfirmations on file with HHS will, going forward, find that history influencing HHS's view of its next discretionary award.

Who is structurally unprepared

The provision lands hardest on three categories of grantee.

Small community-based nonprofits. The 200,000-odd nonprofits that touch federal money each year skew small. The median federally-funded 501(c)(3) has under twenty employees. Most have never been a federal contractor, have no FAR-clause experience, and have no HR system that integrates with E-Verify. The DHS E-Verify enrollment process itself is free, but the operational layer — designating a verification officer, training that officer, building the new-hire workflow, training hiring managers on the tentative-nonconfirmation process, integrating with payroll — costs real money. The Society for Human Resource Management estimates a small-employer first-year compliance cost of $1,500 to $4,000, with ongoing annual costs in the $500-$1,500 range. For a nonprofit operating a $200,000 federal subaward, that is a one-percent overhead hit on a budget that has no overhead to spare.

Pass-through entities with extensive subrecipient networks. A state agency administering federal Workforce Innovation and Opportunity Act money may have 80 subrecipient community-based organizations. A community action agency administering federal Community Services Block Grant money may have a dozen subrecipients in its catchment area. A research university administering NIH money may have 30 subaward institutions on a U54 center grant. Under proposed §200.332 read together with §200.303, the pass-through entity owes monitoring of each subrecipient's E-Verify enrollment status and use compliance. That is a new monitoring obligation layered on top of the existing single-audit and subrecipient risk-assessment regime — and it requires the pass-through to develop expertise in an immigration-compliance system most state and local grants offices have never touched.

Human-services nonprofits whose workforce includes workers with complex documentation. Refugee resettlement agencies, immigrant legal-services organizations, community health centers serving immigrant populations, and farmworker-services nonprofits frequently employ workers whose work authorization is recently granted, on temporary status, or based on documentation that E-Verify's database lags in recognizing. E-Verify's known false-positive Tentative Nonconfirmation rate is meaningful — DHS's own 2023 report put it at roughly 0.15 percent of all queries, with concentration among naturalized citizens and workers with recently-issued employment-authorization documents. For an organization whose new-hire pool is heavily naturalized or recently-authorized, a small percentage error rate translates into recurring Tentative Nonconfirmations that consume HR staff time and, under proposed §200.303, may eventually surface to the awarding agency in ways the organization has no current process to manage.

The five-month operational runway

If OMB finalizes substantially as proposed and implements October 1, 2026, every federal grantee and subrecipient has roughly five months to be E-Verify-compliant. That window is tight but workable for organizations that start now.

Enroll early. DHS E-Verify enrollment is free and takes under an hour to complete online. The hard part is what happens next: designating a verification officer, completing the DHS-required tutorial, signing the Memorandum of Understanding, and integrating the system into the new-hire workflow. An organization that enrolls in July has time to work the bugs out before the October implementation. An organization that enrolls in September will be running its first cases on its first compliance-relevant new hire.

Designate two verifiers. DHS allows multiple verification officers per employer account. Designate two — a primary and a backup — so that hires do not stall when the primary is on vacation or out sick. The three-business-day E-Verify window is rigid, and a missed window is the kind of pattern audit finding that gets organizations into DHS's adverse-action queue.

Document the I-9 process first. E-Verify sits on top of Form I-9. An organization whose I-9 process is sloppy — late completion, missing signatures, expired identity documents — will surface those problems in E-Verify cases. Audit the last 12 months of I-9 files now. Fix what is fixable. Train hiring managers on the I-9 requirements before adding the E-Verify layer.

Map the subrecipient population. Pass-through entities should pull a current list of every subrecipient with an open or anticipated federal subaward and add an "E-Verify enrollment status" field to subrecipient monitoring. The pass-through does not need to require E-Verify enrollment of the subrecipient before October — the rule is not yet final — but the pass-through does need to know which subrecipients will struggle and which will not.

Comment on the rule. The comment deadline is July 13, 2026, on docket OMB-2026-0001 at regulations.gov. The most useful comments on §200.303 will not argue against E-Verify use as policy — that argument has been made and lost in the contracting context. The useful comments will identify the operational ambiguities in the proposed text: the scope of "working on or supporting," the timing window for Final Nonconfirmation reporting, the relationship to existing state E-Verify laws, the small-employer exemption that the FAR contractor clause includes but that the proposed grant clause does not, and the subrecipient pass-through mechanics that §200.332 leaves underspecified. OMB has signaled willingness to clarify operational provisions in the final rule; the comment record is the leverage point.

The strategic frame

The E-Verify provision in §200.303 is not the most legally aggressive piece of the May 29 rewrite. It is not the most ideologically charged. It will not generate the litigation that the political pre-issuance review under §200.205 or the viewpoint-neutrality clause we analyzed separately will generate. But it may be the provision that touches the most grantees in the most operationally disruptive way — because it imposes a federal-contractor compliance system on a population of organizations that has never been organized to absorb federal-contractor compliance.

For the executive director of a $1.5 million community-based nonprofit that has held the same HHS Head Start grant for fifteen years, this is the moment to find out whether the organization is, in fact, prepared to take on a new federal compliance system in five months. For the grants office at a state human-services agency, this is the moment to start the subrecipient inventory. The rule is not final and may yet narrow in scope. The organizations that wait to see the final text will not have the runway to absorb whatever the final text says.