EU penalties for employing a non-EU worker without authorisation

Directive 2009/52/EC sets the minimum sanctions every EU member state must impose on an employer of an illegally staying third country national: penalties that rise with headcount, back pay presumed to cover three months, and liability up a subcontracting chain. Section 404 of the German Social Code Book III adds a fine of up to €500,000.

That German fine is enforced by the customs administration, and the directive also requires criminal liability in serious cases. The directive is a floor rather than a ceiling, which is why comparing headline fines between member states misleads. What transfers across borders is the structure, and the structure is what a contractor should be planning against.

The three obligations that create the defence

Article 4 imposes three duties before employment begins. The employer must require the third country national to hold a valid residence permit or other authorisation for their stay and to produce it. It must keep a copy available for inspection throughout the employment. And it must notify the competent national authority of the start of employment within the period each member state sets.

An employer that has done all three is not liable under Article 5 even if the document later proves to be a forgery, unless the forgery was manifest or the employer knew. That is the whole of the defence, and it is documentary. A verbal confirmation, a scan taken three weeks after the start date, or a notification filed late does not establish it.

The duty is continuing rather than a one off. Where permission is time limited, the copy on file has an expiry date, and the employer is exposed from the day after it passes. This mirrors the verification regime described in right to work verification in the EU, and it fails in the same way: not at hire, but eleven months later on a file nobody was tracking.

What the employer pays when the defence fails

Article 6 is the provision employers least expect. The three month presumption runs against the employer, so a worker found on site on the first day is presumed to have worked three months and to be owed wages, taxes and contributions for that period. Disproving it requires records the employer will not have, because the employment was undeclared.

Article 7 is the one that ends businesses. Exclusion from public procurement removes a construction or facilities contractor from the market segment it depends on, and recovery of subsidies reaches back a year. In Germany, any final fine above €200 under section 404 of Social Code Book III is entered in the commercial central register, which public contracting authorities consult. The penalty and the register entry are separate consequences of the same decision.

Article 8, the chain, and how inspections are targeted

Article 8 is the reason this directive belongs in a procurement conversation rather than only in an HR one. Where a subcontractor employs a third country national illegally, the contractor who directly engaged that subcontractor is liable for the financial penalty and for the back payments under Article 6. Main contractors and intermediate subcontractors further up the chain are liable where they knew that the subcontractor was employing illegally.

Member states may relieve a contractor that carried out due diligence obligations defined in national law, and that exemption is the only practical protection. It is documentary in the same way the Article 4 defence is: evidence that the contractor checked, before award and during performance, that the subcontractor held the right to employ the people it sent to site.

For a shipyard, a food processing plant or a logistics operator that staffs peaks through labour providers, the working rule is that the chain does not move liability away from the top. It adds parties without removing anyone. The allocation of these duties between employer, agency and subcontractor is set out in the employer sponsorship compliance chain.

Article 14 requires member states to carry out effective and adequate inspections based on a risk assessment that identifies the sectors where illegal employment is concentrated, and to report the number of inspections and their results to the European Commission each year. Construction, agriculture, hospitality, food processing and road transport appear in almost every national risk assessment, which means an employer in those sectors is not selected at random.

Enforcement is also becoming harder to be surprised by. Immigration, tax, labour and social security administrations increasingly share data, and the Entry Exit System gives authorities a movement record they previously had to reconstruct. The practical consequence is that the mismatch between a payroll entry and a permit record surfaces in an office rather than on a site visit.

Outside the directive, the United Kingdom runs the same logic through a different instrument, with penalties of up to £45,000 for a first breach and £60,000 for a repeat, described in UK right to work checks and the civil penalty. An employer operating on both sides of the Channel is running two documentary regimes with one workforce.

The evidence that answers an inspection is created at hire and maintained monthly, not assembled after a visit. Werklist keeps that record for the corridors it runs, and the split of responsibility with the employer is set out on our employers page.