Most operators in the labour hire and hospitality space know that work rights verification is a legal requirement. Most have heard of VEVO. Most believe they are broadly compliant because they run a check at onboarding.
The gap between that assumption and the actual compliance position is wider than most realise, and it is not because the law is unreasonable. It is because the operational reality of casual, high-churn workforces sits poorly with a verification framework designed around stable, long-term employment relationships.
This article is not about scaring operators. It is about giving an honest account of where the system works well, where it does not, and what a practical compliance position actually looks like for a business placing casual workers across multiple sites.
What VEVO is and what it does well
VEVO (Visa Entitlement Verification Online) is the Department of Home Affairs' real-time database for visa status. It is free, it is fast, and it is the closest thing Australia has to a single source of truth on whether a worker is entitled to work and under what conditions.
For the majority of workers, VEVO is straightforward. An employer runs the check with the worker's consent using their passport number and date of birth. VEVO returns one of three results: unlimited work rights, limited work rights with conditions stated, or no work rights. For workers on student visas, the 48-hour fortnightly limit is stated. For sponsored workers, any single-employer restriction is shown.
The manual portal handles individual checks. For businesses running volume, Home Affairs-authorised gateway providers including vSure, CVCheck, CheckWorkRights, and FrankieOne provide API-integrated access that returns a structured result and an official Home Affairs PDF, which serves as dated evidence of the check.
Compared to occupational licensing, which is fragmented across eight state-based regulatory regimes with no single national database, VEVO is refreshingly simple. One system, one federal regulator, real-time results. For the cases it covers cleanly, it works.
The difficulty is in the cases it does not cover cleanly, and there are more of those than most operators account for.
The penalty framework — for reference
The relevant provisions sit in Division 12A of the Migration Act 1958 (Cth), strengthened from 1 July 2024 by the Migration Amendment (Strengthening Employer Compliance) Act. The two primary offences are s.245AB (allowing an unlawful non-citizen to work) and s.245AC (allowing a lawful non-citizen to work in breach of a visa condition).
At the current penalty unit value of A$330, civil penalties are $79,200 per individual and $396,000 per body corporate — per worker. Criminal exposure (requiring knowledge or recklessness) runs to 2 years imprisonment or $594,000 for a body corporate. Aggravated exploitation offences carry up to $1,485,000. The full breakdown is on the Home Affairs penalties table.
The more practical point: s.245AB(6) places the burden of proving reasonable steps on the employer, not on the regulator. The question is not whether a breach occurred but whether the business can demonstrate what it checked, when, and how. That is what this article is really about.
Who is responsible for running the check?
This question matters more than it seems, particularly in a labour hire arrangement where the worker has one employer of record and is directed by an entirely different business.
The Department of Home Affairs is clear: using a labour hire organisation does not free the host employer from its own work rights obligations. Both parties carry the obligation, through different provisions of the Migration Act 1958 (Cth), and those obligations run in parallel rather than in sequence.
The labour hire operator, as the employer of record, holds the obligation to verify work rights before placement. If a labour hire company refers a worker to a host knowing, or being reckless as to whether, that worker is not entitled to do the work, the labour hire operator is exposed under ss.245AE and 245AEA of the Act.
The host employer, as the party directing the work, holds a separate and parallel obligation. A worker performing work at a host site is "working" under the Migration Act regardless of who employed them. Home Affairs recommends host employers include a VEVO requirement in their contracts with labour hire operators and conduct their own checks at the point of engagement.
Relying on the labour hire company's check is not a defence for the host employer. If the labour hire operator's VEVO check lapsed, was run incorrectly, or was never run at all, the host employer cannot point to the LHO's supposed compliance to discharge their own obligation. The check needs to happen at both ends of the arrangement, not just one.
The same logic applies to independent contractors. The Migration Act's definition of "allows to work" captures work performed under a services arrangement, not just formal employment. Operators using ABN contractors rather than employees are not in a different position.
In states with labour hire licensing, there is a second obligation on top.
In Victoria, Queensland, South Australia, and the ACT, host employers can only engage licensed labour hire providers. This means the host is verifying two things independently: that the labour hire operator holds a current licence, and that work rights have been checked. A current licence does not mean work rights were verified, and a valid VEVO check does not mean the operator is licensed. These are separate obligations that have to be tracked separately.
Where VEVO falls short in practice
For most workers most of the time, VEVO produces a clean result and the process works. The difficulty is in the edge cases, and in a high-churn casual workforce, edge cases are common.
The citizen and permanent resident gap.
VEVO only covers visa holders. Australian citizens, most permanent residents, and some holders of older visa classes simply do not appear in the system. For these workers, the employer's obligation is met by sighting and recording an original identity document: a passport, Australian citizenship certificate, or birth certificate alongside current photo ID.
Applying VEVO checks only to workers who appear foreign-born creates two problems at once. It leaves citizens and permanent residents unverified against any documented process, and it creates racial discrimination liability under the Racial Discrimination Act 1975 (Cth) by applying different procedures based on apparent nationality. The same onboarding process should apply to every worker, with VEVO for visa holders and document sighting for citizens and permanent residents.
The bridging visa timing problem.
A worker whose visa is about to expire and who has lodged a renewal or bridging visa application continues to show their current (expiring) visa on VEVO right up until it expires. Once the substantive visa expires, a Bridging Visa A activates if a valid application was lodged, and that bridging visa then appears in VEVO. The window between expiry and the bridging visa showing is a period of apparent unlawfulness on paper, even where the worker's legal position is sound.
Managing bridging visa holders in a casual labour hire pool requires active monitoring rather than set-and-forget checks. Workers rolling between visa applications, Bridging Visa A holders whose applications are refused, and workers on Bridging Visa B or C (which may or may not carry work rights depending on the circumstances) all require individual case management that a one-time VEVO check at onboarding does not provide.
The student visa hours problem.
Student visas carry a 48-hour fortnightly work limit that is cumulative across all employers. VEVO shows that the condition exists. It has no visibility into how many hours the worker has logged with other employers that fortnight. A labour hire operator placing a student visa holder across multiple host sites in the same week may push that worker into breach without either party having any indication that it is happening.
This is a structural gap in the system, not a fixable process problem. The information simply does not exist in VEVO. The practical response for operators with significant student visa cohorts is active communication with the worker about their hours across all employers, and conservative scheduling when workers are approaching condition limits.
The identity verification gap.
VEVO confirms that a visa record exists and that the conditions match the passport number entered. It does not confirm that the passport is genuine, that the person presenting it is the actual holder, or that the photo matches. A VEVO check run using a legitimate visa number that belongs to a different person passes cleanly. The check itself is only as good as the document verification that precedes it.
This is why sighting the original document and verifying the photo against the person is a separate step from running VEVO, not an optional addition to it.
VEVO does not verify qualifications or occupational licences.
A clean VEVO result tells you a worker can legally work in Australia. It tells you nothing about whether they hold the RSA certificate they presented, a current white card, a forklift licence, or any other occupational qualification. As we covered in our RSA verification article, the fragmentation of occupational licensing verification across eight state-based regimes means VEVO and qualification verification are entirely separate compliance obligations that have to be managed in parallel.
The platform dispatch timing problem
Traditional compliance guidance assumes a structured onboarding process where documents are collected, VEVO is run, results are saved, and work commences. In a gig-adjacent or platform-based labour hire model, this sequence is compressed significantly.
Workers registered on a platform may be dispatched to a shift within hours or minutes of a vacancy opening. A VEVO check run at platform registration can be months or over a year old by the time a worker accepts a shift. Visas expire in that time. Bridging visas activate and lapse. Conditions change.
A VEVO check run once at onboarding is not a standing compliance position. For temporary visa holders, the check needs to be repeated before visa expiry and at regular intervals during the engagement. For bridging visa holders, every three months is the practical standard. Running VEVO once and dispatching indefinitely does not constitute reasonable steps under the Act.
The right architecture for a platform-based labour hire business is: standing consent obtained at registration, automated re-verification against VEVO on a defined schedule for all temporary visa holders, and a process that prevents dispatch for any worker whose VEVO status is stale, expired, or flagged. This is not a manual process problem. It is a systems problem. Spreadsheets and calendar reminders do not scale across a pool of hundreds of casuals with different visa types and different expiry dates.
What reasonable steps actually looks like
The Migration Act does not define "reasonable steps," but s.245AB(2)(a) explicitly names VEVO as the prescribed system for establishing work rights. Completing a VEVO check, saving the result, and keeping records is the clearest evidence available. The burden of proving reasonable steps sits with the employer under s.245AB(6), not with the regulator.
A documented reasonable steps position in a labour hire context includes:
- Obtain the worker's written consent before running VEVO (required; the check cannot proceed without it)
- Run VEVO before any work commences, including unpaid trial shifts
- Sight the original identity document and verify the photo matches the person presenting it; record the document type, number, and expiry
- Save the dated VEVO result PDF; record who ran the check, when, and the result
- For visa holders: set re-check triggers before visa expiry; for bridging visa holders, every three months as a minimum
- For student and working holiday visa holders: track cumulative hours across all placements to monitor proximity to work condition limits
- For Australian citizens and permanent residents: sight and record an Australian passport, birth certificate, or citizenship certificate alongside photo ID
- Apply the same documented process to every worker regardless of apparent nationality
- Retain all records for seven years post-employment, consistent with Fair Work Act record-keeping obligations
- For host employers: include VEVO requirements in contracts with labour hire operators and conduct your own check at point of engagement; do not rely solely on the LHO's process
Why this is genuinely hard to do well
Laying out a ten-step checklist makes compliance sound manageable. In practice, several things make it hard for most businesses operating in this space.
The workforce is dynamic. A business placing 200 casual workers across 30 sites has workers with different visa types, different expiry dates, different conditions, and different re-check schedules. There is no single check date and no single expiry date. Each worker is on their own compliance clock.
The obligation is ongoing. A VEVO check is not a one-time event. For temporary visa holders, it needs to be repeated. For bridging visa holders, it needs to be repeated frequently. Workers who were compliant at onboarding may not be compliant six months later, and the business has no automatic notification when a visa status changes.
The system has blind spots the employer cannot fully close. Hour-stacking across multiple employers is invisible. Bridging visa timing gaps require case-by-case management. The citizen gap requires a parallel document sighting process that most onboarding workflows do not systematically capture.
And the obligation runs in two directions at once. In a labour hire arrangement, both the LHO and the host have independent obligations. Coordinating those, documenting them, and making sure neither party assumes the other has handled it, requires explicit contractual and operational agreement between the parties.
None of this is impossible. But it requires a level of systematic, ongoing, and documented process that goes significantly beyond what most businesses currently have. The businesses that handle this well treat work rights verification as an ongoing operational function rather than an onboarding checkbox, and they use systems that automate re-check schedules and flag expiring visa status before it becomes a dispatch problem.
TwoStreams is workforce management software built for gig-economy and casual labour-hire businesses in Australia. Join the waitlist to be first in line.