Six of the Biggest IT Outsourcers Just Lost Their Green Card Pipeline. Your Delivery Plan Runs Through It.

What Happened on October 8

At a White House event on Thursday, October 8, 2026, Labor Secretary Keith Sonderling announced that he was suspending some of the largest IT outsourcing firms in the world from the Permanent Labor Certification Program: Cognizant, Infosys, Tata Consultancy Services, Wipro, HCL Technologies and Capgemini. Microsoft and Adobe were suspended in the same action, with the department citing multiple active federal investigations. Vice President JD Vance, who leads the administration's anti-fraud task force, spoke at the same briefing.

The scope is unusually broad. According to reporting of Sonderling's remarks, the department will "not accept any new or process any pending permanent labor certification applications involving these companies." That covers both new filings and cases already sitting in the queue. Sonderling justified the action on scale: since 2009, he said, the six outsourcers together requested almost three million foreign workers, and received more than 230,000 H-1B approvals and more than 100,000 permanent labor certifications.

Vance reserved his sharpest words for Microsoft. As Business Today reported, he said the company laid off 6,000 American workers in 2025 after certifying that it could not find qualified American employees, was approved for more than 6,000 H-1B visas, and filed 3,682 PERM applications. Microsoft disputes the framing: according to Alma's summary of the dispute, the company says about 80% of its roughly 6,000 H-1B applications in the most recent fiscal year were extensions or status changes for people it already employed.

The story spread fast on Hacker News, X and LinkedIn, and most of the reaction focused on the politics or on the workers. Both matter. This article is about a narrower question that few people asked: what does this mean for the companies that buy software delivery from these firms? Those are hundreds of enterprises in the US and Europe whose roadmaps depend on onsite and near-site engineers employed by the six named outsourcers.

This Was Not a Surprise. It Was the Fourth Step.

The October 8 action is the latest step in an enforcement campaign that has been building for a year. The Department of Labor launched Project Firewall in September 2025. For the first time, it let the Secretary of Labor personally certify H-1B investigations on "reasonable cause" instead of waiting for a worker to complain. By April 2026, Bloomberg Law was reporting a 48% rise in the department's H-1B investigation caseload, with attorneys describing more site visits and more data-driven inquiries.

On July 8, 2026, the department's Office of Inspector General announced a "major investigation" into fraud in the H-1B and PERM systems, run with the White House anti-fraud task force. Mayer Brown's analysis notes that the Inspector General later said his office had issued dozens of subpoenas and was considering criminal prosecutions, and that the inquiry covered technology among other sectors.

The first suspensions came on September 8, 2026. Inspector General Anthony D'Esposito announced on X that Cognizant's and Cloudera's PERM filings were suspended, without disclosing the specific allegations or how long the suspensions would last. It came a day after Cognizant had announced plans to expand its US workforce, including hiring 1,500 American college graduates. One month later, the list grew from two companies to eight.

The pattern matters more than any single announcement. Each step widened the scope, shortened the gap to the next one, and moved from investigation toward sanction before any formal finding. Anyone planning on the assumption that this will blow over is betting against a year of consistent direction. Sonderling himself said multiple federal investigations are ongoing, which means the list of suspended employers can grow.

What a PERM Suspension Does, and What It Does Not

PERM is the step in many employment-based green card cases where an employer certifies to the Department of Labor that it tested the US labour market and found no qualified, willing and available US worker for the role. It is not a visa, and it is not a green card. It is the first gate on the path from temporary H-1B status to permanent residence, and the filing date usually becomes the worker's priority date in the green card queue.

The legal basis is 20 CFR 656.31, which lets the department suspend processing of applications from an employer under investigation for possible fraud or willful misrepresentation. A suspension does not need a final finding of wrongdoing. Alma's legal breakdown describes it as lasting up to 180 days initially with extensions allowed, while debarment, the more serious penalty that does require a formal violation finding, generally runs up to three years. No company has been charged with anything, and the affected firms may challenge the action, particularly the refusal to accept new filings.

What the suspension does not do is just as important. It does not cancel anyone's H-1B status. It does not revoke PERM certifications already granted or I-140 petitions USCIS has already approved. Engineers working onsite at your offices today can keep working tomorrow. That is why Indian IT stocks rallied on October 9 as investors concluded the action would not halt daily operations.

The damage arrives on a slower timeline. H-1B status is normally capped at six years. Under the AC21 rules, a worker can extend beyond that limit if a PERM application has been pending for at least 365 days. An engineer at a suspended employer who is in year four or five and has not yet had PERM filed now has no clear way to stay past year six with that employer. The same applies to engineers whose pending applications are frozen before they reach the 365-day mark. These are often the most experienced people on an onsite team, because they have been there the longest.

Why This Is Your Problem, Not Only Your Vendor's

For a client, an outsourcing contract with a large services firm usually has two halves. An offshore team does most of the work at a lower rate, and an onsite or near-site team sits with you: solution architects, delivery leads, business analysts, senior engineers who know your systems and run the bridge to offshore. That onsite layer is small but carries a lot of weight. It holds the domain knowledge, makes the daily decisions and turns your requirements into tickets someone else can work on.

Much of that layer is staffed with visa holders, and for them the green card is the main reason to stay with one employer through a long engagement. A sponsored PERM case is a retention tool. When it disappears, the engineer's best option for permanent residence may be to move to an employer that can still sponsor them, which could be a competitor, a product company, or one of your own in-house teams. The early analysis of the suspension describes the main risk for the providers as administrative and related to talent retention, and that is exactly the risk that passes through to the client.

Attrition in the large services firms was already a planning assumption, not an exception. We covered the numbers in our article on replacement and continuity clauses: Q1 FY26 voluntary attrition ran from 12.8% to 15.1% across HCL Tech, TCS, Infosys and Wipro. A suspension that removes the green card path for onsite staff increases the risk of losing exactly the people who are hardest to replace. When your onsite lead leaves, months of context go with them, and the offshore team loses its interpreter.

There is also a forward-looking cost. If the vendor cannot offer a green card path, recruiting experienced engineers into onsite roles becomes harder and more expensive, and some of that cost will reach your rate card. If enforcement widens from PERM into H-1B processing, as Newsweek reported it already had for Cloudera, the onsite layer itself becomes harder to staff. None of that is certain. All of it is now possible, with no end date, and outside your control.

The Market Said "Not Yet". It Did Not Say "Never".

The calm reaction has some basis. Nasscom, India's technology industry body, responded that the number of employees moving from H-1B to permanent residence through PERM is relatively limited, and that Indian technology companies have significantly reduced their dependence on H-1B visas in recent years, partly by hiring locally in the US. Exposure also varies by firm. Some of the named companies have filed far fewer PERM cases recently than others, so the direct effect will not be uniform.

But the market was pricing the next quarter, not the next three years. Several questions remain open. The department has not published a reinstatement process or the criteria it used to pick these companies. Vance said companies must change their behaviour and that Microsoft's suspension would last as long as needed. Sonderling said investigations are continuing. Each of those is a reason to expect the situation to change, and not necessarily in the clients' favour.

It is also worth remembering how unstable the wider US work visa system has been this year. Our analysis of the 2026 H-1B whiplash tracked a $100,000 fee that arrived, was vacated by a court, was briefly reinstated and then lifted again, alongside a wage-weighted lottery that reshaped who gets selected. The PERM suspension adds another layer of uncertainty to a channel that was already hard to plan around.

For a CTO or procurement lead, the practical conclusion is simple. You do not need to predict how this ends. You need to know how much of your delivery depends on it, and to have a plan if the answer turns out to be uncomfortable.

Five Questions to Put to Your Vendor This Month

Most clients have never asked a vendor about immigration exposure because it never seemed to be their concern. It is now a reasonable part of vendor risk management, in the same category as business continuity and key-person risk. These questions are factual, they do not require the vendor to disclose anything about individual employees' legal status, and a good partner should be able to answer them quickly.

First, how many people on our account work in the US on employer-sponsored visas, and in which roles? Second, how many of them are in years four to six of H-1B status, and how many had PERM cases pending or planned? Third, what is your plan if one of those people leaves, including the overlap period and who pays for ramp-up? Fourth, which knowledge sits only with the onsite team, and is it documented anywhere the offshore team or our own engineers can reach? Fifth, if visa-based onsite staffing becomes harder or more expensive, how would the delivery model and rate card change?

The answers will tell you where you are fragile. If two of your three onsite leads are in year five with frozen PERM cases, you have a continuity problem to solve this quarter, not next year. If the vendor cannot answer, that tells you something too.

Then look at your contract. Key-person clauses, client approval for replacements, minimum handover overlap and ramp-up billed at the vendor's cost are standard protections, and many agreements still lack them. If the review suggests you may need to move work, read our guide to switching software development vendors without losing momentum before you start the conversation.

Where Else Can the Work Live?

The onsite model exists because, for a long time, the only way to get senior engineers into your working day was to move them physically into your country. That was a reasonable answer when collaboration tools were weak and offshore teams sat ten or more hours away. It is a much weaker answer in 2026, when the same work can be done by a team that keeps your hours from its own country.

Nearshore development removes the immigration question entirely. A senior engineer working from Belgrade or Novi Sad does not need an H-1B, a PERM case, a green card or a lottery win. Their employment is governed by local law, their retention does not depend on a US government programme, and no announcement in Washington can freeze their career path. For European clients, Serbia is a short flight and one hour or less from most EU capitals. For US clients, it gives a real overlap with the East Coast morning, which is often enough for daily standups, design reviews and incident handling.

This does not mean the onsite role disappears. Some engagements still benefit from someone in the room for discovery workshops, go-lives or major planning sessions, and short business trips cover that without employer-sponsored work visas. What changes is that the permanent layer of the team, the people who hold context and make decisions every day, no longer depends on a visa system that is under active enforcement.

There is also a structural benefit that clients often discover only after switching. When the whole team works from one location in a compatible time zone, you stop paying for the translation layer between onsite and offshore. Decisions are made by the people who will write the code. We wrote about how that hidden coordination cost shows up in practice in our article on the cost of time zone gaps that never appears in outsourcing quotes.

Moving Without Breaking Things

If your review shows heavy dependence on a suspended vendor's onsite layer, the worst response is a rushed exit. The suspension does not stop work tomorrow, which gives you time to move carefully. A practical approach has three phases.

Start with knowledge capture. Use the next one or two months to document what the onsite team knows: architecture decisions, integration quirks, deployment procedures, the unwritten rules about which systems can be touched when. That work protects you whatever you decide, because it also reduces the cost of normal attrition.

Next, run a parallel team on a bounded piece of work. Bring in a dedicated development team alongside the incumbent on one service or workstream, with clear ownership and its own definition of done. This tests the new team on your real codebase and your real processes before you depend on it, and it builds a second source of knowledge about your systems.

Finally, shift ownership in stages, one area at a time, with overlap at each handover. The aim is not to replace one concentration risk with another. It is to make sure no single vendor, location or immigration programme can take out a critical part of your delivery capacity. For many clients the right end state is a blend: a smaller incumbent footprint for what it does well, and a nearshore team that owns a growing share of the core product.

How We Structure This at Stepto

Stepto builds dedicated development teams in Serbia for clients in Europe and the US. Our engineers work from Serbia under local employment, so nothing in our delivery model depends on US work visas, PERM filings or green card sponsorship. When the rules in Washington change, our clients' teams do not.

We set up engagements around the things that the onsite model was supposed to provide and often did not: named senior engineers who stay on your account, working hours that overlap with yours, direct access to the people writing the code, and documentation that lives in your systems rather than in someone's head. Replacement terms, handover overlap and knowledge transfer are written into the contract from the start, not negotiated after someone has already left.

For clients moving work away from a large incumbent, we usually start with a bounded workstream, run alongside the existing vendor, and take on more ownership as the team proves itself. If you want to compare the options for your situation, our comparison of Serbia, Poland and Romania sets out the trade-offs, and a conversation with us can help you put numbers on your own exposure.