That said, immigration and employment attorneys also urge employers not to overreact to the end of the DACA program. Businesses that prematurely start firing employees or probing workers for information on their immigration statuses, could be violating anti-discrimination laws.

“There might be a knee-jerk reaction by employers. Hopefully, not,” says Nieves Bolanos, a Chicago-based employment lawyer who represents workers. “Folks who have permits are going to be able to continue to work with those permits. Employers should take a deep breath and wait to see how this is going to play out, before they react.”

On Tuesday, President Trump’s administration announced it would rescind DACA, an Obama-era policy that protected nearly 800,000 young undocumented immigrants—more often referred to as Dreamers—from deportation. Business leaders, including Facebook’s Mark Zuckerberg and Apple’s Tim Cook, are up in arms about the potential impact the DACA decision will have on their workforce. Unless Congress passes alternative immigration laws to protect DACA recipients, businesses will be forced to start laying off these employees as their work permits expire.

An end to the program could lead to an average of 30,000 DACA recipients losing their jobs each month over the next two years, a report by the Center for American Progress estimates. That same group estimates that 91% of DACA recipients – or roughly 700,000 individuals – are currently working, and these workers can be found on the payrolls of 72% of the top 25 Fortune 500 companies.

Here are five things employers need to know before they start firing DACA recipients.

1. Penalties for employing Dreamers could be steep—eventually

If Congress does not act, current law requires employers to fire DACA recipients the day after their work permits expire. Not all DACA permits will expire on the same day, however. DACA permits are generally valid for two years, and workers whose permits expire between now and March 5, 2018 can submit renewal applications by October 5, possibly re-upping their work eligibility until early 2020.

Once these permits start expiring, though, businesses that do not lay off these employees could be subject to steep penalties. Employers could pay civil fines ranging from $548 to $4,384 per unauthorized worker for first-time offenders. Criminal penalties for a pattern of violations could result in up to a 10-year prison sentence, plus fines.

Business owners who object to the end of DACA or opt to turn a blind eye to their workers’ eligibility, could try to play the odds. There are more than 7 million business establishments in the U.S., and from 2012 to 2016, federal immigration agents completed an average of 2,000 audits on businesses each fiscal year. From October 2016 to June this year, Immigration and Customs Enforcement conducted only 420 worksite investigations.

“The odds of any particular employer ever being audited are fairly low,” says Daniel Brown, a Washington, D.C.-based immigration lawyer and former Homeland Security official. “That being said, we don’t know what the government might do immediately or in the future in terms of enforcement.”

It’s possible enforcement will ramp up under President Trump, who has ordered the hiring of an additional 10,000 immigration agents.

2. It’s illegal to fire DACA recipients prematurely

Although it’s illegal to employ DACA recipients after their work permits expire, it’s also illegal to fire them prematurely.

DACA recipients are entitled to the same protections against discrimination in the workplace as other workers, and it is illegal for businesses to fire any authorized worker simply because of nationality or immigration status. If a DACA recipient is on your payroll, you cannot fire them now, just because their permit will expire in the future.

“Employers need to be really careful because they can be potentially liable for unlawful discrimination if they terminated somebody because of this,” said Greg Siskind, an immigration lawyer based in Memphis, Tenn.

3. You can’t not hire someone because of their DACA status

Consider a situation in which an employer has already offered a person a new job. As part of the onboarding requirements, the worker fills out an I-9 form and submits valid identification showing he or she is authorized to work in the U.S. That said, the work permit is set to expire next month.

According to the Department of Justice website, it is illegal for the employer to suddenly rescind the job offer just because someone’s work authorization is set to expire in the future.

Some attorneys point out that this law only applies to protected classes of workers like U.S. citizens, permanent residents or persons granted refugee or asylee status, and DACA recipients fall in none of those categories. But this part of the law appears to be open to interpretation.

In a novel court ruling in 2015, in the case Juarez v. Northwestern Mutual Insurance, a federal judge in the Southern District of New York held that protection against job discrimination “extends to all lawfully present aliens,” not just green-card holders. As long as their permits are still current, DACA recipients are considered to be lawfully present aliens.

4. Don’t ask your employees if they are DACA Dreamers

In many cases, employers will not know if their employees are DACA recipients unless workers voluntarily disclose this information. Employment authorization cards are given to foreign nationals of many different statuses, including refugees and asylum recipients, and employers should not ask for any specific details beyond the bare minimum information required on the I-9 form.

Asking a job applicant or an employee about specific details related to his or her immigration status is akin to asking about other sensitive personal details like race, gender, sexual orientation and pregnancy. It’s a no-no for employers, and in some cases, it’s possibly illegal.

At hiring, employees are required to produce documents that satisfy the I-9 requirements, but they are not required to disclose whether they were DACA recipients.

“The employee does not have to raise the subject at all,” said David Lopez, a Washington, D.C.-based immigration lawyer and former general counsel for the Equal Employment Opportunity Commission. “If it expires, the employer can ask to see a new work permit, but it’s not necessary for workers to give the employer any more information than is required.”

Asking an employee whether he or she is a DACA recipient can be considered discrimination in the workplace, especially if employees are singled out because of a foreign accent, the way they look, or because they appear to be in typical age range of the Dreamers.

Instead, employment lawyers recommend businesses generally keep track of temporary work authorizations that are about to expire and give workers some advanced notice, indicating that they will need to show proof of their work authorization when their permits eventually expire. DACA status and nationality need not ever enter the conversation.

5. Don’t ask employees to resubmit their I-9 papers

Although employers are entitled to ask to see work eligibility documents after an existing permit expires, they are not allowed to conduct random or selective checks on workers who are immigrants or they perceive to be immigrants.

It is an illegal act of discrimination for employers to selectively target certain employees to re-verify their work eligibility on the basis of their country of origin, citizenship, or type of immigration status. It is also illegal for an employer to request more or different documents than are required by the I-9 form.