Actually, Congress can't. E-verify has been law since 1997, but it only applies to federal contractors and while some states have passed laws requiring all employers to use it, some have not.
"In 2011, California passed an act to prohibit municipalities from mandating use of E-Verify.
[28] At least 20 municipalities had required use of E-Verify,
[29] for all businesses and/or companies doing business with the local government, including Mission Viejo
[30] (2007), Temecula
[31][32] (ordinance 5.06.030) (2010), Murrieta
[33][34][35] (ordinance Chapter 5.04) (2010), Riverside,
[36]Santa Maria
[37][38] (only for city employees), Lake Elsinore
[39] (Ordinance No. 1279)
[40] (2010), Wildomar
[41] (only for contractors) (2010), Lancaster
[42] (Ordinance No. 934), Palmdale, San Clemente, Escondido, Menifee, Hemet, San Juan Capistrano, Hesperia, Norco, San Bernardino County, Rancho Santa Margarita, and Simi Valley.
[29]
Cities considering E-Verify ordinances for businesses for 2011 are Costa Mesa,
[43] San Luis Obispo, Santa Maria
[44] (for all businesses) Santa Barbara, and San Jose. However, Costa Mesa
[45][46][47] is the only city that has adapted the same state law as Arizona's SB-1070, allowing the City to arrest those without proper identification of resident status under suspicion of being unlawfully present in the United States."
E-Verify - Wikipedia