Right to Work Checks and Employer Immigration Compliance

Right to Work in Brief

Immigration, Asylum and Nationality Act 2006 requires employers to check eligibility
Civil penalty up to £60,000 per illegal worker since 2024
Manual, digital and Identity Service Provider (IDSP) check methods

The Right to Work Duty in UK Law

The Immigration, Asylum and Nationality Act 2006 creates the civil penalty regime for employing someone who does not have the right to work in the UK. Under section 15, an employer is liable to a penalty if they employ an adult subject to immigration control who does not have leave to enter or remain, or whose leave does not permit the employment in question. The Immigration Act 2016 added a criminal offence of employing an illegal worker where the employer has reasonable cause to believe the worker does not have the right to work, with up to five years' imprisonment and an unlimited fine.

The duty applies to all UK employers. There is no exemption based on size, sector, or whether the illegal employment was intentional. A sole trader hiring a single employee is subject to the same framework as a multinational with thousands of staff. The key features are:

Check before employment begins - the check must be completed before the worker's first day. A check completed afterwards does not establish the statutory excuse
Apply to every new hire - regardless of nationality, including British citizens. Selecting only certain nationalities to check would itself be discriminatory under the Equality Act 2010
Use a prescribed method - the Home Office sets out three valid check routes. Any other process does not give a statutory excuse
Retain the evidence - records must be kept for the duration of employment and for two years after employment ends
Follow-up checks - for workers with time-limited permission, a follow-up check is needed before that permission expires

The Civil Penalty Regime

Penalty levels were significantly increased on 13 February 2024 and remain at those levels in 2026:

First breach - up to £45,000 per illegal worker
Repeat breach within three years of a previous penalty - up to £60,000 per illegal worker
Fast payment reduction - 30% reduction available if a first-breach penalty is paid within 21 days, with no objection or appeal

The penalty is per worker, not per employer, so a single check failure across multiple staff can multiply rapidly. The Home Office can also pursue criminal prosecution where it considers the employer knew or had reasonable cause to believe the worker did not have the right to work.

Beyond the financial penalty, other consequences include compliance visits to the business, possible closure notices for up to 48 hours, sponsor licence suspension or revocation for organisations holding a sponsor licence, and reputational damage from publication on the Home Office register of employers issued with civil penalties.

The thing that catches small businesses out is not knowing the rules - it is shortcuts. The bookkeeper who starts on a Monday and the manager promises to do the paperwork later in the week. The cleaner who starts the same day they are interviewed. The cousin of a current employee who looks fine on the face of it. None of those situations qualify for a statutory excuse. The check has to be before the first day worked, on the right document, in the right way, retained correctly. If any of that is missed, the penalty is up to £45,000 for one worker, regardless of how the relationship started.

What I look for on right to work is not just the file of copies, but the system. Is there a written process? Does it identify which check method applies to which worker? Are the check dates and document expiry dates recorded somewhere where they will trigger the follow-up check? Is the named person doing the check trained on what acceptable evidence looks like in 2026 - knowing, for example, that physical biometric residence permits expired as valid evidence on 31 December 2024? An organisation that produced the same paper-based process in 2023 and has not updated it for the eVisa transition is at considerable risk regardless of the file's apparent completeness.

The other point I emphasise is that the check is the only defence. If you employ someone illegally, the question on civil penalty is not whether you knew - it is whether you carried out the prescribed check before employment started, by the right method for that person, and retained the evidence. There is no defence based on trusting the worker, no defence based on the agency saying everything was in order. The statutory excuse is yours or it is not, and only the prescribed method gives it to you.

The Three Prescribed Check Methods

The Home Office Employer's Guide to Right to Work Checks sets out three prescribed methods for establishing a statutory excuse. The correct method depends on the worker's status:

Method 1 - Manual Document Check

For workers who hold acceptable physical documents and who do not fall into one of the other categories. The employer must:

Obtain the original document(s) from the worker
Check the document is genuine and that the person presenting it is the rightful holder, in the worker's presence (in person or via live video link)
Take a clear copy of the document, retaining the date the check was made
Keep the copy securely for the duration of employment and for two years afterwards

The Home Office maintains lists of acceptable documents. List A documents (for example, a British passport) give a continuous statutory excuse. List B documents (for example, a residence card with time-limited permission) give a time-limited excuse and require a follow-up check.

Method 2 - Home Office Online Check

This is the mandatory method for most non-British and non-Irish workers in 2026. Workers with digital immigration status - including those under the points-based system, the EU Settlement Scheme, the Skilled Worker visa and most other migrant routes - prove their right to work by generating a share code through their UK Visas and Immigration (UKVI) account. The employer:

Asks the worker for their share code (which begins with a "W" for right to work) and date of birth
Goes to the gov.uk/view-right-to-work service
Enters the share code and date of birth
Confirms the photograph displayed matches the worker
Saves the result page (PDF or screenshot) with the date of the check

Physical Biometric Residence Permits (BRPs) ceased to be acceptable evidence on 31 December 2024. Workers who previously held BRPs must now use the share code method. Accepting a BRP, however convincing it looks, no longer establishes a statutory excuse.

Method 3 - Identity Document Validation Technology (IDVT)

This method, also referred to as Digital Verification Service (DVS), is limited to British and Irish citizens with valid passports or Irish passport cards. The employer uses a certified Identity Service Provider (IDSP) to verify the worker's identity digitally. The IDSP carries out the document and identity check; the employer retains the IDSP's report. This method does not work for any non-British and non-Irish worker - the online check (Method 2) must be used for those.

Time-Limited Permission and Follow-Up Checks

Where a worker's right to work is time-limited - for example, a Skilled Worker visa with an expiry date - the employer must conduct a follow-up check before that permission expires to retain the statutory excuse. The follow-up check uses the same prescribed methods. If the worker's permission expires without a successful follow-up check, the statutory excuse ends and the employer is exposed to a penalty for any continued employment.

Notable exceptions to the follow-up requirement:

EU Settlement Scheme pre-settled status - no follow-up check is needed once a compliant initial check has been completed
British or Irish citizens - their right to work is permanent, so no follow-up is needed
Settled status / indefinite leave - permanent, so no follow-up

For everyone else with time-limited status, the employer needs a system that records the expiry date and triggers a reminder before the deadline.

The Employer Checking Service

Where a worker cannot provide acceptable documents and cannot generate a share code - typically because their immigration application is still pending - the employer can use the Employer Checking Service (ECS). If the Home Office confirms the right to work, it issues a Positive Verification Notice (PVN), which provides a statutory excuse for six months. A repeat ECS check is needed before the PVN expires if the worker's status remains unresolved.

The ECS is not a substitute for the prescribed check methods - it is a fallback for specific situations where the standard methods are not possible. Using it without justification, or failing to follow up before the PVN expires, removes the statutory excuse.

TUPE Transfers and Acquired Employees

Where a business acquires staff through a TUPE (Transfer of Undertakings) transfer, it cannot rely on the previous employer's right to work checks. The acquiring employer has a 60-day grace period from the date of transfer to carry out compliant checks on each transferred employee. After 60 days, any failure to check exposes the new employer to civil penalties. The 60-day grace period applies only to the initial check on transfer - it does not extend the deadline for any required follow-up checks.

For SMEs, the right to work duty is one of the few areas where there is genuinely no scaling. The check has to be done in exactly the same way for a five-employee business as for a five-thousand-employee one - same methods, same evidence, same retention, same follow-up timeline. What varies is the system around it. Larger employers tend to have HR software that flags expiry dates; SMEs need at minimum a spreadsheet or calendar reminder for each time-limited worker. Skipping the check, doing it after the start date, or using the wrong method for the worker's status - any of those removes the only defence to the penalty. The £45,000 first-breach figure is per worker, not per organisation, so even a single oversight is significant.

Practical Advice

For most SMEs, right to work compliance comes down to a documented process applied consistently to every new hire, the right method chosen for each worker's status, evidence retained for the duration of employment plus two years, and follow-up reminders for time-limited permissions. The toolkit and policy below provide the documented basis.

The transition from physical documents to digital immigration status is now substantially complete. Employers still relying on Biometric Residence Permits or other historical document-based processes need to update their procedures to reflect the share code system for digital status holders.

alphaZ document	How to use it
IMS Toolkit (ISO 9001/14001/45001)	The integrated management system toolkit. Includes the staff handbook, recruitment policy and induction framework where the right to work check sits as a mandatory step before employment begins.
General Staff Handbook	The consolidated staff handbook. Sets out the recruitment and onboarding process, including the right to work check as a pre-employment requirement and the records that need to be retained.
ER9 Legal Register	The legal register entry for the Immigration, Asylum and Nationality Act 2006 and the Immigration Act 2016 sits here, alongside the wider employment legislation.
F-HR15 Employment Letter and Contract	Example letter confirming employment, and example staff contract, which covers job title, responsibilities, place of work, start date, working hours, salary, holiday pay and entitlement, sickness and absence, termination and notice, confidentiality and non-disclosure, company guidance and policies.

Note: subscribers to alphaZ documents can download all of the documents above as part of the subscription.

Frequently Asked Questions

Do I have to check British citizens?

Yes. Right to work checks must be carried out on every new employee regardless of nationality, including British citizens. Checking only those who appear to be from outside the UK would itself be discriminatory under the Equality Act 2010. For British and Irish citizens with a valid passport, the employer can either use a manual check of the passport or use a certified Identity Service Provider for digital identity verification. For other British citizens (for example, those without a passport), other List A documents may be used.

What is the maximum civil penalty for employing an illegal worker?

From 13 February 2024, the maximum civil penalty under section 15 of the Immigration, Asylum and Nationality Act 2006 is £45,000 per illegal worker for a first breach and £60,000 per illegal worker for a repeat breach within three years. A 30% reduction is available for first-breach penalties paid within 21 days under the fast payment option, with no objection or appeal. The penalty applies to employers of any size with no SME exemption. In serious cases involving knowing employment, the Immigration Act 2016 creates a criminal offence with up to five years' imprisonment and an unlimited fine.

Can I still accept a Biometric Residence Permit?

No. Physical Biometric Residence Permits (BRPs) ceased to be acceptable evidence of right to work on 31 December 2024. Workers who previously held BRPs must now prove their right to work through the Home Office online check using a share code generated through their UKVI account. Accepting a BRP card, even one that appears valid on its face, does not establish a statutory excuse. This is one of the most common errors that employers make in 2026, particularly where they have not updated processes since the eVisa transition.

Can I get a recruitment agency to do the check for me?

Generally, no. The statutory excuse belongs to the employer who has the contract with the worker. If a recruitment agency carries out the check on the employer's behalf, the employer cannot rely on it for the statutory excuse - the employer remains liable for the civil penalty. The one exception is using a certified Identity Service Provider (IDSP) to carry out the digital identity verification step on British and Irish passport holders - in that case, the IDSP performs the technical check but the employer retains responsibility and liability.

When do I need to do a follow-up check?

A follow-up check is required before the worker's right to work expires, where their permission is time-limited - for example, a Skilled Worker visa with a fixed expiry date. The follow-up uses the same prescribed methods as the initial check. No follow-up is required for British or Irish citizens, settled status holders, or EU Settlement Scheme pre-settled status holders (an exemption introduced in 2024). For everyone else with time-limited status, a system that records the expiry date and triggers a reminder before the deadline is essential to retain the statutory excuse.

UK Legislation

Further Resources