UK employers must check every worker's right to work before their first day. Three methods exist: manual document check (List A or List B documents), digital IDSP check (British and Irish citizens with a valid passport only, via a certified Identity Service Provider), or online share-code check (workers with a Home Office immigration status). Since February 2024, the civil penalty for employing an illegal worker without a statutory excuse has risen to £45,000 for a first breach and £60,000 for repeat breaches per worker. Follow-up checks are required before any time-limited permission expires.
Last reviewed May 2026
Right-to-work checks are a legal obligation for every UK employer before a worker starts employment - not a recommendation, and not limited to roles where immigration status might seem uncertain. The civil penalty regime applies equally whether the employer suspected an issue or not: the statutory excuse is created only by following the correct check process, regardless of outcome. This article explains the three check methods, which documents are acceptable, when follow-up checks are required, and how the Home Office's Employer Checking Service operates for edge cases. For onboarding software that automates the check workflow, see employee onboarding software UK and best HR software UK.
The Three Right-to-Work Check Methods
The Home Office's employer guidance on right-to-work checks defines three compliant methods. Using any one of them correctly, before the worker's first day, creates a statutory excuse against a civil penalty for the duration of employment (or until the method-specific follow-up check is required).
Method 1: Manual document check. The employer examines original documents from List A (documents that establish a permanent, ongoing right to work in the UK) or List B (documents that establish a time-limited right to work). List A documents include a British or Irish passport, a birth certificate combined with National Insurance number evidence, an indefinite leave to remain vignette, and settled status under the EU Settlement Scheme confirmed by the online checking service. List B documents include a visa with a specific leave-to-remain date, a biometric residence permit, and pre-settled status under the EU Settlement Scheme confirmed online. The employer must check the document is genuine, that it belongs to the holder, and that it permits the work being offered. A copy (photocopy or scan) must be retained.
Method 2: Digital IDSP check. Since 6 April 2022, employers may use a certified Identity Service Provider to conduct a digital identity check for British and Irish citizens who hold a valid passport or Irish passport card. The IDSP verifies the document's authenticity and the individual's identity remotely, producing a verification output that constitutes the record of the check. The employer must also satisfy themselves that the individual presenting for work is the same person as the verified identity - typically by comparing the IDSP's output (including a photograph) with the individual's appearance. The Home Office publishes a register of certified IDSPs at GOV.UK; only certified IDSPs create a statutory excuse.
Method 3: Online share-code check. Workers who have a Home Office immigration status - including EU Settlement Scheme pre-settled or settled status, a biometric residence permit, a biometric residence card, or a UKVI status - provide a share code to the employer. The employer enters the share code and the worker's date of birth into the Home Office's online checking service at GOV.UK/view-right-to-work. The service returns a result confirming whether the individual has the right to work and, for time-limited statuses, the expiry date. The employer must retain a copy or screenshot of the result. Share codes are valid for 90 days from the date the worker generates them.
Which Method Applies to Which Worker
The three methods are not interchangeable for all workers. Understanding which method is applicable to which worker category is the most common area of confusion in employer right-to-work practice.
British and Irish citizens can be checked by any of the three methods: manual document check using their passport or passport card; digital IDSP check; or, if they have an eVisa or other digital immigration status (rare for British/Irish citizens but possible following the UKVI digital transition), via the online share-code system. In practice, the IDSP route is fastest for remote hiring and creates the clearest audit trail.
EU, EEA, and Swiss nationals who applied to the EU Settlement Scheme before 30 June 2021 hold either settled or pre-settled status, which is held digitally and cannot be evidenced by a physical document. For these individuals, the online share-code check is the only compliant method - a manual check of a European passport alone does not establish right to work for these workers (European passports are not on List A or List B for workers who entered the UK under EU free movement). This is the most frequently misunderstood aspect of post-Brexit right-to-work practice.
Workers from outside the UK and EEA with leave to remain (work visa, skilled worker visa, graduate visa, or similar) can be checked via the online share-code system using the eVisa share code, or manually using a biometric residence permit if one has been issued. The Home Office is transitioning all physical immigration documents to eVisas; from early 2025, biometric residence permits are being phased out and replaced by eVisa status verifiable only via the online system.
|
Follow-Up Checks: When They Are Required and What Happens If Missed
A right-to-work check conducted at the start of employment creates a statutory excuse for the period of employment - but only if any time-limited permissions are re-verified before they expire. For workers whose right to work is time-limited (pre-settled status, work visas with a leave-to-remain date, graduate visas), the employer must conduct a follow-up check before the existing permission expires.
The consequence of missing a follow-up check is significant: from the expiry date of the worker's permission, the employer's statutory excuse lapses. If the worker is subsequently found to be working without valid leave (because their visa application was refused after the original permission expired, or because they failed to renew), the employer faces a civil penalty as if no check had ever been conducted. The maximum penalty since February 2024 is £45,000 per illegal worker for a first breach and £60,000 for repeat breaches - increases from the previous £15,000 and £20,000 limits respectively.
The Home Office does not notify employers when a worker's leave expires or when a visa application outcome is known. The employer is responsible for tracking expiry dates and initiating follow-up checks. HR systems that store the expiry date from the initial check and generate automated alerts at 90 and 30 days before expiry are therefore providing a compliance control, not a convenience feature. Manual tracking via a spreadsheet is legally adequate but practically unreliable at scale.
For workers who have applied to extend their leave and are waiting for a Home Office decision, the employer can use the Employer Checking Service. A positive Verification Notice from the ECS creates a statutory excuse for 6 months while the application is pending. The ECS is accessible at GOV.UK/employee-immigration-employment-status.
Record Retention and ICO Requirements
Right-to-work check records must be retained for the duration of employment plus two years. After that point, the Home Office no longer requires retention, and continued storage of identity documents beyond their purpose is a breach of the UK GDPR storage limitation principle under Article 5(1)(e). The ICO's employment records guidance is explicit that retaining identity documents indefinitely creates unnecessary data breach risk and is likely non-compliant.
The format for retention depends on the check method used. For manual checks, a clear copy of the relevant document pages (the photo page and any page showing leave-to-remain conditions) is required. For IDSP checks, the IDSP's verification output (typically a PDF containing the verified identity photograph and check result) is the record. For online share-code checks, a screenshot or PDF export of the GOV.UK checking service result - showing the worker's name, the date of the check, and the right-to-work status - is required. The screenshot must show the date on which the check was conducted.
Access to right-to-work records should be restricted to HR personnel with a documented need. These records contain passport-quality identity documents and, for some workers, information about immigration status that may be sensitive. A data breach involving right-to-work documents is likely to be reportable to the ICO under the 72-hour notification obligation.
| Worker category | Compliant check method | Follow-up required | Record type |
|---|---|---|---|
| British/Irish citizen (passport) | Manual, IDSP, or share code | No | Document copy or IDSP output |
| EU/EEA settled status | Share code only | No | Share-code check screenshot |
| EU/EEA pre-settled status | Share code only | Yes (before expiry) | Share-code check screenshot |
| Skilled Worker visa holder | Share code or BRP (if issued) | Yes (before visa expiry) | Screenshot or BRP copy |
| Pending Home Office decision | Employer Checking Service | Yes (after 6 months) | ECS Verification Notice |
Civil Penalties: How the Home Office Calculates and Applies Them
The civil penalty regime under the Immigration, Asylum and Nationality Act 2006, as updated by the Illegal Migration Act 2023, operates on a per-worker basis. Each illegal worker for whom the employer cannot demonstrate a compliant right-to-work check attracts a separate penalty. An employer found to have employed five workers without compliant checks faces a penalty of up to five times the per-worker maximum.
The Home Office's employer liability guidance sets out the factors that may reduce a penalty from the maximum: whether the employer reported the matter to the Home Office before an inspection, whether this is a first breach, and whether the employer cooperated fully with the investigation. The previous three-tier penalty structure (£15,000, £10,000, £5,000 depending on circumstances) was replaced by the February 2024 increases, which set a first-breach maximum of £45,000 per worker and a repeat-breach maximum of £60,000 per worker, with a minimum penalty of £25,000 per worker for most circumstances.
Criminal liability (rather than civil penalty) arises where the employer knew that a worker did not have the right to work. Criminal conviction can result in an unlimited fine and up to five years' imprisonment for the responsible individual. The criminal threshold requires knowledge, not merely negligence - but wilful blindness (deliberately not conducting checks to avoid knowledge) is treated as knowledge by the courts.
FAQ
Does a right-to-work check need to be completed before or on the first day?
Before the first day. The Home Office guidance is unambiguous: the check must be completed before employment begins. Conducting the check on day one - even before the worker starts their first task - does not satisfy the requirement. Digital IDSP checks and online share-code checks can be completed remotely before the start date, which is the recommended approach for all new hires regardless of check method.
Can an employer rely on a passport that has expired for a right-to-work check?
Yes, in specific circumstances. An expired British or Irish passport, or expired passport of an EEA national, can be used for a manual right-to-work check if it was valid at the time of issue and the individual's photograph is still a reasonable likeness. An expired passport cannot be used for an IDSP digital check - IDSPs require a valid (unexpired) document. For non-British/Irish workers whose right to work is evidenced by a digital immigration status, document expiry is irrelevant - the online share-code check reflects current status.
What should an employer do if a worker cannot produce right-to-work documents immediately?
The employer should not allow the worker to start until a compliant check has been completed. If the worker's documents are with the Home Office as part of a pending application, the employer should use the Employer Checking Service. If the worker cannot produce documents and has no pending application, starting employment without a check creates immediate civil penalty exposure. There is no grace period under the legislation.
Do right-to-work check requirements apply to volunteers and unpaid interns?
The right-to-work check obligation applies to employees and workers - individuals who work under a contract. Genuine volunteers (who receive no pay, benefits, or contractual obligation to attend) are not covered. Unpaid interns who perform work under a practical obligation to attend may be workers for the purposes of the check requirement, and the cautious approach is to conduct checks for all individuals performing regular work regardless of pay status.
What is the difference between settled and pre-settled status for right-to-work purposes?
Both are verified via the online share-code check, not by a physical document. Settled status (indefinite leave to remain in the UK) creates a permanent right to work - no follow-up check is required. Pre-settled status is time-limited (typically five years from the grant date) and requires a follow-up check before it expires. The online checking service confirms which status the individual holds and, for pre-settled status, the expiry date that triggers the follow-up obligation.
Frequently asked questions
What right-to-work check methods are valid in UK employment?
Three methods are valid: manual check of original documents (List A or List B per Home Office), digital check via Home Office certified Identity Document Validation Technology (IDVT) for British and Irish passport holders, and share code verification through gov.uk online check for those with eVisa or BRP. The Home Office Right to Work Checks Employer Guide at gov.uk is the definitive reference. Records must be retained for the duration of employment plus two years after.
What is the penalty for employing illegal workers in the UK?
Civil penalties for employing illegal workers can reach 60,000 pounds per worker as of 2024 rates. The employer can establish a statutory excuse against civil penalty by completing the prescribed right-to-work checks before employment starts. Criminal sanctions apply where the employer knew or had reasonable cause to believe the worker did not have permission to work. Home Office Civil Penalty Compliance Code at gov.uk explains the framework.
Can UK employers use video calls for right-to-work checks?
Adjusted right-to-work checks via video call were permitted during COVID-19 but ended in September 2022. Current valid methods are manual document check (in person), certified IDVT digital check, or share code online check. Video-only checks are no longer a valid method. The Home Office at gov.uk publishes the current Employer Guide reflecting these changes. Continued reliance on video checks after the end of the adjusted period creates civil penalty exposure.
How long must UK employers keep right-to-work check evidence?
Evidence must be retained for the duration of employment plus two years after employment ends. Evidence includes copies of documents inspected (where manual check) or IDVT/share code verification records. For workers with time-limited right to work, follow-up checks must be conducted before expiry; failure to conduct follow-up checks removes the statutory excuse against civil penalty. The Home Office Employer Guide at gov.uk covers retention and follow-up check requirements.
Do right-to-work check rules apply to UK self-employed contractors?
Right-to-work checks under the Immigration Act 2006 apply to employees and certain workers. Genuinely self-employed contractors (those outside IR35 with their own personal service company) are not employees and do not require right-to-work checks by the engaging business. However, the engaging business may have due diligence obligations under modern slavery or anti-money laundering rules. Home Office at gov.uk publishes employer guidance; ACAS and HMRC publish self-employment status guidance.
How We Verified
This article draws on Home Office employer guidance on right-to-work checks (updated following the February 2024 civil penalty increases), ICO guidance on retention of employment records, and the Immigration, Asylum and Nationality Act 2006 as amended by the Illegal Migration Act 2023. The Home Office's certified IDSP register and Employer Checking Service guidance were reviewed as of May 2026. Legislation was verified against current text on legislation.gov.uk. No vendor paid for inclusion in this article.
