Share Code for Employer 2026: How to Verify Right to Work in the UK

The civil penalty regime and what a statutory excuse buys an employer

The civil penalty for employing a worker without the right to work in the UK runs to GBP 45,000 per worker for a first breach and GBP 60,000 per worker for a repeat breach in the three years before the date of the offence. The penalty schedule sits under section 15 of the Immigration, Asylum and Nationality Act 2006 and was lifted to its current level by Home Office order on 13 February 2024. Through 2026 those figures remain the published ceiling.

A statutory excuse is the defence that blocks the penalty. An employer who carried out a prescribed right to work check in the prescribed way, before the worker started the role, and who retained the prescribed evidence, has a statutory excuse against the civil penalty even if the worker turns out to lack permission. The prescribed routes are listed in the Home Office Employer's Guide to Right to Work Checks. There is no statutory excuse against criminal liability under section 21 of the same Act, which applies where the employer knew or had reasonable cause to believe the worker did not have the right to work.

What this means in practice: a hospitality operator who hires a chef on a Skilled Worker visa, verifies the share code at gov.uk/view-right-to-work, saves the PDF export with the date of the check, and diaries a follow-up before the visa expiry, has a complete statutory excuse for the duration of that employment. The same operator who accepts a photocopy of an expired BRP card in 2026 has no excuse, because the document is no longer a prescribed item.

The three statutory categories of right to work check in 2026

The Home Office Employer's Guide to Right to Work Checks, current to 2026, recognises three checking routes. Each one produces a statutory excuse only when followed in full. Picking the wrong route for the wrong worker category is a common compliance failure.

The first route is the online check at gov.uk/view-right-to-work. It applies to anyone whose immigration status is held digitally: holders of an eVisa, EU Settlement Scheme status, frontier worker permits, points-based visas, and most other current categories. The worker generates a share code at gov.uk/prove-right-to-work and the employer verifies it. The check must be carried out before the worker starts the role.

The second route is an Identity Service Provider check, used for British and Irish passport holders who hold a valid passport. The IDSP uses Identity Document Validation Technology to verify the document and match it to the holder via a likeness check. The Home Office publishes a list of certified IDSPs. The IDSP route was introduced to take pressure off in-person checks and now sits inside many applicant tracking systems.

The third route is a manual document check, reserved for the narrow category of workers whose status is not yet held digitally and who hold an original document on the Home Office list (List A or List B). The employer takes a copy, signs and dates it, and retains it for the period set out in the Guide. From October 2025 the categories that legitimately use this route shrank, because the BRP-to-eVisa migration is now complete for most former BRP holders.

The step-by-step share code verification at gov.uk/view-right-to-work

An employer who has received a 9-character share code from a candidate goes to gov.uk/view-right-to-work. The page asks for the share code and the candidate's date of birth. Entering both produces a profile screen.

The profile screen displays the worker's name, a photograph held on file at the Home Office, the immigration category (for example, Skilled Worker, Graduate, Student, Settled Status), any conditions attached to the leave such as a 20-hour-per-week study cap, and the expiry date of the permission. For Indefinite Leave to Remain or settled status the expiry field reads "indefinite".

To create a statutory excuse the verifier completes three steps in sequence. Step one: open the profile while the candidate is physically present or on a live video call. Step two: compare the photograph on screen to the candidate. Step three: save a clear copy of the profile (PDF export or screenshot), date it, and store it in the personnel record. The Home Office Guide states that the date the check was completed must be clearly recorded on the saved copy.

The dated copy is retained for the duration of employment and for two years after employment ends. Records can be held electronically. Where the worker has a time-limited leave end date, the employer schedules a follow-up check before that date and requests a fresh share code in advance.

The Employer Checking Service and what it covers

The Employer Checking Service exists for the edge case where a worker cannot produce a share code or an original document, but does have an outstanding immigration application or appeal. The employer submits an online enquiry to the Home Office Employer Checking Service and receives a Positive Verification Notice in return where the worker's status permits work. The Notice is valid for six months and establishes a statutory excuse for that window.

Use of the Employer Checking Service is narrow. The two main scenarios are: a worker who applied to extend or vary their leave before their previous leave expired and is therefore on section 3C leave with no fresh document, and an asylum applicant whose claim has been pending more than 12 months without their own delay (a category that may take work in shortage occupations under the published policy).

For most workers in 2026 the Employer Checking Service is not the right tool. The share code service handles the routine cases. The Service is a backstop for paperwork gaps, not a substitute for the online check.

The October 2025 eVisa default and its effect on 2026 checks

The Biometric Residence Permit programme ran from 2008 to 2024, with cards issued to most non-EU migrants and to EU Settlement Scheme holders. The final issued BRPs carried an expiry date of 31 December 2024 even where the underlying immigration leave ran beyond that date. From 2025 the Home Office migrated all BRP holders to an eVisa, a digital record accessed through a UKVI account.

From October 2025 the Home Office position is that the eVisa is the primary evidence of status for the former BRP cohort. A physical BRP that has expired is no longer accepted as evidence in a right to work check. The compliant route is for the worker to log in to their UKVI account, generate a share code, and pass that code to the employer for verification at gov.uk/view-right-to-work.

What this means in practice for a recruitment team: any candidate who turns up in 2026 with only an expired BRP card needs to be redirected to gov.uk/prove-right-to-work to generate a share code. Accepting the card alone, even with a stated explanation that the underlying leave is in force, will not produce a statutory excuse.

Common employer errors that wipe out the statutory excuse

The compliance audits published in the Home Office penalty notices give a recurring list of failures. Checking the wrong document type is the most common: accepting a National Insurance card, a driving licence, or a residence card from an unfamiliar country as proof of right to work. None of these is on the Home Office List A or List B.

The second is checking after the start date. The Guide is explicit that the check must be completed before the worker begins the role. A check carried out on day one of employment does not retroactively cover a worker who started a day earlier.

Third is failing to follow up time-limited leave. If a worker's leave expires during employment and no fresh check is recorded, the statutory excuse falls away from the date of expiry. The employer becomes liable for any continued employment beyond that date.

Fourth is poor record-keeping: undated copies, copies stored on a shared drive that cannot be retrieved promptly, or copies that show only part of the profile screen. The Home Office expects the full profile to be saved and the date of check to be visible.

How we verified this

Figures and procedural detail were cross-checked in May 2026 against the Home Office Employer's Guide to Right to Work Checks on GOV.UK, the gov.uk/view-right-to-work service page, the gov.uk/prove-right-to-work service page, and the civil penalty schedule published in the Home Office Code of Practice on preventing illegal working. Statutory grounding was checked against section 15 of the Immigration, Asylum and Nationality Act 2006 on legislation.gov.uk. The eVisa migration position was checked against the gov.uk/evisa service pages. No third-party recruitment vendor documentation was used as a source for fees or rules.

Frequently asked questions

What is a share code for an employer?

A share code is the 9-character reference, beginning with W, that a non-British and non-Irish worker generates at gov.uk/prove-right-to-work. The employer enters that code at gov.uk/view-right-to-work along with the worker's date of birth, and the page returns a Home Office snapshot of the worker's right to work in the UK. The code is valid for 30 days from generation in the employer-facing service.

What is the maximum civil penalty in 2026 for hiring an illegal worker?

The maximum civil penalty in 2026 is GBP 60,000 per worker where the employer has been penalised for the same breach in the previous three years. A first breach is capped at GBP 45,000 per worker. These figures were set by the Home Office uplift that came into force on 13 February 2024 and remain published as the ceiling through 2026.

Do British and Irish citizens use a share code?

British and Irish citizens do not generate a share code, because their status is not held digitally by the Home Office. The compliant route for them is either a manual passport check by the employer or an Identity Service Provider check using Identity Document Validation Technology. The IDSP route applies only to a valid passport, not to a birth certificate or driving licence alone.

How long must the employer keep the dated copy of the share code check?

The dated copy of the profile screen, saved as a PDF or screenshot, is retained for the duration of employment plus two years after the employment ends. The two-year tail covers the Home Office investigation window. Records can be stored electronically, provided they remain retrievable and the date of the check is clearly visible on the saved file.

Does an expired BRP card still work for a right to work check in 2026?

An expired BRP card is not accepted as evidence in a right to work check in 2026, even where the worker's underlying immigration leave continues beyond the card expiry. From October 2025 the eVisa is the primary record for the former BRP cohort. The compliant route is for the worker to generate a share code at gov.uk/prove-right-to-work and for the employer to verify it online.

What is the Employer Checking Service used for?

The Employer Checking Service is the Home Office route used where a worker has no document and no share code, but does have an outstanding immigration application or appeal. The employer submits an enquiry and receives a Positive Verification Notice that creates a statutory excuse for six months. Typical cases include applicants on section 3C leave and certain asylum claimants in shortage occupations.

Sources

• GOV.UK: Right to work checks: an employer's guide
• GOV.UK: View a job applicant's right to work details
• GOV.UK: Prove your right to work to an employer
• legislation.gov.uk: Immigration, Asylum and Nationality Act 2006