UK Share Codes: Right-to-Rent, Right-to-Work, Right-to-Study

Overview

As the UK transitions from physical Biometric Residence Permits to fully digital eVisas, the share-code system has become the standard way to evidence immigration status. The holder logs in to their UKVI account at gov.uk/view-prove-immigration-status, generates a single-use code (separate codes for rent, work and study), and gives the code plus their date of birth to the landlord, employer or university. The recipient verifies the code on a separate gov.uk page and sees only the immigration information relevant to their check.

How to generate a share code

The applicant logs in to their UKVI account at gov.uk/view-prove-immigration-status using their passport details, BRP number or other identity. The dashboard shows the current immigration status. The applicant clicks 'prove your status' and selects the purpose (right to rent, right to work, right to study). The system generates a unique nine-character code, valid for thirty days from generation.

How the recipient verifies

The landlord, employer or university navigates to a separate gov.uk verification page and enters the share code and the applicant's date of birth. The system displays the relevant status information: in the case of right-to-rent, this is whether the person has a right to rent in England. The recipient prints or saves the result for their records as their statutory evidence.

Right-to-rent specifics

Right-to-rent checks apply only in England, under the Immigration Act 2014. Landlords (and letting agents acting for them) must check before granting a tenancy. The share-code system is the standard route for non-British nationals; British and Irish citizens use passport checks. Failure to perform the check exposes the landlord to civil penalties of up to twenty thousand pounds per occupant.

Right-to-work and TUPE

Right-to-work checks are mandatory for all UK employers, regardless of nationality. Employers using the share-code system gain a statutory excuse: if the check is done correctly, the employer is not liable for illegal-working penalties even if the underlying status turns out to be wrong. The same system applies for paid and unpaid work.

How institutions verify UK address

Address verification at UK institutions combines documentary evidence with database checks. Banks under FCA and JMLSG guidance typically require documents from a recognised list (utility bills, council tax, bank statements, government letters) plus an address validation against the Royal Mail Postcode Address File (PAF). Address-not-found in PAF can stall account opening even where the documents are genuine; new-build properties are a common case.

Credit reference agencies build address history from multiple sources: electoral roll (the strongest signal), credit account address records reported by lenders, public records including court judgments, and (increasingly) Open Banking data shared with the agency. Each address on file has a verification status; unverified addresses produce thin-file scoring and trigger manual review at lenders.

Updating address across the system is manual: HMRC, DVLA, GP, council, bank, electoral roll and utilities each need separate notification. The gov.uk Tell-Once service exists for births and deaths only; address changes use individual channels. Setting aside an afternoon when moving to do all the notifications systematically is the standard advice.

Key GOV.UK resources for new UK residents

The gov.uk website is the single front door for UK government services. Key services for newcomers include: gov.uk/apply-national-insurance-number for the NI number application; gov.uk/register-to-vote for the electoral roll; gov.uk/view-prove-immigration-status for the eVisa account and share codes; gov.uk/apply-renew-passport for British passport applications after citizenship; gov.uk/exchange-foreign-driving-licence for DVLA exchange.

Cross-cutting services include gov.uk/personal-tax-account for HMRC self-service (tax codes, employment history, NI record, state pension forecast), gov.uk/help-with-childcare-costs for the Tax-Free Childcare and free hours schemes, and gov.uk/sign-in-childcare-account for the parent-facing TFC portal. The NHS App at nhs.uk/nhs-app provides the parallel front door for health services.

For up-to-date practical guidance, the citizensadvice.org.uk and moneyhelper.org.uk websites cover the major newcomer scenarios. Citizens Advice operates free in-person and telephone advice across the UK; Money Helper is the consumer-facing site of the Money and Pensions Service offering free financial guidance.

Troubleshooting common identity and address verification failures

The most common verification failures involve: address not on PAF (new-build), name spelling variants (middle initial vs full middle name, accents in names), date-of-birth format mismatch (different conventions in different countries), and recent moves where the new address has not yet propagated to credit agencies.

Specific fixes by problem type. Address not on PAF: provide alternative documentary evidence including completion statement, mortgage offer, council tax registration letter and Royal Mail redirection confirmation. Wait for PAF update which typically takes four to twelve weeks for new-builds. Name spelling: provide alternative ID documents showing both spellings; bring deed poll if there has been a formal change.

Where verification fails repeatedly, request enhanced underwriting at the institution (most have a manual review path), or try a different institution that uses different verification systems. Open Banking sharing can sometimes work where standard document verification fails. Specialist identity-verification services including Onfido, Yoti and GBG offer a fallback that some institutions accept where their own verification is inconclusive.

Address change cascade: who to notify when you move

Moving home triggers a cascade of address updates. There is no single notification that updates all UK records. Priority notifications include: HMRC (via the personal tax account at gov.uk), the GP surgery (which transfers your registration to the new surgery or updates the existing one), the local council (for council tax registration), the DVLA (within fourteen days for the driving licence), and the electoral roll (re-register at the new address at gov.uk).

Financial updates include each bank, credit card and insurance provider, the pension provider, and Tax-Free Childcare or Universal Credit account where relevant. Utility updates include energy, water, broadband, mobile and TV licence. Subscriptions including streaming services, magazines and delivery services need separate updates. Royal Mail's address redirection service forwards post for a fee, buying time to update individually.

Setting aside an afternoon when moving to systematically work through the notifications is the standard advice. Most have online forms; many can be updated via the institution's mobile app. The gov.uk Tell-Once service is only for births and deaths; routine moves require individual notifications.

Identity fraud prevention and what to do if compromised

Identity fraud is one of the most common types of fraud in the UK. Action Fraud (actionfraud.police.uk) is the national reporting centre for cyber crime and fraud. Cases involving identity fraud are also reportable to the Cifas national fraud prevention service, which can flag the affected identity with multiple financial institutions to reduce subsequent harm.

Protective steps include: regularly checking credit files at each of the three agencies (free statutory reports under the Data Protection Act); enabling two-factor authentication on all financial accounts; using unique strong passwords (a password manager makes this manageable); being alert to phishing emails and SMS; never sharing OTP codes or full bank security details by phone.

If identity fraud is suspected: contact the bank and credit reference agencies immediately to flag the affected accounts; report to Action Fraud; obtain a Cifas protective registration (Cifas Protective Registration is paid; Cifas Member Protection is free for victims). The credit reference agencies can add a notice of correction or fraud marker to the file that lenders see at credit applications.

Specific routes for compromised passports (HMPO at gov.uk), driving licences (DVLA), eVisas (UKVI account) and NI numbers (HMRC) exist. Each replaces the compromised credential with a new one. The Information Commissioner's Office (ICO) is the regulator for data protection breaches; ICO complaints can support broader investigation where an organisation's data has been compromised.

Work, employment rights and the UK labour market

Once UK-resident with the right to work, employment in the UK is governed by the Employment Rights Act 1996, the Equality Act 2010 and a comprehensive framework of further legislation. Right-to-work checks are mandatory for employers; the share-code system through the UKVI account is the standard route for non-British nationals. The check provides the employer with a statutory excuse against illegal-working penalties.

Statutory employment rights include: the National Minimum Wage (different rates by age, set by HMRC); statutory holiday entitlement of 5.6 weeks per year (28 days for someone working a five-day week, including bank holidays at the employer's discretion); statutory sick pay; statutory maternity, paternity, adoption and shared parental leave; the right not to be unfairly dismissed (after two years' service in most cases); protections against discrimination on the nine protected characteristics under the Equality Act.

Workplace pensions are auto-enrolled for most employees aged twenty-two or over earning above the auto-enrolment threshold (currently around 10,000 pounds per year). The employee can opt out within the opt-out window. Auto-enrolment contributions are a minimum of eight percent of qualifying earnings (three percent employer, five percent employee). Many employers offer better than minimum.

HMRC personal tax account at gov.uk/personal-tax-account is the self-service portal for tax matters: viewing tax code, employment history, state pension forecast, marriage allowance claim and many other functions. The personal tax account works across employers and replaces previous paper-based interactions for most matters.

Data protection rights and how to exercise them

The UK GDPR and Data Protection Act 2018 give individuals strong rights over their personal data. Key rights include the right to be informed about data processing, the right of access (subject access request), the right to rectification of inaccurate data, the right to erasure in defined circumstances, the right to restrict processing, the right to data portability, the right to object, and rights related to automated decision-making.

To exercise rights with a specific organisation, send a written request to the data protection officer or to a general data-protection inquiry address. Most organisations have a privacy notice (often called Privacy Policy) on their website setting out the contact details. The organisation has one month to respond, extendable to three months for complex requests.

The Information Commissioner's Office (ICO) regulates data protection in the UK. Complaints about an organisation's handling of personal data can be made to the ICO at ico.org.uk. The ICO investigates, can require remediation, and can issue fines for serious breaches (up to four percent of global turnover for the most serious GDPR breaches).

Identity verification organisations collect substantial personal data and are particularly tightly regulated. The Cifas national fraud database is a special-purpose data store with specific governance. Individuals can subject-access Cifas to see whether they appear on any fraud database and challenge incorrect entries.

Newcomer documentation checklist and next steps

A useful documentation checklist for newcomers covers: passport (current, valid); UK visa or eVisa share code; UK address evidence (tenancy or temporary address letter); NI number documentation (or application reference if pending); UK bank account confirmation; tax record (HMRC personal tax account at gov.uk/personal-tax-account); NHS number (issued at GP registration); driving licence (foreign or UK photocard).

Storage of these documents matters. Originals should be kept in a secure place (not all in one bag carried daily). Photocopies and digital copies (encrypted cloud storage) provide backup. Some institutions require originals for verification; others accept certified copies. Solicitors and notaries can certify copies for a fee.

Recovery of lost documents is straightforward through the relevant agency: HMPO for passport, DVLA for driving licence, HMRC for NI number documentation, UKVI for eVisa account. Each has online and phone routes. Identity fraud reports should go to Action Fraud immediately; Cifas protective registration adds an extra layer of protection.

Reviewing the document set every twelve to twenty-four months helps catch upcoming expiries: passports expiring within six months of an intended trip may not be accepted by some destination countries; driving licences need renewal every ten years; eVisas remain current as long as the underlying immigration status remains.

For sensitive documents (deed poll, marriage certificate, gender recognition certificate) keeping multiple certified copies avoids the need to use the original repeatedly. The General Register Office issues additional copies of birth, marriage and civil partnership certificates for a small fee.

Disclaimer

This article provides general information for UK residents and newcomers. It is not legal, tax, financial or medical advice. Rules, rates, eligibility criteria and processes change frequently; readers should verify details with the linked primary sources or consult an authorised professional before acting on anything described here. References to specific firms, products or services are illustrative and do not constitute endorsements.

Frequently asked questions

How long is the share code valid?

Thirty days from generation. The recipient must complete the verification within thirty days. After that the code expires and a fresh one must be generated; the underlying status itself is unaffected.

Can I generate multiple codes?

Yes. A separate code is needed for each verifier and for each purpose (rent, work, study). There is no limit on the number of codes generated. Each is independent.

What if my immigration status is being reviewed or pending?

The UKVI account shows the current status; if a pending application has the previous status protected under section 3C of the Immigration Act 1971, the share code reflects that protection. Where status is pending without 3C protection, the share code may show no current right; in that case the applicant should contact UKVI.

Does the share-code system work for visiting?

The share-code system is for residents with leave to enter or remain. Visitors do not typically need to prove right to rent or work because they are not entering tenancies or employment. Where a visitor needs to prove status, alternative routes apply.

Will the recipient see all my immigration details?

No. The system shows only the information relevant to the check: for right-to-rent, just whether the person has the right to rent and any duration; for right-to-work, the right to work and any restrictions. Personal details beyond what is needed are not displayed.