Right to work compliance in the UK is a stateful problem. It's not a one-time check at onboarding — it's an ongoing obligation with expiry tracking, re-verification triggers, and audit record requirements that differ by nationality and document type. Building systems that handle this correctly requires understanding what the underlying check actually produces, not just that it needs to happen.
Three check types, three different data shapes
Manual checks apply to British and Irish nationals presenting physical documents — passport, birth certificate plus National Insurance card, or other documents from the Home Office's Lists A and B. The record is a retained copy of the original. No structured expiry data is produced unless the document itself carries a time limit (which British passports don't). List A documents give an unrestricted statutory excuse. List B documents require follow-up verification at expiry.
Online share code checks apply to everyone with biometric immigration status: EU Settlement Scheme holders, Skilled Worker visa holders, Graduate visa holders, Student visa holders, and most other visa categories. The employer enters a 9-character alphanumeric share code plus the worker's date of birth at gov.uk/view-right-to-work. The response includes:
- Right to work status (confirmed / not confirmed)
- Work condition restrictions (e.g. "20 hours maximum during term time", "work in any job with any employer")
- Leave expiry date
- A reference number identifying the specific check
IDSP checks (Identity Document Validation Technology) apply to British and Irish passport holders whose employer uses a certified third-party provider. The output varies by provider but must include check outcome, timestamp, and underlying document data. Certification is maintained by the Home Office — only providers on the published register confer statutory excuse.
What to persist
For online checks:
- Date and time of check
- Worker's date of birth (used in the query; don't retain the share code itself post-check)
- Confirmation page as PDF or screenshot
- Expiry date of leave (critical for scheduling re-verification)
- Any work conditions returned (these affect payroll and scheduling logic)
For manual checks: a clear copy of every document presented, with the check date recorded.
Retention period: duration of employment plus two years. The Home Office audit process checks record completeness and timeliness, not just existence. A record dated after the worker's start date does not establish statutory excuse for the period before it.
The re-verification scheduler
This is where most implementations fail. A worker joins on a Skilled Worker visa expiring in 18 months. The initial check runs. No re-verification event is created. The visa lapses. The employer continues paying wages. Six months later, an enforcement visit finds the worker without valid leave — and the employer without a statutory excuse for the post-expiry period.
Civil penalty: up to £45,000 per worker for a first offence. £60,000 on repeat breach.
A compliant implementation triggers re-verification no later than the leave expiry date. In practice, fire the reminder 28–60 days before expiry. The worker needs time to renew their visa, receive the biometric residence permit or digital status update, and generate a new share code. That process typically takes 8–12 weeks if the renewal application is straightforward.
Edge cases worth handling explicitly
Students: The share code confirmation will show "maximum 20 hours per week during term time, unlimited during vacation periods." If your system tracks hours by worker category, you need to parse and store this restriction — not just log "check complete."
Graduate visa holders: Unrestricted work, no employer tie, no sector restriction. Commonly confused with Student visa holders in legacy HR systems. Expiry: 2 years post-graduation, 3 years for PhD graduates. The share code check will make this clear; the schema should distinguish the visa category.
EEA nationals post-Brexit: Physical EEA passports have not conferred right to work since June 2021. A system that accepts a scanned EEA passport as sufficient verification is non-compliant for any hire made after that date.
Employer-tied visas: Some categories (e.g. Health and Care Worker route, some intra-company transfers) tie the worker to a specific employer. The share code confirmation will name the permitted employer. If the worker has changed employer without updating their visa, the check will return a negative or conditional result.
The adjusted checks gap
March 2020 to April 2022: the Home Office permitted "adjusted" checks — remote video verification with scanned documents. A supplementary in-person or IDSP check was required for workers hired under this regime, to be completed by 30 September 2022.
Systems built during COVID that contain only adjusted check records — with no supplementary check performed — are carrying latent compliance risk. Those records do not provide statutory excuse if inspected today.
Sponsor licence verification
If your HR tooling needs to verify whether a company holds a sponsor licence before processing a right to work check for a visa-national applicant, the Home Office's Register of Licensed Sponsors is publicly searchable. ImmigrationGPT wraps that register (125,000+ records) with search and plain-English Q&A for HR teams that need to do this repeatedly.
Technical information only — not legal advice. UK immigration rules change. Verify current requirements with the Home Office or a regulated adviser before implementing compliance systems.
Top comments (0)