UK Right to Work Checks 2026: eVisa Verification Logic, IDVT Rules, and the Follow-Up Date Problem HR Systems Ignore

Right to work compliance in 2026 is split across three distinct check types, and most HR systems treat them as one. That conflation is the source of most audit failures.

This is a technical walkthrough of what valid checks actually require in 2026 — covering eVisa share code flows, IDVT eligibility constraints, and the follow-up date logic that falls through the cracks of nearly every HRIS.

---

Check type 1: Home Office online service (eVisa workers)

Since January 2025, most non-British, non-Irish workers no longer hold physical Biometric Residence Permits. Their immigration status is digital — held in the Home Office eVisa system and viewable via the online right to work service at gov.uk/view-right-to-work.

The verification flow:

1. Worker generates a share code through their UKVI account (share codes expire after 90 days)
2. Employer enters the share code + worker's date of birth at gov.uk/view-right-to-work
3. System returns: name, photo, immigration status, permission type, expiry date, and any work restriction flags
4. Employer downloads or screenshots the result and retains it

What makes this check invalid:

• Employer checks an expired share code (the system will return an error, but some operators log "checked" without reading the result)
• Worker on a pending switch — their existing leave has lapsed but the new application is in-time; employer assumes permission continues (it does, under section 3C leave, but only if the in-time application was made before expiry — this needs to be verified, not assumed)
• Employer accepts an expired BRP as evidence for a worker who should have an eVisa

The output of the online check should be stored with a timestamp matching the pre-employment date. For workers with time-limited permission, the expiry date returned by the system is the date that drives follow-up scheduling — not the document issue date.

---

Check type 2: Manual document check (British and Irish citizens)

British and Irish citizens aren't in the eVisa system. Their check is document-based. Acceptable evidence includes:

• UK/Irish passport (current or expired, for British citizens)
• UK birth certificate or adoption certificate + NI number evidence
• Certificate of registration or naturalisation as British citizen

The check must be in-person (physically present) or via a certified IDVT provider. Video calls are not valid.

IDVT (Identity Document Validation Technology) applies only to British and Irish citizens. IDVT providers use document scanning + facial comparison to verify identity digitally. The check is valid only if:

• The provider appears on the certified provider list maintained by DSIT (not a self-certification)
• The employer retains the IDVT provider's confirmation output
• The check is done before the start of employment

If a worker is a British national but has a foreign-sounding name and your process defaults to the share code route, that's friction with no compliance value. British nationals don't have share codes for domestic employment.

---

Check type 3: Follow-up checks for time-limited permission

Workers on any visa with an expiry date require a follow-up check. The employer must:

1. Know the expiry date of the worker's current permission (from the initial check output)
2. Run a fresh check before that date using the same method (online service)
3. Retain the new output alongside the original

The problem in most HRIS setups: the only date field tracked is the "right to work document expiry date" recorded at onboarding. For workers who switch immigration route mid-employment — Graduate visa to Skilled Worker, Student visa to Graduate, Spouse visa with a renewal — the tracked date may not reflect current permission.

The minimum correct data model for a right to work record:

Field	Description
check_type	online_service / document / idvt
check_date	Date check was performed
permission_expiry	Date permission expires (from check output)
followup_due	Scheduled follow-up date (before permission_expiry)
status	valid / time_limited / no_restriction
check_output_stored	Boolean or reference to stored output

The followup_due field should trigger a workflow no later than 4 weeks before permission_expiry. Calendaring a follow-up to the expiry date itself is a compliance risk — if the check slips by a day, the worker has been employed without valid RTW permission.

---

Civil penalty scale in 2026

As of February 2024, the maximum civil penalty for employing an illegal worker is £60,000 per worker (up from £20,000). A valid right to work check, performed correctly, provides a statutory excuse — if it fails those validity criteria, the excuse disappears regardless of good faith.

---

For verifying whether a prospective employer holds a valid Home Office sponsor licence — a related check for workers and recruiters — immigrationgpt.co.uk searches the live register.

---

Information only. Not legal advice. Verify against current Home Office guidance before implementation.