Right to work compliance in the UK sits at an awkward intersection of HR policy, immigration law, and document verification technology. If you're building or managing a hiring system that touches UK employees, getting this wrong isn't just an audit finding — it's a £60,000-per-worker civil penalty exposure.
This post covers the current legal framework, the three verification methods, and how to design a workflow that handles the edge cases your hiring pipeline will inevitably encounter.
The Legal Foundation
Under the Immigration, Asylum and Nationality Act 2006, every UK employer must verify that workers have the right to work before they start. The Home Office operates a strict liability system: if you employ someone without a right to work, you're liable for a civil penalty even if you didn't know — unless you followed the correct checking process and obtained a "statutory excuse."
The statutory excuse is the key concept. It's your documented proof that you did what the law requires. Without it, you have no defence.
Three Checking Methods — and When to Use Each
The Home Office currently recognises three checking mechanisms:
1. Manual Document Check
Used for British/Irish citizens with physical passports, and for some legacy immigration documents. You examine original documents in person (or via live video call in prescribed circumstances), retain copies, and record the date of check.
Gotcha: Physical EU passports and national ID cards no longer confer the right to work for EU/EEA/Swiss nationals who arrived after 31 December 2020. If your manual check process accepts these, it's misconfigured.
2. Home Office Online Checker (Share Code)
For anyone with a digital immigration status: Skilled Worker visa holders, EU/EEA/Swiss nationals with settled or pre-settled status under the EU Settlement Scheme, Graduate route holders, and more.
The employee generates a 9-character share code from their UKVI account; you enter it alongside their date of birth at gov.uk/prove-right-to-work. The result gives you their name, permission to work, and any work restriction details.
Implementation note: The check result page must be saved as a screenshot or printed record that clearly shows the employee's photo, the date of the check, and the work permission details. An audit log entry that just says "checked online" is insufficient.
3. Identity Document Validation Technology (IDSP)
Certified IDSPs can verify the identity and right to work of British and Irish citizens using their passport or driving licence — entirely digitally. The employer receives a verified record from the IDSP.
This is increasingly the default for large-volume hiring because it creates a more auditable trail than manual document checks and removes the in-person verification step.
When to use which: If the candidate is a British or Irish citizen, you can use manual check, IDSP, or (in limited cases) the online checker. If they have any other immigration status, use the online checker with a share code.
The Repeat Check Problem
Most compliance systems handle the initial check reasonably well. Where workflows break down is the follow-up check for time-limited permissions.
If an employee has a visa that expires in 18 months, your system needs to:
- Record the expiry date at the time of the initial check
- Schedule a follow-up check 4-6 weeks before expiry
- Alert an HR owner (not just the employee) when the check is due
- Block or flag the employee record if the check isn't completed by expiry
Missing a repeat check means you lose your statutory excuse from that point forward — even though you did everything right initially.
The eVisa Transition Edge Case
BRPs have been replaced by eVisas. Employees who previously had a BRP should now have a UKVI account and can generate share codes. However, the transition hasn't been seamless: some employees have accounts with mismatched names, expired BRPs they haven't converted, or technical issues generating share codes.
Practical approach: If an employee can't generate a share code, they need to contact the UKVI technical helpline before starting work. Don't accept the physical BRP card as a workaround — the Home Office no longer considers this sufficient for time-limited permissions.
Document Retention
Right to work records must be retained for the duration of employment and two years after employment ends. This means:
- Clear copies of all documents checked (front and back where applicable)
- Screenshot/printout of online check results with employee photo and check date
- Date of check and name of the person who conducted it
- Repeat check records with their own dates
Penalty Framework (2026)
| Offence | Maximum Civil Penalty |
|---|---|
| First offence, unknowing | Up to £45,000 per worker |
| Repeat/deliberate | Up to £60,000 per worker |
| Criminal conviction | Unlimited fine + up to 5 years imprisonment |
The Home Office publishes a public register of civil penalty recipients. The reputational consequence adds to the financial one — particularly relevant if you hold or plan to apply for a sponsor licence, since a civil penalty can affect sponsor licence eligibility.
Building a Compliant Workflow
Minimum viable compliance setup:
- Pre-offer: Inform candidates which checking method applies to them based on their stated right to work status
- Pre-start: Complete the check, retain records with correct metadata
- HRIS integration: Store expiry dates as structured fields, not document notes
- Automated reminders: Trigger follow-up check tasks 6 weeks before visa expiry
- Escalation path: If follow-up check isn't completed by expiry date, escalate to HR lead and flag in payroll
For teams building on top of UK immigration data — including sponsor licence lookups, visa type classifications, and policy Q&A — ImmigrationGPT provides an AI-powered reference layer built on live government data.
This post is for informational purposes only and does not constitute legal advice. UK immigration law changes frequently — always verify against current Home Office guidance.
Top comments (0)