Right to work verification in the UK sits at the intersection of immigration law and HR process. For developers building compliance tooling — or HR teams designing verification workflows — the rules in 2026 are more precisely defined than most guides acknowledge. The gaps in implementation appear in the same three places, over and over.
The Legal Structure
Under the Immigration, Asylum and Nationality Act 2006, employers who conduct a valid right to work check gain a statutory excuse against civil liability if a worker later turns out to be working illegally. Civil penalties now reach £60,000 per illegal worker for repeat offenders who fail to conduct any check at all. Criminal liability for knowingly employing someone without the right to work is separate, carrying sentences up to five years.
The check requirement applies before employment starts — not during onboarding, not after probation. That distinction matters if you're building a workflow with stage gates.
Two Verification Paths With Different Mechanics
Path 1: Manual document check
Applies to: British and Irish nationals presenting a physical passport or birth certificate.
Process: Inspect the original document in the presence of the holder (or via a certified Identity Service Provider for remote hiring). Retain a copy. Record the date.
No expiry tracking required: for British and Irish nationals, right to work does not expire with documentation, so no follow-up check is needed.
Path 2: Online share code check
Applies to: anyone with digital immigration status — EEA/Swiss nationals with settled or pre-settled status, Skilled Worker visa holders, Graduate route holders, and anyone else whose leave was granted under the digital-first Points-Based System.
Process: Worker generates a share code at gov.uk/prove-right-to-work. Employer enters the code plus the worker's date of birth into the employer-facing portal at gov.uk/view-right-to-work. The system returns real-time status, permitted work types, and an expiry date if leave is time-limited.
Critical point: this is the only valid check for digitally-statused workers. Inspecting a Biometric Residence Permit alone does not give the statutory excuse.
What the Check Returns
The online check returns:
- Worker name and photograph
- Whether they can work (yes/no)
- Work restrictions (e.g., "No restriction on hours" vs. "Maximum 20 hours per week during term time")
- Expiry date if leave is time-limited
For a compliance system, capture: share code used, date of check, expiry date returned (if any), and a screenshot or PDF of the confirmation page. Home Office expects this documentation retained for the duration of employment plus two years.
The Follow-Up Check Scheduling Problem
This is where most compliance systems leave a gap.
If the online check returns an expiry date, a follow-up check is required before that date. Home Office guidance says "shortly before" — in practice, build a trigger at 28 days out, with an escalation at 7 days:
from datetime import timedelta
def schedule_rtw_followup(worker_id, expiry_date):
trigger_date = expiry_date - timedelta(days=28)
escalation_date = expiry_date - timedelta(days=7)
create_compliance_task(
worker_id=worker_id,
task_type='right_to_work_renewal_check',
due_date=trigger_date,
escalation_date=escalation_date
)
The 7-day escalation matters: if the follow-up check has not been completed by then, block payroll processing or generate a priority flag. Continuing to pay a worker without refreshed right-to-work evidence removes the statutory excuse regardless of what the original check showed.
Identity Service Providers for British Nationals
Since April 2022, employers can use certified Identity Service Providers (IDSPs) to conduct digital identity verification for British and Irish citizens, removing the need for in-person document checks. The IDSP must be certified to the UK Digital Identity and Attributes Trust Framework.
This pathway is relevant for remote-first hiring workflows. The IDSP returns a shareable confirmation (not a share code — different system) that the employer retains. Certified IDSPs are listed on the DCMS trust framework register.
Four Common Implementation Gaps
1. BRP accepted as sole evidence for digital-status workers.
BRPs frequently don't reflect current visa conditions after a renewal. Always require a share code check in addition — or instead.
2. No expiry monitoring for time-limited leave.
Workers on Skilled Worker visas who renew get a new share code with a new expiry date. The employer needs to run a fresh check at renewal. Manual spreadsheets miss this.
3. Post-pandemic adjusted check hangover.
Video-only document verification was valid from September 2020 to September 2022. Workers hired in that window whose leave has since changed may need re-verification under current rules.
4. Work restriction parsing.
The online check specifies permitted hours and work types. A Graduate route holder can work any job. A Student visa holder cannot exceed 20 hours per week during term time. If your compliance system does not parse and act on restrictions, you are completing only half the check.
Sponsor Licence Status Is a Separate Check
Right to work checks confirm that a worker can legally work in the UK. They do not confirm that your organisation can sponsor them for a particular route. For sponsored roles, you must hold an active sponsor licence with the correct route — and the licence must remain in good standing.
The public sponsor register is downloadable from the Home Office as a CSV — updated periodically, not real-time. If you are building tooling that covers both verification paths, immigrationgpt.co.uk provides consolidated access to sponsor register data alongside right to work guidance across all UK immigration routes.
This article is for information purposes only and does not constitute legal advice. For complex right to work situations, consult a qualified UK immigration solicitor.
Top comments (0)