The manager's guide to right to work checks
Right to work checks are a legal duty on every employer, for every new employee.
Getting a right to work check right protects your business and your new starter alike. This guide sets out the three ways to check someone's right to work, the process that establishes your statutory excuse, when a follow-up check falls due, how long to keep your records, and the civil penalty you are protecting your business against.
Your legal duty to check right to work
- Carry out a right to work check on every person before they start work for you, not only those you think may need a visa.
- The duty has applied to employers since 29 February 2008, under the Immigration, Asylum and Nationality Act 2006.
- Apply the check consistently to every new starter. Home Office guidance is explicit that you must not decide who to check based on colour, nationality, ethnic or national origin, accent, surname or how long someone has lived in the UK.
- From 1 October 2026, an updated Home Office code of practice extends the right to work check duty beyond direct employees to certain contractors and individuals engaged through supply chains, under the Border Security, Asylum and Immigration Act 2025.
The manual document check
- Obtain original documents from List A or List B of the Home Office's acceptable document list.
- Check the documents in the presence of the holder, in person or by live video call. Either way, you must be in physical possession of the original documents while you check them.
- Confirm the photograph and date of birth are consistent across the documents and with the person in front of you, and that any expiry date for permission to work has not passed.
- Make a clear copy of each document in a format that cannot be manually altered, such as a PDF or scanned image, and keep it along with a note of the date you carried out the check.
The Home Office online check
- Ask the employee for their right to work share code, a 9-character code they generate themselves through the Home Office's online service.
- A share code is valid for 90 calendar days from when it is issued, so use it promptly.
- Enter the share code together with the person's date of birth at gov.uk to view their right to work status, including any time limit on their permission to work.
- Retain the online check result securely, for example as a PDF or screenshot, and record the date you carried out the check.
Digital identity checks for British and Irish citizens
- An Identity Service Provider (IDSP) uses Identity Document Validation Technology (IDVT) to verify a British or Irish passport and confirm the applicant's identity, without you needing to see the physical document.
- Using an IDSP is optional for these checks, but the Home Office recommends choosing one certified under the UK Digital Identity and Attributes Trust Framework (DIATF).
- You must still satisfy yourself that the IDSP has carried out its check in line with Home Office guidance, and retain a copy of the check result.
- Certified providers are listed on the Home Office's register of digital identity and attribute services, and must pass an annual audit and biennial recertification to stay listed.
What makes a check valid
- Use one of the three prescribed methods: a manual document check, a Home Office online check, or a check via a certified IDSP.
- Complete the check before the person's employment starts.
- Follow every step required for the method you use, including the presence and possession rules for a manual check, or the correct provider process for a digital check.
- Keep a dated record that shows exactly which check you carried out and when.
Follow-up checks for time-limited permission
- If someone's permission to work is time-limited, for example shown by a List B document or an online check with an end date, diarise a follow-up check before that date if they are continuing to work for you.
- No follow-up check is needed once someone has shown indefinite leave to remain, settled status, or another form of permission with no time limit.
- If they have applied to extend or vary their permission, or have an appeal or administrative review pending, a 28-day grace period applies from the expiry date.
- During that grace period, use the Home Office Employer Checking Service to request a Positive Verification Notice, which itself gives a statutory excuse for six months.
The civil penalty for getting it wrong
- The civil penalty is up to £45,000 per illegal worker for a first breach.
- It rises to up to £60,000 per illegal worker for repeat breaches. Both figures have applied since 13 February 2024.
- The exact amount for a specific case depends on the factors set out in the Home Office's Code of Practice on preventing illegal working, such as whether you reported your suspicions yourself.
- Where an employer knowingly employs someone disqualified from working, or has reasonable cause to believe they are, this is also a criminal offence carrying up to five years' imprisonment, an unlimited fine, or both.
The statutory excuse: how a correct check protects you
- Under the Immigration, Asylum and Nationality Act 2006, an employer who has complied with the prescribed requirements is excused from the civil penalty.
- This excuse applies even where a document accepted in good faith is later found to be false, provided the check was carried out correctly.
- The excuse is lost if you knew, at any point during the employment, that the person did not have the right to work.
- A List A document, or a compliant digital check for a British or Irish citizen, gives a statutory excuse for the duration of that person's employment. A List B document gives an excuse only until the follow-up check falls due.
Record-keeping: what to keep and for how long
- Keep a copy of every document or online check result securely, electronically or in hard copy, in a format that cannot be manually altered.
- Record the date on which you carried out each check.
- Retain the records for the duration of the person's employment and for a further two years after they stop working for you.
- Securely destroy the records once that retention period ends.
Getting right to work checks right
- Check every new starter before they begin work, applied consistently and without assumptions about who might need it.
- Use a manual check, the Home Office online service with a share code, or a certified IDSP for British and Irish passport holders.
- Follow the correct process for whichever method you use, including the presence and possession rules for manual checks.
- Diarise follow-up checks for time-limited permission, and use the Employer Checking Service during the 28-day grace period if needed.
- Keep dated, unalterable copies of every check for the duration of employment plus two years.
- A correct check gives you a statutory excuse against the civil penalty, up to £45,000 for a first breach and £60,000 for a repeat breach, even if a document later proves fraudulent.
How Jamie HR helps
- Right to work records stored securely against each employee, with the check date logged automatically.
- Follow-up reminders for time-limited permission, so a recheck is never missed.
- Document storage that keeps copies in an unalterable format for as long as you need them.
- Onboarding checklists that build the right to work check into every new starter's process.