Civil Penalty Notice: Help for Employers

Section A: Overview of Civil Penalty Notices

Employers are liable for a civil financial sanction if they are found to have employed someone who is disqualified from working by their immigration status and the employer cannot show a statutory excuse. The scheme sits under the Immigration, Asylum and Nationality Act 2006 and is administered through the Home Office’s civil penalty framework and the statutory Code of Practice.

The current code applies where the breach occurred on or after 13 February 2024, and works alongside the employer right to work guidance updated on 26 June 2025, which applies to checks carried out on or after 12 February 2025.

The statutory excuse is the employer’s defence against civil liability. Officials should assess this first. If a prescribed right to work check was done correctly before employment started, liability should not arise

1. What is a Civil Penalty Notice?

A Civil Penalty Notice is the formal decision that an employer is liable for a monetary penalty for illegal working. It follows an assessment that a worker did not have permission to do the job in question and that the employer failed to establish a statutory excuse through a prescribed right to work check completed before employment began.

The notice sets out the amount, the calculation used, the workers identified, the due date for payment, and how to object or appeal. The starting point is £45,000 per illegal worker for a first breach and £60,000 per worker for a repeat breach within the previous three years, before any reductions are applied.

Section 15 of the 2006 Act creates civil liability where an employer employs a person who is disqualified from working by their immigration status. The Code of Practice issued under section 19 sets out how liability is determined and how amounts are calculated, including the increase to the current maximum levels.

Section 21 creates the separate criminal offence of knowingly employing an illegal worker or having reasonable cause to believe the person is working unlawfully, which carries an unlimited fine and up to five years’ imprisonment in serious cases.

2. How Breaches are Identified

Cases are usually picked up through compliance visits, intelligence or data sharing. Where a potential breach is found, the employer is served with a Referral Notice and the case moves to officials for consideration. An Information Request then gives the employer a short window to send evidence.

A response within ten days counts as active cooperation and can affect the calculation later. Decisions are issued with a Civil Penalty Notice and a statement of case. Depending on the facts, officials can cancel liability, issue a Warning Notice for a first breach where effective practices are shown, or impose a monetary penalty. The notice also explains payment options, the fast payment discount rules for a first penalty, objection grounds and the county court or sheriff court appeal route.

Section B: Civil Penalty Process

The process follows a set sequence. Officials first decide whether a worker was disqualified from working and whether the employer held a statutory excuse at the point of hire or at any required follow-up. If liability is in scope, the case moves through staged notices and deadlines. Accuracy and timing decide outcomes, so treat each step as an evidence exercise rather than a narrative.

1. Referral Notice

A case starts with a Referral Notice that records the date the breach was identified. That date fixes which code applies and frames the calculation. An Information Request usually follows, giving a short window to submit records. A complete response within ten days is treated as active cooperation, so gather the right to work file for each named worker, the online profile page where digital status was checked, and any internal notes evidencing who did the check and when. Officials then carry out an internal review. Outcomes are cancellation, a Warning Notice for a first breach where effective practices are shown, or a Civil Penalty Notice setting out the amount, due date, calculation, and how to object or appeal.

2. Level of Fine

For breaches identified on or after 13 February 2024 the starting point is £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within the previous three years. The decision maker works through a three-stage framework. Stage one is liability and statutory excuse. Stage two is first or repeat breach using the three-year lookback. Stage three is calculation and outcomes. Mitigations apply in pounds not percentages: £5,000 per worker for self-reporting with a URN, £5,000 per worker for active cooperation. For a first breach only, where records show effective right to work practices, a Warning Notice can replace a monetary penalty. Officials record each step of the calculation in the notice, so check the arithmetic, the lookback period, and whether claimed mitigations were credited.

The code that applies is fixed by the date the breach occurred, and the Referral Notice will specify the date officials identified the breach. That date drives the penalty levels and the calculation framework, so it should be checked against the employer’s records and the workers named.

3. Paying the Fine

A first penalty can qualify for a fast payment reduction of 30 per cent if paid in full within 21 days. This is separate from the £5,000 mitigations and does not apply to repeat breaches. Some employers choose instalments for cashflow reasons. Payment plans are usually available for up to 24 months via the Home Office shared services team, however instalments do not attract any fast payment reduction. Keep proof of payment and reconcile it to the internal case log.

4. Objecting to the fine

An objection is a short, structured review request. File it in writing within 28 days of the date of the Civil Penalty Notice (or as specified on your notice). Keep to the recognised grounds: not liable, statutory excuse, or penalty too high because the calculation is wrong or mitigations were not applied. Evidence carries the weight, so attach the right to work copies, the online profile pages, and any documents that show who did the check and on what date. If the penalty is maintained or varied, the Objection Outcome will start a fresh 21-day clock for any fast payment on a first penalty.

5. Appealing the Decision

If the objection outcome is not accepted, an appeal lies to the County Court, or the Sheriff Court in Scotland, within 28 days. The court considers liability, statutory excuse, and the reasonableness of the amount. Parallel to this, unpaid penalties progress to civil recovery, court registration, and enforcement. Publication follows once objection and appeal routes are exhausted and there is no payment or plan in place, and also for later penalties after routes are exhausted, even where payment is made. Those public lists can have immediate commercial effects, so treat timelines as a priority.

Section C: If you’ve received a Civil Penalty Notice

Once a Civil Penalty Notice arrives, deadlines start running immediately. Every detail in the document matters. The notice states the names of the workers, the breach identification date, the due date for payment, and the calculation used. Those dates govern which code applies, how much is owed, and when any objection or payment has to be made. Treat the notice as both a legal demand and a compliance trigger.

Start by reviewing it line by line. Check whether the listed workers were your employees, whether the right to work evidence is on file, and whether the checks were done correctly and on time. Confirm the date of employment against the issue of the notice and any recheck dates if permission was time-limited. A missing or misfiled document can often be found or reconstructed if you act quickly. Build a short internal timeline and keep copies of all correspondence in one file.

1. Respond in time

There are three basic options: pay, object, or appeal. If you accept the decision and the penalty is a first breach, paying in full within 21 days qualifies for the fast payment reduction of 30 per cent. For larger penalties or cashflow constraints, you can request an instalment plan of up to 24 months through the Home Office shared service team, although this does not attract any discount.

If you believe the Home Office is wrong—because a statutory excuse applies, the worker was misidentified, or the calculation is flawed—prepare an objection instead. Objections must be made in writing within 28 days of the date of the Civil Penalty Notice (or as specified on your notice). Use the official Civil Penalty Objection Form and attach supporting evidence. If the Home Office upholds the objection in part, it will issue a varied notice; if it rejects it, you then have 28 days to appeal to the County Court or Sheriff Court.

2. Mitigating Factors

Before deciding whether to object, review whether mitigation has already been applied. The Home Office allows £5,000 per worker for self-reporting a suspected breach with a unique reference number, and £5,000 per worker for active cooperation during the investigation, such as providing complete records within the 10-day Information Request window. For a first breach, if the employer can also demonstrate effective right to work systems, a Warning Notice may be issued instead of a monetary penalty. If any of these factors were missed, highlight them in the objection.

3. Protect your position while responding

Notify your insurer if your policy covers regulatory penalties or investigation costs. Record all communication with the Home Office and keep it factual. Avoid contacting the workers named in the notice directly unless HR and legal have reviewed the risks. Sponsors should alert their key personnel and review the sponsor licence for any related compliance vulnerabilities. Run a rapid audit of all current employee right to work files, not just those named in the notice, to show active remediation. If any status is uncertain, use the Employer Checking Service and retain the Positive Verification Notice with the validity dates.

4. Gather Evidence

Build a single evidence pack. Include copies of right to work documents or online profile pages showing the date and result of the check, signed and dated by the checker. Include internal records identifying who carried out the check and when. Present it chronologically and label each item.

In the covering letter, deal with the Home Office grounds directly: whether you are not liable, have a statutory excuse or believe the calculation is wrong. Keep the language concise and professional.

If you are making payment, retain proof of transfer and confirmation from the Home Office account system.

5. Plan for next steps

If the Home Office maintains the penalty, note the new deadlines in the Objection Outcome. If you appeal, gather legal representation early as the court process involves formal pleadings and evidence exchange. Even while appealing, keep compliance activity running. Expect a follow-up compliance visit, and treat it as a chance to demonstrate improvements. Update training, tighten document retention, and review agency labour supply arrangements. Record these actions; they can influence any future Home Office assessment.

A Civil Penalty Notice is not the end of the process but the start of a short window to limit impact. Fast, accurate assessment and evidence-based decisions can reduce exposure and show regulators that your systems are being corrected, which can prove as valuable as the financial outcome itself.

Section D: Consequences of Immigration Non-Compliance

The impact of immigration breaches extends far beyond the fine itself. Civil penalties, criminal liability, licence downgrades, and reputational damage can each threaten business continuity. The Home Office now takes a layered approach to enforcement, linking civil penalties, sponsor compliance action, and criminal prosecution where evidence shows deliberate or repeat breaches. Employers who treat right to work checks as a box-ticking exercise risk a cascade of operational and regulatory consequences.

1. Financial and operational impact

The immediate exposure is financial. The starting point for a first breach is £45,000 per illegal worker, and £60,000 for a repeat breach within three years. Where payment is late or unpaid, the penalty becomes recoverable as civil debt through the County Court. Judgments can affect credit, financing, and contractual eligibility for public tenders. The Home Office publishes the names of employers with unpaid or repeat penalties once objection and appeal routes are exhausted, which can damage commercial reputation overnight.

The operational disruption can be just as serious. Senior managers are drawn into audits, legal reviews, and record reconstruction while hiring freezes or licence restrictions halt recruitment. The costs of retraining HR and rebuilding compliance systems can easily surpass the penalty amount. If the business relies on sponsored workers, the risks multiply because licence action can immediately affect the right to employ overseas staff.

2. Sponsor licence enforcement

For sponsors, any finding of illegal working or receipt of a civil penalty can trigger a Home Office compliance action plan. The Sponsor Management System will record the event and the licence may be downgraded from A-rating to B-rating pending improvement. During that period, the business cannot assign new Certificates of Sponsorship until the action plan is completed and approved. In more serious or repeat cases, the licence may be suspended or revoked entirely.

Revocation stops the business from sponsoring any workers. Existing sponsored staff have their permission curtailed and must find new sponsors or leave the UK. This can create sudden gaps in operations, delayed projects and contract failures. Restoring a licence is rarely quick or guaranteed, as the Home Office expects to see structural reform rather than quick fixes. Taking advice is recommended to understand your options and the steps to take to enable you to resume normal operations as quickly as possible.

3. Criminal liability and director exposure

Where an employer knows, or has reasonable cause to believe, that a worker does not have permission to work, liability moves into the criminal regime under section 21 of the 2006 Act. Conviction can lead to an unlimited fine, imprisonment of up to five years, and director disqualification. The Home Office can also pass information to other regulators, such as the Insolvency Service or professional bodies, which can lead to parallel disciplinary action.

For individuals, this can mean loss of personal reputation and future disqualification from acting as a company director or senior manager of a licensed sponsor. The threshold of “reasonable cause to believe” is lower than many assume; ignoring expired documents, failing to follow up on visa expiry reminders, or accepting inconsistent information can all qualify.

4. Reputational and workforce consequences

Civil penalties and licence actions are public and carry lasting reputational effects. Media coverage, government press releases, and published penalty lists often appear in search results for years. Clients and supply-chain partners may impose additional audit or warranty requirements before renewal. Recruitment can become harder, particularly in regulated or public-sector supply chains. Internally, morale and confidence can suffer as staff perceive the organisation as under investigation.

Where a licence is lost or suspended, sponsored employees are forced to leave roles, leading to disrupted teams and service continuity issues. Projects can stall while new workers are sourced or visa transfers arranged. The administrative workload involved in clearing those issues often occupies senior management for months.

5. Wider compliance obligations

A civil penalty record often prompts the Home Office to share intelligence with other government agencies. This can lead to unannounced visits or audits from HMRC, the Gangmasters and Labour Abuse Authority, or the Care Quality Commission where relevant. It also increases the likelihood of follow-up inspections under the illegal working regime. For larger organisations, this can extend into sector-specific regulators assessing governance and fit-and-proper standards.

Employers who demonstrate immediate corrective action after a breach stand a better chance of retaining their licence and avoiding repeat penalties. Recording remediation steps, strengthening internal oversight, and commissioning independent audits can provide persuasive evidence in future Home Office reviews.

Immigration compliance failures now reach into every aspect of business governance. Financial sanctions are only the start; the true cost is often the operational delay, licence risk, and reputational loss that follow. Treating right to work checks and licence duties as continuous controls rather than annual exercises is the most reliable way to contain those risks.

Section E: Avoiding Civil Penalty Notices

Avoiding civil penalties is about designing systems that remove discretion and error from the right to work process. Prevention is cheaper than cure, and the Home Office expects employers to demonstrate not just that checks are carried out, but that they are integrated into day-to-day recruitment and HR controls. The statutory excuse exists to protect employers who can show that prescribed checks were completed correctly and on time. The strongest protection comes from embedding those checks as routine practice.

This is all against the backdrop of increasing Home Office enforcement activity, making an even stronger case for proactive compliance.

1. Conducting compliant right to work checks

Every employer in the UK is legally required to confirm that each employee has the right to work before employment begins. There are three recognised methods under the Home Office employer guidance updated on 26 June 2025 (applying to checks on or after 12 February 2025):

• Manual checks – inspecting and copying original documents such as a valid British or Irish passport or other acceptable immigration document in the presence of the individual, either physically or over a live video link where permitted. The employer must still hold the original document and make the copy themselves.
• Online checks – using the Home Office online right to work service for individuals who hold a biometric residence permit, biometric residence card, frontier worker permit, or digital immigration status (eVisa). Physical cards are no longer acceptable proof of right to work.
• Digital checks – using a certified Identity Service Provider (IDSP) that meets the Good Practice Guide 45 (GPG 45) standard for identity assurance. This method applies only to British and Irish citizens with valid passports or passport cards. The employer remains legally responsible for the outcome even when using an IDSP.

For online and IDSP checks, employers should save and securely store the profile page or confirmation output showing the date the check was carried out and the permission outcome. For manual checks, a clear, legible copy of the document must be made, signed and dated, and retained for the period of employment and two years after it ends.

2. Maintaining the statutory excuse

A statutory excuse only exists if the prescribed check is carried out correctly before the person starts work, and repeated where their permission is time-limited. Employers need a system that flags visa expiry well in advance and prompts re-checks at least 14 days before the due date. Where an application or appeal is pending, use the Employer Checking Service and retain the Positive Verification Notice as evidence of temporary protection.

Incomplete, outdated, or incorrectly recorded checks can void the statutory excuse. Each record should clearly show the date of the check, the identity of the checker, and the document or digital result verified. Digital record-keeping is acceptable provided the copies are clear, accessible, and backed up securely.

3. Embedding compliance into HR practice

Compliance is sustained through structure, not intent. Employers should:

• Train all hiring and HR staff on current right to work guidance and how to identify acceptable documents.
• Run periodic internal audits, at least annually, sampling both new starters and long-term staff.
• Maintain a central tracker for visa expiry and re-check dates, accessible to HR and line managers.
• Keep a written policy explaining who carries out checks, how they are recorded, and escalation routes for anomalies.
• Record and close out all compliance incidents, noting remedial action and any communication with the Home Office.

Automation helps but does not replace accountability. Where labour is supplied by agencies or contractors, ensure contracts require compliant checks and give audit rights over those records, as liability remains with the end-employer.

4. Aligning sponsor licence and right to work systems

For sponsor licence holders, right to work compliance should mirror sponsor management duties. Information recorded on the Sponsor Management System needs to match HR files and visa tracking systems. Assigning and monitoring Certificates of Sponsorship, keeping contact details up to date, and recording work location changes all feed into the same compliance picture. Consistency across systems reassures Home Office officers that the business controls are joined up.

When sponsor licence and right to work processes operate on different platforms, build cross-checks so that updates in one trigger reviews in the other. Aligning these controls makes internal audits faster and prevents simple data errors from escalating during a Home Office visit.

5. Continuous monitoring and improvement

Compliance frameworks need to evolve with policy changes. The rollout of eVisas and the gradual withdrawal of physical documents means the Home Office will rely entirely on digital checks in coming years. Employers should review systems regularly, update training material when new guidance is issued, and document every change. Keeping a compliance log that records updates, audit findings, and remedial steps creates an evidential trail that can be used to show proactive management if the Home Office investigates.

Right to work compliance is not a one-off event. When the process becomes routine and traceable, the risk of civil penalties falls sharply, and the business can demonstrate to the Home Office and clients that its workforce controls are sound.

Section F: Summary

The civil penalty regime places the responsibility for preventing illegal working squarely on employers. It is a compliance framework built around proof—proof that right to work checks were carried out, proof that records were kept, and proof that controls are ongoing. Financial penalties are only one risk. Licence loss, criminal prosecution, and reputational harm can follow if breaches are repeated or systemic.

Employers can manage these risks through structure and discipline. Integrate right to work checks into onboarding, train HR and managers regularly, and align record systems so evidence can be produced at short notice. When a Civil Penalty Notice is received, act quickly, gather evidence, and decide whether to pay or challenge within the time limits. Swift, informed engagement can make the difference between a reduced penalty and lasting damage to your business.

Maintaining compliance is not just about avoiding fines. It protects the organisation’s ability to trade, hire, and plan for the future. A transparent and well-documented approach to right to work checks shows clients, regulators, and employees that the business takes its obligations seriously and understands that compliance underpins trust.

Section G: Need Assistance?

Deadlines are tight and the first decision can set the tone. Take advice quickly so the notice, evidence and timelines are reviewed together.

We have extensive experience in helping employers through the civil penalty process. We will test every ground for challenge, including not liable, statutory excuse and penalty level, and confirm whether fast payment or an objection is the better route in your case.

Book a fixed-fee telephone consultation and speak to one of our legal advisers.

Section H: FAQs

What is the maximum civil penalty for employing an illegal worker?

The Home Office can impose up to £45,000 per illegal worker for a first breach and £60,000 for a repeat breach within three years. These levels apply to breaches identified on or after 13 February 2024. The exact amount depends on whether the employer self-reported, cooperated, or showed effective right to work practices that could justify a warning instead of a penalty.

How do I challenge or appeal a Civil Penalty Notice?

You can object in writing within 28 days of the date of the Civil Penalty Notice (or as specified on your notice). Use the official Civil Penalty Objection Form and include evidence such as right to work checks, online profile pages, or Employer Checking Service results. If the objection is rejected or only partly accepted, you can appeal to the County Court (or Sheriff Court in Scotland) within 28 days. If successful, the court can cancel or reduce the penalty.

Can I reduce my penalty if I cooperate with the Home Office?

Employers that actively cooperate, by responding to information requests within ten days, submitting complete records, and correcting errors, may qualify for a £5,000 reduction per illegal worker. A further £5,000 reduction applies for self-reporting the suspected breach with a Home Office reference number. A first-time offender who also shows effective right to work systems can receive a warning rather than a monetary penalty.

Does paying quickly make a difference?

A first-time penalty qualifies for a 30% fast payment reduction if paid in full within 21 days of the notice date. Instalments can be agreed over up to 24 months, but they do not attract any discount. Keep written confirmation of all payments as part of your audit trail.

What happens if I ignore the notice or miss a deadline?

If you do not pay, object, or appeal within the set deadlines, the penalty becomes enforceable as civil debt. The Home Office can register the debt with the County Court, issue enforcement action, and publish your company details on its penalty list. Once published, removal is only possible after full payment and expiry of the appeal period.

How long should I keep right to work records?

Records should be kept for the entire period of employment and for two years after it ends. For online checks, retain the profile page showing the verification result and date. For manual or IDSP checks, keep clear copies of the verified documents and record the check date. Records can be stored electronically as long as they are legible and retrievable.

What if a worker’s visa is expiring soon?

You need to recheck before the expiry date. If the worker has applied to extend or vary their permission, use the Employer Checking Service to obtain a Positive Verification Notice, which confirms temporary right to work for six months. Schedule a follow-up reminder before that notice expires and keep a copy on file.

How does a civil penalty affect my sponsor licence?

A civil penalty can trigger immediate compliance action. The licence may be downgraded, suspended, or revoked. During suspension, you cannot assign new Certificates of Sponsorship. A revoked licence ends sponsorship of all workers and requires them to find a new sponsor or leave the UK. Even a downgraded licence can restrict recruitment and delay renewals.

Can the Home Office visit again after I’ve paid?

A paid penalty does not close scrutiny. Follow-up visits are common to test that compliance systems have improved. The Home Office may request further evidence or conduct unannounced inspections, particularly where sponsored workers are employed. Keeping records accurate and training current will help show that remedial measures are working.

Is criminal prosecution likely?

Criminal prosecution is reserved for employers who knowingly employ someone without permission to work or have reasonable cause to believe they are working illegally. It requires proof of intent or deliberate disregard. Conviction can result in an unlimited fine, imprisonment, and director disqualification, and the reputational damage is lasting. Proper right to work systems remain the best safeguard.

Section I: Glossary

Section J: Additional Resources & Links