Right to Work Checks UK Guide

Section A: What are Right to Work Checks?

Right to Work checks are a central part of the UK’s enforcement framework against illegal working. Employers are required to complete these checks for every new hire. The obligation applies across all sectors, regardless of size or recruitment model. The Home Office expects a high, uniform standard of compliance from multinationals and small employers alike. The consequence of a weak or incomplete check can reach far beyond a single recruitment decision. Civil penalties, criminal allegations, sponsor licence sanctions and reputational harm can all follow if an employer cannot show that they took the steps required to establish a statutory excuse.

A Right to Work check is the process an employer is expected to follow to confirm that a prospective worker has permission to work in the UK. When completed correctly it gives the organisation a statutory excuse. This protection shields the employer from liability even if the Home Office later discovers that the worker had no valid status. Without it the employer is exposed to penalties of up to £45,000 for a first breach and up to £60,000 for any repeat breach. For sponsors the consequences can escalate quickly. Illegal working findings often lead to licence suspension or revocation because they raise questions about the organisation’s ability to meet its obligations under the sponsorship system.

The checking system has changed significantly in recent years. Digital status is now the default for most migrants. The Home Office expects employers to rely on the online status checking service for eVisa holders and to work with Identity Service Providers when verifying British and Irish passport holders. Manual checks remain but apply to a far narrower range of documents than before. Digital audits now allow the Home Office to inspect entire workforces remotely. These developments have increased the need for employers to maintain consistent, well understood processes. Caseworkers look for gaps, inconsistencies and outdated practices. These weaknesses are often interpreted as evidence of poor governance rather than isolated mistakes.

An employer’s ability to conduct checks consistently across all sites and departments is also central to compliance. The Home Office treats the organisation as a single legal entity. If one site carries out the correct steps but another does not the employer remains liable. Inspectors focus heavily on cross site variation because it offers insight into the organisation’s culture and oversight. Where they find uneven practice they often escalate investigations and may consider whether the organisation has the capacity to support sponsored workers.

1. Legal Framework

The requirement to prevent illegal working is set out in the Immigration, Asylum and Nationality Act 2006 and accompanying Codes of Practice and official guidance. The Act introduced the civil penalty regime and created the statutory excuse. To rely on this excuse as a defence against enforcement action, the employer needs to complete a compliant check before the worker starts employment. A check completed after employment begins does not protect the organisation. The statutory excuse only exists if the correct method was used, the evidence was saved in the correct format and the check was carried out at the correct time.

The Home Office expects employers to check every prospective worker, including British and Irish citizens. The only variation relates to the checking method. British and Irish citizens can be checked manually or through an Identity Service Provider. Workers with digital immigration status must be checked using the online system and a share code. Workers with pending applications or outstanding appeals require verification through the Employer Checking Service. Using the wrong method means the employer did not conduct a valid check. Caseworkers treat method selection as an indicator of whether staff understand the rules.

Employers also need to understand the separate criminal offence of employing someone they knew or had reasonable cause to believe did not have the right to work. This applies where the employer has concerns about documents or status but proceeds regardless. The threshold for reasonable cause is lower than many assume. While criminal prosecutions are less common than civil penalties, they remain a real risk and can lead to unlimited fines and custodial sentences for individuals within the business.

2. Employer Obligations

Checks are compulsory for all new employees. Skipping checks for British citizens is a common but serious mistake. Many British citizens rely on documents that are out of date or incomplete. Employers who apply different standards to different categories of workers create inconsistent processes. Inconsistency is one of the clearest indicators of weak governance. It also increases the risk of discrimination claims because assumptions about nationality or appearance can influence decision making. A uniform process protects the employer legally and operationally.

Completing checks for every worker ensures that permissions are current. Many migrants have time limited visas and employers need to confirm that they hold valid permission before they start work. Where permission is time limited a follow up check is required before the expiry date. Missed follow up checks are one of the most common reasons the statutory excuse collapses. Employers should not rely on employees to alert them to upcoming expiries. Tracking systems should be used to avoid missing deadlines.

Different categories of workers require different checking methods. Workers with digital status cannot be checked manually. Workers relying on outstanding applications cannot use the online system. Employers must understand which method applies. Where staff rely on habit or guesswork the statutory excuse is lost. Employers should keep up to date with Home Office guidance and ensure that staff understand the distinctions.

3. Penalties for Non-Compliance

An incorrect check exposes the organisation to civil penalties, regardless of whether the employer acted in good faith. Civil penalties are issued per illegal worker. For organisations that recruit at scale even a single oversight can carry significant financial consequences.

Sponsors face additional exposure. Illegal working findings almost always trigger sponsor licence scrutiny. The Home Office may suspend the licence while it investigates. This affects recruitment immediately because the sponsor cannot assign Certificates of Sponsorship during suspension. If the Home Office identifies systemic weaknesses the licence can be revoked. Revocation ends all sponsored employment. Sponsored workers must leave the UK or switch routes. Employers are also barred from applying for a new licence for a set period. For many businesses this scenario creates operational disruption far beyond the initial breach.

Civil penalties also carry reputational consequences. The Home Office publishes a quarterly list of employers who have received civil penalties. Clients, regulators and contracting authorities often review this list. Being named on it can affect tenders, bids and commercial relationships.

Investigations also cause operational strain. Employers may be asked to produce recruitment records, payroll data and communications at short notice. Staff may need to divert time and resource to respond to Home Office requests. Delays or incomplete responses can be interpreted as further evidence of weak governance.

4. Role of Right to Work Checks in UK Immigration

Illegal working is a stated enforcement priority. The Home Office uses the civil penalty regime to influence employer behaviour and deter risk taking. Right to Work checks are considered a frontline control and the Home Office expects employers to execute them consistently.

Digital status has expanded the Home Office’s capacity to detect anomalies. The online system creates a detailed audit trail. Caseworkers can check when a share code was used, whether the profile matched the worker’s details and whether the employer viewed the status at the correct time. They can also cross reference this information with HMRC data. Where discrepancies appear they may begin an investigation without alerting the employer beforehand.

Identity fraud remains a concern. The Home Office expects staff to compare photographs carefully and to question inconsistencies. Employers who rely heavily on manual checks without training are at risk of missing forged documents or identity mismatches.

The use of agencies and supply chain labour adds further risk. The statutory excuse only protects the employer if they hold their own evidence. Agency assurances do not absolve the employer of responsibility.

5. What is the Statutory Excuse?

The statutory excuse is the employer’s only defence against liability. It is created only when the employer completes the correct check using the correct method and saves the correct evidence. The Home Office does not allow partial compliance. If the employer cannot produce evidence, the excuse does not exist.

Digital status has increased the importance of the statutory excuse. Many workers now rely entirely on share codes. Employers must understand how to use the online system and how to verify identity. Common mistakes such as checking the wrong profile or failing to save the evidence correctly will invalidate the excuse.

Follow up checks also form part of the statutory excuse. A correct initial check does not protect the employer indefinitely. When permission expires the excuse lapses. Employers must complete the follow up check before expiry. If permission lapses without the follow up the employer is exposed to penalties even if the worker later receives an extension.

Section B: Types of Right to Work Checks

Right to Work checks now operate across three separate methods. Each method has strict rules, specific evidence requirements and limited situations where it can be used. The Home Office does not treat these methods as interchangeable. Using the wrong one means the statutory excuse is not created even if the worker has valid status. Many civil penalties arise not because employers ignore the rules but because staff apply the wrong method for the worker in front of them or blend elements of different methods. The Home Office expects employers to understand which method applies, complete it correctly and retain evidence that can withstand scrutiny during any digital or onsite audit.

The shift to digital immigration status has made the online check the default for most migrant workers. Manual checks continue but apply to a smaller set of acceptable documents. Identity Verification Technology introduced a parallel route for verifying British and Irish citizens. The variety of methods creates risk, particularly in organisations where recruitment is decentralised or staff rely on outdated assumptions. This section explains each method clearly, the evidence involved and how employers should decide which method applies.

1. Online Right to Work checks

The online check is now the standard method for verifying most migrants because physical documents no longer prove status in many categories. Workers with digital immigration status must use the Home Office online service. The employer enters the worker’s share code and date of birth into the portal, views the individual’s profile and verifies that the photograph matches the person presenting themselves. The profile sets out whether work is permitted and lists any restrictions. Employers need to read these carefully, particularly for sponsored workers and candidates with time limited permission.

The online check applies to anyone who holds:

a. digital eVisa status
b. status under the EU Settlement Scheme
c. a digital Frontier Worker permit
d. digital PBS permission
e. BRP or BRC status that the Home Office has now digitised
f. digital status granted following a recent application

Physical BRPs and BRCs are no longer acceptable evidence. Workers often present them because they still possess the card. Employers who accept them lose the statutory excuse. The Home Office treats this as a straightforward failure.

Identity verification remains the employer’s responsibility. The share code only unlocks the profile. It does not confirm identity. Employers must see the individual in real time via video or in person and check that the image and details match.

Once the profile has been checked the employer must save the full page, including the photograph, the date of the check and the status information. Partial screenshots or missing dates mean the statutory excuse is not created. Evidence must be stored securely and retained for the duration of employment and two years after.

Workers with time limited status require follow up checks. Employers need reliable tracking processes because missed follow up checks are one of the most common reasons the statutory excuse lapses. The online system does not send reminders. It is the employer’s responsibility to monitor expiry dates.

Where a worker cannot use the online service, such as during a pending application, employers must use the Employer Checking Service. Failed attempts to use the online service do not count as a check.

2. Manual Right to Work checks

Manual checks remain lawful but now apply only to a narrow list of acceptable documents set out in the Home Office’s List A and List B. These lists specify which documents establish a continuous statutory excuse and which only establish a temporary one. Employers must not accept documents outside these lists. Workers often present documents that look official but are not acceptable. Accepting them negates the statutory excuse.

Manual checks apply to:

a. British citizens using valid passports
b. British citizens using birth or adoption certificates with National Insurance evidence
c. Irish citizens using passports or passport cards
d. Limited groups holding older types of immigration documentation still recognised by the Home Office

For British and Irish citizens employers may use manual checks, though many now choose Identity Verification Technology because it supports remote recruitment and reduces document handling. However manual checks still need careful execution. Employers must view the original documents, examine them for authenticity and verify identity either in person or through a live video link while the employer physically holds the document.

The employer must make clear and legible copies, including all relevant passport pages and endorsements. The copies must include the date the check was carried out. Missing dates remain one of the most common errors. For List B documents the employer must track expiry dates and complete follow up checks before permission expires. Manual tracking systems such as spreadsheets are prone to omissions, so employers should consider digital alternatives.

Manual checks cannot be used for digital status holders. Printed emails, photographs of documents or legacy BRPs are not acceptable. Employers must direct digital status holders to generate share codes.

3. Identity Verification Technology checks

Identity Verification Technology checks allow employers to verify the identity of British and Irish citizens with valid passports or passport cards using a certified Identity Service Provider. The provider confirms document authenticity and completes biometric matching. This method reduces the need to handle original documents, particularly in remote recruitment.

This method applies exclusively to:

a. British citizens with valid passports

b. Irish citizens with valid passports

c. Irish citizens with valid passport cards

It cannot be used for any other nationality or any migrant category. Identity Verification Technology checks confirm identity, not immigration status, which is why they are limited to British and Irish citizens.

The employer must still complete the final identity match. The provider’s report does not replace this requirement. Employers must meet the individual either in person or via a live video link to confirm that the person presenting themselves matches the individual verified by the provider.

Employers must retain the provider’s report and evidence of the identity match. They must also ensure the provider is certified under the Home Office’s Digital Identity and Attributes Trust Framework. Using an uncertified provider does not create a statutory excuse.

4. When each method applies

Method selection is not optional. Employers need to categorise the worker correctly at the outset.

Digital status holders must use the online check. This includes anyone with an eVisa or status under the EU Settlement Scheme. Employers should ask the worker early and guide them through generating a share code.

British and Irish citizens can be checked manually or through Identity Verification Technology. Employers should adopt one of these as the default and train staff accordingly.

Workers with remaining acceptable physical documents may use manual checks. These categories are diminishing as the Home Office digitises more forms of status, so employers need to keep guidance up to date.

Workers with pending applications or appeals require the Employer Checking Service. Employers must not accept physical documents or attempt manual checks in these cases.

Employers must not mix methods. A single incorrect check cannot be repaired later by carrying out the correct method. The statutory excuse applies only if the correct method was applied at the correct time.

5. Which Type of Check?

The statutory excuse is method specific. A check completed using the wrong method offers no protection. This is why method selection is one of the first things caseworkers examine during audits. Incorrect method selection often signals broader weaknesses in training, governance or record keeping. The Home Office views such patterns as evidence of systemic issues rather than isolated mistakes.

Workers may provide the wrong documents or misunderstand their own status. Employers must verify the correct method independently and guide the worker accordingly. Relying on worker preference or convenience creates risk.

Consistent method selection shows that staff understand the rules. Employers who demonstrate this are viewed more favourably during inspections. Those who cannot explain method selection or who apply methods inconsistently across sites are treated as higher risk.

In practice method selection creates several challenges. Workers often present documents they believe are acceptable. Staff may not feel confident redirecting them. Workers who have recently extended or varied their leave may have a mix of old and new documentation, creating confusion about which method applies.

Digital systems can be unavailable or slow. Without a contingency plan staff may delay checks or choose an incorrect method to progress recruitment. Identity Verification Technology providers vary in their report formats, and employers sometimes fail to check that all required information is present.

Cross site variation is another point of risk. If one site carries out online checks correctly but another relies heavily on manual checks, the Home Office may question the organisation’s overall oversight. Employers need unified processes that do not drift over time or between teams.

Method selection offers caseworkers a clear view of an organisation’s compliance culture. Employers who consistently use the correct method tend to have stronger systems overall. Employers who mix methods or rely on outdated practices often struggle in other areas such as identity verification, evidence retention or follow up tracking.

Inspectors routinely ask staff to explain when each method applies. Staff who cannot answer confidently indicate a lack of training. Inconsistent method selection across sites is treated as weak governance. Outdated assumptions, such as believing BRPs remain valid or that the online service is optional, are red flags that the employer has not kept pace with Home Office requirements.

Inspectors also look at the evidence trail created by each method. Online checks generate digital records. Manual checks create physical evidence. Identity Verification Technology creates third party documentation. Employers who mix methods incorrectly often produce incomplete evidence. Incomplete evidence is taken as a sign that the organisation is not audit ready.

Section C: How to Conduct Compliant Right to Work Checks

A compliant Right to Work check is a legal process with defined steps the Home Office expects employers to follow. It is not an informal glance at documents or a quick look at a digital profile. The statutory excuse only exists if the employer completes the correct method at the correct time and retains the correct evidence. Caseworkers analyse timing, sequencing, identity verification, evidence quality and method selection. Any weakness in these areas can lead to a civil penalty or sponsor enforcement. Employers therefore need a stable, structured and repeatable process that staff understand and follow precisely.

Checks fall into three categories: online checks for digital status holders, manual checks for a narrow group of acceptable documents and Identity Verification Technology checks for British and Irish citizens. Before a check begins the employer must establish which method applies. Once identified, the employer must follow that method exactly. The Home Office does not allow elements to be mixed between methods or steps to be skipped. This section outlines how each method works, how employers should prepare, and the common points where mistakes occur.

1. Preparing for the check

Most errors start before the check even begins. Preparation involves identifying the correct checking method and ensuring that the person responsible is trained, resourced and able to complete the process properly.

The employer should ask the worker simple, direct questions to determine whether they hold digital status, whether the documents they intend to rely on fall within the manual lists or whether Identity Verification Technology is available. Relying on a worker’s assumption about their own status is risky. Workers often do not realise their status has been digitised or do not understand that certain documents are no longer valid.

If the worker needs a share code, they should generate it as early as possible. A share code lasts 90 days, so there is no disadvantage in obtaining it well before the planned start date. Early preparation prevents delays at the point of onboarding.

If a manual check is required, the worker needs to be told which documents are acceptable. Workers frequently present incorrect documents and can become frustrated if this is identified on the day of the check. Clear guidance at the outset prevents this.

If Identity Verification Technology will be used, the employer needs to ensure that the passport is valid and that the worker can complete the verification process promptly.

Staff conducting the check should have access to the online portal, secure storage systems and functioning video technology if the check will be completed remotely. If the employer cannot meet the practical requirements, the check cannot be completed properly.

2. Completing an online check

The online check is now the primary method for migrant workers because most immigration categories rely on digital status. The process must follow the Home Office sequence exactly.

The worker generates a share code and provides it to the employer. The employer enters the code and the worker’s date of birth into the online portal. The system will display the worker’s digital profile. The employer must verify identity by comparing the digital photograph with the individual in real time. This is a core part of the check. Employers who skip this step or who rely solely on the share code undermine the statutory excuse.

The employer must then confirm that the displayed conditions allow the role being offered. Sponsored workers may have restrictions on supplementary work, and some visas allow specific roles only. If the role does not align with the permission, the employer cannot proceed.

The employer must save the full profile page, including the photograph, the status information and the date the check was completed. Saving partial screenshots or failing to capture the date invalidates the statutory excuse. Evidence must be stored securely and remain accessible for audits.

Workers with time limited permission require follow up checks. Employers must record the expiry date and ensure a follow up check takes place before permission expires. The Home Office does not issue reminders. Tracking systems must be maintained internally.

If a worker cannot use the online service because their application is pending or their records are being updated, the Employer Checking Service must be used. Attempting an online check in these cases does not count.

3. Completing a manual check

Manual checks apply only to documents listed in List A and List B. Employers must examine original documents, either in person or via a live video link while physically holding them.

The employer must check that the documents are genuine, unaltered and belong to the worker. They must examine photographs, dates of birth and expiry dates. Any concerns must be raised immediately and resolved before continuing.

The employer must then make clear, legible copies of the relevant pages. For passports this includes the personal details page and any pages containing immigration endorsements. The copy must show the date the check was completed. Missing dates are one of the most common reasons the statutory excuse fails.

If the worker relies on List B documents the employer must note the expiry date and schedule a follow up check. Manual tracking systems are prone to omissions, so employers should consider digital tools to reduce risk.

Manual checks cannot be used for digital status holders. Printed emails, photographs of passports or legacy BRPs cannot be accepted. Employers must direct these workers to generate a share code.

4. Completing an Identity Verification Technology check

Identity Verification Technology checks allow employers to verify the identity of British and Irish citizens using certified Identity Service Providers. This method supports remote recruitment and reduces the need to handle original documents.

The worker completes the verification steps through the provider, who checks the passport’s authenticity and conducts biometric matching. The provider then issues a report. This report alone does not complete the check. The employer must still meet the individual in person or via video to confirm that the person presenting themselves matches the biometric data in the report.

The employer must retain the provider’s report and evidence of this final identity match. They should ensure that the provider is certified under the Home Office’s Digital Identity and Attributes Trust Framework. Using an uncertified provider does not create a statutory excuse.

Identity Verification Technology only confirms identity, not permission to work. This is why it applies exclusively to British and Irish citizens.

5. Managing follow up checks

Follow up checks are required for any worker whose permission is time limited. Employers must track expiry dates accurately and ensure follow up checks are completed before permission expires.

When a worker extends their visa the new status may appear digitally before the decision letter arrives. Employers should direct the worker to generate a new share code. If an extension application is pending the Employer Checking Service must be used. Allowing a worker to continue working without updated evidence exposes the employer to liability for illegal working.

Communication with workers is important. They should understand that their continued employment depends on providing evidence of renewed permission in good time.

6. Record Keeping

Evidence must be stored securely for the duration of employment and for two years after it ends. The Home Office expects employers to follow Appendix D rules.

Evidence should be stored in structured digital systems with controlled access. It should not be stored on personal computers, email accounts or shared folders that are not actively managed. Employers must be able to retrieve evidence quickly if the Home Office requests it. Delays or disorganised storage create the impression of weak governance.

Evidence should never be altered after the check is completed. Employers should save it in a secure, finalised format such as PDF. If evidence appears edited or recreated caseworkers may assume the employer attempted to conceal weaknesses.

When retention periods end, evidence should be destroyed securely with records kept of destruction.

Section D: Common Right to Work Mistakes

Right to Work compliance rarely collapses because an employer disregarded the rules altogether. Problems usually start with ordinary decisions made under time pressure, where staff rely on habit or convenience and drift away from what the Home Office guidance actually expects. Caseworkers focus on these small departures from process because they show how an organisation operates in practice. Once a weak check is identified the Home Office quickly widens its view and looks at how often similar issues appear elsewhere.

Many of the failings that lead to illegal working findings look minor at the time. A check completed the day after a worker starts because they seemed low risk. A share code used without seeing the individual. A physical BRP accepted because the worker insists it is still valid. A follow up check missed because everyone assumed the visa had been renewed. Each of these examples cuts straight across the rules. The good news is that they are predictable, which means they are also preventable if employers put the right controls in place.

1. Mistakes with timing and sequencing

The most common error is timing. Checks are required before any work starts, not after induction or once the person has settled in. The Home Office treats any productive activity as work, which includes shadowing, training and trial shifts. If the check took place after that point the statutory excuse is gone, even if the worker later turns out to have valid status.

Sequencing creates similar problems when permission expires. If a worker’s visa has run out but they have made an in time application, the employer only has protection if they hold a Positive Verification Notice from the Employer Checking Service. Relying on an expired BRP or a promise that an application has gone in does not help. The same applies to follow up checks. As soon as permission expires the original statutory excuse ends. Any work after that date is treated as illegal working if no fresh evidence exists.

To avoid these issues, build the check into the earliest stage of onboarding and lock it into your process so work simply cannot start until evidence is on file. That can be as straightforward as system controls that prevent IT access or payroll set up without a recorded check date. For renewals, avoid relying on staff diaries. Use a central tracking system that flags visa expiry dates well in advance and ties responsibility to a named role rather than to the worker or individual managers.

2. Mistakes with method selection

Civil penalties often arise because the wrong checking method was used. Typical examples include accepting physical BRPs, carrying out manual checks on eVisa holders or trying to combine a manual check with a later online check. None of these combinations meet the guidance. The Home Office expects one correct method that matches the worker’s status at the time of the check.

Identity Verification Technology is another area where errors arise. It is only suitable for British and Irish citizens with valid passports or passport cards. Where it is used for any other nationality, the employer is left without a statutory excuse because the technology confirms identity, not immigration permission.

Prevention here relies on two things. First, a clear internal decision tree that staff follow every time, starting with basic questions about nationality and how the person’s status is held. Second, regular training that explains recent changes, such as the move away from BRPs, so staff do not rely on what used to be acceptable. When a worker offers documents that do not fit the correct method, the process should direct staff to escalate or push back rather than improvise.

3. Mistakes with evidence retention

Another common pattern is that the check itself is done correctly but the evidence is incomplete or difficult to retrieve. Screenshots that do not show the date, online profiles saved without the photograph, unclear passport copies or documents buried in personal inboxes all undermine the statutory excuse. In the absence of clear evidence the Home Office proceeds on the basis that the check did not take place.

Avoiding this comes down to discipline and system design. Evidence needs to be saved in a standard format, in a single agreed location, against the correct person’s record, and it needs to show all elements the guidance requires, including the check date. A centralised digital storage system usually works best. Local folders, paper files or ad hoc saving habits are the quickest route to missing evidence. Routine file reviews or internal spot checks will show quickly whether staff are following the agreed approach or whether gaps are appearing.

4. Mistakes with identity verification

Identity is where many checks quietly fail. The online service confirms a person’s status, but it does not tell you that the person in front of you is the same individual whose profile you are viewing. If the photograph comparison is rushed or skipped altogether the core purpose of the check is lost. The problem is amplified in remote hiring when video quality is poor or when staff rely on a screenshot rather than a live view.

Identity Verification Technology creates similar risks if the employer treats the provider’s report as the end of the process. The provider confirms that the passport presented during the digital journey belongs to a particular person, but the employer still needs to satisfy themselves that the person who turns up for work is that same individual.

The fix is to treat identity as a distinct step in the process. Staff should always view the worker in real time, whether in person or over a good quality video call, and deliberately compare the person’s face to the photo in the online profile or provider report. If there is any doubt, the process should require escalation and a pause on onboarding until the discrepancy is resolved. Training should include practical examples so staff understand what a genuine verification looks like in practice.

5. High risk scenarios in daily recruitment

Certain situations repeatedly give rise to mistakes. Short notice hires increase the temptation to let someone start work before checks are complete. Remote hiring makes it easier for staff to rely on screenshots or scans instead of following the full process. Long serving staff can fall into irregular status if no one is tracking visa expiry dates. Agency and supply chain arrangements are another obvious risk where employers assume someone else has done the checks and never obtain their own copies.

The practical way to manage these scenarios is to treat them as known risks and design specific controls around them. For urgent hires, the rule should be that no start date is confirmed until the check is completed and evidence is saved. For remote hiring, insist on a live video identity step and block the use of documents sent informally by messaging apps or personal email. For agency workers, build into contracts and workflows that you will receive and keep copies of the checks before engagement. For sponsored and time limited staff, central tracking and early renewal planning are non negotiable if you want to avoid expiry surprises.

Getting these controls in place helps manage high risk, as without them, the same patterns repeat, and each repetition gives the Home Office more material to argue that the problem is systemic rather than isolated.

Section E: Summary

Right to Work compliance demands more than completing checks at the point of hire. Employers are expected to maintain a structured, consistent system that works every time, across every site and for every worker. The Home Office now relies heavily on digital audits, data matching and detailed evidence reviews, which means any weakness in method selection, timing, identity verification or record keeping becomes visible quickly. The statutory excuse only protects employers when the correct method is used at the correct time and the evidence is saved exactly as set out in the guidance. If any part of that sequence is missing the organisation is exposed to penalties and, for sponsors, immediate scrutiny of the licence.

The move to digital status has intensified these pressures. Online checks are now the default for most migrants. Physical BRPs no longer prove right to work. Identity Verification Technology has added another route for British and Irish citizens, while manual checks apply to a smaller set of documents than before. Employers need trained staff, reliable internal systems and stable oversight to avoid inconsistent decisions that undermine compliance.

Follow up checks, expiry tracking and secure evidence retention remain high risk areas. Missed dates, poor storage practices or informal document handling can erase an otherwise compliant check. These weaknesses are treated as governance failures, not isolated mistakes.

A compliant environment requires clear responsibilities, documented processes, regular training and active monitoring. Employers who invest in these foundations are better equipped to withstand Home Office inspections and protect their organisation from financial, operational and reputational damage.

Section F: Need Assistance?

Right to Work compliance is a continuous legal obligation, not a quick administrative step. If you are unsure whether your current processes meet Home Office expectations, or if recent audits, staff changes or digital status reforms have exposed weaknesses in your system, early advice will help you control the risk before it escalates.

Our specialists support employers across every stage of compliance, from reviewing checking methods and evidence storage to strengthening internal governance, training programmes and audit readiness. We help organisations fix immediate issues and build systems that withstand inspection, including for sponsors facing licence risk.

If you need clarity, reassurance or strategic guidance on strengthening your Right to Work compliance, contact our team today.

Section G: FAQs

What is the statutory excuse and why does it matter?

The statutory excuse is the legal protection that shields an employer from liability if a worker is later found to have no permission to work. It only exists when the correct Right to Work check is completed at the correct time and the evidence is saved exactly as required. Without it the employer is exposed to financial penalties and, for sponsors, immediate scrutiny of the licence.

Do I need to check British and Irish citizens?

The Home Office expects employers to carry out checks for every new hire regardless of nationality. Skipping checks for British or Irish citizens creates inconsistency, which caseworkers interpret as weak governance and a risk factor for wider non compliance.

Are physical BRPs still acceptable for Right to Work checks?

Physical BRPs and BRCs no longer prove Right to Work. Holders must generate a share code and be checked through the online service. Employers who accept the old cards do not create a statutory excuse.

Can I rely on an agency to complete checks on my behalf?

The statutory excuse only applies if the employer holds its own evidence. Agency assurances do not protect the employer. You need to obtain and retain compliant evidence for every worker you engage.

Does a share code replace identity verification?

A share code unlocks the worker’s digital profile but does not confirm identity. Employers must still see the individual in real time and check that the photograph displayed matches the person presenting themselves.

When should I use the Employer Checking Service?

The Employer Checking Service is required when the worker cannot generate a share code because their application or appeal is pending or because their status is being updated by the Home Office. It is not a substitute for an online check where the worker holds digital status.

What happens if a follow up check is missed?

The statutory excuse ends the moment the worker’s permission expires. If the follow up check was not completed before that date any work done afterwards is treated as illegal working and the employer becomes liable for penalties.

Can I complete an online check weeks before someone starts work?

You can, but you may need to repeat or refresh the check if there is a long gap. A share code is valid for ninety days and the Home Office expects employers to confirm that permission was still valid close to the start date.

Do I still need evidence if the check was completed correctly?

The Home Office will not accept verbal assurances. If evidence cannot be produced quickly and in the correct format the statutory excuse is treated as if it never existed, even if the check was completed properly at the time.

Are remote checks acceptable?

Yes, but the employer must still complete identity verification in real time. Screenshots, informal sharing of documents or poor quality video calls undermine the check. The process must mirror an in person identity match and follow the same evidential rules.

What is the biggest cause of civil penalties?

Most penalties arise from small procedural errors such as using the wrong checking method, missing follow up dates, failing to save evidence correctly or overlooking identity verification. These issues are treated as governance failures rather than minor mistakes.

Section H: Glossary

Section I: Additional Resources & Links