Right to Work Checks in 2026: How to Check Staff and Avoid a £60,000 Penalty

Every UK employer has to check that the people it hires are allowed to do the work, and since 1 October 2026 that duty reaches much further than the payroll. New rules under the Border Security, Asylum and Immigration Act 2025 now cover many casual workers, individual sub-contractors and gig platforms as well as employees. This guide is for small businesses that want to get checks right in 2026: the three ways to check, what to copy and keep, how eVisas replaced paper permits, when to re-check, what the new rules mean if you use contractors, and how civil penalties are calculated, with a worked checklist.

Quick answer

Before anyone starts work, check their right to work in one of three prescribed ways: a manual check of original documents, a Home Office online check using a share code, or a check through a certified digital verification service. Copy and date the evidence and keep it for the job plus 2 years. Do it properly and you have a statutory excuse; skip it and you face a civil penalty of up to £60,000 per illegal worker.

• Check everyone, including British citizens, the same way

• eVisa holders can only prove their status online with a share code

• From 1 October 2026 the duty covers workers, individual sub-contractors and online matching platforms

• Re-check people with time-limited permission before it expires

• Penalty starting points: £45,000 first breach, £60,000 repeat

Why right to work checks matter

The law doesn't technically force you to check anyone. What it does is make you liable for a civil penalty if you employ someone who isn't allowed to do the work — unless you can show you carried out a prescribed check before they started. That defence is called a statutory excuse. Get the check right, and even if the person later turns out to have used a convincing forged document, you won't be fined, as long as the forgery wasn't reasonably apparent.

The stakes are high for a small firm. Beyond the fine, the Home Office can publish your business name, refuse or revoke a sponsor licence, trigger reviews of alcohol, late-night refreshment or taxi licences, and in serious or repeated cases seek a closure notice. Knowingly employing an illegal worker, or having reasonable cause to believe someone has no right to work, is a criminal offence with up to five years in prison and an unlimited fine. Directors can also be disqualified.

What changed on 1 October 2026

The Home Office published a new employer's guide and code of practice that came into force on 1 October 2026. They put into effect section 48 of the Border Security, Asylum and Immigration Act 2025, which widened who counts as an "employer" for the Right to Work Scheme. The scheme now applies to anyone who engages an individual:

• under a contract of employment, as before;
• under a worker's contract — for example, a temporary worker an employment business sends to bars and restaurants;
• as an individual sub-contractor — for example, a courier who logs into a delivery app and is paid per drop;
• through an online matching service that puts an individual service provider, such as a cleaner, in touch with customers.

For those new categories, penalties only apply to engagements that started on or after 1 October 2026. A new extended liability regime also lets the Home Office pursue businesses further up a contracting chain, or that allow substitution, in some cases. Genuinely independent businesses are still outside the scheme: a self-employed plumber who advertises to the public and works for many customers, or a designer who contracts through their own limited company, doesn't need checking by the client.

The guide also renames identity service providers. Checks done digitally must now use a Right to Work digital verification service provider (RtW DVSP) listed on the government's register of digital identity and attribute services, under the Data (Use and Access) Act 2025.

The three ways to check

You can ask everyone to prove their right to work, but you can't insist on a particular method. Offer a reasonable choice, and the right method will depend on the person's nationality and status.

Which right to work check to use

Check	Who it suits	What you keep
Manual document check	British and Irish citizens; people with older physical documents	Clear copy of each document plus a dated record of the check
Home Office online check (share code)	Anyone with an eVisa or digital status, including EU Settlement Scheme	PDF or HTML of the profile page showing photo and check date
Digital check via a RtW DVSP	Holders of British or Irish passports, including expired ones up to 6 months past expiry	The provider's output, including any face-match comparison

Manual document check

Who it suits

British and Irish citizens; people with older physical documents

What you keep

Clear copy of each document plus a dated record of the check

Home Office online check (share code)

Who it suits

Anyone with an eVisa or digital status, including EU Settlement Scheme

What you keep

PDF or HTML of the profile page showing photo and check date

Digital check via a RtW DVSP

Who it suits

Holders of British or Irish passports, including expired ones up to 6 months past expiry

What you keep

The provider's output, including any face-match comparison

The Home Office is clear that people with an eVisa can only prove their right to work through the online service. For British and Irish citizens, who can't get a share code, you'll use a manual check or a digital verification service.

1. Manual document check

A manual check has four steps, all completed before work starts:

1. Obtain original documents from List A or List B of the Home Office's acceptable documents. A current or expired British passport, or an Irish passport or passport card, is enough on its own. A UK birth or adoption certificate needs to be combined with official evidence of the person's permanent National Insurance number, which can now be digital — a screenshot from their HMRC account or an official email, for example, but never ask for their password.
2. Check the documents in the holder's presence — in person, or by live video link if you physically hold the originals. Look for tampering, make sure photos and dates of birth are consistent with each other and with the person, check expiry dates and any limits on the type of work or hours, and ask for supporting evidence if names differ, such as a marriage certificate or deed poll.
3. Copy each document so it can't be altered — a photocopy or a locked PDF. For passports, copy every page with personal details, the photo, expiry date and any visa or endorsement.
4. Record the date of the check, either as a declaration on the copy ("The date on which this right to work check was made: …") or as a separate record. Simply writing a date on the copy isn't enough.

You can't rely on a scan or screenshot of a passport, or on seeing it over video without having the original in your hands.

Online share-code check in four steps

1. 1

   Get a right to work share code

   Nine characters, starting with W, valid for 90 days. Codes starting R or S won't work.

2. 2

   Enter it on GOV.UK with their date of birth

   Record your business name in full.

   Open the checking service
3. 3

   Match the photo and read the conditions

   Confirm the person is who the profile shows and that the job fits any hours or work limits.

4. 4

   Save the profile page

   Keep the PDF or HTML for the job plus 2 years.

2. Home Office online check

Ask the person to generate a right to work share code — nine characters, starting with W — from the "View and prove your immigration status" service. Codes beginning with R or S are for renting or other purposes and can't be used. A code lasts 90 days and can be used more than once in that time.

Enter the code and the person's date of birth on GOV.UK's Check a job applicant's right to work service, and record your business name in full. Then check that the photo is the person in front of you (in person, on a video call, or using a DVSP's facial matching), that they have permission to do the work you're offering, and whether any hours or job restrictions apply. Save the profile page as a PDF or HTML file; it shows the date of the check. Viewing the person's own status page, or a printout of it, doesn't count.

3. Digital verification service

You can pay a certified RtW DVSP to carry out the identity part of the check for British and Irish citizens holding a valid passport or passport card, or one that expired no more than six months earlier (the provider reads the chip to verify it). Clipped passports have been cancelled and can't be used. You remain responsible for the check: make sure the provider is on the register, that its output includes the required details, and that the photo matches your worker. If someone doesn't want a digital check, or has no passport, offer a manual check instead.

Worked checklist: hiring a new kitchen porter

Say you run a café and are taking on three new starters next Monday. Here's how the checks play out:

• Tom, a British citizen with an expired passport. He brings the passport in on Friday. You check it's genuine and that the photo is him, copy the personal details page, and add a dated declaration. An expired British passport is acceptable for a manual check. He has a continuous statutory excuse.
• Ana, a Portuguese citizen with EU Settlement Scheme status. She sends a share code starting W. You run the online check on Friday, compare the photo on a video call, see settled status with no restrictions, and save the PDF. No follow-up check is needed.
• Raj, a student with a time-limited visa. His online check shows permission to work with a weekly hours limit during term time. You ask for his university's term dates, rota him within the limit, save the PDF, and diary a follow-up check before his permission expires.

Right to work checklist for each new starter

0/8

• Check done before the first shift — not on day one after work starts
• Same process offered to every candidate, whatever their nationality
• Method chosen: manual (List A/B), online share code (starts with W) or certified RtW DVSP
• Photo matched to the person; dates of birth consistent
• Expiry dates and any work or hours restrictions checked
• Copy or PDF saved in an unalterable format with the date of the check recorded
• Follow-up date diarised for anyone with time-limited permission
• Records kept for the job plus 2 years, then securely destroyed

Share Print

eVisas and the end of BRPs

The Home Office stopped issuing Biometric Residence Permits on 31 October 2024 and replaced them with eVisas, a digital record of immigration status. A manual check of a BRP, including an expired one, no longer gives you a statutory excuse — you must use the online service. Many migrants are also issued a National Insurance number automatically with their visa, and it now appears on their eVisa profile.

If the name or photo on someone's eVisa is wrong or poor quality, the employer's guide says to ask them to update their Home Office account. If the online service fails — an incorrect share code, a technical error, or they can't generate a code — you can use the Employer Checking Service (ECS) where applicable. People with Indefinite Leave to Remain stamped in an old passport can still show that passport for a manual check if it's current, but many will find a share code easier.

Follow-up checks and the Employer Checking Service

If the first check shows unlimited permission — British or Irish citizenship, settled status or indefinite leave — you have a continuous statutory excuse and don't need to check again. If it shows time-limited permission, you must re-check on or before the date it ends if you want to keep employing the person. The follow-up doesn't have to use the same method as the first check.

Sometimes the person has applied to extend their visa before it expired and is waiting for a decision. They usually keep their right to work in the meantime under what's known as 3C leave. If you're reasonably satisfied they have an application, appeal or administrative review pending, your statutory excuse continues for up to 28 days from the expiry date while you get a Positive Verification Notice from the ECS. Ask for evidence such as a Home Office acknowledgement or reference number.

You must also use the ECS when someone has an Application Registration Card, a certificate of application that tells you to verify it, or status issued in Jersey, Guernsey or the Isle of Man. A Positive Verification Notice gives you a six-month statutory excuse, after which you check again. Keep every notice.

If a follow-up check shows someone no longer has the right to work, you lose your excuse if you keep employing them. Report it to the Home Office on 0300 790 6268 and ask for a Unique Reference Number, which also counts in your favour if a penalty is ever considered.

Follow-up check for time-limited permission

Step 1

First check shows an end date

Step 2

Diary a reminder

a month before expiry

Step 3

Re-check on or before expiry

Step 4

Application pending?

up to 28 days to get a PVN from the ECS

Step 5

PVN received

6-month excuse, then check again

If you use contractors, agencies or platforms

The October 2026 changes matter even if every person on your payroll has been checked. Extended liability can make you responsible where:

• you're contracted to provide work or services to a client and you bring in another business to supply the people who do it;
• you run an online matching service and a service provider you list contracts directly with a customer;
• your contracts allow someone to send a substitute to do the work in their place.

To have a statutory excuse in these situations, you must put the prescribed requirements in place before the work starts. Your contracts with suppliers or service providers need written terms requiring them to carry out prescribed checks, banning further sub-contracting without your consent, letting you audit them, letting you suspend or end the arrangement if illegal working is found, and requiring co-operation with Home Office investigations. Where substitution is allowed, each substitute must be checked before they work, you can't leave the check to the worker, and you need identity controls to make sure the person turning up is the person who was checked. Keep evidence: contracts, audit notes, assurances and records of what you did when concerns came up. Our guide to agency workers covers the related employment rules.

How civil penalties are worked out

The Code of practice on preventing illegal working sets the method. First the Home Office asks whether you had a statutory excuse; if you did, you get a No Action Notice. If not, it decides whether this is a first breach or a repeat breach within three years, then applies the mitigating factors.

Worked example. Immigration officers visit a takeaway and find two people working without permission. The owner never checked either of them. It's a first breach, so the starting point is 2 × £45,000 = £90,000. The owner co-operates fully, so each penalty drops by £5,000 to £40,000, a total of £80,000. If the owner had reported concerns about one worker and got a reference number before the visit, that worker's penalty would fall by another £5,000. A business with no history of breaches, good checking practices, a report and full co-operation could get a Warning Notice instead — but only on a first breach.

A civil penalty notice gives you 28 days to respond, and explains how to pay or object. You must object to the Home Office before you can appeal to a court. Paying a penalty doesn't stop the other consequences, such as being named publicly or problems with a sponsor licence.

Avoiding discrimination

Right to work checks must never become a filter on nationality, accent or appearance. Check everyone in the same way, at the same stage — many employers do it once they've made a conditional offer — rather than only the people you assume are migrants. Don't ask candidates to use a particular method, and don't refuse someone because their document is unfamiliar if it's on the acceptable list. Race discrimination claims at a tribunal have no compensation cap, and an inconsistent checking process is one of the easiest things for a claimant to prove.

Fair checking — do and don't

Do	Don't
Check every hire the same way, at the same stage	Only check people you think might be migrants
Accept any document on the official lists	Insist on a passport or a particular method
Give people a reasonable chance to prove status	Reject someone because a share code failed once
Ask sensitively about genuine anomalies	Make assumptions from name, accent or appearance

Check every hire the same way, at the same stage

Don't

Only check people you think might be migrants

Accept any document on the official lists

Don't

Insist on a passport or a particular method

Give people a reasonable chance to prove status

Don't

Reject someone because a share code failed once

Ask sensitively about genuine anomalies

Don't

Make assumptions from name, accent or appearance

Common mistakes

Checking on day one, after work starts. The check must be complete before employment begins, so treat any working trial shift as the start and check before it.

Accepting a BRP or a photocopy. Neither gives you a statutory excuse.

Not keeping the online check PDF. If you can't produce it quickly when asked, it's as if you never did it.

Missing follow-up dates. Diary the expiry date at the first check and set a reminder a month earlier.

Assuming contractors are someone else's problem. Since 1 October 2026, a contract or platform model can bring you into scope. Review your supplier terms and any substitution clauses.

Official links

• Employer's guide to right to work checksIn force from 1 October 2026
• Check a job applicant's right to work (share code)Online check
• Check if someone can work in the UKInteractive tool for manual checks
• Employer Checking ServicePending applications and other cases
• Right to work checklistHome Office checklist
• Illegal working penalties: codes of practiceHow penalties are calculated

What to do next

Build the right to work check into your hiring process so it happens before any offer turns into a first shift, then audit the files of everyone you already employ for missing or undated copies. If you use contractors or a platform model, review your supplier contracts against the extended liability requirements. Once someone has passed their check, give them a compliant written statement of employment particulars on day one, and if you're hiring for the first time, register as an employer with HMRC.

This is general information, not legal or tax advice — confirm on the official source or with a professional.

Frequently asked questions

Do I need to do a right to work check on British citizens?

Yes. To have a statutory excuse against a civil penalty you must check everyone before they start work, whatever their nationality. British and Irish citizens can't get a share code, so you check their original passport (current or expired) or other List A documents in person, or use a certified digital verification service. Checking everyone the same way also protects you from discrimination claims.

How do I check someone's right to work with a share code?

Ask them for a right to work share code, which starts with W and is valid for 90 days. Enter it with their date of birth on GOV.UK's 'Check a job applicant's right to work' service, make sure the photo matches the person, check any work restrictions, and save the profile page as a PDF or HTML file. Codes starting R or S are for other services and won't do.

What is the fine for employing an illegal worker?

The Home Office can issue a civil penalty of up to £60,000 per illegal worker. The starting point is £45,000 per worker for a first breach and £60,000 for a repeat breach within three years, reduced by £5,000 each for reporting and for co-operating. Knowingly employing an illegal worker is a crime carrying up to five years in prison and an unlimited fine.

Can I still accept a Biometric Residence Permit?

No. The Home Office stopped issuing BRPs on 31 October 2024 and replaced them with eVisas. A manual check of a BRP, including an expired one, doesn't give you a statutory excuse. Someone with an eVisa can only prove their right to work through the Home Office online service, so ask for a share code instead.

Do gig platforms and contractors have to do right to work checks?

Since 1 October 2026, yes in many cases. The Border Security, Asylum and Immigration Act 2025 extends the scheme to people engaged under worker's contracts, individual sub-contractors and online matching services such as delivery or cleaning platforms. Genuinely independent businesses and personal service companies contracting with clients are not in scope.

How long must I keep right to work check records?

For the whole time the person works for you and for 2 years after they leave, then securely destroy them. Keep a clear copy of each document checked or the online check result, and a record of the date of the check. Make sure you follow data protection law when storing them.

Sources & verification

Figures on this page were checked against the sources below when it was last reviewed on 9 October 2026. Each rate and limit is stored once with its own official source and review date, and official update channels are monitored daily so changes are picked up. How we verify

1. 1.Employer's guide to right to work checks (1 October 2026) — Home Office · accessed 9 October 2026
2. 2.Code of practice on preventing illegal working: Right to Work Scheme for employers (1 October 2026) — Home Office · accessed 9 October 2026
3. 3.Checking a job applicant's right to work — GOV.UK · accessed 9 October 2026
4. 4.Penalties for employing illegal workers — GOV.UK · accessed 9 October 2026
5. 5.Check a job applicant's right to work: use their share code — GOV.UK · accessed 9 October 2026
6. 6.Preventing illegal working and right to work checks: what changes from 1 October 2026 — Lewis Silkin · accessed 9 October 2026