Right to Work Checks 2026: The Employer’s Guide

On This Page

The position in 2026

What Changed, and What You Must Do Now

Two things have moved since most employers last reviewed their process. The physical documents that used to sit in a personnel file have gone digital, so for anyone subject to immigration control the only check that works is an online one. And from 1 October 2026 the duty stops being one owed by employers about employees, and becomes one owed by engagers about a far wider set of working relationships.

The mechanics have not become harder. There are three ways to run a compliant check, and which you use is decided by who is in front of you rather than by preference. What is less forgiving is the margin for error: a check run on the wrong document, or after the first day of work, gives you nothing at all.

The Duty in Law

The obligation sits in sections 15 to 25 of the Immigration, Asylum and Nationality Act 2006. Section 15 creates the civil penalty for employing a person disqualified from that work by their immigration status. It is a strict liability scheme: you do not have to know, suspect or be careless. If the person cannot lawfully do the work and you cannot show a statutory excuse, the penalty follows.

The excuse is the whole point of the exercise. It is not a defence you assemble after a visit; it is a state you are either in or not in on the day the person starts, created by having run the correct check, in the correct way, before employment began, and kept the evidence. Section 21 sits behind it as a criminal offence for employers who know, or have reasonable cause to believe, that the person is disqualified.

Three Routes to a Compliant Check

The Home Office recognises a manual document check, an online check using a share code, and a digital identity check performed by a certified identity service provider. Each produces a statutory excuse only if completed in full. Partial compliance — the right document seen but no copy retained, or a copy retained but taken after the start date — produces no protection whatever.

eVisas, BRPs and Expired Documents

Immigration status is now held digitally. A person granted permission holds an eVisa — a record in their UKVI account — rather than a card. Biometric residence permits are no longer issued, and the cards that remain in circulation have expiry dates that have long since passed. That last point is where most avoidable penalties now come from.

Dates That Still Bite

Most of the transition is now history. What still matters to an employer is a short list: which documents are dead, which are alive, and what to do when someone presents the wrong one. A cancelled passport — one with its corner clipped — cannot prove a right to work, and neither can an expired card.

Key Dates for Employers

How a Share Code Works

A share code is a time-limited key the individual generates from their own UKVI account and passes to you. It is valid for 90 calendar days and can be used as many times as needed within that window. You then enter it, with the person's date of birth, on the Home Office check a job applicant's right to work service.

Running Each Check Step by Step

Each route has its own sequence, and the sequence is what the Home Office examines if a penalty is contested. The common thread: see the evidence, satisfy yourself it relates to the person in front of you, and record what you did with a date on it.

Manual Checks for British and Irish Citizens

A manual check is available where the person holds a current passport, or a passport that has expired but was issued by the UK or Ireland, along with the other acceptable combinations in the guidance. You must see the original in the person's presence, check that the photograph and date of birth are consistent with their appearance and any other documents, and take a clear copy. The copy is dated and retained; an undated copy is evidence of nothing.

Online Checks Using a Share Code

For anyone subject to immigration control, the online route is the only route. You enter the share code and the person's date of birth, and the service returns a profile photograph together with the permission and any conditions attached to it. Read the conditions rather than skipping to the outcome: permission to be in the UK is not the same as permission to do the particular work, and a restriction on hours is a restriction you are expected to observe.

You then satisfy yourself that the photograph is the person before you, and retain a clear copy of the response. Where the response shows time-limited permission, note the expiry date at the same time — that is the moment the follow-up check gets diarised, not later.

Identity Service Providers and Digital Checks

British and Irish citizens holding a valid passport may be verified through a certified identity service provider using digital identity technology. The provider carries out the identity verification and returns the result to you. You must still satisfy yourself that the photograph and biographic details returned are consistent with the individual presenting for work, and retain a clear copy for the employment plus two years.

One point is routinely misunderstood, and it is expensive. Outsourcing the check does not outsource the liability. If the person is later found to be working without the requisite permission, it is you rather than the provider who is liable for the civil penalty.

How Your Worker Proves Their Status

Employers lose time explaining this badly, so it is worth setting out plainly what the individual does. They sign in to their UKVI account, select the option to prove their right to work to an employer, and generate a code. They pass you the code; you run the check. A screenshot of their status is not a substitute and would give you no statutory excuse.

Two points prevent most of the friction. The code is theirs to generate and cannot be created by you. And because it lasts 90 days, a candidate who generated one early in a long recruitment process may need a fresh code by the time an offer is made — check it is still live before you rely on it, not after.

When to Use the Employer Checking Service

Some people cannot produce acceptable documents or a share code through no fault of their own: an application, appeal or administrative review is outstanding, they hold an Application Registration Card, or their circumstances place them within the Windrush arrangements. In those cases you ask the Home Office directly, through the Employer Checking Service.

What you are looking for is a Positive Verification Notice. That notice, and only that notice, establishes the statutory excuse in these cases. It is time-limited: the excuse expires six months from the date of the notice, at which point a follow-up check must be carried out. Diarise that date when the notice arrives.

Avoiding Discrimination While You Comply

The immigration duty sits alongside the Equality Act 2010, and employers who over-correct on one create liability under the other. The Home Office publishes a separate code of practice on avoiding unlawful discrimination while preventing illegal working, and a tribunal will read it.

New Working Arrangements from October

Section 48 of the Border Security, Asylum and Immigration Act 2025 extends the illegal working provisions well beyond conventional employment. It comes into force on 1 October 2026, and from that date references to employment and employers in sections 15 to 24 of the 2006 Act reach three further categories.

The draft code of practice, published on 30 June 2026, states that penalties in these new categories will apply where the engagement commenced on or after 1 October 2026, and offers no grace period for them. A draft employer's guide followed on 16 July 2026. Until both take effect, the operative guidance remains the employer's guide of 26 June 2025.

If you use casual, freelance or platform labour, the work to do before October is to map who you engage and on what basis, because the answer decides whether the duty reaches them at all. Those same individuals hold most ordinary employment rights whatever their immigration position, which our note on work rights for migrants sets out. Our note on what is in force and what is coming for employers puts this in the wider sequence of change.

What a Breach Costs

The civil penalty regime works from published starting points rather than a tariff. A first breach starts at £45,000 per worker and a repeat breach within three years starts at £60,000, which is also the statutory maximum. Mitigating factors — reporting a suspected illegal worker before the Home Office finds them, and active co-operation — reduce the figure, and on a first breach a combination of mitigation and effective checking practices can produce a warning notice instead of a penalty. The code of practice sets out how the calculation runs.

Civil Penalties and Criminal Liability

Alongside the civil scheme sits the criminal offence. It bites where the employer knew, or had reasonable cause to believe, that the person was disqualified — a materially different threshold from the strict liability civil penalty, and one met more often than employers expect where warning signs were ignored.

Penalties and Consequences

A penalty is not the end of the matter. Sponsor licence holders face separate consequences from the same facts, and a notice can be objected to and then appealed. If you have received one, our guide to challenging an illegal working civil penalty sets out the route, and licence holders should read it alongside our note on sponsor licence compliance.

Keeping Your Statutory Excuse

An excuse established correctly can still be lost. It is lost by letting time-limited permission lapse unchecked, by destroying the evidence too early, or by never having had it because the check was run after the start date. Each of those is a process failure rather than a legal one, which is why the process is worth writing down.

Establishing the Excuse Before Work Starts

Complete the check before the first day. Record the date you carried it out on the copy itself, in a form that cannot be back-dated credibly. Keep the copy securely for the duration of the employment and for two years after it ends, then destroy it securely — retention beyond that period creates a data protection problem rather than a compliance benefit.

Follow-Up Checks for Time-Limited Permission

Where permission is time-limited, a follow-up check must take place on or before the date the permission ends if the person is to keep working for you. In practice this means the expiry date goes into a diary system at the moment of the first check, with a reminder far enough ahead to allow for an outstanding application and, if needed, an Employer Checking Service request.

Where the individual has applied to extend before their permission expired, they may continue working while the application is pending — but your excuse in that period comes from a Positive Verification Notice, not from the expired permission. Employers who are recruiting internationally should read this alongside our business immigration services.

Frequently asked

Questions about right to work checks