Before a new starter does a single hour of paid work, one legal check cannot be skipped: the right to work check. Every UK employer must confirm each person taken on is legally allowed to do the job offered, before employment begins. Get it wrong, and the Home Office can fine you up to £45,000 per illegal worker for a first breach and £60,000 per worker for a repeat breach. Get it right, and you gain a “statutory excuse” — a legal defence that protects you even if the worker is later found not to have had permission to work. This guide covers the process in plain English, including the 1 October 2026 change that extended the duty well beyond traditional employees.
What Is a Right to Work Check, and Why Does It Matter?
A right to work check verifies that a person has immigration permission to work in the UK covering the specific role offered. It is not optional, and it cannot be done retrospectively: a check after the person has started gives no statutory excuse at all.
The statutory excuse is the whole point. Carry out the correct check, in the correct way, before the person starts, keep the evidence, and you will normally avoid a civil penalty even if the person is later found to have worked illegally. If you cannot produce that evidence, you face a penalty whether or not you knew — liability does not depend on intent. For a small business the arithmetic is stark: one unchecked worker can mean £45,000, and the penalty applies per worker.
Who Must You Check?
Everyone. This is the rule small employers most often get wrong. You must check every person you take on, whatever their nationality or appearance — including British citizens. Checking only people you think “might” need checking is unlawful and risks discrimination claims. Check every starter, every time, the same way.
Since 1 October 2026 the duty is wider. Under the Border Security, Asylum and Immigration Act 2025, it now covers workers, agency staff, individual subcontractors, casual and zero-hours staff, and people engaged through online platforms — the working relationship matters, not the job title. If you use freelancers or platform workers, review whether they fall within scope.
The Three Ways to Carry Out a Check
There are three accepted routes; the route must match the person’s status.
1. Manual document check
The traditional route, still the main one for British and Irish citizens. The person shows you original documents from the Home Office’s lists (List A or List B, below). Examine the originals in the person’s presence — in person or over live video — checking they look genuine, untampered with, and theirs. Photocopies, scans, and photographs are not acceptable. Then copy the relevant pages and record the check date. For passports, copy the front cover and every page showing personal details, photographs, or visa endorsements. This route costs nothing but your time, making it the sensible default for most small employers.
2. Online check using a share code
Most workers who are not British or Irish citizens now hold digital status, as an eVisa or under the EU Settlement Scheme. For them, use the free Home Office online service: the worker generates a share code through their UK Visas and Immigration account and gives it to you with their date of birth. Enter both on the GOV.UK “check a job applicant’s right to work” service, confirm the photograph matches the person and the result allows the work offered, and save the profile page. Two warnings: an applicant’s screenshot is not sufficient — view the result yourself — and physical biometric residence permits can no longer be used for a manual check.
3. Digital check through an Identity Service Provider (IDSP)
For British and Irish citizens with a valid passport or passport card, you may use a certified Identity Service Provider (IDSP) using Identity Document Validation Technology (IDVT). The provider verifies the document digitally and returns an output you retain. You must still match the verified identity to the person, and ensure the provider is properly certified — since 1 October 2026, a statutory excuse via this route requires a provider certified against the relevant framework and registered for that service. This route is optional: small-volume provider prices typically run from around £6.50 plus VAT to around £20–£24 including VAT per check, with older reports up to £70. For a handful of hires a year, the free manual check is usually better.
List A and List B Documents Explained
List A documents prove a continuous, permanent right to work — for example, a current or expired British or Irish passport, a naturalisation certificate (with an official document showing the person’s permanent National Insurance number and name), or settled status under the EU Settlement Scheme (verified online). One valid List A document is enough, and a correct check covers the whole employment, with no follow-up needed.
List B documents prove a time-limited right to work — for example, a passport endorsed with a current work visa, or pre-settled status under the EU Settlement Scheme (checked online). Diarise a follow-up check before the permission expires; in some groups the excuse lasts only six months even if the permission runs longer. Losing track of follow-up dates is a common, avoidable failure.
If a person cannot prove their right to work through any route — for example, an outstanding application or appeal — use the Home Office Employer Checking Service. A Positive Verification Notice gives a six-month statutory excuse while the case is resolved.
Your Step-by-Step Process for Every Starter
Build this sequence into your recruitment workflow, before any start date is confirmed:
- At offer stage, tell the new starter what you need. Ask for original documents or a share code before day one.
- Choose the correct route. British or Irish passport holders: manual check or IDSP. Digital status: online share-code check. Outstanding application: Employer Checking Service.
- Obtain. Get the original documents, or the share code and date of birth.
- Check. Examine the documents in the person’s presence, or view the online result yourself. Confirm they are genuine, theirs, and cover the role.
- Copy and date. Copy the relevant pages, or save the online profile page, and note: “The date on which this right to work check was made: [date].”
- Store securely and set reminders. File the evidence where it can be retrieved for that individual, and set a reminder for any follow-up check.
- Only then confirm the start date. No evidence, no start.
This sequence sits naturally in a broader hiring routine: our new-starter legal compliance checklist covers the other checks alongside it, from contracts to pension enrolment.
Follow-Up Checks and Record-Keeping
For anyone with time-limited permission, carry out a follow-up check before it expires, following the same obtain-check-copy steps. Diary the expiry date on hiring, with a reminder at least a month ahead.
Keep clear, dated copies for the duration of employment and two years after it ends. Electronic storage is fine if records are secure, retrievable, and linked to the individual. Restrict access: these are sensitive personal documents.
What Happens If You Get It Wrong?
Penalties have been severe since 13 February 2024, when maximum fines were sharply increased:
| Breach | Starting point / maximum per worker |
|---|---|
| First breach | £45,000 per worker |
| Repeat breach within three years | £60,000 per worker |
The Home Office can reduce a penalty for mitigation, such as reporting a suspected illegal worker before it finds them, but mitigation is a fallback, not a strategy. There is also a criminal offence: an employer who knew, or had reasonable cause to believe, a worker was disqualified can face an unlimited fine and up to five years’ imprisonment. Enforcement has intensified, with a reported 12,791 illegal working visits in 2025, up from 8,122 in 2024. The check is free and takes minutes; skipping it can cost tens of thousands per worker.
Common Mistakes Small Employers Make
- Checking only some starters. Every starter must be checked, including British citizens; selective checking invites penalties and discrimination claims.
- Accepting copies or screenshots. A photocopy, phone photo, or applicant’s screenshot is not a compliant check.
- Checking after the start date. A late check gives no statutory excuse — build the check into the offer stage.
- Forgetting follow-up checks. List B permissions expire; if nobody owns the diary reminder, the excuse lapses too.
- Ignoring the October 2026 extension. The old “employees only” assumption no longer holds for subcontractors, agency staff, or platform workers.
Frequently Asked Questions
Do I need to check British citizens? Yes — every starter, regardless of nationality. A current or expired British passport is a List A document, but the check must still be evidenced.
Can I accept a scan or photo of a passport? No. A manual check requires the original in the person’s presence; for digital status, view the result yourself through the Home Office online service.
What if the worker’s documents are with the Home Office? Use the Employer Checking Service. A Positive Verification Notice gives a six-month statutory excuse, and employment can begin on that basis.
Related reading: If you are tightening up hiring, our new-starter legal compliance checklist covers every other check alongside right to work, our guide to essential HR policies for UK small businesses explains the documents every small employer needs, our employee onboarding checklist covers the first 30 days after the legal checks, and our statutory sick pay employer guide for 2026 covers the other major 2026 employment change for small employers.