Right to work checks: a plain-English guide for UK employers

You've found someone to hire. Brilliant. Before they touch a keyboard, sit in a van, or answer a single phone call, you need to check they're allowed to work for you. This isn't optional, and it isn't a box you tick after they've started. It's a proper legal thing with proper legal consequences, so let's get into it.

The good news is it's not complicated once you've done it once. The bad news is that getting it wrong can be very expensive. So it's worth ten minutes.

What is a right to work check?

A right to work check is exactly what it sounds like: confirming, before someone starts, that they're legally allowed to work in the UK for you specifically. Do it properly and you won't have to pay the civil penalty if it later turns out something was wrong with the person's status. That's the whole trade. You do the check correctly, you're protected. You skip it, or fudge it, and you're exposed.

It applies to everyone. Not just people who "look like" they might need checking (more on why that phrasing is a trap later). Everyone.

When to do it

Before you employ them. That's it. That's the rule.

In practice, do it at offer stage, not on their first day, not in week two once the induction paperwork's piled up. Offer stage. That way nobody actually starts work before you've confirmed they're allowed to. It sounds obvious written down like that, but I promise you, in the scramble of getting someone onboarded, this is the step that slips.

Keep a dated record for each person. Diarise any follow-ups you'll need (more on that below). Future you will thank present you.

The three ways to check

There are three routes, and this is where people get tangled up.

First, the manual check. This works for anyone, and it means checking original documents with the applicant present, taking an unalterable copy, and recording the date you did it. Simple, if a bit old-school.

Second, the digital verification service, but this one's British and Irish citizens only. If someone's not British or Irish, this route isn't available for them.

Third, the Home Office online check, for everyone else, meaning most people who aren't British or Irish citizens.

Here's the important bit: you cannot mandate how an individual proves their right to work. You don't get to pick the method and force it on someone. If they're eligible for more than one route, the choice is theirs, not yours.

For manual checks, the photo on the document has to look like the applicant, and for anyone who isn't British or Irish, you need to check their permission to work is in date and actually covers the job they're doing. Worth saying too: you can no longer accept biometric residence cards or permits. If someone hands you one of those, that's not a valid manual check any more.

For the online route, you'll need a share code plus the person's date of birth, and British and Irish citizens cannot get a share code, which is your clue they need a different method. Whether you're doing this online or via the digital verification service, you (or someone doing it on your behalf) confirm the photo is the person, and that can happen in person or by video call.

What to keep, and for how long

Keep your evidence: the copy, the online check confirmation, whatever route you used, for the duration of someone's employment plus two years after they stop working for you. Not two years from when you did the check. Two years from when they leave. Long tail on this one, so build it into whatever filing system you're already using rather than inventing a new one just for this.

Follow-up checks and the ECS

Some people have time-limited permission to work, a visa with an end date, say. When that's the case, you need to check their documents again when it's due to expire. This is exactly the sort of thing that gets forgotten, so diarise it the day you do the first check, not the week before it expires.

Then there's the trickier situation: someone doesn't have the usual documents or an online status to show you, maybe they've got an outstanding appeal, review, or application with the Home Office. In that case, you use the Employer Checking Service. If that comes back positive, you'll get a Positive Verification Notice, and you must keep this document. Don't lose it, don't file it somewhere weird. It's your proof.

Penalties

Right, the bit that makes people sit up. Get it wrong and the civil penalty can be up to £60,000 for each illegal worker. Per worker. Not per incident.

The starting points are £45,000 for a first breach and £60,000 for a repeat breach within three years. Those are the figures before any reductions are applied. Either way, this isn't a slap on the wrist.

And if you knowingly employ someone illegally, that's not a civil matter any more, that's a crime, with jail time of up to five years and an unlimited fine attached. So this really isn't the sort of thing to wing.

Avoiding discrimination

Here's where I want to slow down, because this is the bit people mess up with the best of intentions.

You must check everyone the same way, including British citizens, and you must not discriminate. Not "check everyone who seems foreign," not "check anyone with an accent," not "check people whose documents look unusual." Everyone. Same process, same standard, every single time, regardless of nationality, accent, name, or anything else.

It's tempting to think you're being careful by scrutinising some applicants more than others. You're not being careful. You're discriminating, and it's unlawful, and it also just doesn't hold up, because the whole point of the system is consistency. Offer every applicant the same options for how they prove their right to work, let them choose the route that applies to them, and apply exactly the same rigour across the board. Simple as that, really, even if it takes a bit of discipline to actually do.

What changes from 1 October 2026

There's a new employer's guide coming into force on 1 October 2026, and it widens the scope of who this all applies to. It's not just direct employees any more; it also covers workers on worker's contracts, individual sub-contractors, and situations involving online matching services.

One other thing worth flagging: if you do choose to use a digital verification provider, under the new guide, it's mandatory that the provider is registered on the OfDIA register. That's not the same as saying you must use a digital provider at all, you don't have to, but if you go down that route, the one you pick needs to be on that register.

Anyway. None of this is as daunting as the £60,000 figure makes it feel. Check before day one, offer the same options to everyone, keep a dated record, and diarise anything with an expiry date. Do that and you're mostly there.

This is general information, not legal advice, so check GOV.UK for guidance specific to your own situation.