Illegal Working Civil Penalties: What Every Employer Needs to Know in 2026

Key Takeaways

• Civil penalties for employing someone without the right to work are £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years. These are starting points, before any reductions.
• This applies to every UK employer, not just sponsor licence holders. You do not need to employ a single migrant worker knowingly to be exposed; you need only fail to carry out a compliant check.
• Enforcement is at record levels. To the end of June 2026, more than 1,200 businesses had been issued with a civil penalty, with fines totalling over £74 million.
• A compliant right to work check before employment begins gives you a statutory excuse. If you have one, the Home Office issues a No Action Notice and there is no penalty at all. It is the only real defence.
• There are three mitigating factors that reduce a penalty. Reporting suspected illegal workers and actively co-operating each cut £5,000 per worker. Critically, if you also have effective right to work checking practices, a first breach can be reduced all the way down to a Warning Notice.
• Deadlines are tight. A faster payment option gives a 30% reduction if you pay in full within 21 days on a first penalty, you have 28 days to object, and 28 days after the objection outcome to appeal to the County Court.
• From 1 October 2026 the regime expands beyond employees to many contractors, agency and gig workers, which widens civil penalty exposure considerably for labour-heavy businesses.
• The best protection is the one you build in advance. WPC HR's compliance software safeguards your business by making sure every check is done correctly and evidenced, so your statutory excuse holds and no penalty arises in the first place. Our Sponsor Licence Compliance Audit then tests that evidence across your whole workforce before the Home Office does.

Introduction

Most employers understand that hiring someone without permission to work is unlawful. Far fewer realise how the penalty regime actually operates, and that is where the money is lost. You do not have to knowingly employ an illegal worker to receive a fine of £45,000. You simply have to be unable to show that you carried out the prescribed check, in the prescribed way, before that person started work.

That distinction matters enormously in 2026. Enforcement activity is at its highest level on record, with more than 1,200 businesses fined and over £74 million in penalties issued to the end of June 2026. Most of those employers were not criminals. They were businesses whose checks were undated, incomplete, delegated to untrained staff, or simply never repeated when someone's permission expired.

This guide explains the civil penalty regime as it actually works: who is liable, how the Home Office calculates the amount, what a statutory excuse is and how you get one, the three mitigating factors that can reduce or even eliminate a penalty, the notices you might receive, and the deadlines for paying, objecting and appealing. Our WPC group has also covered the wider enforcement picture in its analysis of immigration raids and £74 million in fines and the Q1 2026 enforcement statistics.

What a Civil Penalty Is, and Who Can Receive One

A civil penalty is a financial sanction issued by the Home Office to an employer found to have employed someone who does not have the right to do the work in question. It sits under the illegal working regime and is entirely separate from the sponsor licence system, which is why it catches out so many businesses that have never sponsored anyone.

The crucial point is scope. Every UK employer is within it. A restaurant, a care home, a construction firm, a corner shop and a multinational are all assessed on the same basis. Holding a sponsor licence does not increase your exposure to civil penalties, though it does mean a penalty can trigger separate action against the licence as well.

It is also worth separating civil liability from criminal liability. A civil penalty does not require the Home Office to prove you knew. Where it can show that you knew, or had reasonable cause to believe, that a person did not have permission to work, the matter escalates to a criminal offence carrying up to five years' imprisonment and an unlimited fine. Most employers never reach that territory. Very many reach the civil one.

How the Home Office Calculates a Penalty: The Three Stages

The calculation is not discretionary guesswork. It follows a published framework in the Code of Practice on preventing illegal working, which was updated on 30 June 2026 and is the document officials actually work from. Understanding the three stages tells you exactly where you can influence the outcome.

Stage 1: Determining liability

The first question is whether you have a statutory excuse. If you do, the Home Office issues a No Action Notice and the matter ends there with no penalty. If you do not, the case moves to stage 2. Everything therefore turns on whether your check was compliant.

Stage 2: Determining the level of breach

The second question is whether you have breached the scheme within the past three years. If not, this is a first breach. If so, it is a repeat breach, which raises the starting point.

Stage 3: Determining the penalty amount

Note that these figures are per illegal worker, not per business. An enforcement visit that identifies four workers without a valid check exposes a first-time employer to a starting point of £180,000. This is why the scale of civil penalties surprises people: the multiplier, not the headline number, is what causes the damage.

The Statutory Excuse: Your Only Real Defence

A statutory excuse is the legal protection you gain by carrying out a right to work check in exactly the manner prescribed, before the person begins work, and by keeping the evidence. Where you have one, you are not liable for a civil penalty even if the individual turns out to have no right to work.

In 2026 there are three compliant routes: an online check using the worker's share code through the Home Office service, a manual document check using acceptable documents, or a digital identity check through a certified provider for British and Irish passport holders. Where an application is pending, the Employer Checking Service provides a Positive Verification Notice. GOV.UK sets out the process in its guidance on checking a job applicant's right to work, and we cover it in practical detail in our guides to right to work checks and share code checks.

The excuse is fragile in specific and predictable ways. It fails where the check was carried out after employment started, where the record is undated so you cannot prove when it happened, where an online check was done without viewing the person alongside their record, where a follow-up check was missed before time-limited permission expired, or where the person is doing work their conditions do not permit, such as a student exceeding term-time hours. Each of these is an administrative slip rather than misconduct, and each removes your protection entirely.

The Three Mitigating Factors That Reduce a Penalty

If you have no statutory excuse, the calculation moves to what you can evidence in mitigation. The Code sets out three factors, and the third is the one HR teams should pay closest attention to.

Read that third row again, because it is the most commercially significant sentence in the whole regime. An employer facing a £45,000 starting point who reported the suspicion, co-operated with the investigation, and can demonstrate effective checking practices can have the penalty reduced to a Warning Notice, meaning no fine at all. The Home Office assesses effective practices by looking for robust document checking systems, thorough and consistent processes, retained records of checks for your staff, and a history of co-operation.

That is not something you can assemble after a visit. It is the accumulated evidence of how you have been operating all along, which is precisely why systems matter more than intentions. A Warning Notice is also not costless: it counts against you in determining the level of any subsequent penalty within the following three years.

The Notices You Might Receive

Alongside these, you may receive an information request or referral notice during the investigation stage. Treat every one of them as time-critical, and make sure such correspondence reaches the right person immediately rather than sitting in a general inbox.

Paying: The 30% Faster Payment Option

You must pay by the date specified in the Civil Penalty Notice, or object. The scheme operates a faster payment option that reduces the penalty by 30% if you pay in full within 21 days. Two conditions apply: it is available only to employers receiving their first penalty, and it cannot be combined with payment by instalments.

If you cannot pay in one sum, you may request permission from the Home Office's Shared Service Centre to pay by instalments, usually over a period of up to 24 months, giving full reasons for your inability to pay at once. Importantly, objecting within the deadline does not cost you the faster payment option. If you object in time and are still liable afterwards, you have 21 days to pay in full from the date on the Objection Outcome Notice and remain eligible for the reduction.

Objecting to a Penalty

If you receive a Civil Penalty Notice, you can object in writing within 28 days of the due date specified in the notice. You must set out your reasons and provide evidence supporting one or more of the acceptable grounds. Broadly, those grounds are that you are not liable at all, that you have a statutory excuse, or that the amount is too high because mitigating factors were not properly applied.

The response you send matters as much as the fact of objecting. A successful objection is evidence-led: dated copies of the checks you did carry out, your written procedures, training records, correspondence showing you reported a suspicion, and a clear explanation of anything that did go wrong along with what you have changed. A general assertion that you take compliance seriously will not move the outcome.

The Home Office will then issue an Objection Outcome Notice cancelling, reducing or maintaining the penalty. It can also increase it, in which case a new Civil Penalty Notice is issued.

Appealing to the Court

Where your objection has been determined and you remain liable, you may appeal to the County Court in England, Wales and Northern Ireland, or the Sheriff Court in Scotland. The appeal must be lodged within 28 days of the date on the Objection Outcome Notice or the new Civil Penalty Notice.

Two practical points. First, you generally cannot go straight to court; the objection stage comes first, so missing it narrows your options considerably. Second, this is a genuine court process with cost consequences, so it warrants regulated advice and a realistic assessment of the evidence rather than an instinctive appeal. Unlike the sponsor licence regime, where there is no appeal at all, the civil penalty regime does at least give you a court route, which makes preserving your position at the objection stage all the more valuable.

What Else Follows a Civil Penalty

The fine is rarely the end of it. A civil penalty can carry a series of knock-on consequences that often cost more than the penalty itself:

• Sponsor licence action. For licensed sponsors, illegal working findings feed directly into licence decisions and can lead to a downgrade, suspension or revocation. We cover that process in our guide to suspension, downgrade and revocation.
• Public naming. The Home Office publishes quarterly reports of employers issued with penalties, which are visible to clients, candidates and competitors.
• Escalation to criminal liability. Where there is evidence you knew or had reasonable cause to believe, the matter can become a criminal prosecution with up to five years' imprisonment and an unlimited fine.
• Director disqualification and licensing consequences. Depending on the sector, findings can affect other licences and the standing of individuals within the business.
• Debt recovery. An unpaid penalty is enforceable as a debt, with the associated cost and disruption.

The October 2026 Expansion Widens Your Exposure

One change deserves specific attention from anyone using flexible labour. From 1 October 2026, the duty to carry out right to work checks extends beyond traditional employees to a much wider range of arrangements, including many individual contractors, agency workers, and gig and platform workers, under a refreshed Code of Practice.

The civil penalty regime follows that expansion. Businesses that have never needed to check a subcontractor may find that failures in their labour supply chain now carry the same £45,000 and £60,000 exposure as their direct employees. Construction has been singled out by the Home Office as a high-risk sector precisely because so much of its workforce is engaged this way. Our guide to the gig economy and construction changes sets out who is in scope and what to do before the deadline.

Preventing a Penalty: A Practical Checklist

Because the statutory excuse is the only complete defence, and effective checking practices are the difference between a £45,000 penalty and a Warning Notice, prevention here has an unusually direct financial return.

1. Check everyone, before day one. Every new hire, including British and Irish citizens, checked before employment begins and using the correct method for their status.
2. Date and retain every check. Keep an unalterable copy for the duration of employment plus two years. An undated record is treated as no record.
3. View the person alongside the record. For online checks, in person or on a live video call, so the photograph is genuinely matched to the individual.
4. Diarise follow-up checks. Track every time-limited permission centrally and act well before expiry, not after.
5. Read the conditions, not just the status. Hours restrictions and work-type limits are breached surprisingly often, particularly with student visa holders.
6. Apply the process consistently. Checking only those who look or sound foreign creates discrimination liability under the Equality Act 2010 alongside your immigration risk.
7. Bring contractors and agency labour into scope now. Map who you engage ahead of 1 October 2026 and tighten contracts accordingly.
8. Document your system, not just your checks. Written procedures, training records and audit trails are what evidence effective practices when mitigation is assessed.
9. Audit yourself. Review right to work files across the whole workforce periodically, and keep a record that you did.

How Can WPC HR Help?

The civil penalty regime rewards exactly one thing: being able to prove what you did and when you did it. WPC HR's HR compliance software is built for that. It records every right to work and eVisa share code check with a dated, tamper-evident audit trail, tracks time-limited permissions and prompts follow-up checks before they lapse, applies the same process consistently to every hire so there is no discrimination risk, and builds the documented evidence of effective checking practices that protects your position if your compliance is ever questioned. It also covers contractors and agency workers, which matters from 1 October 2026. If you would rather find the gaps before an enforcement visit does, our Sponsor Licence Compliance Audit reviews right to work evidence across your entire workforce, not a sample, and gives you a prioritised plan to fix whatever is missing while it is still fixable.

📞 Call us: 020 8087 2343
📅 Book a free compliance audit: wpchr.co.uk/sponsor-licence-compliance-audit
🔗 See the platform: wpchr.co.uk/hr-compliance-software-features

Conclusion

The civil penalty regime is unusual in how clearly it signposts what protects you. A compliant, dated check before day one removes liability entirely. Effective checking practices, combined with reporting and co-operation, can take a £45,000 starting point down to a Warning Notice. Neither of those protections can be created after an enforcement visit, which is the whole point: the regime is designed to reward employers who were already doing it properly.

With more than £74 million in fines issued to the end of June 2026, penalties reaching £60,000 per worker, and the scheme expanding to contractors and gig labour from 1 October 2026, the cost of an inconsistent process has never been higher. Check everyone before they start, date and keep the evidence, diarise every expiry, apply the same process to every hire, and audit yourself before someone else does. Where you would rather have a system carry that burden and produce the evidence automatically, that is exactly what WPC HR is built to do.

Glossary