Right to Work Checks in 2026: The Complete Guide for HR Teams
What changed: Updated for the right to work rules in force from 1 October 2026: who is now in scope, how eVisa holders are checked, and digital verification services.
First published 15 July 2026
Key Takeaways
- Every UK employer, sponsor licence holder or not, must complete a compliant Right to Work check before a new hire's first day, or risk losing the statutory excuse that protects them against a civil penalty.
- Civil penalties now reach £45,000 per illegal worker for a first breach and £60,000 for repeat breaches, and enforcement is at record levels, with 2,438 civil penalties worth over £130 million issued in 2025 and raids up 77 per cent.
- There are three approved verification routes in 2026: an online check using a share code, a manual document check, or a digital identity check through a certified Digital Verification Service (DVS), plus the Employer Checking Service for pending applications.
- Biometric residence permits and cards are no longer accepted as physical proof. Most migrant workers now hold digital eVisas and prove their status through the Home Office online service.
- The rules changed on 1 October 2026: Right to Work checks now reach beyond employees to people engaged under a worker's contract, individual sub-contractors and people who find work through online matching services, such as gig and platform work. A new Code of Practice is in force, eVisa holders must still be checked online with a share code, and any digital verification service you choose to use must be registered for Right to Work checks.
- For sponsor licence holders, Right to Work failures are increasingly treated as evidence of wider HR governance weakness and can trigger a compliance visit, a rating downgrade or licence action, not just a fine.
- Checks must be applied consistently to every applicant regardless of nationality or background, to avoid both illegal working risk and discrimination claims under the Equality Act 2010.
- Right to Work compliance is far easier when it is automated. WPC HR's compliance software handles Right to Work monitoring, dated records of every check, including eVisa share code checks, and automated expiry alerts, and our practitioner-led Sponsor Licence Compliance Audit checks your files against current guidance before the Home Office does.
Introduction
Right to Work checks used to be treated as a quiet administrative step tucked into onboarding. That is no longer a safe assumption. During 2025, UK Visas and Immigration issued 2,438 civil penalties to employers, worth more than £130 million, and illegal working visits rose to 12,791 from 8,122 the year before. The Home Office has confirmed that enforcement raids are now at their highest level in UK history. For HR teams at sponsor licence holders, the stakes are higher still, because a single Right to Work failure can trigger a full sponsor compliance review, not just a fine.
On top of the existing rules, the biggest shake-up in years is now in force. Since 1 October 2026, the duty to carry out Right to Work checks extends well beyond traditional employees, and a new Code of Practice has changed how some checks are done. This guide sets out exactly what a compliant Right to Work check looks like in 2026, the three approved verification methods, how record keeping and follow-up checks work, what changed on 1 October 2026, and what sponsor licence holders specifically need in place before the Home Office comes knocking.
What Is a Right to Work Check, and Why Does It Matter More in 2026?
A Right to Work check is the process by which an employer verifies, before someone starts work, that they are legally permitted to work in the UK and to do the specific job on offer. It is a legal requirement under the Immigration, Asylum and Nationality Act 2006, not a discretionary HR courtesy.
Carrying out a compliant check gives an employer a statutory excuse, a legal defence against a civil penalty if it later turns out the individual did not, in fact, have the right to work. Get the check wrong, or skip it altogether, and the business is exposed to the full weight of a civil penalty with no defence available. You can read the full official rules in the Home Office's guide to checking a job applicant's right to work.
Three things have converged to make 2026 a higher-risk year for HR teams:
- The shift to digital-only status for most migrant workers, following the phase-out of biometric residence permits (BRPs) and cards in favour of eVisas.
- A sharp rise in Home Office enforcement activity, with raids up 77 per cent between July 2024 and December 2025 and penalty values climbing accordingly.
- A wider Right to Work regime since 1 October 2026, which brings people engaged under a worker's contract, individual sub-contractors and gig or platform workers into scope for the first time.
Who Needs a Right to Work Check?
Every new employee needs a Right to Work check before their first day, regardless of nationality, role, seniority or how long they are expected to stay. This includes British and Irish citizens, who are just as much in scope as any other nationality and should never be waved through on assumption.
| Worker Category | How They Typically Prove Right to Work |
|---|---|
| British and Irish citizens | Current or expired passport, or a birth/adoption certificate plus an official letter showing their National Insurance number. Can also use a certified Digital Verification Service for a digital identity check. |
| EU Settlement Scheme (settled or pre-settled status) | Online check using a share code. Pre-settled status holders do not need a follow-up check once a compliant initial check is completed. |
| Skilled Worker, Health and Care Worker and other visa holders | Online check using a share code generated from their eVisa via their UKVI account. |
| Frontier worker permit holders | Online check using a share code. |
| Commonwealth citizens without standard documents | Documentation obtained through the Windrush Scheme. |
| Anyone with a pending application, review or appeal | Employer Checking Service, resulting in a Positive Verification Notice. |
You do not need to repeat checks for existing EU, EEA or Swiss employees who were already working for you before 1 July 2021. Any new hire from these groups still needs a full check like any other candidate.
The Three Approved Right to Work Check Methods in 2026
Home Office guidance sets out three prescribed ways to establish a statutory excuse, plus a fallback route for pending applications. Which one applies depends on the individual's nationality and how their immigration status is held.
| Check Type | Used For | How It Works |
|---|---|---|
| Online share code check | Non-British/Irish nationals whose status is held digitally, including eVisa and EUSS holders | The worker generates a share code through their UKVI account. The employer enters the code and the worker's date of birth into the Home Office view a job applicant's right to work service. |
| Manual document check | British and Irish citizens without a digital check, and anyone with acceptable physical documents | The employer checks original documents in the holder's presence (or via live video link where permitted), confirms they are genuine and unaltered, then copies and dates them. |
| Digital identity check (via a certified DVS) | British and Irish citizens with a passport or Irish passport card that is valid or expired by no more than six months | A certified Digital Verification Service verifies the document using Identity Document Validation Technology (IDVT). The employer must still confirm the report matches the person presenting for work. |
| Employer Checking Service (ECS) | Anyone who cannot provide a share code or documents, typically because an application, review or appeal is pending | The employer submits the worker's details and Home Office reference number and receives a Positive Verification Notice, usually valid for six months. |
Step by Step: How to Carry Out Each Type of Check
Whichever method applies, every compliant check follows the same three pillars: obtain, check and copy. Miss any one of the three and the statutory excuse is at risk.
Online checks using a share code
Ask the candidate for their share code and date of birth, then look up their record using the Home Office online service. You must view the person, either in person or on a live video call, at the same time as checking their online profile, to confirm the photograph matches who is in front of you. Download and retain the PDF response as your dated record. Simply glancing at the screen without saving the output is not sufficient.
Manual document checks
Ask for original documents from the Home Office's List A (unrestricted right to work) or List B (time-limited right to work). With the person present, confirm the documents are genuine, unaltered and belong to the holder, that photos and dates of birth match across documents, and that any name discrepancies are explained by supporting paperwork such as a marriage certificate. Make a clear, unalterable copy and record the date of the check.
Digital identity checks (certified DVS)
This route is optional and is used for British and Irish citizens with a passport or Irish passport card that is valid or expired by no more than six months. The employer instructs a certified Digital Verification Service, which captures the biometric page, personal details, photo and expiry date, then produces a report. The employer must still be reasonably satisfied that the person in the report is the person starting work, and must retain both the report and a copy of the document checked.
Employer Checking Service
Where a worker cannot provide a share code or documents, request a Positive Verification Notice through the Employer Checking Service. Do not allow the individual to start work until the notice is received, unless another compliant check has already been completed.
What Changed on 1 October 2026?
The single most important development for HR teams this year is the expansion of the Right to Work regime under the Border Security, Asylum and Immigration Act 2025. Since 1 October 2026, the duty to carry out Right to Work checks reaches well beyond traditional employees, and a new Code of Practice and employer's guide apply to checks carried out on or after that date. A check made before 1 October 2026 is still judged against the guidance in force on the day it was made.
Checks expand beyond employees
Until 1 October 2026, the legal duty to check applied to direct employees. For engagements that begin on or after that date, it also covers individuals engaged under a worker's contract, individual sub-contractors, and people whose details an online matching service provides to clients or customers, which takes in much gig and platform work. The business in the direct contractual relationship with the individual carries out the check. Businesses further up a chain of contracts, online matching services, and employers whose contracts allow substitution can also be held liable. They protect themselves through the prescribed written contractual terms, substitution controls and identity verification.
People running a genuinely independent business, in their own name or through their own company, are not caught, and neither are ordinary business-to-business contracts for a service rather than for an individual's labour. Temporary agency workers are not new to the scheme either: the employment business that supplies them is their employer for Right to Work purposes and is responsible for the check. For many organisations, though, this is a cross-functional issue that pulls in HR, procurement, legal and operations, not an HR task alone.
Digital verification services must be registered for Right to Work checks
eVisa holders must be checked through the Home Office online service using a share code, and a digital verification service is not a substitute for that check. Using a digital verification service is optional, and it is mainly for British and Irish passports and Irish passport cards. Since 1 October 2026, where an employer chooses to rely on one, the provider must be registered on the Office for Digital Identities and Attributes (OfDIA) register, with its entry showing that it provides Right to Work checks, and the employer must obtain the provider's confirmation that it is registered and that its service meets the supplementary code for digital Right to Work checks. Registration for identity checks alone is not enough. Because the route is optional, a British or Irish citizen who cannot or does not want to use it should still be offered a manual document check.
A new Code of Practice
A new Code of Practice underpins all of this and has applied since 1 October 2026. Under it, employers are expected to check every worker consistently through one of the three permitted routes: a manual document check, the Home Office online service, or a registered digital verification service. The practical message for HR teams is simple: review who you engage and how, map which arrangements are now in scope, and make sure your onboarding covers contractors and casual labour, not just permanent staff.
Follow-Up Checks and Time-Limited Permission
Where an employee's permission to work is time-limited, a follow-up check is required before that permission expires to keep the statutory excuse in place. The exception is EU Settlement Scheme pre-settled status: because the Home Office no longer displays an expiry date to employers on the online check, no follow-up check is required once the initial check was compliant.
One of the most common and costly misconceptions is relying on an informal grace period after a visa expires. There is no general grace period for maintaining a statutory excuse. HR teams should trigger follow-up checks well ahead of expiry dates, ideally through automated alerts, rather than waiting for a renewal date to be missed.
Record-Keeping: What to Keep and For How Long
Every check, whichever method is used, must be backed by a secure, dated record. Copies must be kept for the duration of the individual's employment and for two years after they stop working for you. Records must be stored in a format that cannot be manually altered, and handled in line with data protection law given the sensitivity of the documents involved.
A record that cannot demonstrate when the check was carried out, or that has gone missing entirely, is treated the same as no check having taken place at all. Regular internal audits are the only reliable way to catch these gaps before the Home Office does.
Right to Work Checks for Sponsor Licence Holders
For sponsor licence holders, Right to Work compliance is no longer just about the civil penalty regime. Sponsors are expected to treat Right to Work verification as a living duty rather than a one-off onboarding task, with real-time monitoring of status across the whole sponsored workforce. Three areas of sponsor duty sit alongside the standard check:
- Appendix D record-keeping. Sponsors must retain specified documents for each sponsored worker, including contact details, contracts, qualifications, travel documents and monitoring records, structured the way UKVI expects to see them during a visit.
- SMS reporting obligations. Certain changes, such as a change of role, location, salary or absence, must typically be reported through the Sponsor Management System within 10 working days. Right to Work files and SMS records are frequently reviewed together, and mismatches between the two are a common finding.
- Wider civil penalty exposure. During a compliance visit, UKVI does not limit its review to sponsored staff. Right to Work checks across your entire workforce, sponsored or not, are assessed as part of understanding your overall recruitment and HR governance.
A single gap in this area can affect your licence rating directly, from an A-rating downgrade to a B-rating, through to suspension in more serious cases. If it has been some time since your sponsored worker files were reviewed against current guidance, a practitioner-led compliance audit is the fastest way to find out where you stand before UKVI does.
Civil Penalties and Enforcement in 2026
The financial exposure for getting this wrong has increased significantly. Under the Code of Practice that applies to breaches identified on or after 13 February 2024, employers face a civil penalty of up to £45,000 per illegal worker for a first breach, rising to up to £60,000 per illegal worker for repeat breaches within a three-year period.
Enforcement activity has scaled up to match. During 2025, UK Visas and Immigration issued 2,438 civil penalties worth more than £130 million, and the Home Office confirmed in early 2026 that illegal working raids were up 77 per cent and arrests up 83 per cent compared with the previous period. Most penalties do not arise from deliberate wrongdoing. They arise from what the Home Office describes as non-compliance by negligence, where an employer acted in good faith but did not follow the specific, current verification steps required to secure a statutory excuse.
Where the Home Office finds that an employer knowingly employed someone without the right to work, or had reasonable cause to believe they did not, the matter can move beyond civil penalties into criminal liability, with unlimited fines and up to five years' imprisonment possible. Full detail on the penalty framework is available in the Home Office's guidance on penalties for employing illegal workers.
Common Mistakes That Cost Employers Their Statutory Excuse
Most breaches are the result of everyday shortcuts rather than deliberate rule-breaking. The most frequent issues HR teams should watch for include:
- Accepting an expired biometric residence permit or card as physical proof, when the holder should instead be using the online view and prove service.
- Completing an online share code check without viewing the applicant alongside the record, so the photograph is never actually compared to the person starting work.
- Missing a follow-up check because visa expiry dates are not tracked centrally, or because the process relies on an individual manager remembering to act.
- Applying different standards across sites, departments or contractor groups, which UKVI reads as a sign of wider governance weakness.
- Delegating checks to junior staff without proper training, so errors go unnoticed until an audit or a Home Office visit uncovers them.
- Checking only candidates who look or sound like they might not be British, which creates real exposure to discrimination claims under the Equality Act 2010.
Right to Work Checks and Remote or Hybrid Hiring
Remote and hybrid hiring have made these checks harder to get consistently right. Where an online share code check is used remotely, a live video call is required so the assessor can see the applicant at the same time as viewing their record, matching the photo to the person in real time.
Risk increases where employees are onboarded without any in-person or live video interaction, where staff are working from overseas without formal authorisation to do so, or where line managers carry out checks independently without central HR oversight. Digital tools make remote verification easier, but they do not remove the need for a documented, centrally reviewed process. Sponsors in particular should build hybrid and remote working patterns into their monitoring, since sponsor duties extend to knowing where and how a sponsored worker is actually carrying out their role.
Preparing for a Home Office Compliance Visit
Unannounced compliance visits are increasingly common, and HR teams should plan on the basis that a visit is a matter of when, not if. A well-prepared HR function significantly reduces both the disruption and the risk of an adverse finding.
- Run internal audits of Right to Work records on a regular schedule, not just when a licence renewal or a Home Office letter prompts it.
- Keep every file dated, complete and structured against Appendix D requirements, so nothing needs to be reconstructed under time pressure.
- Cross-check Right to Work files against SMS records to close any gaps between what has been reported and what is on file.
- Make sure your Authorising Officer and any Key Contact understand current guidance, not the process as it stood when the licence was first granted.
- Consider a mock compliance visit before the real one happens, so your team has already been through the questions a Home Office officer is likely to ask.
Conclusion
Right to Work compliance in 2026 is no longer a box-ticking exercise at the edge of onboarding. It sits at the centre of both immigration enforcement and, for sponsor licence holders, the survival of the licence itself. With civil penalties at £45,000 to £60,000 per worker, record enforcement activity, the full transition to digital status, and the significant expansion of the regime from 1 October 2026, the margin for error has narrowed considerably.
The good news is that the fundamentals are well within reach for any HR team: check every hire consistently, use the correct method for each person's status, view the applicant alongside their record, keep dated and unalterable records for the required period, and diarise follow-up checks in good time. Build those habits into a documented, centrally overseen process, review who has come into scope since 1 October 2026, and a Home Office visit becomes a routine confirmation of good practice rather than a crisis. Where you would value an extra layer of assurance, automated monitoring and a practitioner-led audit close the remaining gaps before they ever become findings.
How Can WPC HR Help?
Right to Work compliance is easiest to get right when it is not managed on spreadsheets and memory. WPC HR's HR compliance software includes Right to Work monitoring with automated expiry alerts, a dated record of every check, including eVisa share code checks, and a compliance dashboard that flags gaps before they become findings, so your team can work to the rules in force since 1 October 2026. If you would rather have a practitioner check your existing files against current Home Office guidance, our Sponsor Licence Compliance Audit reviews your entire sponsored workforce, not a sample, and gives you a prioritised remediation plan.
📞 Call us: 020 8087 2343
📅 Book a compliance audit: wpchr.co.uk/sponsor-licence-compliance-audit
🔗 See the platform: wpchr.co.uk/hr-compliance-software-features
Glossary
| Term | Definition |
|---|---|
| Right to Work | An individual's legal permission to undertake employment in the UK, based on citizenship, immigration status or visa conditions. |
| Statutory Excuse | A legal defence against a civil penalty, established by carrying out a Right to Work check in the prescribed manner before employment starts. |
| Share Code | An alphanumeric code generated by a worker through their UKVI account, used by employers to view their Right to Work status online. |
| eVisa | The digital record of an individual's UK immigration status, which has replaced physical biometric residence permits and cards. |
| BRP / BRC | Biometric Residence Permit / Biometric Residence Card. Physical cards formerly used to evidence immigration status, now expired and replaced by eVisas. |
| Digital Verification Service (DVS) | A certified provider that verifies identity documents digitally using IDVT. Since 1 October 2026 it must be registered for Right to Work checks on the OfDIA register. |
| IDVT | Identity Document Validation Technology, used by certified providers to verify British and Irish passports digitally. |
| Employer Checking Service (ECS) | A Home Office service that lets employers verify a worker's status when they cannot provide the usual documents or online record, typically because an application is pending. |
| Positive Verification Notice (PVN) | A notice issued by the ECS confirming a worker's right to work while their Home Office application, review or appeal is pending. |
| Appendix D | The section of Home Office sponsor guidance setting out the records a sponsor must keep for each sponsored worker. |
| SMS (Sponsor Management System) | The online system sponsors use to manage their licence and report specified changes about sponsored workers within set timeframes. |
| A-rating / B-rating | The rating the Home Office assigns to a sponsor licence based on compliance. A B-rating typically means an action plan is required to avoid suspension or revocation. |
| Windrush Scheme | A scheme helping Commonwealth citizens who settled in the UK before 1973 to obtain documents confirming their right to live and work in the UK. |
| Civil Penalty | A financial penalty issued to an employer found to have employed someone without the right to work, without a valid statutory excuse in place. |
FAQ
Frequently asked questions
Yes. Every employee needs a Right to Work check before their first day, including British and Irish citizens. Checking only candidates who appear to be foreign nationals is a discrimination risk as well as a compliance gap, so the same process should apply to every hire.
Right to Work checks now reach beyond employees to people engaged under a worker's contract, individual sub-contractors and people who find work through online matching services, for engagements beginning on or after 1 October 2026. A new Code of Practice applies to checks made on or after that date. eVisa holders must still be checked online with a share code, and any digital verification service you choose to use must be registered for Right to Work checks on the OfDIA register. People running a genuinely independent business are not caught.
No. BRPs and BRCs have now expired and are no longer valid as physical proof. Holders need to use the Home Office online service to generate a share code, or you can use the view and prove service to check their eVisa status directly.
A statutory excuse is the legal defence against a civil penalty that you establish by carrying out a Right to Work check in exactly the way Home Office guidance prescribes, before the individual starts work. Get the method wrong, or skip a required step such as viewing the applicant alongside their online record, and the excuse is not valid even if the person did in fact have the right to work.
Records must be kept for the duration of the person's employment and for two years afterwards. They should be dated, stored securely, and kept in a format that cannot be altered.
Compliance visits can happen with little or no notice, particularly for sponsor licence holders. Officers will typically review employee files, Right to Work documentation and your internal processes and controls. A prepared HR function with regularly audited, well-structured records is far less likely to face an adverse finding.
