Right to Work Checks: A 2026 UK Guide

Key takeaways

• Do the check before the person starts work. A correct check can give you a statutory excuse against a civil penalty.
• The 1 October 2026 guide has three routes: original documents, a Home Office online check with a share code, or a registered digital verification provider for British and Irish passports.
• British and Irish citizens cannot get a share code. An expired biometric residence permit is not acceptable for a manual check.
• A share code for work starts with W, is nine characters, and lasts 90 days. Codes that start with R or S are for other services.
• Keep the evidence for the whole employment and for two years after it ends. If permission is time-limited, check again before it runs out.
• The code of practice’s starting point is £45,000 per worker for a first breach and £60,000 for a repeat within three years.

What is a right to work check, and when do you do it?

A right to work check is how a UK employer shows it looked, before someone started, at whether that person is allowed to do the work. If you follow the steps in the Home Office guide in force on that day, you can have a statutory excuse, which is a defence against a civil penalty if they are later found to be working illegally.

The employer’s guide that came into force on 1 October 2026 says you establish that excuse by doing one of three checks before employment starts: a manual document check, a Home Office online check, or a check using a Right to Work digital verification service provider (RtW DVSP). You cannot insist on only one method. Someone who does not want a digital check must be given another way to prove their status, or you risk a discrimination complaint.

You remain responsible. A recruiter, an accountant or a piece of software does not take the penalty, except where the guide allows a registered RtW DVSP to do the digital identity part. The UK HR compliance guide lists this with the other records a small employer keeps. From 1 October 2026 the code also covers some worker contracts, individual sub-contractors and online matching services. This article is about the check before someone starts.

How do you check someone’s original documents?

A manual check means you obtain an original document from the Home Office lists, check it while you hold it, with the person there, and keep a copy that cannot be altered, with the date of the check. All of that has to happen before they start if you want the statutory excuse.

The acceptable documents are List A and List B in the guide. List A can give a continuous excuse, such as a valid British or Irish passport. List B gives a time-limited excuse and a follow-up date. GOV.UK’s short guide says you can no longer accept a biometric residence card or permit: ask for a share code. A manual check of an expired biometric residence permit does not give a statutory excuse.

1. Obtain the original. A scan or a video of a passport is not the check. They can post the original and join a live video call, but you must hold the document. Do not ask for their phone password. Official digital evidence of their name and National Insurance number can be used only with the right other document.
2. Check it in their presence, in person or on that video call. The photo, date of birth and any permission must match the person and the job. If names differ, you need a supporting document, such as a marriage certificate or deed poll.
3. Copy every document in a format that cannot be manually altered. For a passport, copy the pages with the expiry date, nationality, date of birth, signature, photograph and any permission to work. The front cover does not have to be copied.
4. Record the date in a way that shows it is the date of the check. The guide’s example is: “The date on which this right to work check was made: [insert date]”. Writing a bare date on the copy is not enough.

For a student with limited term-time hours, also copy their term and vacation dates for the period you will employ them. If a document looks false, or genuine but not theirs, report it to the Home Office rather than filing it and carrying on.

How does a Home Office share-code check work?

If the person has an eVisa, you use their share code and date of birth on the Home Office online service. That is the check that gives a statutory excuse for someone whose status is digital. Looking at a screenshot of their own Home Office account does not.

They generate the code themselves and must choose “Prove your right to work to an employer”. It is nine characters, starts with W, and lasts 90 days. A code starting with R or S is for another service. They can send it to you, or the service emails you from right.to.work.service@notifications.service.gov.uk.

1. Open the GOV.UK service “Check a job applicant’s right to work: use their share code”. Enter the code and their date of birth, and record your business name in full.
2. Check that the photograph is the person in front of you, in person or by video. Facial recognition is only through a registered RtW DVSP, and you must still offer another way if it cannot match them.
3. Read any conditions on hours, the type of work or student limits. The job has to match. Employing someone in breach of a condition is illegal working even if a profile exists.
4. Save the profile page, including the photograph and the date, as a PDF, HTML or a hard copy. Repeat this for every follow-up check.

If the online service fails, or the person has an outstanding application and cannot generate a code, use the Employer Checking Service. A Positive Verification Notice gives a statutory excuse for six months from the date on the notice. The service aims to reply within five working days. Do not start someone while you wait.

How do digital checks work for British and Irish passports?

British and Irish citizens cannot get a share code. You either check the original passport or passport card yourself, or you use a provider that checks the chip. GOV.UK still describes that provider as an identity service provider offering Identity Document Validation Technology. The 1 October 2026 guide uses the name Right to Work digital verification service provider.

The current guide says these digital checks have existed since 2022, with the Data (Use and Access) Act 2025 as the legislative basis. The provider must be on the Office for Digital Identities and Attributes register as able to do right to work checks. An unregistered screening agency must name the registered provider that does the check. They can check a valid British or Irish passport, or an Irish passport card, including one up to six months past expiry if the chip is verified by passive authentication. A clipped passport is cancelled. A damaged chip means a manual check. You match the photograph to the person and keep the output for the employment and for two years. The provider does not take your civil penalty.

When do you have to check again?

You check again when the person’s permission to work is time-limited and you want to keep employing them after that date. The code of practice says the follow-up is on or before the day the permission ends. It does not have to be the same type of check as the first one.

An online check lasts for the period the profile confirms. If a follow-up shows they cannot work, stop the employment. The Home Office employer helpline is 0300 790 6268. A failed share code can be an in-time application or a technical fault, so give them a reasonable chance to prove they can still work, including through the Employer Checking Service.

• List B Group 1. A current document from that group continues the excuse for as long as it shows they may do the work. If you are reasonably satisfied they applied or appealed before permission expired, the excuse can continue for up to 28 days while you get a Positive Verification Notice or a confirming online check.
• That notice then lasts six months from the date on it. Check again before the six months end. A Negative Verification Notice ends the excuse, and the code says you should no longer employ them.
• List B Group 2, or no document because of an outstanding application and no share code. Use the Employer Checking Service. A Positive Verification Notice lasts six months, then you check again.

There is no follow-up date on a continuous excuse, such as a properly checked British or Irish passport. There is a follow-up date on almost every visa, and on every Positive Verification Notice. The UK HR compliance checklist is a useful place to see whether that date is written down anywhere at all.

What records do you keep, and for how long?

Keep a clear, unalterable copy of whatever you checked, for the whole employment and for two years after it ends, then destroy it securely.

For a manual check, keep the copy plus the dated statement. For an online check, keep the profile page, with the photograph and the date. For a digital provider, keep their output. The GDPR note for UK employers and the document hub are about keeping that file restricted, not about satisfying the Home Office by themselves.

Put the evidence on the new hire onboarding checklist before the welcome email, and name the person who looked at the document.

What is the civil penalty if the check is missed?

If you employ someone who is not allowed to do the work, and you do not have a statutory excuse, the Home Office can issue a civil penalty. The code of practice in force from 1 October 2026 sets the starting point at £45,000 per worker where you have not been found employing illegal workers in the previous three years, and £60,000 per worker where you have.

Those are starting points. A report that produces a unique reference number reduces the penalty by £5,000 per worker, and active cooperation reduces it by another £5,000. If both apply and you had effective right to work practices, the code says the Home Office issues a warning notice rather than a penalty. A penalty cancelled on objection or appeal, and not replaced by a warning, does not count towards the next one.

The excuse exists only if the check was done as prescribed before the work started, with follow-ups where permission was time-limited. Knowing the person cannot do the work, and employing them anyway, is described as a criminal-offence risk, separate from the civil penalty. The employer is liable, not the colleague who was handed the passport.

How can a small employer keep the expiry date in view?

Write the check date, what you looked at, and any expiry date on the person’s record the day you do the check.

In CitoHR you can store that check and the document with the employee, off the company directory, and we show the date. We do not call the Home Office, we do not read a passport chip, and a reminder is not a decision that the visa covers the role. On our pricing page, immigration expiry reminders are part of Pro, not the Free plan. The immigration and visa tracking page describes the record, and the steps to turn reminders on are in the documentation. Collect the evidence during onboarding, not in a folder labelled “sort out later”.

Sources

Read on 21 October 2026. If the live guidance has moved on, follow the live guidance. The version that matters is the one in force on the day you make the check.

• Right to work checks: an employer’s guide (updated 1 October 2026)
• Employer’s guide to right to work checks, 1 October 2026 (PDF)
• Code of practice on preventing illegal working, 1 October 2026 (PDF)
• Checking a job applicant’s right to work