UK right to work checks: the three methods and the October 2026 changes
On this page
A UK right to work check has to be done before someone starts work, using one of three methods: a manual check of original documents, the Home Office online check with a share code, or a check through a registered digital verification service provider. Done correctly, the check gives the employer a "statutory excuse" against a civil penalty of up to £60,000 per illegal worker. The rules changed on 1 October 2026, when a new Home Office guide took effect and the scheme was extended beyond employees to workers, individual sub-contractors and online matching services.
This page is for recruiters and hiring managers who need the working rules: which method fits which candidate, what the October 2026 changes mean, when to do follow-up checks, and where agencies fit. The data protection side of interviewing in the UK is covered in recording interviews under UK GDPR.
Not legal advice. This page summarizes the Home Office employer's guide to right to work checks dated 1 October 2026 and the legislation linked below, as of October 2026. The guide runs to 83 pages and covers many special cases this page does not. Check the guide itself, or take advice, before relying on a check in an unusual situation.
What changed on 1 October 2026
| Change | What it means | Source |
|---|---|---|
| Checks extended to non-employees | Section 48 of the Border Security, Asylum and Immigration Act 2025 extends the prohibition on illegal working to people on worker contracts, individual sub-contractors (for example on delivery and gig platforms) and online matching services. Penalties for these groups apply only to work starting on or after 1 October 2026. Genuinely self-employed people and personal service companies are outside the scheme | 2025 Act, s. 48; SI 2026/683 |
| Extended liability in contracting chains | New liability for organizations in a contracting chain, for online matching services, and where a contract lets a worker send a substitute | Employer's guide, 1 October 2026 |
| Digital providers renamed and widened | Identity service providers are now "RtW DVSPs" (right to work digital verification service providers). They can verify British and Irish passports and Irish passport cards, and other List A and List B documents where the issuing authority makes them available digitally | SI 2026/700; employer's guide |
| Facial recognition | Allowed only through a registered provider, with evidence kept at least two years after employment ends | SI 2026/700 |
| New codes of practice | New versions of the civil penalty code and the code on avoiding discrimination, both in force 1 October 2026 | Penalty codes; Discrimination code |
The online tool has also been renamed. The employer-facing service is now called "Check a job applicant's right to work: use their share code".
The three ways to check, and which to use
The guide is clear that employers cannot mandate the method; the candidate chooses how to prove their right to work, except that eVisa holders must be checked online.
| Method | Who it suits | What you do | What you keep |
|---|---|---|---|
| Manual document check | British and Irish citizens with a passport, and anyone without an eVisa who holds documents on List A or List B | Obtain the original documents and physically hold them; check they are genuine, belong to the person and are valid; a live video call is acceptable only while you hold the originals. Scans and screenshots are not acceptable | A clear copy of each document, with the date the check was made |
| Home Office online check | Anyone with an eVisa, which now includes former BRP holders | Enter the share code and the person's date of birth in the online service, then check the photo matches the person | The profile page, saved as PDF or HTML |
| Registered digital provider (RtW DVSP) | British or Irish passport holders, including passports expired up to six months, and other documents where digitally available | Use a provider on the government register; you remain responsible for the check | The provider's output |
Share codes
A right to work share code is nine characters and starts with "W". It is valid for 90 calendar days. Codes beginning "R" (right to rent) or "S" (other purposes) are not accepted for right to work. If the code has expired, ask the candidate for a new one through gov.uk/prove-right-to-work.
BRPs and eVisas
Biometric residence permits stopped being issued on 31 October 2024 and have been replaced by eVisas. The guide says a manual check of an original, expired BRP is not acceptable proof of right to work. A candidate who hands you a BRP card should be asked for a share code instead.
Follow-up checks and time limits
What the document shows decides how long the statutory excuse lasts:
| Result | How long the excuse lasts | What to do next |
|---|---|---|
| List A document (for example a British or Irish passport) | For the whole of the employment | No follow-up check |
| Settled or EU Settlement Scheme status shown online | For the whole of the employment | No follow-up check |
| List B Group 1 document, or time-limited permission shown online | Until the permission expires | Repeat the check on or before the date the permission ends |
| List B Group 2, with a Positive Verification Notice | Six months from the date in the notice | Request a new notice before the six months run out |
| Application, appeal or review pending when permission expires | Up to 28 calendar days while you check | Use the Employer Checking Service or an online check within that period |
The Employer Checking Service is for cases the online check cannot handle: pending EU Settlement Scheme applications with a non-digital certificate of application, application registration cards, eVisa technical problems, pending in-time applications where no share code can be generated, permission issued in a Crown Dependency, and people who arrived before 1988, including the Windrush generation. It aims to reply within five working days, so start early if the start date is close.
Put follow-up dates in a diary the day the check is done. A missed follow-up date ends the statutory excuse even if the person still has permission.
Penalties
- Civil penalty. The maximum has been £60,000 per illegal worker since 13 February 2024 (SI 2024/82). Under the October 2026 code, the starting point is £45,000 for a first breach and £60,000 for a repeat breach within three years, reduced in steps for mitigating factors.
- Criminal offense. Employing someone while knowing, or having reasonable cause to believe, they do not have the right to do the work carries up to five years in prison and an unlimited fine, according to gov.uk. "Reasonable cause to believe" is wider than knowing.
Where recruiters and agencies fit
- Permanent placements. The hiring client must do the check. The guide says an employer cannot establish a statutory excuse by relying on a check carried out independently by an external third party such as a recruitment agency; the exception is a registered digital provider used on the employer's behalf.
- Agency workers. Where an employment business supplies a worker, the guide treats it as the employer for the scheme, so the check and the liability sit with the agency. The guide says the changes are not intended to make hirers routinely duplicate those checks.
- Contractors and platform roles. From October 2026, ask clients engaging individual sub-contractors whether the new rules cover the arrangement, and who in the chain is doing the check.
Checking without discriminating
The Home Office code on avoiding unlawful discrimination, in force from 1 October 2026, asks employers to treat everyone the same way. In practice:
- Check every candidate, British citizens included, at the same stage. If you check one applicant at a stage, check everyone being considered at that stage.
- Do not decide who to check based on colour, nationality, ethnic or national origin, accent, surname or how long someone has lived in the UK.
- Do not favour eVisa holders, and do not insist on a digital check for people who can prove their right manually.
- In interviews, ask the same neutral question of everyone, along the lines of the wording in work authorization questions in interviews, and leave the detail to the formal check.
Breaches can lead to claims under the Equality Act 2010, where tribunal compensation has no upper limit.
Records and retention
Keep copies of documents, online check results and provider outputs for the duration of the employment and for two years afterwards, then destroy them securely. These are personal data under UK GDPR, so they belong in a restricted file rather than the interview record, and candidates should be told about them in your candidate privacy notice.
Digital ID: not yet a requirement
On 26 September 2025 the government announced that digital ID would be mandatory for right to work checks by the end of the Parliament, and a public consultation ran from 10 March to 5 May 2026. Press reports in mid-2026 suggested the plans had changed; we could not confirm the current position from a government source. The October 2026 guide does not require digital ID, and manual checks remain valid for anyone without an eVisa.
A checklist for each hire
- Tell every candidate at offer stage that a right to work check is required and the ways they can prove it.
- Use the online service for anyone with an eVisa; do not accept a BRP card.
- For manual checks, hold the originals, check them in the person's presence (or on live video while holding them), and copy them.
- Complete the check before the first day of work, not on it.
- Record the date of the check and diarize any follow-up date.
- For workers, sub-contractors and platform roles starting from 1 October 2026, confirm who in the chain is responsible.
- Keep the records for the employment plus two years, then delete them.
Recruiters working on both sides of the Atlantic will notice the timing differs: the US Form I-9 is completed around the start date, with the employer's review allowed within three business days after work begins, while the UK check must be finished before work starts. See I-9 timing in hiring for the US side.
Questions people ask
When must a UK right to work check be done?
Before the person starts work. The Home Office guide says that to establish a statutory excuse an employer must carry out a manual document check, a Home Office online check or a check through a registered digital verification service provider before the worker commences employment. Doing it at the offer stage, for every hire, is the common practice.
Can a recruitment agency do the right to work check for the client?
Not in a way that protects the client. The October 2026 guide says an employer cannot establish a statutory excuse by relying on a check carried out independently by an external third party such as a recruitment agency. For agency workers supplied by an employment business, the employment business is treated as the employer and is responsible for the check.
Is an expired BRP acceptable proof of right to work?
No. Biometric residence permits stopped being issued on 31 October 2024 and have been replaced by eVisas. The Home Office guide says a manual check of an original, expired BRP is not acceptable proof of right to work. Where someone has an eVisa, the employer must use the Home Office online checking service with their share code.
What is the penalty for employing someone without the right to work?
A civil penalty of up to £60,000 per illegal worker since 13 February 2024, with a starting point of £45,000 for a first breach and £60,000 for a repeat breach within three years under the code of practice. Employing someone while knowing, or having reasonable cause to believe, they cannot work is also a criminal offense carrying up to five years in prison and an unlimited fine.
Do right to work checks now apply to contractors and gig workers?
From 1 October 2026, section 48 of the Border Security, Asylum and Immigration Act 2025 extends the scheme beyond employees to people on worker contracts, individual sub-contractors such as those working through platforms, and online matching services. It is not retrospective, and genuinely self-employed people and personal service companies remain outside it.