Before hiring any new employee, you must carry out a legal right to work check. It is a statutory requirement under immigration law, not simply a best practice. If you fail to do this—or do it incorrectly—you face civil penalties of up to £45,000 for a first breach or £60,000 for repeat breaches, regardless of whether you were aware the person had no right to work.
The good news is that conducting a proper check is straightforward. This guide explains your legal obligations, the three methods available, and how to protect yourself with a statutory excuse.
Why right to work checks matter
Every employer has a legal duty to check that anyone they employ has the right to work in the UK. This applies before employment begins and continues if a person’s permission to work is time-limited.
If you employ someone who does not have the right to work—even if they misled you about their status—you can be held liable for a civil penalty unless you can prove you carried out the correct checks. Immigration Enforcement takes enforcement seriously; over 2,400 penalties were issued in 2025 alone, totalling more than £130 million.
The three methods of checking
You must use one of three prescribed methods. Each establishes a “statutory excuse”—a legal defence against a civil penalty.
Manual document checks involve asking the applicant to show you original documents from an approved list. These typically include a current passport, a visa or travel document, a birth certificate plus proof of current address, or a certificate of settlement or indefinite leave. You must verify that the photograph matches the person presenting, confirm their date of birth is consistent across documents, and check that dates of expiry have not passed. You must take and retain a secure copy of the documents checked.
Home Office online checks are faster. An applicant generates a nine-character share code through the Home Office online service, valid for 90 days. You enter this code alongside their date of birth into the official Home Office portal, and you receive immediate confirmation of their immigration status directly from Home Office records. This method eliminates the need for physical documents and is increasingly popular for remote hiring. British and Irish citizens cannot use a share code; they must be checked manually or via digital verification.
Digital Verification Services (DVS) allow certified providers to verify the identity of individuals holding British or Irish passports or passport cards. The provider confirms the photograph and biographic details match the person presenting. This is a newer method and is most useful for British and Irish citizens.
Record keeping requirements
You must retain clear copies of the checks you conducted for the duration of employment and for two years after employment ends. This is essential; if Immigration Enforcement investigates and you cannot produce evidence of your checks, you lose your statutory excuse and become liable to a civil penalty.
Do not store original documents—copies are sufficient. Keep them securely and confidentially, as they contain sensitive personal data. Update records if an employee’s work permission changes or expires.
Time-limited versus indefinite permission
If an applicant has indefinite leave to remain or settled status, no follow-up checks are needed; they can work for you indefinitely without further verification.
If their permission is time-limited (for example, they hold a visa valid until a specific date), you must conduct a follow-up check shortly before that date expires. If they wish to continue working for you, they will need to provide evidence of renewed permission. Without a follow-up check, you lose your statutory excuse when their permission expires, and you become liable to a penalty.
The timescale for follow-up checks is your responsibility to manage. Set reminders when you conduct the initial check so that you do not accidentally employ someone beyond their permission period.
Common mistakes to avoid
Checking too late: Carry out the check before employment starts, not during the first week or month. If you employ someone without having checked their right to work first, you cannot later claim a statutory excuse, even if they later provide evidence of permission.
Relying on verbal assurance: Applicants may tell you they are eligible to work, but you must verify it yourself through one of the three prescribed methods. Word-of-mouth is not sufficient.
Not updating for time-limited permission: Many employers forget to track expiry dates or conduct follow-up checks. If an employee’s permission expires and you do not check, you lose protection from penalties. Use your employment records to flag upcoming expiry dates.
Accepting a share code beyond its 90-day validity: Share codes expire quickly. If the applicant provides a code that is more than 90 days old, ask for a new one.
Retaining originals instead of copies: Storing original passports or visas is unnecessary, creates a data protection burden, and increases security risk. Make a clear copy and return the original.
Establishing your statutory excuse
A statutory excuse is your legal defence. You establish it by completing one of the three prescribed checks correctly before the person starts work. Once established, if Immigration Enforcement later discovers the person has no right to work, you are protected from a civil penalty—provided you can produce evidence that you completed the check.
If the person’s right to work is time-limited and you conduct a follow-up check on time, your statutory excuse continues. If you fail to conduct a follow-up check and their permission expires while employed, you lose the excuse and become liable for a penalty.
What happens if enforcement finds a breach
If Immigration Enforcement identifies an employee without the right to work, they will issue a referral notice to inform you they are considering your case. If found liable for a breach, you receive a civil penalty notice. You have 28 days to respond, and the notice explains payment options and objection procedures.
Penalties are calculated per illegal worker, not per day or per breach. If you employ two people without right to work, you face two separate penalties.
Digital checks and the future
Digital verification services are being expanded. British and Irish citizens can now use certified providers for digital identity checks, removing the need for physical document inspection. This is particularly useful for remote recruitment. The Home Office continues to develop these services, and employers should check for updates.
Key points
- All employers must conduct a right to work check before employment begins
- Three methods are available: manual documents, Home Office online share code, or digital verification
- A proper check establishes a “statutory excuse”—protection from civil penalties if you later unknowingly employ someone without right to work
- Retain copies of checks for the duration of employment plus two years after
- If permission is time-limited, conduct a follow-up check before expiry to retain your excuse
- Civil penalties: up to £45,000 for a first breach, up to £60,000 for repeat breaches
- Do not employ anyone before checking; do not rely on verbal assurance; do not ignore share code expiry dates
Related: Find HR support near you