How to carry out a right to work check
The check itself takes a few minutes. What it buys you is a statutory excuse — the defence that stands between a hiring mistake and a penalty of up to £60,000 per worker. Almost every failure is a missed follow-up date rather than a bad first check.
Summarise with AI
Key takeaways
- There are three valid checks: an online check using a share code, a manual check of original documents, or an IDVT check through a certified identity service provider
- A correct check gives you a statutory excuse — the defence against a civil penalty if a worker turns out not to have the right to work
- Penalties reach £45,000 per illegal worker for a first breach and £60,000 for repeat breaches
- Keep the evidence for the whole of employment plus two years afterwards, and diarise a follow-up check before any time-limited permission expires
The three types of check
Every check must be completed before employment starts. One done in the first week is a check done too late, and it does not give you the protection you were after.
| Type of check | Who it suits |
|---|---|
| Online check using a share code | Anyone with a digital immigration status — the default route |
| Manual check of original documents | British and Irish citizens, and others holding acceptable documents |
| Identity service provider (IDVT) | British and Irish citizens with a valid passport, checked digitally |
A manual check has to be done properly to count: see the original documents, check them in the person's presence — in person or over a live video call while you hold the originals — satisfy yourself the photograph and dates of birth are consistent, then take and date a copy.
Online checks and share codes
The share code is generated by the applicant from their own Home Office account and given to you. You enter it with their date of birth, view the status online, and confirm the photograph matches the person in front of you. Keep a copy of the response you are shown.
British and irish citizens cannot use a share code
This surprises people regularly. A British citizen has no digital immigration status to share, so they prove their right to work with documents — typically a passport — or through a certified identity service provider. Asking them for a share code they cannot obtain wastes everybody's time and looks like the check was not understood.
Follow-up checks for time-limited status
Where permission to work is time-limited, the first check covers you only until it expires. A repeat check before that date keeps the excuse running; missing the date ends it, even though nothing about the original check was wrong.
This is the single most common way a compliant employer becomes a non-compliant one, and it is a diary problem rather than a legal one. Expiry dates that live in someone's inbox get missed when that person is on holiday. Where permissions and certificates are tracked with dates and alerts — as RosterElf does for licences and certifications — the reminder arrives before the date rather than after it, and the same mechanism covers the DBS checks, food hygiene certificates and SIA badges that shift-based teams also have to keep current.
The statutory excuse and what to keep
The statutory excuse is the whole point of the exercise. Carry out a prescribed check correctly, record it correctly, and you are protected from a civil penalty even if the person later turns out not to have had the right to work. It is a defence you either have or do not have — there is no partial credit for having mostly done it.
- Complete the check before the first day of work.
- Keep a clear copy of the evidence — the online response, or a copy of the documents.
- Record the date the check was carried out; an undated copy does not establish when you did it.
- Retain it for the duration of employment and two years after it ends.
- Repeat the check before any time-limited permission expires.
These are personal data and immigration status is sensitive, so store the evidence securely, restrict who can see it, and delete it once the retention period has run. Holding it indefinitely "just in case" breaches the storage limitation principle — the retention rules are covered in how long to keep employee records, and digital HR records keeps the file with the employee rather than in a drawer.
Penalties — and the discrimination trap
The civil penalty reaches £45,000 per illegal worker for a first breach and £60,000 for repeat breaches, following the increase that took effect in February 2024. Knowingly employing someone without the right to work is a criminal offence in its own right, separate from the civil penalty regime.
The second risk runs in the opposite direction. Checks must be applied to every candidate at the same stage, in the same way. Deciding who to check based on a name, an accent, or an assumption about where someone is from is race discrimination, and it is no defence that the motive was compliance. Applying the check universally is both the safer position and the simpler one to operate.
In practice the check belongs in the same sequence as everything else on someone's first day — the written statement of particulars, the bank details, the rest of onboarding. Done as part of a checklist it takes minutes; done as a separate task somebody has to remember, it is the one that gets postponed until the person has already started.
Never miss an expiry date again
Track right to work evidence, DBS checks, licences and certificates against each employee — with alerts before they lapse, not after.
This guide summarises the right to work check regime in general terms and is not legal or immigration advice. The Home Office employer's guide and codes of practice are updated regularly. Check GOV.UK for the current version, or take advice, before relying on it in an individual case. It does not constitute legal, HR, or professional advice and should not be relied on as a substitute for advice specific to your business, workforce, or circumstances.
Right to work check questions
- One of three ways: an online check using a share code the applicant gives you, a manual check of their original documents in their presence, or a digital identity check through a certified identity service provider using IDVT. All three must be completed before employment starts.
- A code the applicant generates from their own Home Office account, which you enter along with their date of birth to view their status online. British and Irish citizens cannot get one — they prove their right to work with documents such as a passport, or through an identity service provider.
- Where someone’s right to work is time-limited. You check again before their permission expires. Miss the date and the statutory excuse lapses from that point, even though the original check was perfectly good.
- Only where their permission is time-limited and due for a repeat check. There is no requirement to retrospectively re-check people whose original check was done correctly and whose right to work is not time-limited.