UK Right to Work Checks 2026: The Complete Employer Guide

The bit no one tells you about right to work checks

Most small business owners I work with have done a right to work check at some point.

They are reasonably sure they have. The candidate sent a passport photo. Somebody, them, the bookkeeper, the office manager, had a look. They thought it looked fine. The person started on Monday.

That is not a right to work check.

A right to work check is a specific thing, done in a specific way, before a specific date, recorded in a specific format, and stored in a specific place. There are exactly three legal methods. There are about a dozen common ways to get it wrong. And since February 2024, the cost of getting it wrong has been up to £45,000 per worker for a first breach and up to £60,000 per worker for a repeat one.

The penalties are not theoretical. The Home Office issued over 5,000 civil penalty notices in 2024 to 2025, totalling more than £155 million, and most of them went to small businesses.

This is the blog that, if you read it once, you will not need to read again. It is the evergreen version. The methods. The records. The pre-start checklist. The follow-up system. What to do if you find a gap. The lot.

Kettle on.

Why this matters more in a small business, not less?

Big companies have HR teams who do this for a living. They have HR software that diaries follow-up checks automatically. They have an immigration solicitor on retainer.

In a small business, the right to work check tends to live in one of three places, the boss's email inbox, the bookkeeper's filing cabinet, or a folder on someone's laptop that nobody else can access.

When the Home Office turns up, and they do, including at businesses in your sector, at your size, with your number of employees, every one of those three places is going to be searched.

The maths is unforgiving. A single £45,000 penalty in a six-person business is the kind of hit that ends careers, ends businesses and ends marriages. The cost of preventing it is an hour of your time and a one-page checklist.

This is not a topic where "we're too small for it to matter" is a defensible position. The Home Office's most active sectors right now, hospitality, care, beauty, construction, agriculture, hand car washes, takeaway food, are dominated by small businesses. If you are in one of those sectors, you are the audit pool.

If you are not in one of those sectors, you are still in the wider audit pool. Random checks happen. Reports happen. Sector sweeps move around. None of this is your concern if your file is tidy. All of it is your concern if it isn't.

The three legal methods, and which one applies to whom

There are exactly three legal ways to do a right to work check in the UK in 2026. Not four. Not "common sense". Three.

Method 1. The manual check

Permitted only for British and Irish citizens, and increasingly less common because there is a better way (see below).

You see the original document, a current British or Irish passport, or other accepted document from the Home Office's published list. You take a clear copy of every relevant page. You write the date you did the check. You sign the copy. You file it.

The full list of acceptable documents for manual checks is on GOV.UK and changes occasionally. The list is split into List A (no follow-up needed, permanent right to work) and List B (follow-up needed, time-limited right to work). It is your job to use the current list, not the one you saved in 2019.

Method 2. The online share code check

This is the method most non-British and non-Irish workers will use. It is also the easiest for you.

The candidate generates a share code via GOV.UK using their identity details. They send you the share code. You go to gov.uk/view-right-to-work as an employer, enter the share code and the person's date of birth, and the system shows you their right to work status, including any expiry date.

You print the resulting page or save it as a PDF. You note the date you did the check. You file it.

This is the method to use for anyone with a digital immigration status (eVisa, BRP holders who have moved to digital, EU Settlement Scheme holders, work visa holders, students). It is fast, free and produces a clean audit trail.

Method 3. The Identity Service Provider (IDSP) check

For British and Irish citizens, since April 2022, you have been allowed to use a certified Identity Service Provider, a piece of software, to verify the document and the person.

You pay the IDSP a small fee (typically £1.45 to £15 per check). They check the document is genuine, they check the person matches the document via a live photo, and they give you a digital report. You save the report. You note the date. You file it.

The Home Office publishes a list of certified IDSPs. You must use one on the current list. Using a non-certified provider does not give you statutory excuse.

The summary, plainly

• British or Irish citizen, manual check or IDSP. IDSP is faster and harder to get wrong.
• Anyone else, online share code check via GOV.UK.
• No exceptions, no workarounds, no "I trust them".

What counts as a valid record?

A right to work check is only as good as the record you keep of it. The record is what gives you the statutory excuse, the legal protection, if anything ever goes wrong.

A valid record contains:

• The document type or check method (e.g. British passport, share code online check, IDSP report).
• The date the check was carried out.
• Confirmation of who carried it out.
• A clear copy or digital report of what was checked.
• Where the right to work is time-limited, the expiry date of the right to work.
• Storage in a format that cannot be tampered with. PDF is fine, an emailed phone photo is not.

You must keep the record for the duration of the person's employment and for two years after they leave.

A WhatsApp photo of a passport with no date and no signature is not a valid record. A scanned BRP with no check date is not a valid record. A "yes" in your HR system with nothing attached is not a valid record. The Home Office expects the actual evidence, not your assurance that you saw it once.

The bit most small businesses get wrong, time-limited workers

If the person you employ has a permanent right to work, a British passport, an Irish passport, settled status, indefinite leave to remain, one check at the start is enough. Done correctly, filed correctly, and you can move on.

If the person has a time-limited right to work, a Skilled Worker visa, a Graduate visa, a Student visa, a Health and Care visa, pre-settled status that needs to be reviewed, one check at the start is not enough.

You must do a follow-up check before the expiry date of their right to work. If the right to work expires and you have not followed up, the employee is working illegally from that date, and you have lost your statutory excuse for every working day after expiry.

The fix is boring and effective. Whenever you do a check that surfaces an expiry date, you diary two things in your calendar.

• Three months before expiry, a reminder to start the follow-up process.
• Two weeks before expiry, a hard cut-off to have the follow-up check completed and filed.

That is it. Two recurring calendar reminders per affected worker. Free. The single most overlooked piece of compliance hygiene in small business HR.

The pre-start checklist (the one I would steal if I were starting a business tomorrow)

Five steps. Use it every time you hire. Every time. No exceptions for the boss's nephew.

Step 1. Conditional offer wording

Your offer letter says, in writing, that the offer is "subject to a satisfactory right to work check and any other pre-employment checks we deem appropriate". If you do not have this wording, add it today. It protects you if you have to withdraw the offer because the check fails.

Step 2. Book the check before the start date

The moment the candidate accepts, diarise a 30-minute slot in the calendar before their first day. Not "during the first week". Not "before payroll". Before they start work.

Most online share code checks take ten minutes. There is no excuse to leave them until later, and "later" is the single most common point of failure.

Step 3. Use the right method

• British or Irish citizen. IDSP (recommended) or manual.
• Anyone else, share code online check.
• Make it the same process every time. Don't improvise.

Step 4. Store the result properly

PDF the result. File it in the employee's record with the date. If their right to work is time-limited, add the two calendar reminders described above.

Step 5. Train the person who does it

If you delegate the check to a manager or admin person, give them thirty minutes of actual training on what they are doing, why it matters, what the current accepted documents are, and how to use the share code system or the IDSP. Record the date of the training. That training record is part of your defence if you ever need mitigation on a penalty.

That is the entire pre-start process. Five steps. Doable in well under an hour from offer to filed check.

What to do if you find a gap?

You read the above. You went and checked your own files. You found at least one gap, a check you cannot find, a follow-up that wasn't done, a record that does not match what the regulations require.

Do not panic. Do not invent records. Do not back-date anything.

Here is the order of operations.

• For currently employed people where the gap is recent, under 28 days, you may still be able to obtain valid evidence and salvage the position. Take advice before you act.
• For currently employed people where the gap is older, over 28 days, you have probably lost the statutory excuse for the gap period. You can, and should, do a fresh, valid check now. It does not retroactively cover the gap, but it puts the situation right going forward and reduces the future exposure.
• For currently employed people whose status you cannot now verify, for example, you cannot get hold of the original document, the share code has expired, or the person's status has materially changed, get advice from a qualified immigration solicitor or HR advisor before you do anything else. Do not panic-fire. Do not panic-interview. Take advice.
• For ex-employees where you have discovered a gap, your exposure is limited to the period of their employment. Keep what records you have. Take advice if there is reason to think there is going to be enforcement interest.
• In all cases, co-operation with the Home Office, if they come, is the single biggest mitigator on a civil penalty. Co-operation does not mean invention. It means being polite, transparent, producing what you do have, and explaining honestly what is missing.

The four myths that keep small businesses exposed

"My bookkeeper does this."

Maybe. Maybe not. Find out today exactly what method they use, where the records are stored, who runs the time-limited follow-ups and how they would produce the file if asked. If "my bookkeeper does it" is followed by silence when you ask for detail, your bookkeeper does not, in fact, do it.

"We've been doing it the same way for ten years and it's always been fine."

The way you have been doing it pre-dates the digital share code system, the IDSP system, the February 2024 penalty increase, and probably several iterations of the accepted documents list. Doing it the way you used to do it is now substantively non-compliant for most workers. Doing it the way you used to is the single most common reason small businesses are penalised.

"They had a British passport so I didn't need to check."

You still need to check. You still need to see it, copy it (or use an IDSP), date it, sign it and file it. "British passport" is a method category, not a free pass.

"We're too small to be a target."

The majority of civil penalties in 2024 to 2025 went to small businesses. Big employers have HR teams who do this properly. Small businesses are the easier target and they know it.

The seven-minute action list

If you have just seven minutes right now, do these.

1. Open your employee files. Pick one. Can you produce a clear, dated, in-format right to work check for that person? If yes, breathe out. If no, mark it as a gap.

2. Repeat for two more employees, at random. You are sample-auditing yourself.

3. For every employee whose right to work is time-limited, check that you have a calendar reminder for three months before their expiry. If you don't, set it now.

4. Update your offer letter template to include "subject to a satisfactory right to work check" if it doesn't already.

5. Write a one-page "How we do right to work checks here" note. Five steps. Distribute to whoever does the checks.

6. Diarise a thirty-minute training session for one designated checker plus one backup. This month.

7. Save this blog to your favourites. The next hire you do, run through it again before you do the check.

You don't need to be lucky. You need a system.

The honest version of right to work compliance is this.

Most small business owners are decent, well-meaning people who would never knowingly employ someone illegally. The reason they get caught out is not bad intent. It is a missing record, a late check, a follow-up that didn't happen, a method that pre-dates the current rules.

None of those reasons protect you when the Civil Penalty Notice lands. The Home Office does not weigh your character. They weigh your file.

A tight file is twenty minutes of work per new hire and ten minutes of work per quarter on follow-ups. That is the entire job, done properly, forever.

Compared to a £45,000 to £60,000 penalty, an hour a quarter is not a difficult sell.

You do not need to be lucky. You need a system. The system is in this blog. Read it once. Print the checklist. Train the person who does it. Diary the follow-ups.

Then you do not have to think about right to work checks at all, except for ten minutes, per new hire, on the day you do them.

Which is exactly how compliance is meant to feel.

Calm, steady, on file.

Need help getting started?

If you have read this and would like a hand turning it into something that actually runs in your business, that is what I do.

• Book a free HR Health Check for a quick read on where your people processes are tidy and where they aren't
• Book a discovery call to talk through your team specifically
• Listen to Buzzing About HR, new episodes every Tuesday, plain-English HR for small business owners. Episode 21 covers the five most common mistakes; Episode 22 covers what happens when the Home Office turns up.