· TestSafe Compliance
Quick answer: A right to work check is the employer's legal duty under the Immigration, Asylum and Nationality Act 2006. Get it right and you have a statutory excuse against a civil penalty of up to £60,000 per worker. Get it wrong, miss a follow-up, or rely on a physical document that is no longer acceptable evidence, and you carry the liability alone.
A right to work check is the process every employer in the UK must follow before a new worker starts, to confirm that the worker is allowed to do the job they are being hired for. The duty sits on the employer, not the worker. If a worker is found to have no right to work and the employer cannot show they completed a compliant check, the employer carries the civil penalty and, in the worst cases, the criminal liability. The worker can be honest, the worker can be wrong, the worker can be deliberately misleading. None of that protects the employer if the paperwork is not in order.
The current rule book is the Home Office's Employer's Guide to Right to Work Checks, February 2026 version. It sits on top of section 15 of the Immigration, Asylum and Nationality Act 2006, which is the source of the civil penalty power. The guidance changes regularly, the law changes occasionally, and the practical mechanics, share codes, follow-up timings, IDVT providers, are where most Devon employers come unstuck.
There are three lawful ways to perform a right to work check in 2026, and the route you take depends entirely on who the worker is:
There is no fourth route. A photocopy seen by email, a passport scanned in a WhatsApp message, a Right to Work Certificate from a previous employer, none of these give you the statutory excuse. We have seen all three in Devon audits, and each one would fail an inspection.
A manual check can only be used for a British or Irish national. The Home Office List A sets out the documents that prove a permanent right to work. The two routes most Devon employers will see are:
A National Insurance number on its own is not a right to work document. A driving licence is not a right to work document. A bank statement is not a right to work document. The check involves three steps: see the original in the worker's physical presence (or via a live video link with the original document being held by the worker on camera), make a clear dated copy of every relevant page, and record the date the check was performed and the name of the person who performed it. Skip any one of those three steps and you do not have a statutory excuse.
This is the single most common mistake we see in Devon hospitality, and it has been wrong for nearly five years. Before 30 June 2021, an EU, EEA or Swiss national could prove their right to work with their national passport or ID card. From 1 July 2021, that route closed. EEA nationals living and working in the UK now hold either settled or pre-settled status under the EU Settlement Scheme, and the only way to prove that status to an employer is via a share code generated from their gov.uk immigration account.
If you have a Polish, Romanian, Italian or Portuguese worker hired before July 2021 and never re-checked, the original passport scan in your file is no longer compliant evidence on its own. The worker themselves still has the right to work, but you no longer have a statutory excuse, because your record is from a document that is no longer accepted as proof. A retrospective share code check, with the worker's permission, fixes this in minutes. We have walked Devon hospitality clients through this exercise more times than any other RTW exercise.
A biometric residence permit (BRP) or biometric residence card (BRC) is a physical card showing a non-British, non-Irish worker's immigration status. From 1 January 2025 the Home Office has moved away from issuing new physical BRPs in favour of fully digital eVisas, and that direction of travel matters: the physical card alone is no longer the answer.
For a BRP or BRC holder, the share code check on gov.uk/view-right-to-work is what gives the employer the statutory excuse. Photocopying the card is not enough. The card may be valid, expired, or replaced by an eVisa, and only the digital check tells you which. The share code result will also tell you exactly what type of work the holder is allowed to do, whether there is a time limit, and whether sponsorship is required. None of that information is on the physical card alone.
Identity Document Verification Technology was introduced to remove the need for a face-to-face document check for British and Irish workers. The employer uses a Home Office approved IDVT provider, the worker uploads their passport image and a live selfie, and the system verifies the document, matches it to the person, and produces a digital identity verification report. The employer keeps that report on file and treats it as the evidence of the check.
IDVT works well for distributed teams, home-based hiring and seasonal recruitment where the worker is not yet on site. The trap is that it only works for British and Irish nationals. An IDVT check on an EEA national, a sponsored worker, or a BRP holder is not a compliant check, regardless of how good the verification report looks. The route always follows from the nationality and immigration status of the worker, not from the convenience of the employer.
If a worker's right to work has an end date, whether that is pre-settled status, a Skilled Worker visa, a Health and Care visa, a graduate visa, a Youth Mobility visa or any other time-limited permission, the employer must carry out a follow-up check before that end date arrives. The follow-up is a fresh share code check against the worker's current status, not a reuse of the original record. If the worker has been granted further leave, the check renews the statutory excuse. If they have not, their right to work has ended and the employer must stop employing them.
The practical setup is simple, and the failure mode is always the same. Set a diary reminder three months before the expiry date, and a second one month before. The three-month reminder gives the worker time to apply for an extension, gather their documents and complete the process. The one-month reminder is your last line of defence if the application has stalled. Without these reminders, a Devon care provider with twenty sponsored workers and rolling expiry dates will eventually miss one. Once the date passes without a fresh check, the statutory excuse is gone.
The Home Office requires right to work records to be kept for the duration of the worker's employment plus a further two years after they leave. That is the minimum, and it applies to every type of check, manual, share code, IDVT.
In practice that means a single electronic folder per worker, with three things in it: the dated copy of the document (or the saved share code PDF, or the IDVT report), a record of who performed the check and when, and any follow-up checks performed during the worker's employment. Paper-only records are still legal, but they are harder to produce on demand during an inspection, more likely to go missing, and easier to lose during an office move or a staff change. An electronic system is not a legal requirement, but it is a practical one. If a Fair Work Agency inspector or a Home Office officer asks for a worker's right to work file in 2027 for someone who left in 2026, you need to be able to produce it within minutes, not days.
On 13 February 2024 the Home Office tripled the civil penalty for employing an illegal worker. The maximum fine is now £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years. These are not theoretical figures. Quarterly Home Office data continues to show penalties imposed on small employers across hospitality, care, retail and construction in five-figure and six-figure totals. Devon is not exempt from this enforcement activity, and the spread of cases across the South West suggests the opposite, that smaller businesses outside major urban centres are an active target precisely because compliance is less consistent.
Beyond the civil penalty, an employer who knew or had reasonable cause to believe the worker had no right to work can face criminal prosecution under section 21 of the Immigration, Asylum and Nationality Act 2006, with a maximum sentence of five years in prison and an unlimited fine. The statutory excuse defence only operates against the civil penalty, not the criminal offence, but a properly documented check is strong evidence that the employer did not knowingly hire an illegal worker.
Different Devon sectors have different right to work failure modes, and the patterns are consistent enough to be predictable.
The seasonal hiring rush in May and June is where things slip. A pot-washer who can start tomorrow, a waitress who is a friend of a current waitress, a kitchen porter from a hostel down the road, all of them get hired in a hurry, often by a duty manager rather than the owner, and the right to work check either never happens or happens in a way that does not produce a usable record. By August the worker is part of the team and nobody remembers what was checked. We have also seen cash-in-hand drift, where a worker who started as a casual evening helper gradually becomes a full-time employee without a contract or a check. The Fair Work Agency views this as a single problem with multiple symptoms, and so do we.
Devon care providers run two right to work risks. The first is sponsored worker follow-ups. A care home with fifteen Health and Care visa holders has fifteen rolling expiry dates, and missing one means losing the statutory excuse for that worker and potentially the sponsor licence. The second is the use of unregulated immigration advisers. Anyone advising on or representing a worker in an immigration matter for reward must be regulated by the Immigration Advice Authority (formerly OISC). We have seen care providers use unregulated brokers for sponsorship work, which exposes both the worker and the provider to risk.
Hair and beauty salons often run a mixed model: some staff are employed, some are described as chair renters or self-employed. The right to work question follows the actual working arrangement, not the label on the contract. If someone is working set hours, in your premises, using your equipment and being paid by you or through you, they are almost certainly a worker for employment law purposes, and you owe them a right to work check. The Fair Work Agency takes the same view of worker status here as it does on holiday pay and minimum wage, which is to say it looks at the reality of the arrangement rather than what either party calls it.
When a Fair Work Agency inspector arrives, the right to work part of the visit is mechanical. They want to see a complete list of every worker employed in the last six years, and for each one they want to see the right to work record. They will ask how the check was performed, who performed it, what date it was performed, and where the record is stored. If the worker has time-limited status they will ask to see the follow-up checks.
Our Fair Work Agency pre-assessment works through the same exercise in advance. We pull a sample of worker files, recreate the inspector's questions, and tell you exactly what would survive an inspection and what would not. The cost of fixing a gap before an inspector arrives is always lower than the cost of arguing about it afterwards, and the time on site is usually half a day for a small employer.
The setup we recommend to every Devon employer takes about a day to put in place and then runs itself. Create a single secure electronic folder for each worker, named with the worker's full name and start date. Inside that folder, place the right to work evidence (the dated copy of the document, the saved share code result, or the IDVT report), a short cover note showing who performed the check and when, and a sub-folder for follow-up checks if the worker has time-limited status. Add the expiry date to a shared diary with two reminders, three months out and one month out.
When the worker leaves, move their folder to a "leavers" area, tag it with the leaving date, and set a diary reminder to delete or archive it two years and one day after that date. This is the minimum legal retention period. Keeping records longer is not strictly required, and from a UK GDPR data minimisation point of view, holding personal data beyond the retention period without a clear reason is itself a risk. Our Employment Compliance Audit looks at right to work alongside contracts, payslips, holiday pay and working time records, because in our experience the same filing weaknesses tend to surface across all of them at once.
Right to work is one of several areas the Fair Work Agency now inspects in a single visit. National Minimum Wage, holiday pay, written contracts, working time, agency conduct and modern slavery sit alongside it, and an inspector arriving to look at one will look at the rest. A perfectly compliant right to work file alongside a holiday pay calculation that has not been updated since 2019 is not a successful inspection. The areas are connected in the inspector's mind, and they should be connected in yours.
For a Devon employer, the practical answer is to treat right to work as the entry point into a wider review. If your right to work files are in good shape, your filing discipline is good, and the rest of the compliance picture is probably also in better shape than average. If your right to work files are patchy, that pattern almost always repeats across contracts, payroll and working time. We see this every week. The good news is that the fix is the same fix: one written audit, a clear gap list, and a few days of follow-up work. None of it is glamorous, all of it is achievable, and the cost of getting it done is a small fraction of a single Home Office penalty or a single FWA Notice of Underpayment. A Fair Work Agency pre-assessment is designed to do exactly this in a single visit.
The legal source for civil penalties on illegal working is section 15 of the Immigration, Asylum and Nationality Act 2006. The criminal offence sits at section 21 of the same Act. The practical rules an employer must follow are set out in the Home Office Employer's Guide to Right to Work Checks, February 2026 version, available on gov.uk. The guide is updated several times a year as policy and process change, and the version date matters. A check performed against an older version of the guide may still be lawful at the time, but checking against the current edition removes any ambiguity.
We are not a law firm. We do not give regulated immigration advice. What we do is audit right to work compliance against the current Home Office guidance, identify the gaps, and tell you what to fix and in what order. For anything that needs a regulated immigration adviser, we will say so and point you in the right direction.
This article is for general information only and reflects the law as it stood on the date of publication. It does not constitute legal advice and should not be relied upon as a substitute for advice specific to your situation. TestSafe Compliance provides audit and assessment services only. Where a specific legal question arises, seek advice from a qualified solicitor or employment law specialist.
For a British or Irish national, a current or expired UK passport is acceptable evidence, but the employer must still see the original document in person or use a certified IDVT provider, check that the photograph and date of birth are consistent with the person standing in front of them, and keep a clear dated copy on file. A passport alone is not enough if it belongs to an EEA national, since 1 July 2021 EEA nationals must be checked via the gov.uk online share code service against their settled or pre-settled status.
A share code is a nine-character code generated by a worker from their gov.uk online immigration account. The employer enters the code at gov.uk/view-right-to-work along with the worker's date of birth, and the Home Office returns a digital record showing the worker's status, any conditions, and the date the check was performed. You need a share code for any EEA national with settled or pre-settled status, anyone holding a biometric residence permit or biometric residence card, sponsored workers, and anyone with time-limited permission to work. Keep the resulting PDF or screenshot on file.
Records must be kept for the full duration of the worker's employment plus two years after they leave. That is the minimum, and it applies whether the check was manual, online via share code, or run through an Identity Document Verification Technology provider. We recommend a single electronic folder per worker holding the dated copy of the document or the saved share code result, plus a record of who performed the check and when. Paper-only records are still legal but harder to produce on demand during an inspection.
Since 13 February 2024 the Home Office civil penalty regime sets a maximum fine of £60,000 per illegal worker for a repeat breach, and £45,000 per worker for a first breach. There is also potential criminal liability of up to five years in prison for an employer who knew or had reasonable cause to believe the worker had no right to work. A correctly performed check gives the employer a statutory excuse, meaning the civil penalty cannot be imposed even if the worker later turns out to be working illegally. That statutory excuse is the single most important reason to get the process right.
Yes. For any worker whose permission to work has an end date, the employer must carry out a follow-up check before that date expires. The follow-up is a fresh share code check against the worker's current status, not a reuse of the original record. If the worker's leave has not been extended, their right to work ends and the employer must stop employing them or risk losing the statutory excuse. The safest setup is a calendar reminder set three months before each expiry, plus a second reminder one month before, so there is time to chase a worker whose application is delayed.
Half a day on site, written gap analysis within five working days. Devon-based, fixed price, no corporate retainer.