In January 2024, the civil penalty for employing an illegal worker tripled to £45,000 for a first offence and £60,000 for repeat offences. By April 2026, the Fair Work Agency arrived with walk-in audit powers, consolidated enforcement, and a mandate to close the gap between regulation and reality.
The rules around right to work checks have not stood still. If your process hasn't changed since 2024, you are almost certainly carrying risk you don't need to carry. Here is what has changed, what it means in practice, and what you need to do about it.
The shift from manual to digital
For decades, right to work verification in the UK meant a physical, in-person process: the candidate hands over a document, the employer inspects it, takes a copy, and files it. That process still exists. But the landscape has shifted decisively towards digital verification, and the legal implications of choosing one method over the other have become material.
Identity Document Validation Technology (IDVT) — sometimes referred to under the broader label of Identity Service Providers (IDSPs) — allows employers to verify the identity of British and Irish citizens digitally, without an in-person meeting. The Home Office certified the first IDSPs in April 2022, and by 2026 the market has matured significantly.
The critical point for employers is this: using a certified IDSP provides a statutory excuse in exactly the same way that a properly conducted manual check does. But digital checks create a stronger audit trail by default — timestamped, tamper-resistant, and centrally stored. When the Fair Work Agency arrives for an unannounced visit, a digital audit trail is significantly easier to produce than a filing cabinet of photocopies.
However, IDVT has a significant limitation. It is only available for British and Irish citizens holding valid passports (or Irish passport cards). It cannot be used for non-UK/Irish nationals, regardless of their immigration status.
Share codes and the BRP transition
For non-UK/Irish nationals, the right to work check process increasingly centres on online share codes generated through the Home Office's View and Prove your immigration status service.
This matters more in 2026 than it did in 2024 because of the Biometric Residence Permit (BRP) expiry programme. All BRPs issued before 2025 carried an expiry date of 31 December 2024. While the Home Office confirmed that individuals whose immigration status extends beyond that date retain their right to work, the physical BRP card is no longer valid as standalone proof.
In practical terms, this means:
- You cannot accept an expired BRP as proof of right to work on its own
- The worker must generate a share code through the online service, which you then verify against the Home Office checking service
- eVisa status is now the primary record for most non-UK/Irish nationals — the physical card is being phased out entirely
Employers who were relying on checking BRP cards as their primary verification method for non-UK nationals need to update their process. The card in the worker's wallet may be expired. The right to work may still be valid. But you need the share code, not the card, to establish your statutory excuse.
The FWA enforcement context
The Fair Work Agency changes the enforcement environment in three ways that directly affect how seriously employers need to take right to work checks.
Consolidated intelligence. The FWA merges HMRC's National Minimum Wage enforcement, the Employment Agency Standards Inspectorate, and the Gangmasters and Labour Abuse Authority. Previously, these bodies operated separately. Now they share data. A minimum wage investigation that uncovers a right to work issue will be escalated, not ignored.
Proactive enforcement. The FWA has powers to conduct unannounced visits. Under the previous fragmented model, the chances of a small employer being visited were low. Under the FWA, with consolidated resources and a political mandate to demonstrate impact, the probability of inspection has increased across the board.
No size exemption. The penalty regime does not differentiate between a multinational and a five-person business. £45,000 per worker for a first offence, £60,000 for repeat offences. For an SME, a single failure could be existential.
What employers must do differently in 2026
Here is the practical checklist. If you are not doing all of these, you have a gap.
1. Know which check method applies to which worker
This is the single most common source of error. The correct check method depends on the worker's nationality and document type:
- British/Irish citizens with valid passports: Manual check (inspect, copy, retain) OR digital check via a certified IDSP
- Non-UK/Irish nationals with a share code: Online check via the Employer Checking Service
- Non-UK/Irish nationals without a share code (e.g., those with physical documents only): Manual check only — inspect original documents in person
Using the wrong method voids your statutory excuse. If you use an IDSP to verify a non-UK national, you do not have a valid check. If you accept a photocopy instead of inspecting the original, you do not have a valid check.
2. Conduct checks before employment starts
The employer's guide to right to work checks is explicit: the check must be completed before the individual begins working for you. Not on day one. Not during the first week. Before they start.
This is where many businesses fail. The pressure to get a new hire started — particularly in sectors with high turnover like care and hospitality — leads to "we'll sort the paperwork out later." Later is too late. If the person turns out not to have the right to work, you have already committed the offence.
3. Set up follow-up checks for time-limited permission
If a worker has time-limited right to work — a Graduate visa, a Skilled Worker visa, a dependent visa — your obligation does not end at the initial check. You must conduct a follow-up check before their permission expires.
This is the compliance gap that catches the most employers out. The initial check was done properly. But the visa expired six months later, nobody tracked it, and the business is now employing someone without the right to work. The statutory excuse only lasts as long as the permission it was based on.
4. Build an audit trail that survives a visit
An audit trail is not a filing cabinet. It is a system where, for any worker, you can produce a complete record of what was checked, when, by whom, what document was presented, and what the outcome was — within minutes, not hours.
The FWA compliance officer is not going to wait while you search through emails, call HR, and check the shared drive. Your audit trail needs to be immediate and comprehensive.
For each worker, your records should include:
- Date of check (before employment start date)
- Method used (manual, IDSP, or online share code)
- Documents inspected (document type, reference numbers, expiry dates)
- Outcome (right to work confirmed, time-limited, follow-up date set)
- Who conducted the check (name and role)
- Copy of document or IDSP verification record
5. Review your process for agency and temporary workers
The right to work obligation applies to every person working for you, regardless of how they arrived. If you use agency or temporary workers, you need to understand who is responsible for the check and ensure it has actually been done.
The safest approach: verify at the point of arrival. Do not assume the agency has done it. Even if they have, you want your own record for your own statutory excuse.
The statutory excuse: your only real defence
Everything in the right to work regime ultimately comes down to statutory excuse. If you conducted a compliant check before employment started, retained the correct records, and followed up on time-limited permission, you have a statutory excuse. This means that even if the worker turns out not to have the right to work — because they used a fraudulent document, for example — you are protected from civil penalty.
If you did not conduct a compliant check, or conducted it incorrectly, or conducted it late, you have no statutory excuse. The penalty applies regardless of your intentions.
The statutory excuse is binary. You have it or you don't. There is no partial credit.
What good looks like in 2026
The businesses that are genuinely protected in 2026 share common characteristics:
- They check right to work before the first day, not during onboarding
- They use the correct method for each worker type (IDSP for British/Irish passport holders, online check for share code holders, manual for everyone else)
- They have a centralised, searchable record of every check
- They track expiry dates and conduct follow-up checks before permission lapses
- They can produce a complete compliance record for any worker within minutes — not hours, not days
This is not about perfection. It is about having a system that works consistently, creates reliable records, and can withstand scrutiny when it arrives.
Certifyd's Right to Work Portal automates the entire process — from initial document collection through to expiry tracking and audit-ready reporting. Digital verification, centralised records, automated follow-ups, and instant compliance dashboards, built for the 2026 enforcement environment.