On 13 February 2024, the civil penalty for employing an illegal worker trebled overnight. The maximum fine for a first offence went from £15,000 to £45,000 per worker. For repeat offences, it went from £20,000 to £60,000 per worker.
These are not theoretical maximums reserved for the worst offenders. They are the starting point for the Home Office's penalty calculation. And with the Fair Work Agency now operational with walk-in audit powers and consolidated enforcement resources, the probability that a non-compliant employer will face these penalties has increased significantly.
If you employ people in the UK — directly, through an agency, or via any other arrangement — this is the penalty regime that applies to you. Here is the full breakdown.
The civil penalty regime
The Immigration, Asylum and Nationality Act 2006, as amended, establishes the framework for civil penalties against employers who employ individuals without the right to work in the UK. The penalty applies per worker, not per employer.
Current penalty levels (from 13 February 2024)
| Offence | Penalty per worker | |---------|-------------------| | First offence | Up to £45,000 | | Repeat offence | Up to £60,000 |
A "repeat offence" means the employer has been subject to a civil penalty within the preceding three years. The penalty is calculated using a framework set out in the Home Office code of practice on illegal working penalties, which considers mitigating factors such as cooperation with the investigation and genuine remedial action taken.
The scale of the increase
To understand how dramatic the 2024 increase was:
| Period | First offence | Repeat offence | |--------|--------------|----------------| | Before February 2024 | £15,000 | £20,000 | | From February 2024 | £45,000 | £60,000 | | Increase | 200% | 200% |
The government stated that the increase was intended to reflect the seriousness of the offence and to ensure penalties acted as a genuine deterrent. For a business employing three illegal workers, the first-offence exposure is now £135,000. For a repeat offender with five workers, it is £300,000. These are sums that can — and do — put businesses under.
How penalties are calculated
The Home Office does not automatically impose the maximum penalty. The code of practice sets out a framework with aggravating and mitigating factors.
Aggravating factors (penalty increased):
- The employer knew or had reasonable cause to believe the worker did not have the right to work
- The employer has previously been penalised for the same offence
- The employer has been given a warning or an advisory visit and failed to take corrective action
Mitigating factors (penalty reduced):
- The employer cooperated fully with the investigation
- The employer took genuine steps to comply but failed due to error
- The employer reported the suspected illegal worker to the Home Office
- The employer can demonstrate that active checking procedures were in place, even if the specific check was missed
The mitigation factors are assessed on evidence, not assertion. Saying "we usually check" is not evidence. Showing a documented compliance process with audit records is.
Criminal prosecution
Beyond civil penalties, employing an illegal worker can be a criminal offence under Section 21 of the Immigration, Asylum and Nationality Act 2006.
The criminal threshold is higher than the civil threshold. For criminal prosecution, the Home Office must demonstrate that the employer knew, or had reasonable cause to believe, that the worker did not have the right to work.
Criminal penalties
| Offence | Maximum penalty | |---------|----------------| | Employing an illegal worker (with knowledge or reasonable cause to believe) | Up to 5 years' imprisonment and/or an unlimited fine |
Criminal prosecution is reserved for the most serious cases — employers who deliberately exploit illegal workers, employers who have been repeatedly warned, or employers who are involved in wider labour abuse or immigration fraud.
But "reasonable cause to believe" is a lower bar than "actually knew." If you received a document that was obviously fraudulent, if you were told by the worker that their visa had expired, or if you simply never checked at all, you may meet the threshold for criminal liability.
Director and officer liability
Criminal prosecution can extend beyond the business entity to individual directors and officers. Under the Act, any officer of a body corporate who consented to or connived in the offence, or whose neglect led to it, can be personally prosecuted.
This means that a director who knew the company was not conducting right to work checks — or who should have known — faces personal criminal liability. The "I left that to HR" defence does not hold if the director had a duty to ensure compliance and failed to discharge it.
The statutory excuse: your only real defence
The penalty regime is severe. But it comes with a built-in defence mechanism: the statutory excuse.
If you conducted a prescribed right to work check before the individual started working for you, and you conducted it in accordance with the Home Office employer's guide, you have a statutory excuse. This means:
- You are protected from civil penalty, even if the worker turns out to have no right to work
- You are protected from criminal prosecution, because having conducted the check negates the element of knowledge or reasonable cause to believe
The statutory excuse is the single most important concept in right to work compliance. It converts a potentially catastrophic liability into a defensible position.
What establishes a statutory excuse
A statutory excuse is established when you:
- Obtain the required documents from the worker (original documents for manual checks, or digital verification via IDSP or online share code check)
- Check that the documents are genuine, relate to the worker, and confirm the right to work for the job in question
- Copy and retain the documents (or digital verification record), recording the date of check
- Conduct follow-up checks for workers with time-limited right to work, before their permission expires
All four elements are required. Miss any one of them, and the statutory excuse is void.
What voids a statutory excuse
This is where employers most commonly fail. A statutory excuse can be voided by:
Conducting the check late. If the worker started on Monday and you checked on Wednesday, you have no statutory excuse for Monday and Tuesday. The check must be done before the start date.
Using the wrong method. If you used an IDSP check for a non-UK/Irish national (which is not permitted), the check is invalid. If you accepted a photocopy instead of the original document for a manual check, the check is invalid.
Not retaining records. If you checked the document but did not copy it and record the date, you cannot prove the check was conducted. An unprovable check is, for statutory excuse purposes, no check at all.
Failing to conduct a follow-up check. If the worker had time-limited right to work (a visa with an expiry date), your statutory excuse only lasts until that expiry date. If you did not conduct a follow-up check before the expiry, your excuse has lapsed from that date forward.
Knowing the document was false. If you had reasonable grounds to believe the document was fraudulent and proceeded anyway, the statutory excuse is void regardless of whether you went through the motions of checking.
Real enforcement in practice
The Home Office publishes penalty notices and enforcement data that illustrate how the regime operates in practice.
Sector patterns. The sectors most frequently penalised align with the sectors most frequently subject to sponsor licence revocations: care, hospitality, retail, and construction. These are sectors with high turnover, heavy reliance on migrant labour, and — in many cases — lean HR functions that struggle to maintain rigorous compliance processes.
SME vulnerability. While large enterprises receive the headlines, SMEs bear a disproportionate share of enforcement action. A large company with a dedicated compliance team that gets penalised for one worker absorbs the fine and fixes the process. An SME that gets penalised for three workers at £45,000 each faces a £135,000 bill that may exceed its annual profit. Read more about compliance costs for small businesses.
The rise in enforcement activity. The combination of trebled penalties, expanded Home Office compliance teams, and the FWA's consolidated enforcement powers means that the number of penalty notices being issued is increasing. The government has explicitly stated that higher penalties are intended to be matched with higher enforcement — the deterrent only works if employers believe they will be caught.
The cost beyond fines
Financial penalties are only part of the cost. Employers caught employing illegal workers also face:
Reputational damage. Penalty notices are public. Local media report on them. In sectors like care, where trust is fundamental, reputational damage can exceed the fine itself.
Operational disruption. If connected to a sponsor licence, the licence may be downgraded or revoked — meaning you lose your entire sponsored workforce within 60 days.
Closure order risk. For licensed premises, the Home Office can apply for a closure order, forcing the business to close for up to 48 hours initially, with extensions possible.
Management distraction. Defending a penalty, gathering evidence, instructing lawyers, and managing the fallout consumes management time that should be spent running the business.
What to do now
The penalty regime is not new. But the combination of trebled fines, FWA enforcement, and an expanding compliance apparatus means that the consequences of non-compliance are more severe and more likely than at any point in the past.
Audit your current process. Can you demonstrate a statutory excuse for every person currently working for you? If there are gaps — checks not done, records not retained, follow-ups not conducted — fix them this week. Not next quarter.
Establish a system, not a habit. Compliance that depends on individual memory or informal processes will eventually fail. You need a system — documented, centralised, and auditable — that produces a statutory excuse by default, not by exception.
Track time-limited permission proactively. For every worker with a visa expiry date, set automated alerts. Conduct the follow-up check before the deadline. A lapsed statutory excuse is indistinguishable, in penalty terms, from never having checked at all.
Certifyd's Right to Work Portal builds your statutory excuse into every hire — digital document collection, automated verification, expiry tracking, and instant audit-ready records. The system that ensures you always have the defence you need, before you need it.