Right to work civil penalties: what UK employers need to know

An employer can face a civil penalty if it is responsible for employing someone who is not allowed to do the work in question and cannot establish the required statutory excuse. The Home Office code of practice in force from 1 October 2026 explains how liability and the amount are assessed. Its calculation starts at £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years. Those figures are starting points, not an automatic bill every time a check is missing or a worker's status raises a question.

The first practical question is whether the person was permitted to do the particular work. The second is whether the organisation responsible under the Right to Work Scheme completed the prescribed checks or, in some contractual arrangements, the prescribed steps that provide a statutory excuse. A missing document in a folder does not by itself prove illegal working. Equally, a folder full of copied passports does not establish the excuse if the required check was never carried out correctly.

This guide explains the civil-penalty process and the risk controls an employer can organise. It cannot decide whether a particular worker has permission, whether a particular contract brings a business within the extended scheme, or whether a notice should be challenged. Use the final Home Office employer guide and the relevant notice for those decisions. The Home Office guide owns the detailed prescribed methods for carrying out a check.

What is a right to work civil penalty?

The civil-penalty scheme sits in the Immigration, Asylum and Nationality Act 2006. It allows the Home Office to hold a responsible employer liable when an individual is disqualified from doing the work because of immigration status. The final code of practice sets out how the Home Office considers liability, a statutory excuse, a first or repeat breach and mitigating evidence. A civil penalty is an administrative sanction. It must not be described as a criminal conviction.

An employer who has conducted a prescribed right to work check before work starts can establish a statutory excuse against civil-penalty liability if the check satisfies the rules in force when it was carried out. A time-limited permission can require a follow-up check to retain that excuse. The Home Office guide explains the permitted manual, online and digital-provider routes and how to retain evidence. It also explains when the Employer Checking Service is needed. Selecting a route depends on the worker's evidence; a general article cannot select it for an individual case.

The statutory excuse is a defence to the civil penalty. It is not a licence to ignore information that a worker lacks permission. The final employer guide says an employer that knows someone is working illegally does not have a statutory excuse merely because a check was performed. The legal status of the person, the work they are actually doing and the evidence of the check all matter.

Which working arrangements are covered from October 2026?

For years the scheme was principally discussed in relation to employees under contracts of employment. The 1 October 2026 changes extend the Right to Work Scheme to specified worker contracts, individual subcontractors and online matching services. The final employer guide describes examples and boundaries. It also explains when liability may extend beyond the person with the direct contractual relationship with the worker under section 15A of the 2006 Act.

The word “contractor” alone does not tell a business which duty applies. A self-employed person supplying a service through one arrangement, a worker supplied through an employment business and a person substituted into a contract can sit in different legal positions. The final guide says responsibilities depend on the nature of the working arrangement, not merely the label the parties put on it. Do not take a company registration, supplier approval or a contractor file as a substitute for deciding who must carry out the prescribed check.

There is an important commencement boundary. For employment under a worker's contract, as an individual subcontractor, or through the named online matching service arrangement, the final guide says a civil penalty may only be imposed where that employment commenced on or after 1 October 2026. For extended liability under section 15A, the prescribed requirements relating to the contractual arrangement apply from that date where the relevant arrangement was entered into on or after 1 October 2026. Older employee arrangements have their own commencement history. Do not backdate the new contractor wording to every earlier engagement.

If a business uses a chain of suppliers, the final guide and code describe possible contractual terms, substitution controls and identity verification for an organisation seeking a statutory excuse against extended liability. Those requirements are not a generic instruction that every client must personally check every person on every supply chain. The answer turns on the arrangement and the prescribed requirements. Use the final Home Office employer guide, including its non-direct contractual arrangements section, when setting a policy.

How much is the civil penalty?

The 1 October 2026 code gives a starting point of £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years. The Home Office then applies the code's stages, including whether there is a statutory excuse and whether qualifying mitigating evidence changes the amount. The public GOV.UK penalty overview describes a potential penalty of up to £60,000 per illegal worker.

Avoid treating £45,000 as a flat first-offence fine. The code describes particular reductions for specified evidence. It also describes a Faster Payment Option for eligible first penalties. Whether any reduction is available turns on the evidence and the notice. A business should not calculate an expected bill from a headline amount and assume that the Home Office will accept each claimed mitigation. Nor should it assume that an early payment option is the right response before it has assessed the notice and its objection rights.

The code used to assess whether a check established a statutory excuse is the version in force when that check was performed. The code used to set a penalty level is tied to the date of the breach. This matters when an employer is reviewing an old check after a later change in guidance. Applying today's wording retrospectively to every earlier check can produce the wrong conclusion. Keep the date and method of each check with the evidence so the relevant version can be identified.

How does a statutory excuse work in practice?

The central control is to complete the correct prescribed check before work starts and retain the evidence required by the Home Office. Which route is available depends on the person's status and documents. The current employer guide distinguishes a manual check of acceptable original documents, the Home Office online service, and permitted use of a registered Right to Work digital verification service provider. The employer remains responsible for satisfying the applicable requirements even where a provider supplies technology.

A share code is not the result of the check. The employer must use the Home Office employer service to view the response, confirm it relates to the worker and retain the required evidence. Similarly, a scanned document or photograph sent over email is not automatically an acceptable manual document check. Check the appropriate route and precise steps against the final Home Office guide, and use the official employer service for the actual result.

Where permission is time limited, the employer may need a later check to retain its excuse. A calendar reminder may help organise the task, but a reminder does not perform the check or decide whether the person may continue the work. Use the final Home Office guide for follow-up timing and evidence. If an application, appeal or administrative review is outstanding, the official Employer Checking Service instructions explain when Home Office verification may be needed. Do not substitute an applicant's screenshot for the official response.

For some non-direct contractual arrangements, the final code provides a separate route to a statutory excuse through prescribed requirements concerning the contracts and how work is delivered. A written promise that a supplier will check people is not necessarily enough if the required controls are absent in practice. The final guide tells organisations to consider the real arrangement and evidence. Businesses with complex chains or substitution models should obtain advice on their own arrangements rather than borrow a simple employee checklist.

What should an employer record before anyone starts?

A defensible process begins with a clear allocation of responsibility. Record which organisation has the direct contract, what work the individual will do, who will conduct the right to work check and whether a non-direct arrangement may trigger additional prescribed requirements. For a direct check, retain the result and the date in the form required for the chosen Home Office route. For a time-limited permission, record who owns the follow-up task and when it must be revisited. Use the final Home Office guide for the required evidence and retention rules.

This is a process checklist, not a legal verdict:

1. Describe the worker's actual contract and duties before assigning a check route. 2. Identify the person or organisation responsible for the prescribed check. 3. Use the current official Home Office instructions for the evidence the worker presents. 4. Complete the check before the work begins and retain the required dated result. 5. Review any work restrictions and time limit shown by the official result. 6. Allocate follow-up checks where the permission is time limited. 7. For an in-scope chain, matching service or substitution arrangement, review the distinct extended-liability requirements. 8. Escalate an unclear status or a notice to the official service or appropriate adviser rather than guessing.

An internal dashboard can show that someone entered a date or uploaded a document. That is different from proving that the underlying Home Office check was performed correctly. Do not turn an internal “green” status into a claim that the person has permission or that the organisation has a statutory excuse. Reviewers should be able to see what official evidence supports the record and who made the decision.

What happens if the Home Office identifies a possible breach?

The final code of practice describes an investigation and decision process. A potential breach may be identified through an enforcement visit or other information. An employer may receive a referral notice. The Home Office then sends an Information Request that gives the organisation an opportunity to provide information or evidence of a statutory excuse. The Home Office considers that material before deciding liability.

The possible outcomes include a Civil Penalty Notice, a Warning Notice in the circumstances the code describes, or a No Action Notice. A Civil Penalty Notice explains the alleged liability, amount, payment route and objection process, and is accompanied by a Statement of Case. A Warning Notice is not a cash penalty on that occasion, but the code says it can count if there is another breach within three years. A No Action Notice closes the case on that occasion. These are different documents with different consequences, so read the actual notice rather than relying on a generic summary.

If a notice arrives, preserve the relevant worker and check records immediately. Identify the date the notice was given, the deadline stated in it and the basis on which the Home Office says the business is liable. Compare the Statement of Case with the check evidence and the working arrangement. If information is missing, seek the official process or qualified advice quickly. Do not alter records after the event to make a check appear earlier than it was.

Can an employer object or appeal?

The code provides a written objection route. The grounds include not being liable, having a statutory excuse or disputing the amount calculated. It also describes a subsequent court appeal route, with different courts for Scotland and the rest of the UK. The detailed deadlines run from the dates specified in the relevant notices and should be checked against those notices. This article does not calculate a deadline for a particular business.

An objection is an evidence exercise. A useful file may include the actual Home Office online result or retained manual-check evidence, the date of the check, the job and permission restrictions, any Positive Verification Notice, contracts and substitution records where relevant, and correspondence that answers the Home Office's stated case. The relevance of each item depends on the claimed ground of objection. An internal spreadsheet saying “checked” without the underlying evidence may leave the central question unanswered.

The code also describes payment options and the effect of objecting on eligibility for a Faster Payment Option. It would be misleading to tell every recipient either to pay immediately or to object automatically. The notice, the facts and the code determine the next step. A business facing an actual penalty should promptly use the official objection instructions and obtain professional advice where needed.

Civil penalty and criminal offence are different

The final employer guide separates the civil scheme from the criminal offence of employing an illegal worker when an employer knows or has reasonable cause to believe the person is not allowed to do the work. The guide says the civil-penalty scheme is the sanction in most routine cases and that serious cases may be prosecuted. A criminal conviction can carry up to five years' imprisonment and an unlimited fine. That is not the automatic outcome of receiving a civil-penalty notice.

This distinction matters in search results and sales copy. “A missed check means prison” overstates the law. “We stored a passport, so there is no risk” also overstates it. The practical route is to carry out the prescribed check, keep the evidence, review any restrictions and act on information suggesting the person lacks permission.

Three examples of the boundary

A direct employee joins with a Home Office online result. The employer uses the official online employer service before the start date, checks that the response relates to the person and their proposed work, and keeps the required evidence. If permission is time limited, it schedules the required follow-up. Those steps may establish or retain a statutory excuse when the rules are met. An emailed share code on its own does not demonstrate that the employer performed the check.

A supplier sends a worker to site after 1 October 2026. The word “supplier” does not determine whether the direct employer, another party in the chain or both have duties under the scheme. The parties should map the actual contracts and the worker's position against the final Home Office examples. A supplier's insurance certificate, site induction or DBS record is a separate item; none answers the immigration permission question.

A business receives a Civil Penalty Notice for a person it says was never its worker. The code allows an objection on the ground that the business is not liable. The correct response depends on the actual arrangement and evidence, including any extended-liability provisions. It would be unsafe to infer from a job title or invoice alone that liability is impossible. The business should review the Statement of Case and seek advice within the notice timetable.

These examples illustrate process questions, not outcomes for real cases. A change in one fact can change the applicable route. Use the final Home Office guide for current operational requirements.

Keep checks fair and proportionate

Right to work checks must be integrated into a fair recruitment process. Apply the appropriate process consistently to candidates, and use the official evidence routes rather than assumptions based on nationality, accent or appearance. The Home Office publishes a separate code on avoiding unlawful discrimination. Confirm its current version when implementing a policy. A process that is fast but discriminatory is not a sound compliance solution.

The Home Office scheme asks whether the person is permitted to do the work and whether the responsible organisation can establish its statutory excuse. It does not ask an ordinary manager to decide a complex immigration application from a photograph. Where an official response is required, use the official service. Where a person's status or a contract is unclear, record the uncertainty and obtain appropriate help before deciding to proceed.

Where Complys fits

This guide does not claim that Complys conducts the official right to work check, validates immigration status, establishes a statutory excuse or prevents a civil penalty. The official check and legal decision remain with the responsible organisation using the prescribed Home Office process. If you are evaluating a system for organising your internal workflow, compare its actual verified features against the evidence, follow-up and access controls your organisation needs. Request a demonstration against an anonymised real-world case and confirm released capabilities and current terms before relying on a feature claim.

For the procedure itself, start with the final Home Office guide. For a penalty notice, use the notice and official code promptly. A published guide can help you ask the right questions; it cannot settle an individual liability dispute.