Every UK employer has a legal duty to prevent illegal working. A correct right to work check, done before employment starts, gives you a “statutory excuse” against a civil penalty. This is a plain-English guide to how the checks work today — and what changes on 1 October 2026.
It is unlawful to employ someone who does not have the right to do the work in question. An employer who carries out a prescribed right to work check before employment begins establishes a statutory excuse— a defence against liability for a civil penalty if the person later turns out to be working illegally. Get the check right and keep the evidence, and you are protected; skip it, and you are exposed. The civil penalty is currently up to £45,000 per worker for a first breach and up to £60,000 per worker for a repeat breach within three years, and serious cases can bring criminal liability.1
There are three prescribed ways to check, and you must complete one of them before the person starts:
For a manual check, the documents fall into two lists that determine how long your protection lasts. List A documents (for example a British passport, or evidence of settled status / indefinite leave) establish a continuous statutory excuse — no follow-up is needed. List B documents belong to people with time-limited permission, and give a time-limited excuse: you must carry out a follow-up check before their permission ends to keep your protection. Getting the list right is what decides whether you ever need to check that worker again.
For an online check, the individual generates a share code (a nine-character code, valid for 90 days) from their own Home Office account and gives it to you with their date of birth; you enter both on the GOV.UK employer service and check the photo matches the person. People with an eVisa (an online immigration status) prove their right to work this way rather than with a physical document. See our share code guide and digital right to work checks guide for the detail.
Sometimes you cannot check in the usual way — for instance the person has an outstanding application, appeal or administrative review, or holds a document the online service cannot confirm. In those cases you use the Employer Checking Service (ECS). A Positive Verification Notice from the ECS gives a statutory excuse lasting six months, after which a further check is needed. You cannot rely on the ECS route unless it actually applies to the person’s circumstances.
Where someone has time-limited permission (List B, or a six-month ECS notice), your statutory excuse only lasts while you keep it current. A follow-up check must be done on or before the date their permission expires. People with indefinite leave or EU Settlement Scheme settled status do not need re-checking. Missing a follow-up is one of the most common ways an employer loses protection without realising — which is why the expiry dates need to be tracked, not filed and forgotten.
A check only protects you if you can prove you did it. You must keep a clear copy of the evidence — in a format that cannot later be altered — with the date the check was made, for the duration of employment and for two years after it ends, then dispose of it securely. This is exactly the kind of dated, expiry-aware record-keeping Complys is built for. See our record-keeping guide.
You must check everyone you are about to employ in the same way. It is unlawful to check — or refuse to employ — someone based on their colour, nationality, ethnic or national origins, accent, surname or how long they have lived here, or to check only people who “look” or “sound” like migrants. Applying one consistent process to all candidates is both the fair approach and the one that protects you.
The biggest development is a widening of who must be checked. Under the updated Home Office framework coming into force on 1 October 2026, the duty extends beyond employees to people engaged under a worker’s contract, individual subcontractors, and workers sourced through online matching-service arrangements. Where the digital identity route is used, the identity element must be performed by a registered Right to Work Digital Verification Service provider. Until then today’s rules continue to apply; the expanded duty bites for relevant engagements beginning on or after that date. We cover the transition in full on our Right to Work changes from 1 October 2026 page.2
A right to work check and a DBS check do different jobs and are not interchangeable. Right to work confirms someone is legally allowed to work in the UK; a DBS check is about criminal-record suitabilityfor certain roles. A worker may need one, the other, both or neither — treating one as a substitute for the other is a common and serious mistake. See DBS vs Right to Work.
Whichever route you use, the shape of a compliant check is the same. First, obtain the correct evidence for that route — original List A or List B documents for a manual check, a valid share code plus date of birth for an online check, or a certified provider’s result for a digital identity check. Second, satisfy yourself the evidence is genuine and current and, where documents are used, that any photographs and dates of birth are consistent across them. Third, check the evidence belongs to the person in front of you — comparing the photograph with the individual, in person or over a live video call, not from a static image alone. Fourth, make and keep a clear, dated copy. Finally, where permission is time-limited, diarise the follow-upbefore it expires. Miss any of these and the excuse can fall away even though a check was “done”.
The failures that cost an employer its statutory excuse are rarely exotic. The most common are: carrying out the check after the person has already started work; missing a List B follow-up so the excuse lapses mid-employment; keeping a copy that is undated or could have been altered; applying the process inconsistently (which also risks discrimination); and using the wrong route for the person — for example trying to check a non-British/Irish worker by document when they should prove status online. Each is avoidable, and each is really a records-and-process problem rather than a legal one.
If the Home Office issues a civil penalty, there is a process to object and then appealwithin set time limits. Your defence is the evidence that you carried out a compliant check at the right time— which is precisely why the dated, unaltered record matters so much. A penalty can also be reduced for cooperation and reporting, but the surest position is a correctly evidenced check in the first place. This is general information, not legal advice; take advice on a specific penalty.
Complys is the place your right to work evidence and its expiry dates live alongside the rest of each worker’s compliance record — documents, qualifications, training and cards — with reminders before a List B permission or an ECS notice runs out. What Complys does not do is the check itself: it does not verify identity or immigration status, does not query Home Office share codes, is not a certified digital verification provider, and does not create a statutory excuse for you. Digital identity and right to work verification are on our roadmap as provider-dependent, coming capabilities — not something to rely on today. Explore Right to Work compliance software, worker compliance and contractor onboarding.
Before employment begins. A check completed after the person has started does not give you a statutory excuse for the period before it was done.
Continuously for List A documents (indefinite right to work). For time-limited permission (List B) or a Positive Verification Notice, it lasts until the follow-up date — you must recheck before permission expires to keep it.
Yes — you must check everyone consistently. British and Irish passport holders can be checked manually or through a certified identity service provider using digital identity verification.
No. The excuse comes from carrying out a prescribed check correctly and keeping the evidence. Software like Complys helps you organise and retain that evidence and track follow-up dates; it does not perform the check or grant the excuse.
1 Plain-English summary, not legal advice; confirm against current Home Office guidance. Source: Employer’s guide to right to work checks (GOV.UK). 2 Changes from 1 October 2026 are set out in the updated Home Office employer guide and supplementary digital-identity codes; verify the final versions on or after commencement. Reviewed 26 September 2026.
