Every UK employer must carry out a right-to-work check on every hire before employment begins. Since the eVisa transition, BRPs are no longer valid for these checks. Work Permit Cloud advises on the correct methods, record retention, and follow-up obligations.
Talk to an expertWork Permit Cloud Regulated By
IAA - F202100311

WPC Lawyers SRA - Authorised ABS
SRA ID - 8003128
Cyber Essentials
Certified
4.9 rating 873 reviews
★★★★★
Trusted by individuals and businesses across the UK
Every UK employer must check that each person they employ has the right to do the work in question before the work starts, without exception. The check applies whatever the person's nationality, length of service or role, and British and Irish citizens are checked too. Checking only some workers, or only those who appear to be from overseas, is not enough and can be unlawful discrimination. From 1 October 2026 the duty also covers people engaged under a worker's contract, individual sub-contractors and people found through online matching services, as explained below.
The purpose of the check is to establish what is known as a statutory excuse: a legal defence that protects the employer from a civil penalty if it later emerges that the worker did not have the right to work. Without a correctly conducted and retained check, the employer is fully exposed to a civil penalty of up to £45,000 per worker for a first breach and up to £60,000 per worker for a repeat breach, regardless of whether they knew the worker lacked permission.
The right to work scheme is set out in the Immigration, Asylum and Nationality Act 2006 and explained in the Home Office's Employer's guide to right to work checks: 1 October 2026, which applies to checks carried out on or after that date. A check made before 1 October 2026 is judged against the guide and code of practice in force when it was made.
Section 48 of the Border Security, Asylum and Immigration Act 2025 extended the scheme. For engagements that begin on or after 1 October 2026, a business must also check people it engages under a worker's contract, individual sub-contractors, and people whose details an online matching service passes to clients or customers, such as gig and platform workers. The business that contracts directly with the person carries out the check in the usual way.
Liability can also reach further up the chain. A contractor higher up a chain of contracts, or an online matching service, can be treated as the employer of the person doing the work. It protects itself by putting prescribed written terms in its contracts before the work starts and keeping systems that confirm the person doing the work is the person who was checked. Where a contract lets a worker send a substitute, the substitute must be checked before they start, as well as the original worker.
The scheme does not cover a person running a genuinely independent business, in their own name or through their own company, who contracts directly with customers, or a client that contracts with a personal service company. Calling someone self-employed does not settle this. What matters is how the arrangement works in practice.
The UK completed its transition to a fully digital immigration status system at the end of 2024. Biometric Residence Permits (BRPs) ceased to be issued on 31 October 2024. Critically, for the purposes of right-to-work checks, a manual inspection of a physical BRP, even if the card appears valid and shows a future expiry date, no longer establishes a statutory excuse.
Workers who previously held BRPs now hold their immigration status as an eVisa, a digital record linked to a UKVI account. For these workers, the only method that establishes a statutory excuse is the Home Office online checking service, accessed via a share code generated by the worker. If you have existing employees whose right to work was last verified by a manual BRP check and you have not since conducted an online share code check, your statutory excuse for those individuals is now uncertain and should be addressed urgently.
There is no single method that applies to all workers. The correct method depends on the individual's nationality and immigration status. Using the wrong method, even if the worker genuinely has the right to work, removes your statutory excuse. The three prescribed methods in 2026 are:
This is now the standard and, in most cases, the only valid method for any non-British, non-Irish worker whose immigration status is held digitally. This includes all eVisa holders, EU Settlement Scheme status holders, Skilled Worker visa holders, and all other workers who previously held a BRP.
The worker generates a unique 9-character alphanumeric share code through their UKVI account at gov.uk/prove-right-to-work. The code begins with the letter "W" for right-to-work purposes. The employer enters this code along with the worker's date of birth at gov.uk/view-right-to-work to access the worker's current immigration status in real time. The result shows whether the worker has the right to work, any restrictions, and any expiry date requiring a follow-up check.
The employer must save or print the profile page returned by the online service as the record of the check. The check must be completed before employment starts, and the record must be retained for the duration of employment plus two years.
A manual document check involves physically inspecting an original document from the Home Office's List A or List B of acceptable documents. The employer must verify that the document appears genuine, that it belongs to the person presenting it, and make a clear, dated copy.
List A documents establish a permanent statutory excuse for that employment with no follow-up check required. List B documents establish a time-limited statutory excuse and require a repeat check before the document expires. The most common List A document for British nationals is a valid UK passport. Irish citizens may use a valid Irish passport or passport card.
This method is primarily for British and Irish nationals who do not have or choose not to use digital status. Manual checks on BRPs are not a valid method for establishing a statutory excuse in 2026.
British and Irish citizens with a valid passport or Irish passport card may be verified through a certified Identity Service Provider (IDSP) using Identity Document Validation Technology (IDVT). This is a digital route that provides the same legal outcome as a manual check and establishes a statutory excuse. Use of IDSPs is voluntary. Only certified IDSPs on the Home Office register should be used.
The Employer Checking Service is used when an individual cannot prove their right to work through any of the three standard methods, most commonly when they have a pending application or appeal with the Home Office and their current permission is about to expire or has expired. The ECS issues a Positive Verification Notice (PVN) if the worker has the right to continue working while their application is pending, providing a six-month statutory excuse. The employer must conduct a follow-up check before the PVN expires.
Importantly, the ECS will not issue a PVN where the individual has an eVisa available in a UKVI account. In that situation, the online share code check must be used. The ECS is therefore a fallback mechanism only for cases where online verification is genuinely not possible.
For workers who have time-limited immigration permission, a single right-to-work check at the start of employment is not sufficient. You must conduct a follow-up check before the worker's permission expires to maintain your statutory excuse. The online checking service displays any relevant expiry date, making it straightforward to schedule follow-up checks in advance. Missing a follow-up check deadline exposes you to a civil penalty for the period after the permission expired.
All evidence of right-to-work checks must be retained for the full duration of employment and for two years after employment ends. Records must be accessible for inspection and stored securely in compliance with UK data protection law. For online checks, retain the saved or printed profile page. For manual checks, retain clear, legible copies of the original documents, dated to show when the check was made. Our UKVI compliant HR software manages this record retention and schedules follow-up checks automatically.
The right-to-work regime must be applied consistently and without discrimination. The law requires that all employees, regardless of their perceived nationality, appearance, or background, are subject to the same check process. Selective checking, even if well-intentioned, can constitute unlawful discrimination. A consistent, documented process applied uniformly to every new hire is the correct approach.
Read the Home Office Employer's Guide to Right to Work Checks on GOV.UK.
Keeping pace with the right-to-work regime, particularly following the complete overhaul of the checking process with the eVisa transition, requires regular process reviews and well-trained staff. Work Permit Cloud provides training for HR teams, policy reviews, personnel record audits, and ongoing advisory support.
We help employers ensure their checking processes are legally compliant, correctly implemented, and capable of withstanding scrutiny from the Home Office, whether during a routine compliance visit or following a civil penalty investigation. Book an appointment or contact us to discuss your right-to-work compliance.
Ismail
Finally I got my ILR I had a very positive experience with Work Permit Cloud. The team was professional, helpful, and supportive throughout my immigration process, making everything much easier and less stressful. I would especially like to thank Mamun for his excellent support and guidance. He was always approachable, responsive, and happy to help whenever I had questions. A special thank you to Fahad, who handled my ILR application and guided me through the process with great care and professionalism. I’m also very grateful to Sowrov, who provided valuable support and assistance along the way. I really appreciate the service and support I received from the whole team. Thank you to Mamun, Fahad, Sowrov, and everyone at Work Permit Cloud. I would happily recommend their services to anyone looking for professional and reliable immigration advice and support.
md shawon ahmed
I had an outstanding experience with WPC Law Firm. Their team was extremely helpful, cooperative and professional throughout. I would especially like to thank Samia and Christina for their excellent support, clear guidance and reassuring approach, which made me feel relaxed and confident as a client. They followed through on everything they told us they would do, and their care and commitment made the whole process much easier. I would happily give WPC Law Firm 10 out of 10 and highly recommend their services. A heartfelt thank you to Samia, Christina and the whole team.
Siddika Sojib
Excellent service and very helpful team! Work Permit Cloud Ltd made the whole process much easier for me. Prajeet and Samiya were extremely helpful, supportive and professional throughout. They explained everything clearly and guided me whenever I needed help. I really appreciate their time and effort. Highly recommended! ❤️
FAQ
Everyone you employ, before they start work, whatever their nationality, role or length of service, including British and Irish citizens. For engagements starting on or after 1 October 2026, the duty also covers people engaged under a worker's contract, individual sub-contractors and people found through online matching services. Checking only workers who appear to be from overseas is not enough and can be unlawful discrimination.
No. BRPs ceased to be issued on 31 October 2024. A manual check on a physical BRP, even one that appears valid and shows a future expiry date, no longer establishes a statutory excuse. For non-British, non-Irish workers, the only currently valid method is the Home Office online checking service, accessed using a share code provided by the worker.
The worker generates a 9-character alphanumeric share code through their UKVI account at gov.uk/prove-right-to-work. Share codes for right-to-work purposes begin with the letter "W". The employer enters this code and the worker's date of birth at gov.uk/view-right-to-work to access the worker's current immigration status in real time. The result page must be saved or printed as the record of the check, and must be completed before employment starts.
A follow-up check is required when a worker has time-limited immigration permission. The first check establishes a statutory excuse for the period of permission shown. Before that permission expires, a fresh check must be conducted to maintain the statutory excuse. Missing a follow-up check deadline exposes you to a civil penalty for the period after the permission expired.
The Employer Checking Service is used when a person cannot prove their right to work through the standard methods, most commonly when they have a pending application or appeal and their current permission has expired or is about to expire. A Positive Verification Notice (PVN) from the ECS provides a six-month statutory excuse. The ECS cannot be used where the individual has an eVisa available — in that situation, the online share code check must be used instead.
All evidence of right-to-work checks must be retained for the full duration of employment and for two years after employment ends. For online checks, save or print the profile page returned by the Home Office online service, showing the date the check was conducted. For manual document checks, retain clear dated copies of the original documents. Records must be stored securely in compliance with UK data protection law.
If you employ a person without the right to work and cannot produce evidence of a correct, prescribed check, you are liable for a civil penalty of up to £45,000 per worker for a first breach, or up to £60,000 per worker for a repeat breach. Liability arises regardless of whether you knew the worker lacked permission. See our Civil Penalty page for full detail on your options on receipt of a penalty notice.
British and Irish citizens with a valid passport or Irish passport card may be verified digitally by a certified Identity Service Provider (IDSP) using Identity Document Validation Technology (IDVT). This provides the same legal outcome as a manual document check and establishes a statutory excuse. Use of IDSPs is voluntary. Only providers on the Home Office's certified register should be used.
Every case is handled by a qualified UK immigration adviser, regulated by the IAA.
From sponsor licence to visa decision — we manage every stage of the GBM process.
Direct WhatsApp lines, named caseworkers, and same-day response from a real team.
3,000+
Businesses Served
3,400+
Visas Granted
360°
End-to-End Coverage
Contact Us Now
No upfront cost · Free Assessment · IAA-regulated adviser
Start Today
Book a free 30-minute consultation. Our IAA-regulated experts are ready to assess your eligibility and guide you through every step.
Or call us directly: +442080872343 · info@workpermitcloud.co.uk