Right to Work Checks: A Complete UK Employer Guide

Every employer in the UK must carry out a prescribed right to work check before employment begins. Completing that check correctly, and keeping the evidence, creates a statutory excuse against civil penalties for illegal working. The Home Office can issue civil penalties of up to £60,000 per illegal worker, so the stakes are real. Your immediate three-step action plan: (1) ask the applicant for a share code or original documents before their first day; (2) perform the correct check type (online via GOV.UK, manual document inspection, or Identity Document Validation Technology); (3) save the evidence in an immutable format and calendar any follow-up dates. Everything in this guide builds on those three steps.

1. Which documents are acceptable for right to work checks

2. How to perform an online right to work check with a share code

3. IDVT via an identity service provider versus manual document checks

4. What to do when an applicant cannot provide documents or a share code

5. How to store right-to-work evidence and retain your statutory excuse

6. When and how to re-check time-limited permissions

7. Common compliance pitfalls and a practical hiring checklist

Key Takeaways

The compliance gap nobody talks about

How Nightingalesoftware helps you operationalize right to work compliance

Official sources and further reading

1. Which documents are acceptable for right to work checks

The GOV.UK employer’s guide divides acceptable documents into two lists, and the list a document falls into determines how long your statutory excuse lasts.

List A documents prove a continuous, unrestricted right to work. Once you check and copy a List A document, your statutory excuse is permanent for that employee. A British or Irish passport, a passport endorsed with indefinite leave to remain, and a Home Office-issued document confirming settled status under the EU Settlement Scheme all fall here.

List B documents show a time-limited permission. Your statutory excuse lasts only until that permission expires, which means you must schedule a follow-up check. Biometric Residence Permits (BRPs), visas, and documents confirming pre-settled status are typical List B items.

Document type

What to check

British/Irish passport

Genuine document, photo matches holder, not expired (expired passports are still acceptable for British citizens if they confirm nationality)

Biometric Residence Permit (BRP)

Expiry date, permitted work endorsement, photo match, chip-readable security features

EU Settlement Scheme letter/digital status

Confirm via online share code only; no physical document is issued for digital status

Passport with visa/vignette

Expiry of leave, work restrictions, photo match, no signs of tampering

Certificate of Application (digital)

Use ECS if non-digital; confirm via online check

Right of Abode certificate

Endorsement in passport, photo match, genuine document

Note that BRPs issued before December 31, 2024 expired on that date regardless of the date printed on the card. Holders should have transitioned to eVisas. If a candidate presents an expired BRP, direct them to generate a share code from their UKVI account instead.

Pro Tip: Inspect security features on every physical document: holograms, watermarks, microprinting, and the chip symbol on biometric documents. A passport with clipped corners, a laminate that has lifted, or a photo that does not sit flush with the page are all red flags. Examine documents in good light and, where possible, use a UV lamp for passports.

The official RTW Checklist PDF is the printable reference you should keep in every hiring manager’s folder. It maps each document type to the precise steps for inspection and copying.

2. How to perform an online right to work check with a share code

The online route is now the standard path for most workers who do not hold a British or Irish passport. Workers generate a share code through their UKVI online account, and you verify it using the GOV.UK employer-facing checker.

Step-by-step employer workflow:

Ask the applicant to generate a Right to Work share code from their UKVI account and share it with you along with their date of birth.

Go to gov.uk/view-right-to-work (the employer-facing checker, not the worker’s own view).

Enter the share code and the applicant’s date of birth exactly as provided.

Review the profile page: confirm the photograph matches the person in front of you, check the permitted work type, and note any restrictions or expiry date.

Save the profile page as a PDF or HTML file immediately. Do not rely on a screenshot taken from the worker’s own device.

Store the saved file securely and record the date of the check.

Share codes are typically valid for 90 days. Codes that begin with the letter W are specifically for right to work purposes; codes with other prefixes relate to different Home Office services and will not establish a statutory excuse. If the online check does not confirm permission to work, you must not employ that person for the role in question.

Pro Tip: Ask candidates to generate their share code at the point of conditional offer, not on their first day. A code takes minutes to generate but an expired or unavailable code can delay a start date by days. Adding a share-code request to your offer letter template costs nothing and prevents last-minute onboarding problems.

3. IDVT via an identity service provider versus manual document checks

Identity Document Validation Technology (IDVT), delivered through a certified Identity Service Provider (IDSP), is available as an alternative to manual checks for holders of valid British and Irish passports. It gives the same continuous statutory excuse as a manual List A check, provided you follow the rules.

When IDVT applies and when it does not:

IDVT is only valid for British and Irish passport holders seeking a continuous statutory excuse.

For all other nationalities and document types, manual checks or the online share-code route remain the required method.

If a British citizen does not have a valid passport, you must revert to a manual check of another acceptable List A document (such as a birth certificate combined with a National Insurance number letter).

Employer responsibilities when using an IDSP:

Obtain and retain the IDSP’s evidence report for each check. The report must show the level of confidence achieved (the Home Office recommends a “High Confidence” result as a minimum).

Confirm the IDSP is certified against the UK Digital Identity and Attributes Trust Framework before engaging them.

Review the IDSP’s contract for data retention policies, audit log access, and what happens to records if you end the contract.

Retain the IDSP’s output alongside your own record of the check date and the checker’s name.

Verify that the photograph in the IDSP report matches the person you are hiring. The technology does the document validation; you still confirm the human match.

The ultimate compliance responsibility stays with you as the employer. Using an IDSP does not transfer liability. If the IDSP’s report is incomplete or the provider was not certified, the check may not establish a statutory excuse.

Pro Tip: Before signing with any IDSP, request a sample evidence report and confirm it contains: document type, level of confidence, a photograph, and a timestamp. If the report does not include all four elements, the check may not satisfy Home Office requirements.

4. What to do when an applicant cannot provide documents or a share code

Some applicants have a genuine right to work but cannot immediately produce documents or generate a share code. This happens most often when they have an outstanding immigration application, an appeal, or an Application Registration Card. In these cases, the Home Office Employer Checking Service (ECS) is your route to a statutory excuse.

Situations that require an ECS referral:

The applicant has submitted an in-time application to extend their leave and holds a non-digital Certificate of Application.

The applicant has an outstanding appeal or administrative review.

The applicant holds an Application Registration Card (ARC).

The applicant’s physical documents have expired but they have an in-time application pending.

In these situations, a 28-day bridging period applies. You may delay the employment start date while the ECS check is completed, or you may choose to employ the person during that period at your own risk. Recording your decision and the reason in the employee file is good practice either way.

How to submit an ECS request:

Gather the applicant’s full name, date of birth, nationality, and Home Office reference number (if available).

Provide your business name, address, and the job title the applicant will hold.

Submit the request through the ECS portal at the link above.

Wait for the outcome. The ECS will issue either a Positive Verification Notice (PVN) or a negative response.

A Positive Verification Notice is your statutory excuse. Retain it in the employee’s file exactly as you would retain a copy of a passport or a saved share-code profile. The PVN confirms the Home Office has verified the individual’s right to work at the point of the check. If the ECS directs you back to the online checker, follow that instruction and save the resulting profile page.

PVN protections are time-limited. You must carry out a follow-up check when the PVN period expires, just as you would for any List B document. If the ECS returns a negative result, you cannot employ that person for the work in question without risking a civil penalty.

5. How to store right-to-work evidence and retain your statutory excuse

Keeping the statutory excuse you earned at the point of hire requires storing evidence correctly for the full retention period. The Home Office requires you to retain copies for the duration of employment and for two years after employment ends.

Evidence type

Acceptable format

Retention period

Destruction

Copy of passport/BRP

Clear photocopy or scanned PDF

Duration of employment + 2 years

Secure disposal after period ends

Saved share-code profile page

PDF or HTML download from GOV.UK checker

Duration of employment + 2 years

Secure deletion with audit log

IDSP evidence report

PDF from certified IDSP

Duration of employment + 2 years

Secure deletion with audit log

Positive Verification Notice

Original PDF from ECS portal

Duration of employment + 2 years

Secure deletion with audit log

Follow-up check evidence

Same format as original check

Duration of employment + 2 years from final check

Secure disposal after period ends

Storage security requirements:

Store digital copies in an access-controlled system. Only personnel with a direct compliance or HR need should be able to view identity documents.

Use immutable file formats (PDF/A rather than editable Word documents) so the record cannot be altered after the check.

Maintain an audit log showing who accessed each record and when.

Apply date stamps at the point of saving so the check date is embedded in the file metadata.

Separate identity document storage from general HR records where your system allows. A breach affecting general HR data should not automatically expose identity documents.

Pro Tip: Date-stamp every file at the moment of saving, not retrospectively. A Home Office compliance officer reviewing records will look at file metadata. A document saved weeks after the stated check date raises questions that are difficult to answer.

After the retention period ends, dispose of records securely. For paper copies, use cross-cut shredding. For digital files, use certified deletion and record the destruction date in your audit log.

6. When and how to re-check time-limited permissions

A time-limited statutory excuse does not protect you indefinitely. The employer’s guide is clear: you must carry out a follow-up check before the employee’s permission expires to maintain your statutory excuse.

Follow-up check checklist:

Identify the expiry date from the original check evidence and record it in your HR system on the day of hire.

Schedule a calendar reminder at least four weeks before expiry to give the employee time to renew their visa or generate a new share code.

On or before the expiry date, carry out a new check using the same prescribed method (online share code, manual document, or IDVT where applicable).

Save the new evidence and update the employee’s compliance record with the new expiry date.

If the employee’s permission has lapsed and they cannot provide evidence of a new or extended permission, you must not continue to employ them in that role.

The 28-day bridging period applies here too. If an employee has made an in-time application before their leave expired, use the ECS to confirm their status while the application is pending.

Pro Tip: Set two reminders: one at four weeks before expiry and a second at two weeks. If the employee has not provided updated evidence by the two-week mark, escalate to a line manager and HR. Waiting until the expiry date itself leaves no room to use the ECS bridging process if needed.

Integrating expiry dates into your onboarding software or HRIS at the point of hire is the most reliable way to prevent missed follow-ups. A manual spreadsheet works, but it depends entirely on someone remembering to check it. Automated flags remove that dependency. The onboarding compliance practices that HR teams embed at hire stage are the ones that actually get followed.

7. Common compliance pitfalls and a practical hiring checklist

The most frequent errors HR teams make are not about misidentifying documents. They are administrative: failing to save the online profile page, accepting a screenshot from the worker’s own phone, missing follow-up check dates, and using an IDSP that is not certified against the UK Digital Identity and Attributes Trust Framework.

The code of practice on preventing illegal working (updated February 2024) makes clear that conducting and documenting the correct prescribed checks is the employer’s primary legal defense against civil penalties. A check that was performed but not properly evidenced offers no protection in a compliance audit.

Practical hiring checklist:

Collect the share code or original documents before the employment start date, not on day one.

Confirm which check type applies: online share code, manual document, IDVT, or ECS.

Perform the check in person (or via IDVT) and confirm the photograph matches the individual.

Save the evidence immediately in an immutable format with a date stamp.

Record the check type, date, and checker’s name in the employee file.

Note the expiry date (if any) and set calendar reminders for follow-up checks.

Escalate to the ECS if the applicant cannot provide documents or a share code due to a pending application.

Never accept a screenshot from a worker’s own device as evidence of an online check.

The Right to Work Checklist PDF from GOV.UK is the authoritative printable reference for this process. Download it, store it in your compliance folder, and use it as the basis for training any staff member who conducts checks. The employer’s guide updated June 26, 2025 is the governing document for checks conducted from February 12, 2025 onward.

Key Takeaways

Conducting the prescribed right to work check before employment starts, and retaining the evidence for the duration of employment plus two years, is the employer’s complete legal defense against civil penalties for illegal working.

Point

Details

Statutory excuse is the goal

Every check must produce saved evidence; a check performed but not documented offers no legal protection.

Three valid check routes

Online share code via GOV.UK, manual original document inspection, or IDVT via a certified IDSP for British/Irish passport holders.

Retention period is fixed

Keep copies for the duration of employment and two years after employment ends, in an immutable format.

Time-limited permissions require follow-ups

Schedule reminders before expiry; use the ECS 28-day bridging process if the employee has a pending application.

Nightingalesoftware Onboardly

Onboardly captures share codes, stores evidence securely, and automates expiry reminders so follow-up checks are never missed.

The compliance gap nobody talks about

Most HR teams know the rules. The problem is the gap between knowing them and executing them consistently across every hire, every contract type, and every location. A seasonal hospitality employer hiring 40 workers in six weeks faces the same legal exposure as a corporate HR team onboarding one permanent employee. The check is the same. The evidence standard is the same. The penalty for getting it wrong is the same.

What actually breaks down in practice is not the document inspection itself. It is the evidence chain: the profile page that was never saved, the BRP expiry date that was never entered into the HRIS, the agency worker whose check was assumed to have been done by the agency (it was not). The code of practice does not care about intent. It cares about evidence.

The practical fix is not more training. It is building the evidence-capture step into the hiring workflow so it cannot be skipped. When a share-code request goes out with the offer letter, when the saved profile page is a required field before a start date is confirmed, and when expiry reminders fire automatically, the compliance rate goes up because the process does not depend on anyone remembering. That is the operational shift worth making.

How Nightingalesoftware helps you operationalize right to work compliance

Knowing the rules is one thing. Having a system that enforces them at every hire is another. Nightingalesoftware’s Onboardly app is built for exactly this gap: it captures share codes and document uploads at the offer stage, stores evidence in an auditable, access-controlled record, and fires automatic reminders before time-limited permissions expire.

For HR teams managing high-volume hiring, seasonal staff, or multi-site operations, the Nightingalesoftware platform gives you a central audit trail that a Home Office compliance officer can review in minutes rather than hours. Every check type is logged with a date stamp, checker name, and evidence file. Expiry dates feed directly into the reminder workflow, so a List B worker’s permission never quietly lapses. You can also build a custom bundle combining Onboardly with other compliance apps if your team manages time and attendance, shift scheduling, or facilities alongside workforce onboarding.

Onboardly and the broader Nightingalesoftware suite help you operationalize the prescribed checks. They do not replace performing them. The legal obligation to conduct the correct check, in the correct way, before employment starts remains yours. Explore the Onboardly product page or request a demo to see how the evidence workflow maps to your current hiring process.

Official sources and further reading

Every HR team conducting right to work checks should keep the following official documents in their compliance folder and check them for updates at least annually.

Employer’s guide to right to work checks (June 26, 2025) — The governing guidance for checks conducted from February 12, 2025 onward. Defines check types, statutory excuse mechanics, List A and List B documents, and IDVT rules. Download and store this document.

GOV.UK: Check a job applicant’s right to work — The employer-facing overview page with links to the online share-code checker, ECS, and manual check guidance. Bookmark this as your starting point for any check.

Right to Work Checklist PDF — The printable step-by-step checklist for manual, IDVT, and online checks. Print one copy per hiring manager and keep a digital version in your compliance folder.

Code of practice on preventing illegal working (February 13, 2024) — Sets out the actions employers must take to avoid liability, including follow-up check requirements and recordkeeping standards. Read this alongside the employer’s guide.

GOV.UK: Prove your right to work (worker-facing) — Useful to share with candidates who are unfamiliar with the share-code process. Directing applicants here early reduces delays at the offer stage.

Treat GOV.UK and Home Office publications as your primary legal sources. This article is general guidance for HR professionals and does not constitute legal advice. For complex cases, particularly those involving immigration appeals or unusual document types, consult a qualified immigration solicitor or adviser.

Right to Work Checks: A Complete UK Employer Guide