Right to Work UK 2026: Complete Guide for Employers (Manual Checks, Share Codes, and Digital Verification)

💷 Civil Penalty

£20,000

Per illegal worker (increased from £15,000 in February 2024)

Applies if no check OR check was non-compliant (illegible copy, no date, no follow-up)

⚖️ Criminal Prosecution

5 Years

Maximum imprisonment + unlimited fine + director disqualification

Applies if employer knew or had reasonable cause to believe worker was illegal

🛡️ Statutory Defense

Compliant Check

If employer conducted compliant right to work check, even if employee later found illegal, statutory defense applies

The compliance procedure IS the protection

✅ “Employer” Includes All Of:

• Limited companies (even 1-person companies hiring first employee)
• Sole traders hiring staff
• Partnerships and LLPs
• Charities and social enterprises
• Public sector: NHS, local authorities, schools
• Recruitment agencies (responsible for workers they supply to clients)

✅ “Employee” Includes All Of:

• Full-time, part-time, zero-hours, casual workers
• Directors taking PAYE salary (paid through payroll = right to work required)
• Volunteers (if receive any payment beyond genuine expenses)
• TUPE-transferred employees (retrospective check within 60 days)
• Fixed-term workers and seasonal staff

📋 List A: Full Breakdown

Group 1 — British/Irish Citizens:

• British passport (current or expired)
• Irish passport (current or expired)
• Certificate of registration/naturalization as British citizen

Group 2 — Settled Status (EEA/Swiss):

• Share code showing settled status (EEA citizens must use share code — biometric cards no longer issued)
• Frontier Worker permit

Group 3 — Settled Status (Non-EEA):

• BRP showing indefinite leave to remain/enter
• Passport endorsed with indefinite leave to remain stamp

⏰ List B: Full Breakdown + Follow-Up Triggers

Group 1 — Pre-Settled Status (EEA/Swiss):

• Share code showing pre-settled status (expires 5 years after granted — must recheck before expiry)

Group 2 — Visas (Non-EEA):

• BRP showing Skilled Worker visa (3–5 years)
• Student visa BRP (20 hrs/week term-time limit — see below)
• Graduate visa (2 years unlimited work)
• Skilled Worker dependant visa

Set calendar reminders for every List B document expiry date, or use Deel HR for automated 30-day expiry alerts.

Method 1 — Manual Document Check

When: British/Irish passport holders; employees without share codes; employer preference

1. Obtain original documents (not scans, not photocopies)
2. Verify in person (employee physically present)
3. Take clear, legible copy (entire document)
4. Date and sign the copy (date of check, name of checker)
5. Check photo matches person (reasonable likeness)
6. Check date of birth consistent across documents
7. Note List B expiry date — set follow-up reminder
8. Store securely (encrypted, 2 years post-employment)

Method 2 — Online Share Code

When: EEA/Swiss citizens (settled/pre-settled status); BRC holders; most visa holders

Employee steps:

1. Go to: gov.uk/prove-right-to-work
2. Sign in to UK Visas and Immigration account
3. Generate share code (valid 90 days)
4. Provide code + date of birth to employer

Employer steps:

1. Go to: gov.uk/view-right-to-work
2. Enter share code + date of birth
3. View status (unlimited/limited, expiry date)
4. Print or save PDF of result — store securely

Method 3 — IDVT Digital Verification

When: Remote employees; high-volume hiring; digital-first HR processes

How it works:

1. Engage Home Office-certified IDVT provider (Yoti, Onfido, IDnow, Trulioo, GB Group)
2. Employee uploads passport/BRP + selfie via provider app
3. Provider verifies (security features + Home Office database checks)
4. Provider issues report (verified/not verified)
5. Employer stores report (2 years post-employment)

Cost: £2–10 per check. Remote-friendly, faster, full digital audit trail. Check gov.uk for current certified providers (certified annually).

• Photocopy too dark/light — illegible text or photo
• Forgot to date and sign the copy
• Employee provided scanned copy (must be original documents)

• Video call check (COVID adjustment ended October 2022 — must be in-person or IDVT)
• Accepted EU passport without share code (no longer valid post-Brexit)
• No follow-up check on expired List B documents

✅ Section 3C Leave: Employee Can Keep Working While Applying

What it means: If the employee applies for a visa extension before their current visa expires, their leave continues automatically while the application is pending.

Employer’s obligation: Obtain evidence of pending application (Home Office email confirmation, application reference number). Keep copy on file.

Example: Skilled Worker visa expires 1 March. Employee applies 15 February. Application pending 8 weeks, decided 10 April. Employee works legally 1 March – 10 April on Section 3C leave. No gap in employment.

❌ What Happens If Section 3C Not Used

Employee applies after visa expires → no Section 3C leave → employee cannot work until new visa granted.

Employee does not renew → right to work expires → employer must stop employment or face £20,000 penalty.

Solution: Deel HR sends automated alerts 30 days before List B documents expire — giving sufficient time to prompt renewal before the deadline.

🎓 Student Visa: 20-Hour Term-Time Limit

Employer obligations:

• Verify BRP or share code shows “Student” visa
• Ask employee for their academic calendar (term dates vary by institution)
• Track hours worked during term time (rota records)
• Keep evidence of vacation periods (student-provided calendar)

🎓 Graduate Visa: 2 Years Unlimited Work

Introduced 2021. Allows international students to work in UK for 2 years post-study (3 years for PhD graduates) with no work restrictions — any employer, any hours, any sector.

Employer obligations:

• Check BRP or share code shows “Graduate” visa
• Note expiry date (2 years from grant) — List B, follow-up required
• Before expiry: employee may apply for Skilled Worker visa or leave UK

Step 1 — Within 60 Days of TUPE

Request right to work documents from ALL transferred employees. Previous employer often didn’t keep compliant records — assume you’re starting from scratch.

Step 2 — Conduct Full Checks

Conduct compliant manual, share code, or IDVT checks for every employee. Prioritize highest-risk employees (non-UK nationals, known expired visas) immediately. After 60 days, statutory excuse lapses.

Step 3 — Remediate Issues

Employee has expired visa: stop employment or support visa application. Employee cannot provide documents: take legal advice. All checks compliant: file securely, set List B reminders. Download TUPE template via Growth Access below.

🪪 BRP Expiry: Important Distinction

BRP cards expire (10-year physical card validity) even if the underlying immigration status does NOT.

Example: Employee has indefinite leave to remain (unlimited right to work — List A). BRP expires 10 years after issue. BRP expiry does NOT mean status expired. But you must conduct a follow-up check — employee provides new BRP or share code showing ILR continues.

Do not confuse BRP card expiry with visa expiry. Different things. Always verify the underlying status via share code when in doubt.

📱 eVisa Transition (From 2025)

UK is transitioning from physical BRP cards to digital eVisas (accessed via UK Visas and Immigration online account).

• BRPs issued until 31 December 2024 for most visa types
• From 2025: new visas issued as eVisas (digital only)
• Employees with eVisas: use online share code (Method 2) for all checks
• Existing BRP holders: continue manual check until BRP expires, then migrate to share code

Action: Update your HR process to accommodate share code checks as default for new hires from 2025.

📁 Home Office Storage Requirements

• Store for duration of employment + 2 years after employee leaves
• All copies must be legible (readable text, clear photo)
• All copies must be dated (date of check visible)
• Store securely (locked filing cabinet or encrypted digital)
• Access restricted to HR personnel only
• UK GDPR compliant (right to work documents contain personal data — see: UK GDPR Guide 2026)

Deel HR: Automated Right to Work Management

• Employee uploads documents via Deel app (passport, BRP, share code screenshot)
• Expiry tracking: alerts 30 days before List B document expires (“Employee X’s Skilled Worker visa expires 1 March — conduct follow-up check”)
• AES-256 encrypted storage — access controlled to HR admins only
• Audit trail: who uploaded, when, who accessed (evidence for Home Office audit)
• UK GDPR compliant: DPA available, ICO registered
• Cost: Included in Deel EOR (£499/month) or Deel Contractors (£39/month), or standalone Deel HR ($8/user/month)

💷 Civil Penalty: £20,000 Per Illegal Worker

Increased from £15,000 in February 2024. Applies if:

• No right to work check conducted
• Check conducted but non-compliant (wrong documents, illegible copy, no date, not stored)
• Initial check done but no follow-up on expired List B document

Repeat offender (within 3 years): Home Office discretion on additional penalties per worker.

⚖️ Criminal Prosecution: Up to 5 Years + Director Liability

Applies if employer knew or had reasonable cause to believe worker was illegal. Indicators include: employee admitted illegal status, obviously forged documents, known pattern of illegal working.

Penalties: Up to 5 years imprisonment + unlimited fine + director disqualification (2–15 years)

Important: Directors can be prosecuted personally. This is not just a company liability.

• Evidence for ALL employees (not just recent hires)
• Quality of copies (legible, clear photo)
• Date on each copy (proves when check conducted)

• Follow-up checks for all List B employees
• Secure storage and access controls
• Systemic failures across workforce (escalates investigation)

Q: Can I accept a photocopy or scan of a passport?

No. Must be original documents physically present (manual check) or verified via IDVT-certified provider. Scans, photocopies, email attachments, and photos are NOT acceptable — even high quality ones. The Home Office requires original verification.

Q: Employee has Spanish passport. Can they work in the UK?

Depends entirely on their immigration status post-Brexit. Spanish passport (or any EU passport) alone does NOT prove right to work since 1 July 2021. They must provide a share code showing settled or pre-settled status, or a UK visa. EU passport + no settled status = no right to work.

Q: British employee lost their passport. Can they start work?

Consider an emergency passport (issued 2–3 days). Alternatively, check Home Office guidance on alternative List A documents — UK birth certificate + National Insurance letter may be accepted in some circumstances. Best practice: wait for passport replacement. Do not let employment start without a compliant check.

Q: Student wants to work 25 hours/week. Can I employ them?

Only during vacation periods. During term time, maximum 20 hours/week. Working 25 hours during term time is illegal — £20,000 penalty risk. Request the employee’s academic calendar showing term and vacation dates. Track hours worked during term time in payroll records.

Q: Employee’s visa expires in 2 weeks, applying for extension. Can they keep working?

Yes, if they apply before expiry — Section 3C leave covers them while the application is pending. You need their Home Office confirmation email or application reference number on file. If they apply after expiry, no Section 3C leave applies and they cannot work until a new visa is granted.

Q: We did a TUPE transfer and inherited 50 employees. Must we check all 50?

Yes, within 60 days of the TUPE date. Conduct retrospective checks for all transferred employees — the previous employer may have failed to check properly, and after 60 days you become liable for any illegal workers who continue in employment. Prioritize non-UK nationals and known high-risk cases immediately. Use the TUPE Retrospective Check Template (available via Growth Access below).

£20,000

Per illegal worker — the risk of not getting this right

15 Minutes

Compliant check per employee — the cost of getting it right

Automated

Deel HR expiry tracking eliminates the “forgot to follow up” failure mode