Every UK employer must verify that each new employee has the right to work in the UK before they start — and getting it wrong now carries civil penalties of up to £45,000 per illegal worker for a first breach and £60,000 for repeat breaches. A correct check gives you a statutory excuse against those penalties. In 2026 there are three prescribed methods — a manual document check, an online check using a share code, and a digital identity check (IDVT) via a certified provider — and the system has shifted decisively to digital following the rollout of eVisas and the retirement of Biometric Residence Permits.
This guide explains exactly how to check, who needs which method, and how to stay compliant. It is general information, not legal advice; always check current Home Office guidance.
What a Right to Work check is — and why it matters
A Right to Work check confirms a person is legally permitted to do the work you are offering. You must carry it out before employment begins, and you must check every employee — including British citizens — because checking only those who look or sound foreign is discriminatory under the Equality Act 2010.
Do the check correctly and you gain a statutory excuse: if it later turns out the person did not have the right to work, you have a defence against the civil penalty. Get it wrong, or skip it, and you lose that protection. Since 13 February 2024, the civil penalty has been up to £45,000 per illegal worker for a first breach and up to £60,000 for repeat breaches, tripled from £15,000 and £20,000. Penalties apply per worker, and serious or knowing cases can also bring criminal liability.
The three ways to check Right to Work in 2026
There are three prescribed methods in 2026: a manual check of original documents, an online check using the worker's share code, and a digital identity check through a certified provider. The next three sections take each in turn, and the table further down shows which method applies to whom.
Method 1 — Manual document check (List A / List B)
The employer examines the individual's original documents in their presence, or over a live video call with the person holding the originals, checks they are genuine and that the photo and details match, and keeps clear copies with the date of check. Home Office guidance sets out acceptable documents in two lists. List A documents show a continuous, permanent right to work, and no follow-up check is needed. List B documents show a time-limited right to work, and a follow-up check is required before the permission expires.
Important: a physical Biometric Residence Permit can no longer be used for a manual check, as the eVisa section below explains.
Method 2 — Online check using a share code
For anyone whose immigration status is held digitally — holders of an eVisa, EU Settlement Scheme status, frontier worker permits, and others — the route is the Home Office online service. The individual generates a 9-character share code at gov.uk/prove-right-to-work and gives it to you with their date of birth. You enter both on the employer's online checking service, which returns the person's photo, name, and work entitlement. You must confirm the photo matches the individual, in person or by video, and keep a record of the check. This is now the primary method for most non-British, non-Irish workers, and the only option for those who hold an eVisa with no physical document.
Method 3 — Digital identity check (IDVT via a certified provider)
British and Irish citizens with a valid passport, or an Irish passport card, can be checked using Identity Document Validation Technology (IDVT) through a Home Office-certified Identity Service Provider (IDSP) — now framed within the Home Office's Digital Verification Services. The certified provider verifies the document and that the person is its rightful holder; you then carry out a visual check that the person matches.
Two cautions: the provider must be certified, because an identical but non-certified service gives no statutory excuse, and the current list is on GOV.UK; and IDVT may only be used for British and Irish passport holders, not for manual checks or online-service checks.
The eVisa transition: what changed
The biggest recent shift is the move from physical documents to eVisas, or digital immigration status. Biometric Residence Permits (BRPs) have been decommissioned — most expired on 31 December 2024, and from 1 June 2025 expired BRPs can no longer be accepted for a Right to Work check. Workers who previously held BRPs now prove their status through the online share-code route, linked to their UKVI account. From 2025 the Home Office has been migrating immigration permissions to the eVisa system, making online checks the default for most migrant workers. The practical takeaway: if someone offers you a physical immigration card as proof, that is now a red flag — verify their status online instead.
Which method for whom
Match the worker to the method.
| Worker | Method |
|---|
| British or Irish citizen | Manual check (valid or expired British passport, or birth/adoption certificate plus NI number), or IDVT via a certified IDSP for passport holders |
|---|
| eVisa holder | Online share-code check (the only option — no physical document) |
|---|
| EU Settlement Scheme status | Online share-code check |
|---|
| Other visa or digital status | Online share-code check |
|---|
| Former BRP holder | Online share-code check (expired BRPs not accepted from 1 June 2025) |
|---|
Record-keeping and follow-up checks
Keep a clear, dated copy of the evidence — the document copies, the online check result, or the IDVT output — for the duration of employment and for two years after it ends. For List B, time-limited workers, diarise and carry out a follow-up check before their permission expires, or you lose the statutory excuse from that point.
Avoiding discrimination
Check everyone to the same standard. Singling out candidates by nationality, accent, or appearance is unlawful under the Equality Act 2010, and the Home Office's own code of practice requires consistent, non-discriminatory checks. A standard, documented process applied to every hire protects you on both fronts.
Where document verification is heading — and where VerifyDoc.ai fits
It is worth noticing what the Right to Work regime tells us about the direction of travel. The Home Office replaced forgeable physical cards with eVisas and online, verify-at-source checks for exactly the reason every issuer eventually confronts: a physical document can be faked, but a status confirmed at source cannot. Identity and document verification is going digital because digital verification is harder to defeat.
That same principle applies to the documents your organisation issues. While a Right to Work check is something you perform on a worker, employers also produce a stream of documents — employment contracts, offer letters, employment-verification and reference letters — that recipients later have to trust. VerifyDoc.ai lets you issue those with a QR-backed Certificate of Authenticity and a proof page, so a future employer, landlord, or agency can confirm they are genuine and unaltered in seconds — and you can e-sign them with a verification trail.
Read this carefully: VerifyDoc.ai is not a Right to Work check provider, is not a certified IDSP or Digital Verification Service, and is not the Home Office online service. It cannot perform or replace a statutory Right to Work check, and using it for that purpose would not give you a statutory excuse. For Right to Work, you must use the prescribed methods above — the manual check, the Home Office online service, or a certified IDSP. VerifyDoc.ai's role is limited to making the documents your organisation issues verifiable. See how it works.
A compliance checklist for employers
Check before the first day of work, every time, for every hire. Use the right method for the worker — manual, online share code, or certified IDVT. Do not accept physical BRPs; direct former BRP holders to the online share-code route. Confirm the photo matches the person, in person or by video.
Record and date the evidence, and retain it for employment plus two years. Diarise follow-up checks for time-limited, List B status. Apply one consistent process to all candidates to avoid discrimination. Use only Home Office-certified IDSPs where you use IDVT. And keep training current, because the rules change frequently.
Make the documents your organisation issues verifiable
Right to Work checks must go through the Home Office's prescribed routes — but the contracts, offer letters, and reference letters you issue can carry a QR-backed Certificate of Authenticity, so any future employer or agency can confirm they are genuine and unaltered in seconds. Start free or see how it works.
Related reading: How to spot a fake UK payslip or bank statement and UK GDPR and verifiable documents: an issuer's guide.
This article is for general information and does not constitute legal advice. Right to Work rules change frequently; always confirm current requirements in the Home Office's Employer's guide to right to work checks and take professional advice on your specific circumstances.
