Right-to-work checks, done properly
Three approved routes, one statutory excuse, and penalties that start at £45,000 per worker when the process is sloppy. Here is how the checks actually work — and the October 2026 change that pulls contractors and gig workers into scope.
Section 48 of the Border Security, Asylum and Immigration Act 2025 extends the illegal-working regime to workers, individual sub-contractors and platform-sourced labour. Businesses running on contracted or gig workforces get the same duties — and the same penalties — that employers of staff have today. Map your labour categories and your suppliers' checking obligations before the autumn.
The three approved routes
Route 1 · Online share-code check
Anyone with digital immigration status (eVisa) — most non-British, non-Irish hires. Not available for British or Irish citizens.
The candidate gives you a share code; you check it with their date of birth on the Home Office online service, with their permission, and keep the result page. Physical biometric residence permits have been replaced by eVisas, so digital status is now the norm.
The online check result is your statutory excuse — save it dated, not just glanced at.
Route 2 · Digital identity check (IDVT)
British and Irish citizens holding a valid passport (or Irish passport card).
A certified identity service provider verifies the passport remotely using Identity Document Validation Technology. You keep the provider’s output. Use a provider on the government’s certified list.
The IDVT result plus your record of it gives the statutory excuse — remote hiring without couriering passports.
Route 3 · Manual original-document check
The universal fallback — including British citizens without passports (other approved document combinations exist).
Inspect original documents from the approved lists with the person present (a live video call while you hold the originals also works), check they belong to the person, then copy and date them.
A correctly performed check before employment starts, with dated copies retained.
The questions that actually come up
What exactly is the “statutory excuse”?
It is your defence against a civil penalty if someone turns out not to have the right to work: you did a compliant check, by an approved route, before employment started, and kept the evidence. Keep copies securely for the whole employment plus two years after it ends. An incorrect check — a photocopied document, a scan emailed over, a check done after the start date — gives no excuse at all.
How big are the penalties really?
Civil penalties run up to £45,000 per illegal worker for a first breach and up to £60,000 per worker for repeat breaches — levels in force since February 2024. Knowingly employing someone without the right to work is a criminal offence on top, and sponsor-licence holders risk their licence. The penalty applies per worker, so one bad process can multiply quickly.
Do I need to re-check existing employees?
Not routinely. If the original check was compliant, your statutory excuse continues — you only repeat a check when someone’s permission is time-limited, before it expires. EU citizens employed since before 1 July 2021 did not need retrospective checks. What you must not do is single people out for re-checking based on nationality or appearance — checks must be applied consistently to everyone.
What changes on 1 October 2026?
Section 48 of the Border Security, Asylum and Immigration Act 2025 extends the illegal-working regime beyond employees — to workers, individual sub-contractors, and people supplied through online matching platforms. If your operation runs on contracted or gig labour, checks (or contractual assurance that your suppliers perform them) stop being optional from that date. Mapping who works for you under what arrangement is the preparation that matters this summer.
Can I accept a scanned passport or a photo on WhatsApp?
No. For manual checks it must be original documents, inspected with the person present or over live video while you hold the originals. If remote is the goal, use the share-code route (digital status) or a certified IDVT provider (British/Irish passports) — those are designed exactly for remote hiring and give a full statutory excuse.
Sources: GOV.UK — check a job applicant's right to work, GOV.UK — penalties for employing illegal workers, BSAI Act 2025 (Commencement No. 3) Regulations 2026. Checked 5 July 2026. This is general guidance, not immigration-law advice.
A statutory excuse is only as good as your record-keeping.
Blankitt HR stores dated check evidence against each employee record and reminds you before time-limited permissions expire — the two habits that make penalties someone else's problem.