The £60,000 civil penalty myth that puts careful employers at risk
The £60,000 civil penalty myth that puts careful employers at risk
Most of the HR Directors and Compliance Managers we speak to hear the figure £60,000 per worker and file it away under 'not us.' They run checks. They have a process. They are not the kind of organisation that employs illegal workers deliberately. The penalty is for someone else.
That assumption is one of the most dangerous in employment compliance. And right now, with illegal working raids at the highest level in UK history, it is worth dismantling carefully.
What the penalty actually requires
The civil penalty regime under the Immigration, Asylum and Nationality Act 2006 does not ask whether you intended to employ someone without the right to work. It asks one question: can you demonstrate a statutory excuse?
A statutory excuse is the legal protection that sits between an employer and a civil penalty. You establish it by carrying out a prescribed right to work check, correctly, before employment begins, and by retaining the evidence that you did so. If the check was done correctly and the records are there, you are protected even if it later emerges the worker was not entitled to work. If the check was not done correctly, or the records cannot be produced, the protection falls away. The Home Office can then issue a penalty regardless of how careful you thought you were.
That is the part most employers do not fully absorb. The penalty is not the consequence of employing someone illegally. It is the consequence of not being able to prove you checked. Those are two very different things.
How careful employers end up with penalties they did not expect
Two decades of working across real cases and real audit situations have shown us the patterns clearly. The employers who find themselves facing civil penalties are not predominantly the ones who ignored their obligations. They are the ones whose process had a gap they were not aware of.
The most common gap is documentation. The check was done. Someone looked at the documents, confirmed the person had the right to work, and moved them through onboarding. But the copy was not retained. Or it was retained on a system that has since been migrated. Or it was kept as a photograph on a phone that has been replaced. When enforcement comes and the Home Office asks for evidence of the check, there is nothing to produce.
A statutory excuse requires a copy of the document checked, kept securely, for the duration of employment and for two years afterwards. Not a note saying a check was done. The copy itself.
The second common gap is using the wrong check type. Since January 2026, non-British and non-Irish workers can no longer use a physical Biometric Residence Permit to prove their right to work. They must generate a share code through the Home Office online service. Employers still accepting physical BRP cards have lost their statutory excuse on those hires, as our complete Right to Work guide for 2026 covers in detail. The document looked legitimate. The process felt compliant. But the prescribed method was not followed, so the excuse does not apply.
The third gap is follow-up checks. Where a worker has time-limited permission to work — a visa that expires at a fixed date — employers are required to carry out a follow-up check before that expiry date. Many organisations have no system for tracking this. The original check was compliant. The follow-up never happened. The statutory excuse for continued employment after the expiry date is gone.
The fourth gap is delegation without oversight. Right to work checks are frequently carried out by line managers, recruitment coordinators or HR administrators rather than by the person who is ultimately accountable for compliance. If those individuals have not been trained on the prescribed process, or if there is no audit mechanism to confirm checks are being done correctly, errors accumulate quietly. The legal obligation stays with the employer. The training gap stays invisible until enforcement arrives.
The enforcement context right now
This is not an abstract risk. Between July 2024 and December 2025, illegal working raids increased by 77% and arrests increased by 83%. The Home Office confirmed those figures in January 2026. That is the highest level of enforcement activity in UK history, and the direction of travel is clearly towards more rather than less.
The Fair Work Agency, which we covered in detail in our piece on what the Fair Work Agency means for your screening, launches on 7 April 2026. It brings together enforcement functions including minimum wage compliance and employment rights with a wider brief that extends into how organisations manage their workforce's. The coordination between agencies is increasing, not decreasing.
And since February 2024, the penalty levels themselves increased significantly. A first breach now starts at £45,000 per worker. A repeat breach reaches £60,000 per worker. The Home Office has made clear it is prepared to issue penalties at those levels even where the breach was entirely unintentional. There is no goodwill discount for meaning well.
What the statutory excuse actually requires in 2026
It is worth being precise about what a compliant check looks like right now, because the requirements have shifted and the margin for error is narrow.
For British and Irish citizens, the check must be carried out using an original passport, a birth certificate combined with a National Insurance number, or another document from the prescribed list. A clear copy must be retained.
For non-British and non-Irish workers, the online Employer Checking Service or a share code generated by the worker through the Home Office system must be used. The output from that check — the digital confirmation screen showing the result and the date — must be retained. A physical BRP card is no longer acceptable for new checks.
Where a worker has time-limited permission, the follow-up check must be diarised and completed before the expiry date. Not after. Before.
Where an Identity Service Provider is used to conduct the check on the employer's behalf, the employer must retain written assurance from that provider that the check was conducted correctly, and must keep the output on file. Liability remains with the employer regardless of who carried out the check.
The question worth asking before April
With the Fair Work Agency launching in April and enforcement at record levels, this is a reasonable moment to ask a direct question about your own process: if a Home Office officer walked through your door today and asked to see your right to work records for your last twenty new starters, what would they find?
Not whether you have a policy. Not whether your intention was to comply. Whether the records are there, complete, correctly completed, and retrievable.
If the answer to that question is uncertain, the time to find out is now rather than during an unannounced compliance visit.
Working with Vetting Hub
Vetting Hub is a subscription based consultancy built by Graham and Vivianne Johnson, who spent twenty years running an operational screening business across security, healthcare, financial services and government. They sat in the audits. They saw the gaps that enforcement finds. Everything they learned from that work is now inside Vetting Hub.
A Vetting Hub subscription gives your organisation the knowledge to understand every aspect of employment screening and vetting compliance, the tools to implement it correctly, and direct access to Graham and Vivianne every month as the regulatory landscape shifts. It is an ongoing professional relationship built around making sure your process holds up when it matters most.
