Right to Work Checks: The Complete Employer Guide 2026

If you are still accepting physical Biometric Residence Permits from new starters, you have already lost your statutory excuse. The protection you thought you had does not exist. And the Home Office is now conducting raids and investigations at the highest rate in UK history.

That is not alarmism. It is the reality of where we are in March 2026, and it is why every organisation that employs people in the UK needs a clear, current and properly implemented right to work process. Not a vague awareness that checks need to happen. A structured, consistent, auditable system that can withstand scrutiny on the day an enforcement officer walks through your door.

This guide covers everything you need to know. The legal framework. The three checking methods. What the statutory excuse actually is and how you lose it. The BRP transition and what it means for your existing workforce. The new obligations introduced by the Border Security, Asylum and Immigration Act 2025. And the practical steps to make sure your process is compliant right now.

Why this year is different

The Home Office confirmed in January 2026 that illegal working raids and arrests are at their highest level in UK history. Between July 2024 and December 2025, the number of raids increased by 77% and arrests rose by 83%. These are not numbers from a gradual upward trend. They represent a deliberate and sustained enforcement posture from a government that has made illegal working a priority.

The construction sector has been hit particularly hard, with over 200 immigration enforcement visits in just nine months of 2025 resulting in nearly 500 arrests and £4.9 million in civil penalties issued to construction companies alone. But enforcement is spreading across every sector. If you are in hospitality, healthcare, logistics, security, care or professional services, the chances of your organisation receiving an unannounced visit are higher now than they have ever been.

The financial exposure is also higher than many employers realise. Civil penalties now reach £45,000 per illegal worker for a first breach, rising to £60,000 per worker for repeat breaches. These are not theoretical maximums. They are the figures the Home Office is applying.

The legal foundation every employer needs to understand

The right to work checking regime sits under the Immigration, Asylum and Nationality Act 2006. Every employer in the UK, regardless of size, sector or location, is legally required to check that each person they employ has the right to work before employment begins.

The law is deliberately straightforward in principle: you carry out the prescribed check, you retain the evidence, and if it later emerges that someone was working illegally, you have a statutory excuse against civil liability. If you did not carry out the prescribed check, or you carried it out incorrectly, that protection disappears entirely.

The statutory excuse is not a technicality. It is the only defence available to you. And it is only available if the check was done using one of the three approved methods, done correctly, and the evidence retained in a way that can be produced on request.

The three checking methods in 2026

In 2026 there are three recognised methods for conducting a compliant right to work check. Using the wrong method, even if the documents look perfectly valid, will not establish your statutory excuse.

Online share code check. This is now the mandatory route for any individual holding digital immigration status. That includes most skilled worker visa holders, students, those with EU Settlement Scheme status, and almost all other migrants whose status has been converted to an eVisa. The individual generates a unique share code through the Home Office's view and prove service, and you access the result through the official online checking portal. The check shows the individual's current immigration status, what work they are permitted to do, and whether their permission has an end date requiring a follow-up check. You must retain a clear record of the result. A screenshot or printed copy with the date recorded is the minimum requirement.

Manual document check. This route remains available for British and Irish nationals who do not have a valid passport, and in a small number of specific circumstances for other individuals, such as those waiting to collect their BRP before the system changed. A manual check requires you to physically handle the original document, not a photocopy, not a scan, not an image on a phone screen. You verify that the document appears genuine, that the person presenting it appears to be the person described in it, and you retain a copy. It is worth noting that manual checks on documents from List A give you a permanent statutory excuse for that employment. Documents from List B give you a time-limited excuse that requires a repeat check before it expires.

Digital Verification Service check. British and Irish citizens with a valid passport or Irish passport card can be verified through a certified Identity Document Verification Technology provider. The IDVT route is available for British and Irish nationals only and gives a permanent statutory excuse equivalent to a manual check on a List A document. This route is particularly relevant for remote onboarding where handling original documents in person is not possible.

The Employer Checking Service is a fourth route, not a checking method in its own right, but a separate mechanism used where an individual cannot provide documentation or a share code because they have an in-time application, appeal or administrative review pending. The ECS issues a Positive Verification Notice that provides a time-limited statutory excuse of six months. You must conduct a repeat ECS check before it expires.

What happened to BRPs and why it matters

Biometric Residence Permits are no longer valid proof of the right to work. This is not a future change. It happened. All BRPs expired on 31 December 2024 and the Home Office stopped issuing them on 31 October 2024. From January 2026 onwards, non-British and non-Irish workers must prove their right to work digitally using the share code system.

If you have workers on your payroll who last had their right to work verified using a physical BRP, and you have not since carried out a fresh online share code check, your statutory excuse on those individuals is now questionable. The original check may have been valid at the time, but the landscape has changed and you need to understand exactly where you stand.

For workers with time-limited immigration status, a follow-up check was always required before their permission expired. Given that all BRPs showed an expiry date of 31 December 2024, that date will have passed. If you have not conducted a fresh online check for these individuals, you need to do so now. Retaining a copy of an expired BRP is not a defence.

The new obligations under the Border Security, Asylum and Immigration Act 2025

The Border Security, Asylum and Immigration Act 2025 received Royal Assent in December 2025 and it extends the scope of right to work obligations in a way that most organisations have not yet absorbed.

Under the expanded regime, right to work check obligations will apply not just to direct employees but to individuals engaged under workers' contracts, individual sub-contractors, and people engaged through online matching platforms and gig economy services. The exact commencement date for these expanded obligations is expected during 2026, but organisations that use contractors, freelancers or platform workers need to start reviewing their processes now rather than waiting for the implementation date to land.

This is a significant shift. Many organisations currently operate on the assumption that right to work compliance is the responsibility of a staffing agency or a contractor's own company. The new Act challenges that assumption directly. If your organisation is engaging workers through any of these routes, you need a clear picture of what your obligations will be and how your current processes measure up.

Building a process that holds up under scrutiny

The Home Office's approach to enforcement has matured considerably. Compliance officers are not simply asking whether a check was carried out. They are asking whether the process was structured, consistent and auditable across the whole organisation. Informal or inconsistent checking practices are now treated as systemic failings, and systemic failings attract a very different level of scrutiny than isolated errors.

A defensible right to work process in 2026 has several characteristics that are worth building into your documentation.

Every check is carried out using the correct method for the individual's specific immigration status. The method is determined by the status of the individual, not by what is most convenient or what worked last time. A process that relies on whoever is doing the onboarding making a judgement call on the day is not a process. It is a risk.

Every check is carried out before employment begins. Not during the first week. Not once the onboarding paperwork has been processed. Before the individual starts work. This is one of the most common failures we have seen in real operational settings across two decades of doing this work, and it is one of the easiest to address with a clear policy and a joined-up onboarding process.

Every check is evidenced and retained in a format that can be produced on request. For online checks, that means a dated record of the share code result. For manual checks, it means a clear copy of the document with the date of the check recorded. For IDVT checks, it means the output from the certified provider. Verbal confirmation, email trails and informal notes are not sufficient.

Repeat checks for time-limited permission are diarised and completed before the permission expires. An HR system that flags upcoming expiry dates is not a luxury. It is a basic compliance requirement. A worker who had the right to work on the day they joined you does not automatically have it twelve months later if their visa has expired.

The statutory excuse in practice

It is worth being precise about what the statutory excuse means and what it does not mean. Having a statutory excuse does not mean you cannot be investigated. It means that if an illegal worker is found at your organisation and you have carried out a compliant check, you have a defence against the civil penalty.

If you cannot produce the evidence, the statutory excuse is lost even if the check did take place. This is why record-keeping is not a bureaucratic afterthought. It is the mechanism by which your compliance actually protects you.

The statutory excuse also does not protect you if you knew or had reasonable cause to believe that the individual did not have permission to work. Where knowledge or reasonable suspicion is present, the exposure shifts from civil penalty territory into the possibility of criminal prosecution. This is a very different risk profile and it is one that organisations underestimate.

The link between right to work and the rest of your screening process

Right to work verification does not sit in isolation. It is part of a broader picture of employment screening that also includes identity verification, reference checking, DBS checks where applicable, and sector-specific standards like BS7858 or BPSS.

One of the consistent patterns two decades of processing real cases across every regulated sector reveals is that organisations that have a weak right to work process tend to have weakness elsewhere in their screening too. The same gaps that allow a non-compliant check to slip through will allow other problems through as well. The right to work process is often the most visible part of an employer's screening compliance, partly because it attracts the most direct regulatory enforcement. Getting it right is a signal of a well-run operation. Getting it wrong is a signal that there may be other things worth examining.

For further context on how right to work fits into the wider screening landscape, take a look at From the Frontline to the Classroom: Why Graham and Vivianne Johnson Founded Vetting Hub, where we set out the operational experience behind everything we do at Vetting Hub.

What to do this week

If you are reading this and you are not fully confident that your right to work process is compliant right now, there are three things worth doing immediately.

First, review your current workforce records and identify anyone whose right to work was last verified using a physical BRP. Those records need a fresh online share code check.

Second, audit your onboarding process and confirm that checks are being carried out using the correct method for the individual's immigration status, not a single default approach applied to everyone.

Third, review your contractor and freelancer arrangements in the context of the Border Security, Asylum and Immigration Act 2025 and start to understand what your expanded obligations will look like when the commencement regulations come into force.

Working with Vetting Hub

Right to work compliance is one of the areas where organisations most often discover, too late, that what they thought was a process was actually a habit. The Home Office does not award credit for good intentions.

At Vetting Hub, our subscribers get the knowledge to understand the full right to work framework in practical terms, the tools to implement it correctly through templates, checklists and decision guides built from real operational experience, and the direct access to bring specific situations to Graham and Vivianne through monthly briefings and written question responses.

It is a subscription-based consultancy relationship, not a course or a helpdesk. The difference is that when a question comes up or something changes, you have somewhere to turn that knows your organisation and can give you a specific, practical answer, not a generic one.

Find out more at www.vettinghub.co.uk