Hiring in the UK comes with a non-negotiable compliance step: right to work checks. Done correctly, a right to work check gives an employer a statutory excuse (legal defence) against a civil penalty if an employee is later found to be working illegally. Done incorrectly (or inconsistently), it can expose the business to serious risk and even claims of discrimination.
This guide is a practical, step-by-step explanation of:
Which check method to use
How to perform it correctly (online, manual, or digital via IDSP)
How to handle follow-up checks
What evidence to keep
Common mistakes that cause compliance failures
Note: This is general guidance. Rules can change, so always cross-check the latest Home Office employer guidance when implementing your process.
1) What is a “right to work check” (and why it matters)?
A right to work check is the prescribed process employers must follow before employment begins to confirm a person is legally allowed to do the work offered. If the worker’s permission is time-limited, the employer must also do a follow-up check shortly before it expires.
When carried out correctly, you establish a statutory excuse, which protects you from a civil penalty for illegal working (for that worker) as long as you complied with the prescribed steps.
2) The 3 legal ways to do a UK right to work check (choose the correct method)
The Home Office recognises three main check types (the right one depends on the person’s nationality/status):
A) Home Office online check (share code + DOB)
Used mainly for non-British and non-Irish individuals who prove status digitally (eVisa / digital profile).
B) Manual document check
Used for many British/Irish hires (and other situations where manual evidence is acceptable), following the “originals + check + copy + date” process.
C) Digital right to work check via an IDSP (British & Irish passports only)
Employers can use an Identity Service Provider (IDSP) using IDVT to verify British and Irish citizens with a valid passport / Irish passport card.
Important note about BRPs/BRCs: You can no longer accept biometric residence cards or permits as manual proof, and you should ask for a share code instead.
3) Step-by-step: Online right to work check (share code method)
This is the most common method for people who hold an eVisa/digital status.
Step 1 — Get the worker’s share code + date of birth
The individual generates a share code and gives it to you. The Home Office employer guidance explains that the share code is 9 characters and is valid for 90 calendar days.
Also, share codes are purpose-specific:
Codes starting with “W” are for right to work
You cannot use codes starting “R” or “S” (other services)
If their share code has expired, ask them to generate a new one.
Step 2 — Use the employer online service (not the employee view)
To obtain a statutory excuse, you must perform the check using the employer service: “Check a job applicant’s right to work: use their share code”, entering the share code + DOB.
It is not sufficient to view what the candidate sees on the “migrant side” of the service.
Step 3 — Verify the photo matches the person
You must check that the photo returned by the online profile is of the person presenting themselves for work—this can be done in person or via video call.
Step 4 — Confirm they’re allowed to do this role
Only employ them if the online check confirms:
they have the right to work, and
there isn’t a restriction preventing them from doing the work you’re offering (including hours limits for some categories).
Step 5 — Retain evidence (this is where many employers fail)
You must keep evidence of the online check—specifically the profile page that shows the individual’s photo and the date the check was conducted (saved/printed as PDF/HTML).
4) Step-by-step: Manual right to work check (original documents)
For people who prove status with original documents (commonly British/Irish passports), GOV.UK summarises the manual process clearly:
Step 1 — Obtain the original documents
Ask to see the applicant’s original documents. (And remember: you can no longer accept biometric residence cards/permits as manual evidence.)
Step 2 — Check validity with the person present
You need to check:
documents are genuine, original, unchanged, and belong to them
photos and DOBs match across documents
name differences are supported by documents (e.g., marriage certificate)
For non-British/non-Irish using manual docs, you also check:
permission dates are not expired
the work type/hours are permitted (including student limits where applicable).
The Home Office guide also notes “presence” can be in person or via a live video link, but you must still follow the prescribed steps to establish your statutory excuse.
Step 3 — Copy, store, and record the date
GOV.UK says to make and keep copies and record the date you made the check, keeping the copies during employment and for 2 years after they stop working for you.
5) Digital checks via IDSP (British & Irish passports)
British and Irish citizens cannot get a share code, so employers either:
do a manual check, or
use an IDSP to do a digital check via IDVT.
The Home Office recommends employers only accept IDSP checks meeting at least a Medium Level of Confidence, and there’s a GOV.UK list of certified providers (though it’s not mandatory to use only certified providers).
This route is popular for remote hiring because it can streamline identity verification, especially at scale.
6) Follow-up checks: List A vs List B (the rule that protects your statutory excuse)
If the check evidence shows someone has a continuous right to work, you don’t need follow-up checks.
If it shows a temporary/time-limited right to work, you must schedule follow-ups.
The Home Office explains:
List A → continuous statutory excuse; no follow-up checks required
List B → time-limited statutory excuse; follow-up check required to keep protection
Best practice: As soon as you run a check, record:
check date
“List A” or “List B”
follow-up date (if List B)
who completed the check and where evidence is stored
7) When to use the Employer Checking Service (ECS)
Sometimes you can’t complete a standard online/manual check—e.g., where someone has an outstanding application/appeal and their digital profile can’t yet confirm it. In those specific scenarios, you can use the Employer Checking Service to request a Positive Verification Notice (PVN), which provides a statutory excuse for six months.
8) Avoid discrimination: do checks consistently across all hires
The Home Office guidance is explicit: do not only check people who “look like migrants” or make assumptions based on nationality, accent, surname, ethnicity, or length of residence—this can be discriminatory and used as evidence under equality law.
Simple compliance rule: apply the same hiring-stage check process to everyone:
same point in the funnel (e.g., “offer accepted, before start date”)
same retention rules
same HR audit trail
9) Common right to work mistakes (and how to prevent them)
Mistake 1: Accepting the wrong evidence type
Example: accepting BRP/BRC as manual evidence instead of using the online share code approach.
Fix: Train recruiters: “BRP/BRC → online share code check.”
Mistake 2: Checking the wrong online page
Viewing what the candidate sees does not give you a statutory excuse.
Fix: Always use the employer share-code checker, save the profile page.
Mistake 3: Not retaining evidence correctly
No saved profile/copies = weak audit trail = no statutory excuse.
Fix: Standardised storage naming + HR policy.
Mistake 4: No follow-up system for time-limited permissions
Fix: Put follow-ups into HRIS/calendar when a List B/time-limited outcome is recorded.
Mistake 5: Inconsistent checks (discrimination risk)
Fix: One consistent workflow for all candidates.
10) Ready-to-use internal SOP (copy/paste for your HR process)
Right to Work SOP (UK)
Run RTW checks for every hire after offer acceptance and before start date.
Choose method:
Non-British/Irish with digital status → share code (employer portal)
British/Irish → manual passport check or IDSP
Verify identity match (photo) in person or by video call where permitted.
Save evidence:
Online check → PDF/HTML profile page
Manual check → dated copies of originals
Record outcome:
Continuous vs time-limited; schedule follow-up if time-limited
Store securely for employment duration + required retention after employment ends (per GOV.UK guidance).
