A right to work check confirms that a person is legally allowed to do the work in question in the UK. Employers must complete a compliant check before the person starts work, keep a copy, and in some cases repeat the check later. Done correctly, the check gives the employer a “statutory excuse” against a civil penalty of up to £45,000 per illegal worker for a first breach and up to £60,000 for repeat breaches. From 1 October 2026, these rules were extended beyond traditional employees to cover more working arrangements, including some subcontractors and online platforms.
This guide explains how to carry out checks, what changed in October 2026, and what it means for businesses that use contractors and outsourced staff.
The three ways to check right to work
| Method | Used for | How it works |
|---|---|---|
| Home Office online check | People with an eVisa, settled or pre-settled status, or a biometric immigration record | The person gives you a share code; you check it on GOV.UK with their date of birth and save the result |
| Digital check through an IDSP | British and Irish citizens with a valid passport (or one expired up to six months), or an Irish passport card | A certified identity service provider verifies the document digitally |
| Manual document check | British and Irish citizens using other acceptable documents | You check original documents in the person’s presence, then copy and date them |
Since the move to eVisas, most non-British and non-Irish workers will prove their right to work online with a share code. Physical documents such as expired biometric residence permits are no longer acceptable on their own.
Step by step: a compliant check
- Check before work starts. A check done after the first shift does not give a statutory excuse for the period already worked.
- Use the right method for the person’s status.
- Verify the person is the same as the photo and details.
- Check limits such as restricted hours for students or limits on the type of work.
- Record the date of the check and keep a clear copy for the duration of the work and two years after.
- Diary follow-up checks where permission is time-limited.
What changed on 1 October 2026
Section 48 of the Border Security, Asylum and Immigration Act 2025 came into force on 1 October 2026. It extends illegal working liability beyond contracts of employment to cover:
- Workers who provide personal services under a contract that is not an employment contract.
- Individual subcontractors in a contracting chain, with liability able to reach businesses further up the chain.
- Online matching platforms that connect service providers with clients, including for permitted substitutes.
Genuinely self-employed professionals contracting directly with their own clients are generally outside scope. For the new categories, a statutory excuse requires more than a document check: written contract terms covering right to work, controls on substitutes so no one starts until checked, and identity verification systems to make sure the person doing the work is the person who was checked.
Why this matters for facilities and staffing
Cleaning, security, hospitality, events, car parks and airport services often use layers of subcontractors and short-notice cover. After October 2026, a business can face liability if illegal working is found in its supply chain and it cannot show proper checks and controls. Clients buying these services should now ask suppliers how they check workers and substitutes, not just whether they do.
Questions to ask your contractor
- Which check method do you use for each worker, and when?
- Do you subcontract any work, and how do you check subcontractors’ staff?
- How do you control substitutes and short-notice cover?
- How do you verify that the person on site is the person checked, for example with ID passes or sign-in?
- Can you provide an audit of check records on request?
Airport roles already include identity verification through the airport ID pass process. See our airport ID pass guide.
Penalties at a glance
| Consequence | Detail |
|---|---|
| Civil penalty (first breach) | Up to £45,000 per illegal worker |
| Civil penalty (repeat breach) | Up to £60,000 per illegal worker |
| Criminal offence | Where there is reasonable cause to believe someone is working illegally: unlimited fine and possible prison for individuals |
| Other impacts | Being named publicly, loss of sponsor licence, closure notices and contract loss |
Need a supplier you can audit?WWSG checks right to work before every start and controls cover and substitutes on site.
Frequently Asked Questions
When must a right to work check be done?
Before the person starts work. A late check does not give a statutory excuse for the time already worked.
What is the fine for employing an illegal worker?
Up to £45,000 per worker for a first breach and up to £60,000 per worker for repeat breaches.
Do right to work checks apply to contractors now?
From 1 October 2026, liability extends to workers on non-employment contracts, individual subcontractors in a chain and online platforms, with genuinely self-employed professionals generally outside scope.
Can I accept an expired passport?
For digital checks through an identity service provider, British and Irish passports can be accepted up to six months after expiry. Otherwise documents must be current.
How long should I keep right to work records?
For the duration of the work and for two years after it ends.
This article is general guidance, not legal advice. Follow the latest Home Office guidance for employers.