Right to Work Checks in the UK: Share Codes, Documents and Follow-Ups
Every UK employer has to check that a person is allowed to work for them before they start. Done correctly, the check gives you a statutory excuse against a civil penalty if the person later turns out to be working illegally. The check itself is quick. Doing it before day one, keeping the right record, and checking again before someone's permission runs out is where employers slip.
Since 1 October 2026 the same duty also covers many workers, individual sub-contractors and some gig economy arrangements, not only employees. This post covers who needs a check, the three ways to do one, follow-up checks, how long to keep the record, the penalties, and how to set WorkZerk up to track it.
Who needs a check
Everyone you employ, British citizens included. The Home Office employer's guide, dated 1 October 2026, says to check everyone the same way. Checking only the people you assume are migrants risks a discrimination claim.
Section 48 of the Border Security, Asylum and Immigration Act 2025 widened who counts as an employer for these rules. It came into force on 1 October 2026. As of early November 2026, the scheme covers:
| Arrangement | Example from the Home Office guide |
|---|---|
| Employees | A receptionist on a hotel's payroll |
| People on a worker's contract | Temporary staff an employment business sends to bars and restaurants |
| Individual sub-contractors | Couriers who log in to a delivery app and are paid per delivery |
| Online matching services | A platform that matches a cleaner with a homeowner |
Liability can also reach further up a chain of contracts. Arrangements entered into before 1 October 2026 are not brought into scope just because the work continues, and there is no grace period for new ones. A self-employed person running their own business, or a personal service company contracting directly with a client, is generally outside the scheme. The UK contractor onboarding checklist covers the rest of what to collect from contractors.
The three ways to check
The guide lists three prescribed checks. You must do one of them before the person starts work. You cannot insist on a particular method, so offer a reasonable alternative.
| Check | Who it is for |
|---|---|
| Home Office online check | Anyone with an eVisa or other online immigration status. They give you a share code. |
| Manual check of original documents | Anyone with a document from List A or List B, including British and Irish citizens |
| Digital check through an identity service provider | British and Irish passport holders, plus some other documents where the issuer makes them available digitally |
Online checks with a share code
The person generates a share code at Prove your right to work to an employer. It starts with W and is valid for 90 days. Codes starting with R or S are for other services.
You enter the code and their date of birth at Check a job applicant's right to work, check the photo is of the person (in person or by video call), and keep a PDF or HTML copy of the profile page. The person's own view of their status, or a printout of it, is not enough.
Biometric residence permits are gone. The Home Office stopped issuing them on 31 October 2024 and replaced them with eVisas, and a manual check of an expired BRP does not give you a statutory excuse. British and Irish citizens cannot get a share code.
Manual checks: List A and List B
For a manual check you must hold the original documents and check them with the person present, in person or on a live video call. A scan, photo or video of a document does not count, except official digital evidence of a National Insurance number used alongside another document.
The acceptable documents are in Annex A of the employer's guide:
| List | Statutory excuse | Examples |
|---|---|---|
| A | Continuous, no follow-up needed | A British passport, current or expired. An Irish passport or passport card, current or expired. A UK birth or adoption certificate with an official document showing their permanent National Insurance number. |
| B, Group 1 | Until their permission ends | A current passport endorsed to show they can stay in the UK and do the work |
| B, Group 2 | 6 months | A Positive Verification Notice from the Home Office Employer Checking Service, on its own or with certain other documents |
Check the documents are genuine and belong to the person, and that the work fits any restrictions, such as term-time hours for students. Copy each document in a form that cannot be altered, and record the date of the check, either as a dated declaration ("The date on which this right to work check was made: [date]") or a separate record made at the time. A date written on the copy alone is not enough.
Digital checks for British and Irish passports
An identity service provider, which the guide now calls a right to work digital verification service provider (RtW DVSP), can check a British or Irish passport, or an Irish passport card, online, including one up to 6 months past its expiry date. The provider must be on the government's digital verification services register. You still confirm the photo matches the person and keep the provider's output, and you stay responsible for the check. If someone does not want a digital check, offer a manual one.
Follow-up checks
If someone's permission is time-limited, check again on or before the date it ends if you want to keep employing them. The follow-up does not have to use the same method as the first check. A List B Group 2 excuse lasts 6 months from the date on the Positive Verification Notice.
No follow-up is needed for someone with a List A document, or where the first check showed settled status or status under the EU Settlement Scheme.
If someone cannot prove their right to work at the follow-up, they may still have it, for example while an application is in progress. Give them a reasonable chance, and use the Employer Checking Service where it applies.
How long to keep the record
Keep the copies, the online check output or the provider's output, and the date of each check, for the length of the employment and for 2 years after it ends. Then destroy them securely. Handle them under data protection law, since passports and immigration status are personal data you should only keep as long as you need.
Penalties
The maximum civil penalty is £60,000 per illegal worker. The code of practice dated 1 October 2026 sets how the amount is worked out:
| Breach | Starting point per worker |
|---|---|
| First breach in 3 years | £45,000 |
| Repeat breach within 3 years | £60,000 |
Reporting the worker to the Home Office first, and co-operating with it, can each take £5,000 off. On a first breach, an employer with effective checking practices may get a warning notice instead.
Knowingly employing an illegal worker is a criminal offence, with up to 5 years in prison and an unlimited fine. The Home Office also publishes the names of employers it fines.
Rules change, so this is general information, not legal advice. An employment or immigration lawyer can advise on your situation.
What WorkZerk does and doesn't do
- Each person sends proof of their right to work, or their share code, from a private link, with no account or password.
- Uploads marked Sensitive are stored encrypted, only admins can open them, and every view is recorded.
- For time-limited permission, WorkZerk tracks the end date and emails the person and your team before it arrives.
- The Document compliance report shows whose follow-up check is current, coming up or overdue.
What it does not do: WorkZerk does not run the Home Office online check, examine original documents or act as an identity service provider, and it does not connect to any Home Office system. Your team runs the check and records the result in WorkZerk. A passport photo uploaded to WorkZerk is not the check.
Setting it up in WorkZerk
1. Turn on two-factor authentication
Asking people to upload documents needs two-factor authentication on your account. Set it up first under Account, then Two-factor authentication (opens in WorkZerk in a new tab).
2. Create the fields
Open Fields (opens in WorkZerk in a new tab) and add:
- Right to work evidence, an Upload field. Leave Require an expiry date off, because a British passport check never needs repeating.
- Right to work (follow-up by), an Upload field with Require an expiry date ticked. The expiry date is the day their permission ends.
- Right to work share code, a Text field.
- Right to work checked on, a Date field your team fills in after each check.
Switch on Sensitive for the two Upload fields. See Keeping sensitive information private.
3. Create a portal from the UK staff pack
Open Portals (opens in WorkZerk in a new tab), click New portal, and add the Staff onboarding (United Kingdom) pack. It asks for Proof of your right to work (marked sensitive), an emergency contact, a DBS certificate if the role needs one, a P45 or starter checklist, their National Insurance number and bank details. See starter request packs and the UK new starter checklist. For DBS, see DBS checks for employers.
Leave the portal open while anyone on it has time-limited permission. Closing a portal switches off its links, and the reminders stop with them.
4. Ask each person only what applies to them
On the portal's Requests panel, click + Insert and add:
- A Choice request, "Which of these applies to you?", with three options: British or Irish citizen, Permission with no time limit (for example settled status), Time-limited permission (for example a visa).
- An Upload request, "Proof of your right to work", with Right to work evidence as its Document type. Under Show only when, pick the Choice question and the first two options. In the description: "A photo of your passport photo page. Bring the original on your first day, or use a share code."
- A Fields request for Right to work share code, with the description "If you have an eVisa, get a code at gov.uk/prove-right-to-work. It starts with W."
- An Upload request, "Your right to work", with Right to work (follow-up by) as its Document type and Require expiry on. Under Show only when, pick the Choice question and Time-limited permission. In the description: "Upload a screenshot of your status from your UKVI account. Enter the date your permission ends as the expiry date."
Then delete the pack's own Proof of your right to work request, which these replace. A request hidden from someone never counts against them.
5. Add the same requests for contractors in scope
The Contractor onboarding (United Kingdom) pack does not ask for right to work. If you engage individual sub-contractors or people on worker's contracts from 1 October 2026, add the requests from step 4 to their portal too. This is a separate question from their tax status under IR35.
6. Run the check before they start, then approve
Uploads wait under Needs review on Requests (opens in WorkZerk in a new tab). Before each person's first day:
- Run the online check with their share code, examine their original documents, or use your identity service provider.
- Save the online check's PDF, or the provider's output, and attach it to their contact record.
- For time-limited permission, compare the end date with the expiry date they entered. If it differs, click Change date and enter the date from the check.
- Approve the upload, and enter the date in Right to work checked on.
7. Switch on the reminders
Open Automations (opens in WorkZerk in a new tab) and switch on Document expiring reminder and Document expired reminder. Both start switched off. The expiring reminder goes 30 days before the date. Change it to 60 days so the follow-up check is done before permission ends, not on the day.
To remind your team too, build a Document expiring automation with Send account email. See Automations.
8. Record each follow-up check
Have the person upload their new status on the same row, with the new end date as the expiry date. The new file replaces the old one and the reminders start again. Run the check, attach the new output, and update Right to work checked on.
9. Check who is covered, and how long you keep it
Open Requests (opens in WorkZerk in a new tab) and click Document compliance. Each person shows as current, expiring, needs review, expired or missing. Tick Only people who aren't compliant for the list to work through, and use Download CSV for a register. See Document compliance.
The 2-year rule is longer than WorkZerk's Document retention setting allows, so leave it off for right to work evidence. See deleting documents after you approve them. If you set sensitive information to delete automatically under Profile (opens in WorkZerk in a new tab) and close the portal when someone leaves, 5 years or 7 years covers the rule. 1 year does not.
Getting started
Start a free WorkZerk trial at workzerk.com, then work through the steps above. If you get stuck, the getting started guide walks through a first portal end to end, or email us at [email protected].