This free right to work check checklist takes each new starter from the job offer to a filed, dated record. It asks every candidate the same question, shows only the steps for the check you are using (manual documents, the Home Office online share code service, a registered digital provider or the Employer Checking Service), asks HR to confirm the check before the start date, and sets up the follow-up check for anyone whose permission runs out. It is built on the Home Office guidance in force from 1 October 2026, when the rules widened to cover workers and individual sub-contractors as well as employees. It is UK-specific by design. US employers verify employment eligibility on Form I-9 instead: see the Form I-9 & E-Verify Compliance Checklist.
The check is simple. The timing and the record are where it fails. Every employer in the UK has a duty to prevent illegal working. If you carry out a check exactly as the Home Office prescribes, before the person starts, you have a “statutory excuse”: a defence against a civil penalty if it later turns out they had no right to do the work. Miss a step, check after the start date, or fail to keep the copy, and the excuse is gone even if you saw the right document.
The documents have changed. The Home Office stopped issuing Biometric Residence Permits on 31 October 2024 and moved to eVisas, an online record of a person’s immigration status. Someone with an eVisa can only prove their right to work through the online service with a share code, and a manual look at an expired BRP is not an acceptable check. Older onboarding packs that still ask for “passport or BRP” are out of date.
Who must be checked has changed too. From 1 October 2026 the Border Security, Asylum and Immigration Act 2025 extends the scheme beyond employees. The Home Office published a rewritten Employer’s guide to right to work checks dated 1 October 2026, alongside an updated code of practice on preventing illegal working and a new code on avoiding unlawful discrimination.
For the new groups, penalties apply only where the engagement began on or after 1 October 2026. There is no general grace period.
The rules apply across England, Scotland, Wales and Northern Ireland.
The stakes are high. The Home Office guide puts the civil penalty at up to £60,000 per illegal worker, and knowingly employing someone without the right to work is a criminal offence. Discrimination is the other risk: checking only the people you assume are migrants is unlawful. This template turns the Home Office guidance into process steps; it is not legal advice. If your model involves labour supply chains, platforms or substitution clauses, where the new “extended liability” rules can apply, take advice from an employment or immigration lawyer on your specific arrangements.
Seven phases. The check type chosen in Phase 1 shows one of Phases 2 to 5, and the follow-up phase appears only when the person’s permission is time-limited.
Shown when the check type is a manual document check.
Shown when the check type is the Home Office online check. Required for anyone with an eVisa.
Shown when the check type is a digital verification service provider. For British and Irish passports and Irish passport cards.
Shown when the Home Office has to verify the right to work, for example during a pending application or appeal.
Shown when the person’s permission to work has an expiry date.
You cannot insist on one method for everyone, but you also cannot pick freely. The person’s nationality and immigration status decide which checks are open to them, and the result decides how long your statutory excuse lasts. Use this table when choosing the check type in Phase 1.
| The person has | Check to use | Statutory excuse | Follow-up |
|---|---|---|---|
| A British passport | Manual (List A, current or expired) or a registered digital provider | Continuous | None |
| An Irish passport or passport card | Manual (List A, current or expired) or a registered digital provider | Continuous | None |
| No passport, but a UK birth certificate | Manual: the birth or adoption certificate plus an official document showing their permanent National Insurance number | Continuous | None |
| An eVisa with settled status or indefinite leave | Online share code check only | Continuous | None |
| EU Settlement Scheme pre-settled status | Online share code check | Lasts without a repeat check | None required |
| An eVisa with time-limited permission | Online share code check only | Until the permission expires | On or before the expiry date |
| Only an expired BRP | Online share code check; the card itself is not acceptable | As the online result shows | As the online result shows |
| A pending in-time application or appeal | Online check if they can get a share code, otherwise the ECS | Six months | Before the six months end |
| An Application Registration Card allowing work | ECS, for a Positive Verification Notice | Six months from the notice | Before the six months end |
One dropdown picks the check type and shows the manual, online, digital provider or ECS steps, nothing else. Each task carries its own instructions, so a hiring manager doing their first check follows the same route as HR.
Due dates count back from the start date. The HR confirmation is an approval task assigned to the approver picked at the start, and the checklist halts until it is approved, so nobody starts on an unchecked promise.
When permission is time-limited, the follow-up tasks fall due from the recorded expiry date. Copies are uploaded to the task they belong to, and the audit trail shows who checked what and when, which is the evidence the Home Office asks for.
The right to work check is one step between the offer and the first day. CheckFlow’s HR checklist software runs recruitment, onboarding, reviews and departures from templates, with assignments, due dates and approvals shared between HR and line managers.
Run the check alongside the Pre-Employment Background Check Checklist and the New Hire Preboarding Checklist, so the conditions of the offer are cleared before the start date.
Before the person starts work. A statutory excuse is only established if the prescribed check is completed before employment begins, so a check on the first morning is cutting it fine and a check in the first week is too late. Many employers make the job offer conditional on the check and run it as soon as the offer is accepted. Whatever stage you choose, check every candidate at that stage in the same way, including British citizens, so nobody is singled out.
No. The Home Office stopped issuing BRPs on 31 October 2024 and replaced them with eVisas. Looking at an expired BRP is not an acceptable check, and anyone with an eVisa can only prove their right to work through the Home Office online service. Ask for a right to work share code, which starts with W and lasts 90 days, then run the check yourself on the GOV.UK employer service with their date of birth. British and Irish citizens cannot get a share code, so use their passport, Irish passport card or another List A document instead.
Many do, from 1 October 2026. Section 48 of the Border Security, Asylum and Immigration Act 2025 extends the scheme to people engaged under a worker’s contract, individual sub-contractors and service providers found through online matching services. It also creates “extended liability” for some contractors in a supply chain, platforms and employers whose contracts allow substitution. The change is not retrospective: what counts is whether the arrangement was entered into on or after 1 October 2026. Genuinely independent businesses that contract directly with their own customers remain outside the scheme.
For as long as the person works for you and for two years afterwards, then destroy them securely. Keep a clear copy of each check, with a record of the date the check was made, and be able to produce it quickly if the Home Office asks. For online checks, keep the PDF or HTML profile page; for digital provider checks, keep the provider’s output and any facial comparison.
Without a statutory excuse, a civil penalty of up to £60,000 per illegal worker. Under the Home Office code of practice the starting point is £45,000 per worker for a first breach and £60,000 for a repeat breach within three years, reduced by £5,000 each for reporting the worker first and for co-operating with the investigation. Knowingly employing an illegal worker is also a criminal offence. A penalty can also affect your ability to sponsor migrant workers and to hold some licences, and penalised employers may be named on GOV.UK.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
