Right to work check: the employer duty, the penalty, and when the statutory excuse is lost

A right to work check is the employer's pre-employment control against employing someone who has no permission to do the work. It is a continuous, per-hire duty — completed before employment begins, and repeated before time-limited permission expires. The civil penalty falls on the employer, per illegal worker.

What is a right to work check?

It is the employer's own verification, carried out before someone starts, that the individual is permitted to do the work in question. Section 15(1) of the Immigration, Asylum and Nationality Act 2006 makes it contrary to that section to employ an adult subject to immigration control in any of four situations: the person has no leave to enter or remain; their leave is invalid; their leave has ceased to have effect; or their leave is subject to a condition preventing the employment.

That fourth limb is the one most often missed. Someone can hold entirely valid, in-date permission and still be a person you cannot lawfully employ, because their permission carries a condition — a work prohibition, an hours cap, a restriction on the type of work — that the job in front of them would breach. Valid leave is not the same thing as permission to do this job.

The check is not a filing and there is no return to submit. Nothing is sent to the Home Office in the ordinary course of getting it right. It is a control the employer operates, evidences and retains.

Which employers must check right to work?

Every employer, before employing any individual — including an employer with no staff yet. The duty bites at the point of recruitment, which is precisely the moment a business is least likely to think of itself as an employer with obligations.

Scope reaches wider than "employees" in the narrow contractual sense, and the boundary matters:

• A company with employees under contracts of employment is plainly within scope.
• A company engaging workers who are not employees — casual, zero-hours, and other arrangements short of a contract of employment — is also within scope.
• A company that has neither, but is currently recruiting or about to engage someone, is within scope too. This is the case that catches new businesses: the duty is live before the first hire exists, because the check has to happen before employment begins.

A company with no staff, no workers and no recruitment under way has nothing to do here. Every other configuration does.

When must the right to work check be done?

Before employment begins. There is no grace period, no window that opens after the start date, and nothing that can be regularised afterwards.

This is a continuous duty rather than a calendar deadline. Nothing falls due on a fixed date, there is no periodic return, and no reminder can be generated from company data alone — the obligation is discharged per hire and then repeated, before the expiry of any time-limited permission to work.

That gives an employer two distinct triggers to manage: the pre-employment check for every new individual, and a repeat check keyed to each individual's own expiry date. Neither is company-level. Both are person-level, which is why this cannot be run off an annual compliance calendar.

What are the prescribed check methods for the statutory excuse?

Section 15(3)'s excuse is established by complying with "any prescribed requirements" — set out in the Immigration (Restrictions on Employment) Order 2007 (SI 2007/3290), made under section 15(7). The Order prescribes three routes to the excuse, not one, and every route runs to the same clock: the document must be produced, or the check completed, before employment begins. A check done after the employee starts does not establish the excuse, however carefully it is carried out.

The manual document check, at article 3, is the route most employers picture, and it comes with seven conduct-and-record steps at article 6: take reasonable steps to check the document's validity and record the date checked; retain the copy securely; confirm any photograph is of the employee; confirm any date of birth is consistent with their appearance; take reasonable steps to confirm they are the document's rightful holder; if the document is not a passport, keep a clear copy of the whole document in an unalterable format; and if it is a passport, keep copies of the pages showing personal details, photograph, signature, expiry date, and any page evidencing permission to enter, remain and do the work in question. Where the employee is a student subject to term-time hour limits, one further step applies: obtain and retain the course's term and vacation dates.

The other two prescribed routes — the online check and the identity-verification check — carry their own conditions, covered next.

What documents are acceptable for a right to work check?

Which list a document sits on decides how long the excuse lasts, not just whether the document is accepted. A list A document gives an excuse that is not time-limited by the Order. A list B part 1 document excuses only for the period the document itself permits. A list B part 2 document gives no excuse at all on its own — it needs a Positive Verification Notice from the Home Office Employer Checking Service, and even then the excuse runs for six months only.

The list B part 1 period can be extended: where the employer reasonably believes an application to vary leave, or an appeal or administrative review, is outstanding, the excuse continues for a further period ending 28 days later, or earlier if the Home Office gives written notice. The list B part 2 excuse runs for six months beginning with the date of the Positive Verification Notice, whether the notice stands alone or accompanies a document.

Are the online check and the identity-verification check prescribed by law?

Yes — both are in the Order itself, not layered on afterwards as guidance. The online right to work check sits at article 4B; the identity-verification check (IDVT) at article 3A. Content elsewhere commonly treats both as informal options; the Order treats them as routes to the same statutory excuse as a manual document check.

On the online route, the employer uses the Home Office's online right to work checking service, the check confirms the employee may do the work in question, the employer confirms the photograph shown is of the employee, and retains a clear copy of the check for not less than two years after the employment ends. The excuse runs for the period the check confirms, or, where the right to work depends on a pending application, appeal or administrative review, for six months beginning with the date of the check — extendable by the same 28-day mechanism as the list B part 1 route.

On the identity-verification route, the employer obtains a check from an IDVT identity service provider, receives an unalterable copy of the check and the document checked, reasonably believes the provider complied with its own article 6A(1) verification steps, and meets its own article 6A(2) conditions. This route reaches exactly three unexpired documents: a British passport, an Irish passport, or an Irish passport card. The card is a distinct document in its own right, not a variant of the passport — stating the route as covering "British and Irish passports" silently drops the document it also allows.

How long must right to work check records be kept?

Three separate retention rules apply, on three separate provisions, and they do not share one clock.

The floor: copies from the document and online routes must be kept for not less than two years after the employment has come to an end.

The ceiling — scoped, not universal: those same copies also cannot be kept for longer than necessary to ensure compliance with the article 6 requirements. This ceiling reaches the document and online routes — articles 3, 4, 4A and 4B — and no others. It is not a general retention limit, and older summaries citing the Order's 2007 as-made text misstate this scope: the as-made wording capped only articles 3 and 4; the current wording, reaching articles 4A and 4B too, was substituted in by a later amendment (SI 2018/1340).

The identity-verification route sits outside that ceiling altogether. Its own retention duty is a floor only: keep the check and the document checked for not less than two years after the employment ends. Article 7 does not reach that route, so the Order imposes no ceiling on it — a statement about the scope of this Order, and not a general permission to keep the records for as long as you like.

What is the civil penalty for illegal working?

A civil penalty per illegal worker, imposed by notice, with a statutory maximum of £60,000.

The Act itself fixes no figure. Section 15(2) empowers the Secretary of State to require payment of "a penalty of a specified amount not exceeding the prescribed maximum" — so the Act creates the liability and delegates the number.

The prescribed maximum sits in the Immigration (Employment of Adults Subject to Immigration Control) (Maximum Penalty) Order 2008. It was raised to £60,000 from £20,000 by an amending Order made on 23 January 2024, which came into force on the twenty-first day after it was made — 13 February 2024.

The increase is not retrospective. It applies only to contraventions occurring after commencement, so a contravention wholly before 13 February 2024 remains subject to the previous £20,000 maximum. The date of the contravention, not the date of the enforcement action, decides which ceiling applies.

Note the multiplier: the penalty is per illegal worker. Four workers is four penalties, not one penalty covering four.

Is the penalty higher for a repeat breach?

There is no repeat-breach tier in the Order. It sets a single maximum of £60,000 and draws no distinction whatever between a first breach and a subsequent one.

This is worth stating flatly, because a tiered first-breach/repeat-breach structure is routinely reported as though the legislation contained one. It does not.

Where does the £45,000 figure come from?

From the Home Office civil penalty code of practice, not from the Order. The widely quoted "£45,000 for a first breach" is a starting point governing how the Secretary of State exercises discretion within the statutory maximum.

It is a policy figure operating inside a £60,000 statutory ceiling — not a separate legal tier, and not something the legislation says. Quoting it as statute misdescribes both the amount and its authority.

What is the objection and appeal route against a penalty notice?

An employer can object to a penalty notice, then appeal — never appeal without objecting first. The objection window is 28 days beginning with the date the notice is given; a further 28-day appeal window follows if the objection does not resolve things in the employer's favour.

Objection: the grounds are that the employer is not liable, that it is excused under section 15(3), or that the amount is too high. The notice of objection must go to the Secretary of State in writing, before the end of the 28-day period, and it must contain seven specified things: the penalty notice's reference number; the employer's name and contact address; the employee's name and contact address; the full grounds of objection; ability-to-pay details, where instalments are requested; confirmation and details of any court appeal already made; and any documents relied on. The Secretary of State must then cancel, reduce, increase, or take no action, and tell the objector within a further 28 days (or a longer period agreed with the objector).

Appeal: available only once the employer has objected and the Secretary of State has responded, or failed to respond within that further 28-day period. The appeal goes to the county court (England and Wales, or Northern Ireland) or the sheriff (Scotland), within 28 days of the relevant date, on the same three grounds as the objection.

All three windows use the same day-count class — a "period beginning with" the relevant date, which counts that date as day 1. A 28-day period beginning with the date the notice is given therefore expires 27 days after that date, not 28. Separately, the penalty notice itself must give the employer at least 28 days to pay.

What is the statutory excuse, and when is it lost?

Section 15(3) provides the escape: the employer avoids the penalty where it "complied with any prescribed requirements in relation to the employment". A correctly conducted check is what establishes that excuse.

Two consequences follow, and both matter.

First, the excuse operates on the penalty, not on the underlying prohibition. Section 15(1) is still contravened; what the excuse does is stop the civil penalty attaching.

Second, and decisively: the excuse is unavailable where the employer knew, during the employment, that it was contravening the section. Knowledge destroys it outright. A checking process cannot be operated as paperwork over a problem the employer already knows about — the excuse protects an employer who checked properly and was misled, not one who checked properly and then carried on regardless.

Do right to work checks need repeating?

Yes, wherever permission to work is time-limited. The repeat check falls due before that permission expires.

For an individual with unlimited permission there is no repeat trigger in the duty, though the initial pre-employment check still applies in full. For everyone else, the repeat dates are driven by individual expiry dates spread across the workforce — which is exactly why this duty is a standing control rather than an annual item, and why the tracking problem it creates is a per-person one.

What changed recently?

The penalty maximum tripled. The 2024 amending Order substituted £60,000 for £20,000 with effect from 13 February 2024, and the change does not reach backwards.

The duty itself — section 15(1) and the section 15(3) excuse — is untouched by that Order. What changed is the exposure, not the obligation.

What happens if you do not check?

The employer becomes liable to the civil penalty per illegal worker with no excuse available, because the excuse in section 15(3) depends on having complied with the prescribed requirements in the first place. An employer who never checked has nothing to point at.

The liability attaches to the employer as a business, even though the subject matter concerns individuals. That is why this sits among the company's obligations rather than any one person's, and why the exposure scales with headcount.

Related

• Sponsor licence duties and compliance — the overlapping duty set for licensed sponsors
• Written statement of employment particulars — the other day-one employment obligation
• Employers' liability compulsory insurance — triggered the moment you become an employer
• Pillar hub: UK employer compliance obligations (placeholder)
• Companies House deadline checker — start with your company's filing deadlines, then layer on employment duties