Right to work checks are a familiar part of recruitment, but the rules changed on 1st October 2026. The changes affect more than the way employers verify identity. They also widen the range of working arrangements covered by the scheme, bringing some contractors, subcontractors and platform-based work into scope.
This guide explains what changed, which organisations may now have new responsibilities, how the three recognised checking methods work and what employers and workers need to know. It also covers digital verification, fair treatment and the practical steps organisations should take.
The three ways to check someone’s right to work
The employer checks permitted original documents, follows the official steps and keeps the required records.
The employer checks the person’s details on GOV.UK, usually using a share code. This is required for people with an eVisa.
The employer uses a service that is approved and registered to carry out this type of right to work check.
What changed on 1st October 2026?
The expanded scheme: who may now be in scope?
The rules can apply to organisations engaging people under employment contracts, certain worker’s contracts, individual subcontracting arrangements and organisations operating online matching services that introduce individual service providers to customers. The exact legal test depends on the contract and the way the work is arranged.
The 1st October changes widen the types of working arrangements covered by right to work checks, as well as setting requirements for private digital services used in the checking process. The organisation responsible for a check may not always be the direct employer. An ordinary identity-checking app is not automatically suitable for a compliant digital check.
The three recognised checking methods remain available: a manual document-based check, a Home Office online check or a check using a registered Right to Work Digital Verification Service Provider (RtW DVSP). Digital verification is not compulsory for everyone. Employers must not insist that all applicants use one particular method, except where the Home Office rules require an online check for someone with an eVisa.
The formal term is Right to Work Digital Verification Service Provider, shortened to RtW DVSP. Providers must be registered with the Office for Digital Identities and Attributes (OfDIA) for right to work checks. Employers should check the provider’s registration rather than assume that any identity app is suitable.
Who is responsible for carrying out the check?
For a straightforward employment relationship, the employer normally carries out the check before the person starts work. The expanded rules also address arrangements where work is supplied through another organisation, subcontracted or arranged through an online matching service.
Worker’s contract
A contract for an individual to perform work or services personally, where the other party is not simply a customer or client of the individual’s own business or profession.
Individual subcontractor
An individual engaged to provide work or services through a chain of contracts, where the business has contracted with another party to provide or arrange the work.
Online matching service
An organisation operating a service that provides details of an individual service provider to potential clients or customers may also have responsibilities under the scheme.
What is extended liability?
In certain supply-chain and platform arrangements, a business may face civil penalty liability even where it does not directly employ the individual. The law sets out when this extended liability applies and the steps that may establish a statutory excuse against a penalty.
Depending on the arrangement, these steps can include making sure the required written contractual terms are in place before work begins, checking any substitute before they start, having effective controls to prevent unauthorised substitution and taking proportionate steps to confirm that the person doing the work is the person whose right to work was checked.
This is not a blanket requirement for every organisation that buys services from another business. The detailed conditions matter. Businesses using agencies, subcontractors, outsourced service providers or online platforms should review the Home Office guide and obtain specialist advice where the contractual chain is unclear.
What is a digital right to work check?
A digital right to work check uses technology to check identity information electronically rather than relying only on a person showing physical documents. Depending on the service and the person’s circumstances, it can check information from a passport or other permitted records and give the employer a report of the result.
The service must be registered and approved for right to work checks. Before using one, an employer should check its entry on the official government register. A service being able to scan an ID or recognise a face does not, by itself, mean it can be used for a right to work check.
The employer still has to follow the Home Office’s instructions, check that the person presenting themselves for the job matches the identity that was checked, and keep the required records.
What is the difference between a digital checking service and the Home Office online check?
They are different services. This matters because an employer cannot simply swap one for the other in every situation.
The Home Office online check
This is the official GOV.UK service where an employer checks a person’s right to work information held by the Home Office. The person usually gives the employer a share code, which lets the employer view the relevant information online.
Employers must use this service to check someone with an eVisa, which is a digital record of their immigration status. The online result shows whether the person can work and whether any limits apply to the work they can do.
A registered digital checking service
This is a separate service that checks identity information digitally for the right to work process. It can be used for certain people, including holders of British or Irish passports and Irish passport cards, if the service and the check meet the rules.
Some services can also use facial recognition technology to help check that the person is the same person shown in the identity record. This is not a requirement for every worker, and employers must still follow the official process.
Checking documents in person
An employer can still check permitted original documents in person. They must follow the official instructions, make sure the documents belong to the person presenting them, check for any relevant restrictions, and keep clear copies and a record of when the check took place.
A photo or scan of an ordinary physical document is not normally a replacement for the required original-document check. The rules do allow specific kinds of digital evidence, but only when the relevant requirements are met.
What is the Employer Checking Service?
The Employer Checking Service is a Home Office service for specific situations where an employer cannot confirm someone’s right to work through the usual checks. For example, a person may have an immigration application still being considered, or there may be another reason the Home Office needs to confirm their position.
If the service confirms that the person can work, the employer may receive a Positive Verification Notice. In plain English, this is written confirmation from the Home Office that the employer can rely on for the relevant check. It is not a general replacement for the normal checking methods.
Which documents can a digital checking service use?
One important change is that a registered digital checking service can use certain expired passports for a digital check.
The service can use a British passport, an Irish passport or an Irish passport card. If the document has expired, it must have expired no more than six months before the check. The service must also complete the required security checks, so the rule does not mean every expired passport will be accepted.
Registered services may also be able to check other permitted documents when the organisation that issued the document makes the relevant information available digitally. What a service can check will depend on the documents it supports and the rules it has been approved to follow.
Important: this allowance applies to checks through a registered service that meets the rules. It does not mean you can upload an expired passport to any app or website and assume the right to work has been confirmed.
Can employers still check physical documents?
Yes. Checking permitted original documents remains one of the recognised methods.
The employer must follow the official steps for the documents being checked, make sure the person and documents match, and keep the required copies and records. A photo or scan of a physical document does not normally count as a completed manual check on its own.
If an employer already uses manual checks correctly, the October changes do not automatically mean they must move to a private digital service.
Can an employer make everyone use a digital check?
No. The Home Office guidance says employers must not insist that every person uses one particular method to prove their right to work. They should give people a reasonable opportunity to provide the required evidence and offer another permitted method where appropriate.
This matters if someone cannot use a digital service, does not have access to the technology needed, or does not want to use a private digital service. The employer should consider another valid route, such as checking permitted documents in person where the rules allow it.
Facial recognition is not compulsory for every worker either. It is one technology that may be used as part of an approved checking process.
What employers should do now
If you recruit staff or manage right to work checks, review your process against the rules now in force.
- List the methods you use. Make sure your team knows when to check documents, when to use the Home Office online service and when a registered digital checking service may be suitable.
- Check your digital provider. If you use a private service, check its entry on the official government register and make sure it is approved for right to work checks.
- Keep eVisa checks separate. Staff should know that an eVisa must be checked through the Home Office online service.
- Update your instructions. Explain the steps for each checking method and what records must be kept.
- Keep records securely. Follow the Home Office rules on what evidence to save, how to store it and how long to keep it. In general, records must be kept for the person’s employment and for two years after it ends, then securely destroyed.
- Train the staff who carry out checks. They should know what to do if a share code is unavailable or a person cannot use a digital service.
- Treat applicants fairly. Do not decide who to check based on someone’s appearance, accent, name or perceived nationality. Offer a permitted alternative where someone cannot use a particular digital method.
For most people applying for work, the main message is simple: these changes do not mean everyone needs a new digital identity or a share code. The method used depends on their circumstances.
If you are a British or Irish citizen, you cannot use a Home Office share code to prove your right to work. An employer can check permitted documents or, where suitable, use a registered digital checking service.
If you have an eVisa, your employer must use the Home Office online service. If you cannot get a share code or access your account, explain this to the employer so they can follow the correct process.
An employer may also need to check that the person attending work is the same person whose identity was checked. This is part of making sure someone else is not using another person’s details.
What if an employer gets the check wrong?
Employers can face a financial penalty if they employ someone who is not allowed to work and have not carried out the required checks. Following the official process can give an employer a legal defence against that penalty if a worker is later found not to have permission to work. The legal term for this protection is a statutory excuse.
Using a digital provider does not remove the employer’s responsibility. Employers should check that the provider is approved for the right to work service, review the result, make sure it relates to the person they are employing and keep the required evidence.
For an online check, employers must keep the relevant result from the Home Office service. For a manual check, they must keep clear copies of the documents and a record of the date. The Home Office guidance explains exactly what must be kept for each method.
Last checked: 1st November 2026.
This article explains the UK right to work rules in general terms. It is not legal, immigration or HR advice. Employers should follow the latest Home Office guidance for the person and situation they are checking.
Related changes
Employment Rights Changes 2026 →
Explore wider changes to employment rights and what they mean for workers and employers.
Employment Tribunal Time Limits 2026 →
Read about the announced changes to the time limits for bringing employment tribunal claims.
Sexual Harassment at Work 2026 →
Find out about employer responsibilities and workplace protections.