How do right to work checks work for recruitment agencies in 2026?
The party with the direct contract with the individual is responsible for the right to work check, and for an agency supplying agency workers that is the employment business. There are three prescribed routes: the Home Office online share code check, a check through a registered digital verification provider, and a manual check of original documents. A correct check made before work starts gives a statutory excuse against a civil penalty of up to £60,000 per illegal worker. From 1 October 2026 the scheme also covers workers on worker's contracts and individual sub-contractors.
Written by the Vayora team. Updated 28 October 2026.
Right to work law is built around the employer. The Immigration, Asylum and Nationality Act 2006 makes it a civil offence to employ someone who is not allowed to do the work, and gives the employer a defence if it ran the prescribed check in the prescribed way before the person started. That defence is called the statutory excuse. It is the thing you are buying with every check, so the details matter.
For a permanent placement the client is the employer. Your agency screens, and it is sensible to record what you have seen, but the Home Office is clear that an employer cannot rely on a check done by an external third party such as a recruitment agency, apart from a check carried out through a registered digital verification provider. The client still checks before the start date. For agency workers supplied on temporary or contract assignments, the employment business that engages them is the employer for the scheme, and the check is yours.
The scheme widened on 1 October 2026. The Home Office Employer's guide dated 1 October 2026 explains that section 48 of the Border Security, Asylum and Immigration Act 2025 brings in people engaged under a worker's contract and individual sub-contractors, and adds a form of extended liability along contractual chains. The commencement regulations bring section 48 into force on 1 October 2026.
This page sets out who checks, the three routes, how long to keep what, when to check again and what the penalties are. It describes the rules; it does not decide your particular arrangements. Where the Home Office says the answer depends on the facts, so does this page.
Who has to carry out the check: the client, the agency or the umbrella company?
The guide puts responsibility on whoever holds the direct contractual relationship with the individual. A hotel that employs a receptionist checks the receptionist. An employment business that engages a worker on a contract for services and sends them to hospitality assignments is that worker's employer for the scheme, and it is responsible for the check. The guide uses exactly that example.
For agency supply into the hirer's own business, the position is stated plainly in the guide's FAQ. The employment business remains responsible, and in a standard agency supply arrangement the changes are not intended to require the hirer to duplicate the check. The guide gives two examples of workers supplied to a manufacturer and to a food producer where the extended liability rules do not apply and responsibility stays with the employment business.
An umbrella company that employs the worker holds the direct contract, so on the guide's logic the duty sits with it. The guide does not use an umbrella company as an example, and the agency's own position in a chain can turn on the extended liability rules, so treat that as the point to ask for advice. For permanent placements the client checks, as above. If you also supply a service rather than individuals, read the guide's section on extended liability before you assume the answer.
What changed on 1 October 2026?
Section 48 of the Border Security, Asylum and Immigration Act 2025 changes the meaning of employer for the right to work provisions. Employing an individual now includes engaging them under a worker's contract, engaging an individual sub-contractor, and, for online matching services, providing the details of a service provider to a client. Those engagements are checked in the same way as employees.
The same section adds extended liability. In short, a person who is under a contract to provide work or services to a third party, and who contracts with another employer to supply the workers to fulfil it, can be treated as employing the individuals who do the work. To keep a statutory excuse against that liability the contractual arrangements must meet prescribed requirements.
There is a start-date rule. For worker's contracts and individual sub-contractors a civil penalty can only be imposed where the engagement began on or after 1 October 2026, and the prescribed contract requirements apply to arrangements entered into on or after that date. The guide says the measures are not intended to be retrospective.
What are the three ways to check right to work?
The employer may choose the route, subject to who the individual is. People whose status is held digitally, such as eVisa holders, are checked through the Home Office online service. The table sets the three routes next to each other, with the Employer Checking Service as the fallback for people with an outstanding in-time application.
Whichever route you use, the check must happen before work starts, the person in front of you must match the photograph, and any work restrictions must fit the job. The employer stays responsible for the quality of the check even when a provider performs it.
| Route | Who it applies to | What you keep | When to re-check |
|---|---|---|---|
| Home Office online check with a share code | People who can generate a share code from their Home Office account, including eVisa holders | A PDF or HTML copy of the profile page, showing the photograph and the date of the check | On or before the date permission ends if it is time-limited. No re-check for settled status |
| Registered digital verification provider | British and Irish passport holders, and other documents the provider can verify digitally | The provider's output and any facial comparison, in a form that cannot be altered | Only if the person has time-limited permission to work |
| Manual document check | People who present acceptable original documents from the Home Office lists | A clear copy of each document, with a dated record that the check was made | Before time-limited permission expires |
| Employer Checking Service notice | People with an outstanding in-time application or appeal | The Positive Verification Notice | Before the six months the notice covers run out |
What does a manual, online or provider check involve?
In a manual check you see the original documents in the person's presence, check they are genuine and belong to the holder, check expiry dates and work restrictions, copy each document and record the date. The guide says not to rely on inspecting a document over a video link or from a screenshot or scan. A date scribbled on the copy is not enough. Use the Home Office wording, which records the date the check was made.
In the online check the individual generates a share code from their Home Office account. The code is nine characters starting with W and valid for 90 calendar days. You enter it with their date of birth, confirm that the photograph on the result is the person, and keep a copy of the profile page.
A check through a digital verification provider must use a provider registered on the Office for Digital Identities and Attributes register and able to carry out right to work checks. The guide refers to these as registered RtW DVSPs, which is what the market used to call an IDSP. They can check British and Irish passports and other documents available in digital form, and can provide facial recognition. You still own the outcome: if the check was not done to the prescribed standard, you have no statutory excuse.
When do you have to check again?
Follow-up checks apply to people with time-limited permission to work. You must re-check on or before the date their permission ends if you intend to keep employing them. The follow-up does not have to use the same route as the first check. Your excuse depends on having made the initial check before they started and any required follow-up checks after.
If the first check showed settled status or status under the EU Settlement Scheme, the guide says no follow-up is needed. If you relied on a Positive Verification Notice from the Employer Checking Service, the excuse runs for six months from the notice, and the follow-up must be done before that expires. Diary every end date at the time of the first check, because nothing else will remind you.
What are the penalties, and what should you keep?
An employer who has not carried out the prescribed checks may face a civil penalty of up to £60,000 per illegal worker. In serious cases the guide lists a criminal conviction carrying up to five years in prison and an unlimited fine, closure of the business and a compliance order, director disqualification, loss of the ability to sponsor migrants, and seizure of earnings. The criminal offence applies where the employer knows, or has reasonable cause to believe, that the person is an illegal worker. If you know, no check gives you an excuse.
Keep the evidence for the whole engagement and for two years afterwards, then destroy it securely. That applies to the manual copies and dated record, the online profile page and the provider's output. Be able to produce the file quickly if asked. The Home Office also publishes a separate code on avoiding unlawful discrimination, and the discipline is to check everyone the same way, including British citizens, rather than only people who seem to need it.
- The dated copy or output for every check, held for the engagement plus two years.
- A diary entry for every permission end date, with the follow-up route noted.
- Any facial comparison, kept alongside the document or output.
- Notes on who performed the check and how, so you can show the process was followed.
Does this reach limited company contractors?
The guide says its provisions do not apply to individuals running an independent business, in their own name or through their own company, who contract directly with the client. Its example is a graphic designer working through a personal service company: the client company does not need to check.
The guide is just as clear that this is no blanket exclusion. Calling someone a contractor, freelancer or consultant, or using a personal service company, does not decide the question, and a contract between two companies does not by itself take an arrangement out of scope. The Home Office asks you to look at substance: who engages and supplies the individuals, who is contractually responsible, whether substitution is allowed and how it works in practice. For a contractor placed through your agency, take advice on your particular structure, and check what your clients require in their contracts. See also the existing answer on PSC versus umbrella for how the engagement route changes who carries the paperwork.
Where Vayora fits
Vayora is software, not legal advice. It does not carry out a right to work check. It has no share code entry, no connection to the Home Office service or a digital verification provider, and no expiry tracking or follow-up reminder for time-limited permission.
What it does hold is the record around the check. Each candidate has a right to work status (UK citizen, EU settled or pre-settled, visa holder, sponsorship required or unknown) with a notes field, and a contractor can update their own status in the contractor portal. Roles can state a right to work requirement, and matching flags a candidate who needs sponsorship against a role that offers none. You can attach your dated evidence to the candidate record as a file, next to the notes of who checked and when. See the right to work check glossary entry and the platform page, or start a free trial and see how the record looks.
Common questions
- Does an agency have to do right to work checks for permanent placements?
- The client is the employer for a permanent placement, so the client must do its own check before the start date. The Home Office says an employer cannot rely on a check done by an external third party such as a recruitment agency, apart from one carried out through a registered digital verification provider. Agencies still screen and record what they have seen, but that is not the client's excuse.
- Do right to work checks apply to contractors from 1 October 2026?
- From 1 October 2026 the scheme covers people engaged under a worker's contract and individual sub-contractors. A contractor working through their own company and contracting directly with the client is outside the guide, but it says there is no blanket exclusion for personal service companies. Substance decides, so check your structure and your client's contract terms.
- How long must we keep right to work evidence?
- The Home Office guide says to keep a copy of each document, the online profile page or the digital provider's output for the duration of the engagement and for two years afterwards, then destroy it securely. For manual checks the copy needs a dated record of when the check was made. Keep it somewhere you can produce quickly if you are asked.
- What is the penalty for employing someone without the right to work?
- An employer who has not done the prescribed checks may face a civil penalty of up to £60,000 per illegal worker. In serious cases there can be a criminal conviction, with up to five years in prison and an unlimited fine, as well as closure orders and director disqualification. A correct check before the start date gives a statutory excuse against the civil penalty.
- Can I use a digital provider instead of checking myself?
- Yes. Using a digital verification service is optional, but if you use one it must be registered on the Office for Digital Identities and Attributes register and able to do right to work checks. It can verify British and Irish passports and other documents in digital form. You remain responsible for the check, so the provider's output must meet the prescribed standard.