Let's acknowledge something uncomfortable upfront: most HR teams are already aware they need to conduct right to work checks. The problem isn't knowledge — it's process.

Right to work checks fail at scale not because HR managers don't understand the requirement, but because the process is typically managed through a fragile combination of email reminders, shared drive folders, and individual memory. When a new team member joins and doesn't know about the informal system, or when a hiring manager extends a start date and forgets to chase the documents, or when someone on a time-limited visa has their leave extended and nobody tracks the new expiry date — these are the moments where compliance fails.

Your ATS is the logical place to make this process systematic rather than personal. The platforms that do this well have built right to work into the standard hiring workflow — triggered automatically, tracked through to completion, stored in the candidate record, and flagged when document expiry requires action. The platforms that don't require you to build that process manually, in parallel, with all the associated risk.

This guide covers what a compliant right to work process actually requires, what your ATS needs to support it, and which platforms handle it well versus which leave you to manage compliance yourself.

What the law actually requires

The statutory duty

The right to work checking requirement derives primarily from the Immigration, Asylum and Nationality Act 2006, as amended by the Immigration Act 2014 and the Immigration Act 2016. The core obligation is straightforward: UK employers must not employ a person who is disqualified from working by reason of their immigration status, and must conduct prescribed checks before employment begins to obtain a statutory excuse against civil penalties.

The statutory excuse matters enormously in practice. If you conduct a compliant check in good faith — following the Home Office prescribed procedure — and the employee subsequently turns out to have used fraudulent documents, you are protected from the civil penalty. If you fail to conduct the check at all, you have no statutory excuse regardless of the employee's actual status. The check is not just about catching illegal workers: it is about protecting your organisation from liability in all cases.

The timing requirement

Right to work checks must be completed before employment begins. Not at the point of offer. Not during the first week while the new starter is getting settled. Before the first day of work.

This is the single most common compliance gap in UK employer practice. Many organisations have a right to work process that is technically compliant in design but practically non-compliant in execution because it has been absorbed into onboarding rather than pre-employment. An ATS that treats right to work as part of the offer acceptance workflow — triggered when an offer is made and required to be completed before an employment start date is confirmed — enforces the correct timing automatically.

List A and List B documents

The Home Office publishes two lists of acceptable documents for manual right to work checks:

List A documents establish a permanent, ongoing right to work. Checking a List A document provides a statutory excuse for the duration of the employment — no follow-up checks are required. Examples include:

  • A UK or British Overseas Territories Citizens passport (or travel document showing the right of abode)
  • A biometric residence permit showing unlimited leave to remain or no time limit on stay
  • A UK birth or adoption certificate plus a National Insurance number-evidencing document
  • A current passport endorsed to show that the holder is exempt from immigration control
  • A certificate of registration or naturalisation as a British citizen plus a National Insurance number document

List B documents establish a time-limited right to work. They provide a statutory excuse only until the document's expiry date. Examples include:

  • A current passport or travel document endorsed to show the holder has limited leave to enter or remain in the UK
  • A biometric residence permit with limited leave to enter or remain
  • A document from the Home Office showing a positive Employer Checking Service (ECS) result
  • An Application Registration Card showing permission to work

For List B workers, the employer must conduct a follow-up check before the expiry of the current permission — and obtain a new statutory excuse. If no follow-up is conducted and the worker's permission expires, the employer is no longer protected by a statutory excuse even though the original check was compliant.

The online checking service

For certain categories of workers, the Home Office online checking service (now integrated into the UK Visas and Immigration service) must be used rather than accepting physical documents. This applies to:

  • Biometric residence permit holders
  • EU, EEA, and Swiss nationals who hold pre-settled or settled status under the EU Settlement Scheme (physical EU passports and national identity cards are not acceptable for these individuals)
  • Frontier worker permit holders
  • Any individual who provides a share code from the Home Office online portal

The employer accesses the online service using the worker's date of birth and their share code. The service produces a result confirming the right to work details. A screenshot or print of this result must be retained as evidence of the check.

Important: EU nationals post-Brexit

Since 1 July 2021, EU, EEA, and Swiss nationals can no longer rely on their EU passport or national identity card to prove their right to work in the UK for new employments. Employers must use the online checking service to verify their EU Settlement Scheme status (settled or pre-settled). Accepting a physical EU passport as evidence of right to work for a new starter who arrived after the Brexit transition is a compliance failure, even though it was valid before. Legacy check processes that weren't updated at this point represent an ongoing liability.

Document retention requirements

Copies of right to work documents (or evidence of the online check result) must be retained for the duration of the employment and for two years after the employment ends. The copy must be retained securely and, for physical documents, must be a clear copy of the original. The retention period is fixed — you cannot delete documents earlier simply because the employee has left and you no longer need them for the active employment relationship.

This retention requirement intersects with UK GDPR in an important way: you are required to retain these documents (legal obligation basis for processing), but you must also ensure they are securely stored and deleted at the end of the retention period. An ATS that supports both document retention with automated deletion at the correct point in time addresses both obligations simultaneously.

What your ATS must support

Would you be comfortable explaining your current right to work process to a Home Office compliance team? If the honest answer involves the phrase "we send an email and then..." — it's worth asking what would happen if that email chain was deleted, the relevant person left, or a start date was moved forward at the last minute.

A properly designed ATS right to work workflow addresses four distinct requirements:

1. Document request within the hiring workflow

Right to work document collection should be triggered automatically when an offer is made — not added manually to an onboarding checklist after the candidate has started. The ATS should generate a secure document request linked to the candidate's profile, with a clear instruction explaining what documents are acceptable and how to submit them (original document upload or share code provision for online checks).

The critical point: the start date should not be confirmed until the right to work check is complete. An ATS that makes employment start date confirmation contingent on completed right to work documentation enforces the legal timing requirement by design rather than relying on HR memory.

2. Secure document storage linked to the hiring record

Documents must be stored securely, with access controls limiting visibility to authorised HR personnel. They must be linked to the individual's hiring record so the complete employment history — application, assessment, offer, right to work check, employment start — is contained in a single auditable record. Storing documents in a separate shared drive breaks the audit trail and creates practical difficulties if you need to produce evidence quickly in a compliance audit.

UK GDPR applies to these stored documents: they contain personal data (including biometric data in many cases). Your ATS vendor should be able to confirm that document storage meets UK GDPR standards: encryption at rest and in transit, access logging, and data residency in UK or EEA-adequate jurisdictions.

3. Expiry date tracking with automated alerts

For List B workers, the employer must conduct a follow-up check before the current permission expires. Without a tracking system, this requirement depends entirely on someone remembering to check a spreadsheet or calendar — which is not a reliable compliance control.

Your ATS should record the expiry date of any time-limited right to work document and generate automated alerts to the relevant HR contact at a configurable period before expiry — typically 60–90 days in advance, allowing enough time to request documents and complete the follow-up check before the current permission lapses. If the follow-up check is not completed before expiry, the employer loses their statutory excuse for that worker, regardless of whether the original check was compliant.

4. Complete audit trail

In the event of a Home Office compliance audit, the employer needs to be able to produce evidence of: who conducted the check, when it was conducted (confirming it was before the employment start date), what documents were reviewed, and a copy of those documents. The audit trail must cover all current employees and all employees who have left within the previous two years.

An ATS that records the check details — date, document type, expiry date where applicable, who processed it — in an auditable, tamper-evident log provides this evidence immediately. An email chain does not.

Which ATS platforms handle right to work properly

Pinpoint — the strongest native UK right to work support

Pinpoint was built in the UK for the UK compliance environment, and right to work is one of its genuinely differentiating features. The platform includes document request workflows within the standard hiring process, secure document upload and storage linked to candidate records, expiry date tracking for time-limited right to work, and automated alerts before document expiry. The audit trail is clean and accessible.

For UK employers where right to work compliance is a high-frequency operational requirement — particularly those with a significant proportion of international hires — Pinpoint's native support removes a meaningful amount of process overhead and compliance risk. It is the platform most specifically designed for this requirement.

Treegarden — configurable document collection with GDPR-native storage

Treegarden supports document collection as part of the hiring pipeline, with secure, GDPR-compliant storage built in as a foundational capability rather than an add-on. The pipeline is fully configurable, allowing UK employers to build a dedicated right to work checkpoint into every hiring process — triggered at the offer stage, with document upload required before start date confirmation.

The GDPR-native design is particularly relevant here: documents uploaded as part of right to work are stored with the same data protection standards as all candidate data — encrypted, access-controlled, with configurable retention periods. The combination of document collection workflow, secure storage, and GDPR compliance tooling makes Treegarden a strong option for UK employers who want right to work managed within their ATS rather than in a parallel process.

Teamtailor — partial support, good for straightforward UK national hiring

Teamtailor supports document collection via its custom fields and file upload capability. For UK employers hiring predominantly UK nationals with List A documents (passports, birth certificates), this is workable: the document can be requested, uploaded, and stored within the platform. The gap is expiry date tracking — Teamtailor does not have a dedicated right to work expiry alert system. For organisations with a significant proportion of List B workers (visa holders), this requires a separate tracking mechanism.

Workable — document request without full compliance workflow

Workable allows document requests and collection but does not have a fully integrated right to work workflow. Documents can be collected and stored, but expiry date tracking and automated compliance alerts are not native features. For UK employers hiring significant numbers of visa holders, Workable requires manual supplementation for the List B renewal tracking requirement.

US-built platforms — manual workarounds required

Greenhouse, Lever, and Ashby do not natively support UK right to work checks. These platforms can store documents (via custom fields or integrations with background check providers such as Zinc, Onfido, or Veremark), but the right to work workflow itself is manual. For UK tech companies using these platforms, the typical approach is to run right to work through a separate HR system or background check provider, with documents stored outside the ATS. This creates a fragmented compliance record and requires ongoing coordination between systems.

This is not a disqualifying limitation for large UK companies with dedicated TA and HR operations teams who can manage parallel processes. But for organisations where HR resource is limited, or where the ATS is the single system of record for hiring, it is a meaningful operational gap.

Beyond the initial check: what good ongoing compliance looks like

Follow-up checks for List B workers

The follow-up check requirement for List B workers is where compliance most commonly fails after the initial hire. The original check was completed (it was in the process). But 12 months later, when a Tier 2 visa holder's permission approaches expiry, nobody in the current HR team remembers who's on a time-limited permission, when their documents expire, or what the process is for the follow-up check.

This is an entirely predictable failure mode. The only reliable solution is a system that tracks expiry dates and generates reminders automatically — removing the requirement for human memory to maintain compliance over multi-year employment periods. An ATS with this capability is not a luxury for UK employers with international workforces: it is a compliance necessity.

Handling the online share code process

For EU Settlement Scheme holders and biometric residence permit holders, the check must be conducted online using the worker's share code. An ATS should support the online check workflow: the candidate provides their share code and date of birth, the employer accesses the Home Office checking service, and the result is captured and stored in the hiring record.

The practical challenge is that this check cannot be fully automated — the employer must actively access the Home Office portal and record the result. What the ATS can do is: remind the HR team that an online check (rather than document collection) is required for this candidate type, provide a clear record that the check was completed and when, and store the share code evidence in the candidate record.

Data retention and deletion

Right to work documents must be retained for two years after employment ends — and then deleted in accordance with UK GDPR. An ATS that supports automated deletion at the end of the retention period addresses both requirements simultaneously. Without this, organisations accumulate years of right to work documents with no systematic deletion — creating both a GDPR risk (holding data longer than necessary without justification) and an operational burden when the organisation wants to conduct a data audit.

Practical checklist: what to ask ATS vendors about right to work

When evaluating an ATS for UK right to work compliance, ask vendors to specifically demonstrate or confirm: (1) Where in the hiring workflow is document collection triggered — is it configurable to the offer stage? (2) How are time-limited document expiry dates tracked — is there an automated alert system? (3) How are documents stored — encryption, access controls, data residency? (4) Is there an audit trail showing who conducted which check and when? (5) Does the platform support the online checking service workflow for share code verifications? (6) What is the automated deletion timeline for right to work documents after employment ends?

The cost of getting it wrong

Let's be direct about the risk profile here, because it tends to be underweighted in HR team conversations about ATS selection.

A single £20,000 civil penalty is more expensive than several years of even the most comprehensive ATS subscription. The civil penalties are per illegal worker — not per employer — meaning a company that hires multiple people without right to work checks can face penalties running into the hundreds of thousands of pounds. Criminal prosecution is possible where the employer knew or had reasonable cause to believe the worker lacked permission.

The reputational consequences compound the financial ones: Home Office civil penalty notices are a matter of public record, and they are reportable by journalists. A named civil penalty can affect supplier relationships, client contracts, and employer brand in ways that are difficult to quantify but very real.

Against that backdrop, the question to ask when evaluating an ATS is not "does this platform technically support document collection?" but "does this platform make right to work compliance automatic and auditable, or does it require my team to remember to do it correctly every single time?" The answer to that question has a direct bearing on your organisation's compliance risk.

Transparent pricing — no demo required to see the numbers

Startup: $299/mo · Growth: $499/mo · Scale: $899/mo. All features included. GDPR-native from day one.

View full pricing →

Frequently asked questions

When must I complete a right to work check?

Right to work checks must be completed before employment begins — not at the point of offer, and not during the first week of work. The legal requirement under the Immigration, Asylum and Nationality Act 2006 is clear: the check must precede the start of employment. Conducting the check after the employee has started working does not provide a statutory excuse if the employee is later found not to have the right to work. This timing requirement is frequently misapplied when right to work is treated as an onboarding task rather than a pre-employment gate. An ATS that makes employment start date confirmation contingent on a completed right to work check enforces the correct timing automatically.

What documents are acceptable for right to work in the UK?

The Home Office publishes two lists of acceptable documents. List A documents confirm permanent, unlimited right to work (e.g. UK passport, biometric residence permit with no time limit, birth certificate plus National Insurance evidence). Checking a List A document provides a statutory excuse for the duration of employment. List B documents confirm time-limited right to work (e.g. current visa endorsement, biometric residence permit with limited leave). Checking a List B document provides a statutory excuse until the document's expiry, after which a follow-up check is required. EU nationals who arrived under the EU Settlement Scheme must be checked using the Home Office online service — their physical EU passport or national identity card is no longer acceptable for new employments commenced after 30 June 2021.

Does my ATS need to store right to work documents?

You are legally required to retain copies of right to work evidence for the duration of employment plus two years. Whether you store them in your ATS, a separate HRIS, a secure shared drive, or physical files is your choice — but an ATS that handles storage creates a single, auditable record linked to each hire. The compliance advantage is significant: a Home Office audit can be responded to immediately with a complete, structured record rather than a search through archived email threads. For time-limited right to work, the ATS should also track expiry dates and generate automated alerts, which is only possible if the document data is held within a system that can run scheduled checks against expiry dates.

What happens if I hire someone without completing a right to work check?

Failing to conduct a compliant right to work check removes your statutory excuse and exposes your organisation to a civil penalty of up to £20,000 per illegal worker, regardless of whether the worker turns out to have legitimate status. Where the employer knew or had reasonable cause to believe the worker lacked permission to work, criminal prosecution under section 21 of the Immigration, Asylum and Nationality Act 2006 is possible, with potential unlimited fines and up to five years' imprisonment for the relevant individuals. Conducting a compliant check in good faith — even where fraudulent documents are subsequently discovered — provides a statutory excuse against these consequences. The check is fundamentally about protecting the organisation, not just identifying illegal workers.

Related Reading