Right-to-Work Checks UK 2026: How ATS Software Handles Them

Failing a UK Right-to-Work (RTW) check carries a civil penalty of up to £45,000 per illegal worker for a first breach (Home Office, raised from £15,000 with effect from 13 February 2024) and up to £60,000 per worker for repeat breaches, plus potential criminal liability for knowingly employing someone without permission to work. A correct check, completed before employment starts and properly retained, gives you a "statutory excuse", which is the legal defence that protects you from the penalty even if the worker later turns out to be unauthorised. UK SMBs need that workflow embedded in their ATS, not run as a manual side-process where evidence drifts and follow-ups get missed.

This guide covers the three RTW check methods in 2026 (manual, online via Home Office share code, and digital identity verification using IDVT for British and Irish nationals), how UK ATS platforms automate each, exactly what evidence the Home Office expects you to retain, what to do if a check is missed, and the arithmetic of automating the whole thing. Every figure here is drawn from the Home Office Employer's guide to right to work checks (the version in force is dated 26 June 2025) and the statutory Code of practice on preventing illegal working.

The three RTW check methods (UK 2026)

There is no single "right to work check". The method depends on the candidate's nationality and whether they hold their status digitally (an eVisa) or on a physical document. The Home Office has been phasing out physical immigration documents in favour of eVisas through 2025, so for a growing share of candidates the online share code route is now the default rather than the exception.

1. Manual document check. For candidates who still hold acceptable physical documents (for example a British or Irish passport, or an older biometric residence permit not yet migrated to an eVisa). You inspect original List A or List B documents in the candidate's presence, either face to face or over a live video call while you hold the originals, then take and securely retain a clear copy and record the date. A copy alone, without sight of the original or the person, does not establish a statutory excuse.

2. Online check via Home Office share code. For most non-British and non-Irish nationals with digital status, and for anyone with an outstanding, in-time application who is an eVisa holder. The candidate generates a share code at gov.uk/prove-right-to-work (the code is valid for 90 days) and the employer verifies it at gov.uk/view-right-to-work, checking that the photo on the profile matches the person. You retain the online "profile" page that confirms the right to work.

3. Digital identity verification (IDVT). For British and Irish nationals who hold a valid passport (including Irish passport cards). A certified Identity Service Provider (IDSP) uses Identity Document Validation Technology (IDVT) to verify the passport and match it to the person remotely. This route has been available since 6 April 2022. It is optional, not mandatory, and the Home Office maintains the public list of certified providers.

How a compliant check runs, step by step

Whichever method applies, the Home Office expects the same three-step pattern: obtain the right evidence, check it against the person, and copy and retain it. The detail differs by route.

1. Obtain. For a manual check, ask the candidate for original documents from List A (continuous right to work) or List B (time-limited right to work). For an online check, ask for a share code and their date of birth. For IDVT, the IDSP collects the passport image and a likeness check.
2. Check. Confirm the documents are genuine and unchanged, that photographs and dates of birth are consistent across documents and match the person in front of you (or on the live video call, or on the online profile), and that any work restrictions are compatible with the role. For online checks, the gov.uk service confirms the right to work and the conditions attached to it.
3. Copy and retain. Take a clear copy that cannot be altered, record the date the check was made, and keep it securely. For online and IDVT checks, retain the confirmation profile or report. The check must be completed before the person starts work.

The single most common failure is timing: the statutory excuse only exists if the check was done before employment began. A check carried out after the start date, however thorough, does not retrospectively create a defence.

What ATS software does for each method

Treegarden's RTW workflow: the candidate pipeline includes a mandatory RTW stage that must be cleared before an "offer accepted" record can transition to "employee". The recruiter uploads the document image and records sight of the original (manual), enters the share code and the verified online result (online), or initiates an IDVT check via an integrated certified partner such as Yoti, Onfido or TrustID. Each check is timestamped, attributed to the named staff member who performed it, and held against a retention clock that runs for the duration of employment plus two years, as the Home Office requires, after which it is flagged for secure deletion. List B checks raise an automatic follow-up task before the statutory excuse expires.

What Reach ATS does: RTW capture is configurable per workflow; manual and IDVT are both supported via partner integration, though retention and follow-up timers depend on how the workflow is set up.

What BambooHR does: document storage only, with no native UK RTW workflow, so the before-start-date gate, the List B follow-up and the retention clock are a manual workaround.

What Workable does: a document upload field is available, but there is no built-in UK RTW logic to enforce the statutory excuse conditions.

List A, List B and the follow-up trap

The difference between List A and List B decides whether you ever have to check that person again, and it is where time-limited workers slip through.

List A documents show a continuous right to work (for example a British or Irish passport, or proof of settled or pre-settled status that is not time limited for these purposes). A correct List A check gives you a statutory excuse for the entire duration of that person's employment, with no follow-up required.

List B documents show a time-limited right to work. A correct List B check gives you a statutory excuse only until the permission expires, and for some categories, such as someone with an outstanding in-time application verified online, the excuse lasts six months and must then be renewed. You must carry out a follow-up check on or before the date the permission or excuse ends; miss it, and the statutory excuse lapses even though you did everything right at hire. This is exactly the kind of dated, conditional task that belongs in software rather than a diary.

Retention rules under Home Office guidance

You must retain RTW evidence securely for the duration of employment and for two years after the person stops working for you, after which the copy must be securely destroyed. To stand up in an audit, the retained record needs to show, at a minimum:

• a clear copy of the document, share code online profile, or IDVT report, in a format that cannot be manually altered;
• the date on which the check was made;
• who carried out the check (name, and for digital routes the verifying identity), so responsibility is traceable;
• clear evidence the check was completed before employment started;
• for List B, the date of the next required follow-up check.

ATS platforms with built-in retention timers (Treegarden, Reach) hold this metadata against each record and surface it on demand. Loose folder systems (a shared Google Drive, a spreadsheet of dates) tend to drift: the copy is there but the date is not, or the follow-up was never diarised. In practice that drift, rather than deliberate non-compliance, is the most common reason a UK SMB fails to produce a statutory excuse when the Home Office asks.

Common RTW mistakes UK SMBs make

• Verifying after the start date (illegal: must be before)
• Not retaining the verification image/share code
• Manual List B follow-ups missed (List B documents have an expiry; you must re-verify)
• Trusting a candidate's word on visa status
• Skipping the check for 'temporary' or 'contractor' workers (still required)
• Failing to verify in-person for a remote worker (live video is acceptable; entirely document-based without seeing the person isn't)

What the £45k penalty actually looks like

Penalties are issued per illegal worker, not per employer, so the exposure scales with how many people slipped through. A UK SMB with one missed RTW check faces up to £45,000 for a first breach and up to £60,000 per worker for a repeat breach within three years. This is not theoretical: in the quarter covering 1 April to 30 June 2025, the Home Office reported 548 civil penalties issued, 712 illegal workers identified, and a gross penalty value of over £28 million across a single three-month window.

There is a route to reduce or challenge a penalty. The notice explains a Faster Payment Option giving a 30% reduction if you pay in full within 21 days, and you can object in writing within 28 days, for example if you were not the employer, if you can evidence a proper check, or if the amount is wrong. Importantly, objecting before the deadline does not forfeit the faster-payment discount. But the cleanest defence remains the one you build before hiring: a completed, retained check.

The reputational side is harder to price. The Home Office publishes quarterly reports naming employers who have exhausted their objection and appeal rights, with the business name, address and penalty value; that information is routinely picked up by local and trade press and can affect tenders, financing and customer trust long after the fine is paid.

Against that, an automated ATS RTW workflow at SMB scale costs £235 to £710 per month on Treegarden's published GBP plans. One avoided £45,000 penalty pays for several years of the platform, before counting the management time saved on follow-ups and audit retrieval. The arithmetic favours building the check into the hiring system.

Frequently asked questions