Right to work checks are one of those legal requirements that businesses sometimes treat as a formality. They are not a formality. Getting them wrong exposes the employer to civil penalties of up to £60,000 per illegal worker — and the rules around how checks must be carried out have continued to evolve, with significant changes already in 2025 and more coming later in 2026.
When you use an EOR, the EOR carries out the right to work check as part of onboarding, because the EOR is the legal employer. But that doesn’t mean you’re completely insulated from the consequences if something goes wrong. This guide explains how the checks work in 2026, what the EOR does, and where your own responsibility sits.
Recommended Employer of Record
The legal framework
Under the Immigration, Asylum and Nationality Act 2006, UK employers must check that every employee has the right to work in the UK before they start. The check must happen before the first day of work — there is no grace period and no exceptions for urgent hiring needs.
Doing the check correctly, in the way the Home Office prescribes, gives the employer a “statutory excuse” — a legal defence against civil penalties if it later turns out the worker didn’t have valid permission to work. If you carry out the check and unknowingly accept a document that looked genuine but was fraudulent, the statutory excuse generally holds. If you don’t carry out the check at all, the statutory excuse doesn’t exist, and the penalty applies regardless of whether you knew the person was working illegally.
Civil penalties were raised to £60,000 per illegal worker in 2024. Criminal penalties for knowingly employing illegal workers include unlimited fines and prison sentences.
The three check methods in 2026
There are three recognised ways to conduct a compliant check. Using the wrong method — even if the documents look entirely legitimate — does not establish the statutory excuse.
Online share code check. This is now the mandatory method for anyone holding digital immigration status. That covers most skilled worker visa holders, students, people with EU Settlement Scheme status, and almost all other migrants whose status has been converted to an eVisa. The individual generates a share code through the Home Office’s online service; the employer accesses the result through the official portal. The check shows current immigration status, what work the person is permitted to do, and whether their permission has an end date requiring a follow-up check.
Manual document check. For British and Irish citizens without a valid passport, who can’t use the online service, a manual check of original documents is required. The employer must inspect the documents in person or via live video, verify photographs and dates of birth are consistent, and retain a copy with the date of the check recorded.
Digital identity verification (DVS). For British and Irish citizens with a valid British or Irish passport, employers can use a certified Identity Service Provider under the Digital Verification Services framework. The employer must use a certified provider, obtain the check output, and retain it securely. DVS can only be used for British and Irish passport holders — it doesn’t cover anyone else.
The 2025 Home Office guidance removed the temporary COVID-era adjusted check rules. All checks must now follow one of these three methods. There’s no flexibility on this.
Who carries the responsibility when using an EOR?
The EOR carries the primary legal responsibility for conducting the check — because the EOR is the legal employer. The check happens as part of the EOR’s onboarding process. The EOR retains the records.
But you’re not completely off the hook. If you direct someone to start work before the EOR has completed the check — because the hire is urgent, or because you assumed it could happen after the start date — work is being performed without the legal basis to permit it. That exposure sits with you as the directing party, regardless of the EOR structure.
The practical rule: don’t tell a new hire to start until the EOR has confirmed the right to work check is done. Build this into your own onboarding process as a firm step, not an assumption.
It’s also worth asking your EOR which check method they use for different categories of employee, and whether they have a process for follow-up checks when a worker has time-limited permission to work. Failing to conduct a follow-up check when a visa expires removes the statutory excuse for that period onwards — and that failure rests with the legal employer, which is the EOR.
eVisas and the shift to digital
Since January 2025, most migrants no longer receive physical immigration documents. Their status exists as a digital record, accessible via the share code system. A Biometric Residence Permit (BRP) is no longer the document to ask for.
This means that for the majority of non-British, non-Irish workers, the only compliant check method is the online share code. An employer who asks to see a physical BRP for an eVisa holder and accepts it as evidence of right to work hasn’t conducted a compliant check — and therefore hasn’t established a statutory excuse.
For EOR providers, this is a process point: their onboarding workflows need to correctly identify whether the employee holds digital immigration status (requiring a share code) or is a British or Irish citizen (where a manual or DVS check applies). Most established providers have updated their systems accordingly. Worth confirming if you’re hiring non-UK nationals.
Expanded obligations coming later in 2026
On 30 March 2025, the Home Secretary announced that the right to work obligation will extend beyond employees to cover gig economy and zero-hours workers. Currently, the legal duty applies only to workers engaged under a contract of employment. The extension is expected under the Border Security, Asylum and Immigration Act 2025, with implementation anticipated from October 2026.
This doesn’t directly affect businesses using EORs to hire employees. But it’s part of a broader tightening of the right to work compliance framework that’s worth tracking, particularly if your business also engages casual or flexible workers outside the EOR structure.
Keeping records
Right to work records must be kept for the duration of employment plus two years after it ends. The Home Office may request records during enforcement visits.
When you use an EOR, the EOR holds these records. If you transition to your own entity, or switch EOR providers, confirm that right to work records transfer to you or are retained by the outgoing EOR for the required period. Don’t assume it happens automatically.
What it costs if you get it wrong
The £60,000 figure is a maximum. The Home Office operates a scale based on mitigating and aggravating factors. Mitigation: the employer conducted some checks (even imperfectly), reported the issue voluntarily, has no prior history. Aggravation: below minimum wage was paid, the employer was a repeat offender, there were deliberate breaches.
An administrative error — using an IDSP that turned out not to be certified, or missing a follow-up check — is different from wilful non-compliance. But it’s still expensive. And the direction of travel is toward higher penalties and more enforcement activity, not less. Using an EOR reduces the risk of right to work compliance failures by embedding the checks in a professional onboarding process. It doesn’t eliminate the risk entirely — particularly if you’re rushing start dates, hiring workers with complex immigration statuses, or haven’t verified that your EOR is using the right check method. Those gaps are yours to close.
For an introduction to EORs, read our guide to EOR services and our shortlist of the ten best EORs for UK businesses.
