Expansion of UK Right to Work Rules, Part 3: Digital Verification, Identity Matching and Onboarding

The expansion of the UK right to work regime from 1 October 2026 will be accompanied by changes to how employers use digital verification services and confirm that the person presenting for work is the individual whose right to work has been checked. While the principal checking methods will remain familiar, the draft guidance places greater emphasis on identity matching, imposter prevention, registered digital providers and auditable onboarding processes.

This is the final LawFlash in our three-part series on the expanded right to work framework.

THE THREE CHECKING METHODS

A direct employer must carry out one of the following prescribed checks before the individual starts work:

• A manual document-based right to work check;
• A Home Office online right to work check; or
• A check using a registered Right to Work Digital Verification Service Provider.

The appropriate method will depend on the individual’s nationality, immigration status and the evidence available.

Employers should provide individuals with a reasonable opportunity to demonstrate their right to work and should not operate their checking processes in a discriminatory manner.

Manual Right to Work Checks

A manual right to work check requires the employer to obtain an original document or combination of documents from the relevant Home Office list.

The employer must

• obtain the original document;
• check that it is genuine;
• confirm that the individual presenting it is the person shown in the document;
• check any expiry dates and work restrictions;
• make and date a clear copy; and
• retain the copy securely for the duration of the employment and for two years afterwards.

The original document must ordinarily be physically held by the employer when the check is conducted. The individual may be present in person or by live video link, but the employer cannot generally conduct a compliant manual check using only a scan, screenshot or video image of the document.

One exception relates to official digital evidence of the individual’s name and permanent National Insurance number where that evidence forms part of an acceptable document combination.

The employer should confirm that the digital evidence appears genuine and comes from a reliable government source.

Home Office Online Checks

Individuals with an eVisa will normally demonstrate their right to work through the Home Office online service.

The individual must generate a right to work share code. These codes begin with “W” and are valid for 90 calendar days.

The employer must access the employer-facing right to work service and enter the share code and the individual’s date of birth.

It is not sufficient to

• view the information shown to the individual in their own UK Visas and Immigration account;
• accept a screenshot produced by the individual; or
• rely on a printed copy supplied by the individual.

The employer should also ensure that the correct employer or business name is entered in full when the online check is conducted.

Once the result is obtained, the employer must check that

• the photograph is of the individual presenting for work;
• the individual is permitted to perform the proposed role;
• any restrictions are observed; and
• the employment does not continue beyond the period for which the statutory excuse is valid without a follow-up check.

A PDF or HTML copy of the profile page should be retained for the duration of employment and for two years afterwards.

RtW DVSPs

The draft code of practice on preventing illegal working (draft Code) updates the terminology from Digital Verification Service Provider, or DVSP, to Right to Work Digital Verification Service Provider, or RtW DVSP. Under the current employer guide to conducting right to work checks, DVSP checks are limited to valid British and Irish passports and Irish passport cards.

From 1 October, when an employer chooses to use a digital verification provider to conduct right to work checks, it must use a RtW DVSP registered on the Office for Digital Identities and Attributes register with a note confirming that the provider can carry out right to work checks. It will not be mandatory to use a RtW DVSP where another prescribed checking method is available.

Under the draft Code, a RtW DVSP may be able to verify:

• Valid British or Irish passports, including Irish passport cards, up to six months after expiry;
• Certain digital versions of acceptable List A and List B documents where provided by or on behalf of a government department, initially limited to official evidence of a worker’s name and National Insurance number issued by a government agency; and
• Facial recognition checks to assist employers in confirming that the worker is the same individual in respect of whom a right to work check has been carried out.

The draft Code puts renewed emphasis on the need to verify that the individual presenting for work is the same individual whose right to work has been checked.

For a manual right to work check, employers must continue to obtain acceptable original documents, check that the documents are genuine and confirm that the individual presenting them is the prospective worker. The check can be done in person or by video link. The employer must compare the photograph and biographical details, such as date of birth, across the documents and against the individual’s appearance.

For a Home Office online right to work check, employers must use the official Home Office online service with the individual’s share code and check that the photograph on the online right to work profile is of the individual in question. This can be done in person or by video call.

For an RtW DVSP check, the provider will carry out the digital verification, but the employer remains responsible for satisfying that the photograph and biographical details in the check output are consistent with the individual who is presenting for work.

The new practical point is that if an employer wishes to conduct this identity-matching step digitally using facial recognition technology the draft Code says this must be done through an RtW DVSP.

Where facial recognition technology is used, the RtW DVSP should provide a comparison verifying the image on the document or online check against the individual. The employer must retain that comparison securely alongside the right to work check evidence. The employer must also give the individual a reasonable opportunity to verify their identity if the technology cannot verify the images.

This does not mean facial recognition technology will be mandatory in all cases, but for employers operating high-volume, remote or decentralised onboarding processes the draft Code is a clear signal that the Home Office expects robust imposter-check controls and an auditable process.

Services will differ between providers, and employers should confirm precisely which checks a provider is authorised and technically able to undertake.

FACIAL RECOGNITION AND IDENTITY MATCHING

The draft framework places renewed emphasis on confirming that the person doing the work is the individual whose immigration status was checked.

For manual and online checks, the employer may continue to make that comparison in person or by live video call.

Where the employer wishes to use facial recognition technology to carry out the comparison digitally, the technology must be provided through a registered RtW DVSP.

The provider should supply evidence comparing the facial image in the relevant document or online right to work output and the facial image of the worker.

The employer must retain that comparison with the underlying right to work record.

The worker should also be given a reasonable alternative opportunity to verify their identity where the technology cannot confirm a match. Employers should ensure that digital processes do not disadvantage individuals unable or unwilling to use facial recognition.

IMPERSONATION AND FRAUD

A technically valid immigration status check will not protect an employer where it is reasonably apparent that the person presenting for work is not the person shown in the check.

Employers should therefore consider proportionate controls to manage the risk of impersonation:

• Retaining a photograph for later comparison
• Checking identity at induction
• Linking right to work records to workplace passes
• Using access-control systems
• Checking identity when a worker changes assignment
• Escalating unexplained discrepancies

Where an employer becomes the victim of deliberate fraud despite having completed the prescribed check and maintaining appropriate controls, the Home Office may take those circumstances into account.

FOLLOW-UP CHECKS

Where a worker has time-limited permission, the employer must complete a follow-up check before the statutory excuse expires.

If the worker has made an in-time immigration application and cannot immediately demonstrate their continuing right to work, the employer may in some circumstances benefit from a temporary 28-day extension while obtaining verification.

This 28-day period applies to qualifying follow-up checks. It does not allow a new worker to start employment where no initial statutory excuse has been established.

The employer may need to

• conduct a further online check;
• obtain a positive verification notice from the Employer Checking Service; or
• review updated acceptable documents.

A positive verification notice will generally provide a statutory excuse for six months.

If a negative verification notice is received, the employer’s statutory excuse will end and it should not continue to employ the individual without resolving the position.

EMPLOYER CHECKING SERVICE

The Employer Checking Service should be used in defined circumstances, including where

• an individual has a pending in-time application but cannot generate a share code;
• there is a technical problem with the individual’s digital status;
• the individual holds certain evidence connected with the EU Settlement Scheme;
• the individual has immigration status issued by a Crown Dependency; or
• the individual presents information indicating that they are a long-term UK resident who arrived before 1988 but cannot provide acceptable documents.

The Employer Checking Service aims to respond within five working days of a valid request.

ACTIONS EMPLOYERS CAN TAKE NOW

Employers should begin preparing now, especially where they use outsourced labour, agency workers, subcontractors, consultants, gig workers or contractor arrangements with substitution rights.

Recommended actions include the following:

• Map the workforce and labour supply chain. Identify all categories of labour used by the business, including employees, workers, consultants, contractors, individual subcontractors, agency workers, supplier-provided labour, platform workers, substitutes and sponsored workers.
• Classify working arrangements. Distinguish direct employment, worker’s contracts, individual subcontracting, online matching arrangements, substitution arrangements, traditional business-to-business service contracts and genuinely self-employed arrangements.
• Identify in-scope arrangements under the expanded regime. Prioritise arrangements that involve personal service, labour supply chains, online platforms, subcontracted services or contractual substitution rights.
• Review right to work policies and onboarding processes. Update policies to be capable of capturing in-scope non-employee populations from 1 October 2026. Ensure checks are completed before work starts and that follow-up checks are diarised where permission is time-limited.
• Review supplier, subcontractor and platform agreements. Add or update right to work obligations, restrictions on further subcontracting, flow-down requirements, audit rights, cooperation obligations, information-sharing provisions, and remedies such as suspension or termination where illegal working is identified.
• Tighten substitution clauses. Consider whether substitution rights are needed. Where they are retained, introduce a pre-approval process so that no substitute can start work until the required right to work check and identity verification steps have been completed.
• Assess identity verification controls. Review whether site access systems, attendance records, identity passes, training records, licence checks, or biometric or facial verification tools are sufficient to confirm that the person doing the work is the person who has been checked.
• Audit RtW DVSP arrangements. Confirm whether existing or prospective providers will be registered as RtW DVSPs and whether the Office for Digital Identities and Attributes register note confirms right to work capability. Update vendor contracts and due diligence processes accordingly.
• Ensure adequate records are retained. Ensure the business can promptly produce right to work records, RtW DVSP outputs, supplier contractual terms, audit evidence, substitution approvals, identity verification records and escalation records if requested by the Home Office.
• Train relevant teams. Training should cover HR, legal, procurement, operations, site access, contract management and hiring managers. Teams should understand when checks are required, who is responsible, how evidence must be retained and when issues should be escalated.
• Monitor further updates. Employers should monitor for the final code of practice and the updated employer guide, as further practical guidance and examples are expected before implementation.

LOOKING AHEAD

The October 2026 changes represent a shift from an employee-focused right to work regime to a broader workforce and supply-chain compliance framework. Employers with complex labour models, subcontracted services, online platforms or substitution arrangements should not wait for the final employer guide before starting preparations.

Early action will help employers identify which populations may be in scope, update contractual protections, test operational identity controls and ensure that evidence can be produced promptly if the Home Office investigates suspected illegal working.

FURTHER GUIDANCE

For a deeper discussion of these issues, please join us on 10 September for our webinar Expansion of UK Right to Work Regime: Understanding the Changes, where we will explore the practical implications of the changes and the steps employers should take now to prepare.

For additional information on the expansion of right to work, see the first two LawFlashes in this series on the Current Position and Changes from 1 October and Establishing a Statutory Excuse Against Extended Liability.