UK right to work checks and the illegal working civil penalty

The Home Office issues a civil penalty of up to £45,000 per worker for a first breach and up to £60,000 for a repeat breach within three years. Those levels have applied since 13 February 2024. An employer who completed and recorded a compliant right to work check before the worker started holds a statutory excuse and pays nothing.

The penalty is calculated per worker, not per employer. A site inspection that finds six people without permission produces six penalties, and the arithmetic is what turns a documentation lapse into a six figure liability. Home Office figures published on 27 August 2026 recorded 677 penalties issued to employers in the second quarter of 2026, with a combined value of £42.0 million, the highest value quarter in the published series.

The check that creates the statutory excuse

The excuse comes from the check, not from the worker's status. Three routes are accepted under the Code of practice on preventing illegal working. A manual check requires the employer to see the original document, satisfy itself that the photograph and date of birth are consistent with the person present, and keep a dated copy for the duration of employment plus two years. A Home Office online check, used for anyone holding an eVisa or a biometric residence permit, produces a share code the employer enters to obtain a profile. A digital identity verification service, certified against the register maintained by the Office for Digital Identities and Attributes, covers British and Irish passport holders only.

Two timing rules do most of the damage when they are missed. The check must be completed before employment begins, not on the first day and not in the first week. Where permission is time limited, a follow up check must be completed before that permission expires, and the excuse lapses on the expiry date whether or not anyone noticed. Where a worker has an outstanding application or appeal and cannot produce evidence, the Employer Checking Service issues a Positive Verification Notice, which is valid for six months and must then be renewed.

What the penalty costs, and the windows that reduce it

The Immigration, Asylum and Nationality Act 2006 gives the Home Office the civil penalty power at section 15 and creates the separate criminal offence at section 21. The civil route is the one most employers meet, and it runs to a published timetable.

Two mitigating factors reduce the starting figure by up to £5,000 each: reporting the suspected illegal worker to the Home Office before an enforcement visit, and active cooperation with the investigation. Only two can be applied, so the floor for a first breach with full mitigation and fast payment is well below the headline number but still substantial. A sponsor licence holder faces a second consequence the penalty notice does not mention: a civil penalty is grounds for revocation, and revocation curtails the permission of every worker the licence supports. The sponsorship arithmetic behind that exposure is set out in what a UK sponsor licence costs.

What changes on 1 October 2026, and the failure mode behind most penalties

Section 48 of the Border Security, Asylum and Immigration Act 2025 widens the definition of an employer for illegal working purposes, and the change takes effect on 1 October 2026. The Home Office published the revised Code of practice on 30 June 2026 to accompany it.

The duty stops being limited to people on a contract of employment. From 1 October 2026 it reaches individual contractors engaged directly, workers supplied through agencies, and people taking work through online matching platforms. Each of those arrangements now needs its own statutory excuse, and in a subcontracted arrangement the checking obligation does not automatically sit with the party whose site the person works on. Construction and logistics operators with layered supply chains are the most exposed, because the head contractor may carry liability for a check performed, or not performed, three tiers down.

The practical work before October is an inventory rather than a policy. List every category of person who performs work for the business without being on payroll, name the party responsible for the check in each case, and put the evidence somewhere a Home Office officer can be shown it on the day of a visit. The equivalent verification duties across EU destinations, which follow a different directive but produce the same evidence burden, are described in right to work verification in the EU, and the chain of responsibility between employer, agency and subcontractor is covered in the employer sponsorship compliance chain.

The common case is not a forged document. It is a worker whose permission was valid at hire and expired during employment, on a file nobody was tracking. The original check was compliant, the excuse was real, and it ran out on a date that existed only in a scanned copy in a folder. The Home Office visits eighteen months later, the expiry date is on the copy in the employer's own file, and the employer has documented its own breach.

A single owner for expiry dates, a calendar entry set at ninety days before each one, and a follow up check recorded against the same file will prevent nearly every penalty of this type. Werklist keeps that register on the corridors it runs, and the division of responsibility between us and the employer as named sponsor is set out on our employers page.