Right to Work Checks in 2026: What UK Recruitment Agencies Must Get Right
Getting a Right to Work check wrong can cost an agency a civil penalty running into tens of thousands of pounds per worker — and the rules now span manual checks, digital identity verification, and Home Office online share codes. This guide explains the three check types, when each applies, where liability actually sits, and how your CRM should track status and document expiry so nothing slips.
Right to Work (RTW) checks are the compliance obligation with the sharpest teeth. Get one wrong — or skip it — and your agency can face a civil penalty that now runs to tens of thousands of pounds per illegal worker, plus the reputational damage and, in serious cases, criminal exposure. Yet the rules are more fragmented than many recruiters realise, spanning three different check methods that each apply in different situations.
This is a plain-English guide to getting RTW right at agency scale in 2026. As always: this is practical guidance, not legal advice — for a definitive position on a specific case, take proper advice.
The three types of Right to Work check
There is no longer a single way to check. Which method you use depends on the worker's documents and status.
1. Manual document check
The traditional route: you obtain the worker's original acceptable documents, check them in the worker's presence, confirm they are genuine and belong to that person, and keep a clear copy with the date of the check recorded. This still applies for certain document holders, but it has narrowed as digital routes have expanded.
2. Digital identity check (IDVT)
For valid holders of in-date documents, checks can be carried out through certified Identity Document Validation Technology via an Identity Service Provider. This lets the identity verification happen digitally rather than face-to-face, which is well suited to remote and volume hiring.
3. Home Office online check (share code)
Many workers — particularly those with status held digitally rather than in a physical document — evidence their right to work by giving you a share code, which you enter alongside their date of birth on the Home Office online service. It returns their current status. For a growing share of the workforce, this is the only valid method; a physical document check would not be acceptable.
The point most agencies miss: the statutory excuse
The reason to do RTW checks correctly is not just to tick a box — it is to obtain a statutory excuse. If you carry out a compliant check in the prescribed manner *before* the worker starts, and retain the right evidence, you have a defence against a civil penalty even if the worker later turns out not to have the right to work. Do the check wrong, late, or not at all, and you lose that protection entirely.
Where liability sits in the agency chain
In temporary supply, the worker is typically the agency's worker, so the responsibility for the RTW check generally sits with the employment business supplying them — not the end hirer. That means the check is *your* obligation and *your* liability. This is often misunderstood, with each party assuming the other has handled it. Clarity on who checks, documented, is essential.
Follow-up checks and expiry
For workers with time-limited permission, an initial check is not the end of it. You must carry out a follow-up check before their permission expires to maintain your statutory excuse. This is where manual tracking falls apart: a spreadsheet of expiry dates that nobody is watching is a penalty waiting to happen. Every time-limited worker is a diary entry you cannot afford to miss.
What your CRM should do
- Record the RTW check type, date, and outcome against every worker as structured data — not a note.
- Store the evidence (document copy or online check result) linked to the worker, retained for the required period.
- Track document and permission expiry dates and flag follow-up checks *before* they fall due, not after.
- Surface, at a glance, who has a valid check and who is approaching expiry across your whole workforce.
The takeaway
RTW is not the place to rely on memory or a shared spreadsheet. The check is your liability, the statutory excuse depends on doing it correctly and on time, and time-limited workers need active expiry tracking. Software that records the check, stores the evidence, and chases expiry before it bites is the difference between a defensible position and an avoidable penalty. Pair this with our guides to Reg 15/17 and UK GDPR for the full UK compliance picture.