Right to work checks are a legal requirement for all UK employers. This guide explains what security companies must check, which documents and online checks to use, and how to avoid civil penalties of up to £45,000 per illegal worker for a first breach and up to £60,000 for a repeat breach.
Last reviewed: 18 October 2026. This guide is not legal advice; check the official sources linked below before acting.
Start with the current Home Office route
The Home Office employer guide is the controlling starting point. It explains when to use a manual document-based check, an online check or the Employer Checking Service. The route depends on the worker's circumstances and the evidence they can provide, so a process written around an old checklist can create risk.
The guidance changes. For example, the current guide says that expired physical Biometric Residence Permits are not acceptable proof of right to work. Teams should use the live Home Office guidance and any applicable professional advice when they make a check.
What a sound manual check involves
The Home Office code of practice describes three broad actions for a manual check: obtain original acceptable documents, check that they are genuine and relate to the person in front of you, then make and retain a clear copy with the date of the check. The record must be held securely for the period of employment and for two years after employment ends.
List B covers people with time-limited permission to work. Most now hold an eVisa, which an employer checks online with a share code. Physical Biometric Residence Permits expired on 31 December 2024 and cannot be used for a manual check. Where the Home Office online service cannot confirm status, for example while an application is pending, use the Employer Checking Service and keep the Positive Verification Notice.
When the online service is the right route
Some workers evidence their status through the Home Office online checking service. This is also how an employer checks people with an eVisa, including EU, EEA and Swiss nationals with status under the EU Settlement Scheme. The employer uses the person's share code and date of birth to view the record on GOV.UK. A screenshot or PDF supplied by the worker is not enough. Follow the current guidance for who must be checked online and for what evidence to retain.
Where someone has time-limited permission, a dated follow-up plan matters as much as the initial check. If a new application or appeal is pending, the relevant Home Office guidance explains the Employer Checking Service and Positive Verification Notice process. The employer remains responsible for acting on the result and for following the deadline that applies.
Common right-to-work failures to prevent
Most failures are process failures: accepting evidence that is no longer acceptable, checking a copy rather than the original where a manual route is used, overlooking whether the person is the document holder, keeping no dated evidence, or missing a time-limited follow-up check. The Government's civil-penalty guidance says the maximum penalty is £45,000 per illegal worker for a first breach and £60,000 for a repeat breach.
That figure is a reason to take the process seriously, not a reason to treat software as a legal shield. Whether an employer has established or retained a statutory excuse depends on the prescribed check, the evidence and the circumstances. The Home Office and, where needed, a qualified adviser decide how the rules apply.
What right-to-work check software for security companies should support
Right-to-work check software for security companies should help a workforce or vetting team organise what they need to do. In WFC Verify, teams can keep right-to-work and visa evidence with the employee's wider vetting and HR record, record completion dates, identify forthcoming review points and retain an audit trail of the workflow. That is more reliable than searching inboxes and spreadsheets when a contract manager asks for evidence.
WFC Verify does not decide whether a document is acceptable, make an immigration decision or guarantee a statutory excuse. It helps the responsible team stay organised around the route and dates they have confirmed against current Home Office guidance. WFC Control can then make relevant status or evidence visible to the operational team when they are reviewing a deployment decision, while the employment and vetting record remains a WFC Verify workflow.
A simple operating checklist
- Use the current Home Office guidance to choose the right checking route for the individual.
- Complete the check before work starts and make a clear, dated evidence record.
- Record any work restrictions and make sure the proposed role is compatible with them.
- Set follow-up actions for time-limited permission and complete them by the relevant deadline.
- Keep evidence securely, limit access and retain it only for the period required.
- Review the workflow when Government guidance, a contract requirement or the person's status changes.
Frequently asked questions
Does software give an employer a statutory excuse?
No. A statutory excuse depends on the employer carrying out the prescribed checks in the applicable Home Office guidance and keeping the required evidence. Software can support a consistent record and timely follow-up, but it cannot make the legal decision or guarantee the outcome.
When is a follow-up right-to-work check needed?
A follow-up check can be required where a worker has time-limited permission and the employer intends to continue employment after that permission ends. The employer should follow the current Home Office guidance and complete the relevant check on or before the applicable deadline.
Can an employer rely on an expired physical BRP?
No. The current Home Office employer guide says expired physical Biometric Residence Permits are not acceptable proof of right to work. Use the live guidance to identify the correct evidence and checking route.
What records should a security company keep?
For a manual check, the Home Office code of practice requires clear copies of the relevant documents and a secure record of the check date. Records must be held securely for the period of employment and for two years after employment ends. Teams should also retain the evidence required for an online or Employer Checking Service route.