The Government’s plan to introduce a national Digital ID scheme to confirm identity and immigration status has drawn widespread interest. For many employers, the idea of a single digital credential that could instantly verify an individual’s right to work appears to offer long-awaited simplicity.

However, while Digital ID could modernise how identity verification is carried out, it will not alter the fundamental legal duty placed on employers. Every business in the UK must ensure that each person it employs or engages has permission to work here. The penalties for failure have risen sharply, and with fines currently now reaching £60,000 per illegal worker, employers must prioritise compliance within the current system, not wait for digital reform.

The current legal framework

Right to work (RTW) checks sit at the heart of the UK’s immigration enforcement strategy. Under the Immigration, Asylum and Nationality Act 2006, all employers are required to confirm the legal status of every worker before employment begins.

When the employer follows one of the Home Office’s prescribed methods correctly, it gains what is known as the statutory excuse – a complete legal defence against civil penalties if the worker is later found not to have permission to work. But the defence only exists if the check has been completed in line with official guidance and evidence has been retained. Failure to follow the prescribed steps, or to keep proof, means the protection is lost.

The Home Office’s updated Code of Practice on Preventing Illegal Working, in force since February 2024, tripled the penalty levels. Criminal prosecution remains possible for serious or deliberate breaches, and the Government has stated that inspection and penalty activity has risen in recent years. Compliance is therefore a live issue, not a procedural nicety.

How right to work checks must be conducted

Carrying out a lawful RTW check is a defined process, not a matter of common sense.

For British and Irish citizens without an e-passport, a manual check must be completed. The employer must see the original document, typically a passport or birth certificate, in the individual’s presence, confirm it appears genuine and relates to the person, and retain a dated copy.

For most non-UK nationals, the process is digital. The worker logs into the Home Office’s “Prove your right to work” service, generates a share code, and provides it to the employer together with their date of birth. The employer then uses the “View a job applicant’s right to work” service to access the official record, checks that the photograph matches the person, and saves the profile page securely.

Employers may also use Identity Service Providers (IDSPs) to perform digital checks for British or Irish passport holders. These services can improve speed and accuracy, but the legal liability remains with the employer. The verification output must be reviewed, the likeness confirmed, and the report kept as evidence.

If an individual has a pending visa application, appeal or administrative review, the Employer Checking Service (ECS) is the only lawful route. The ECS may issue a Positive Verification Notice valid for six months, which functions as proof of permission to work for that period. Without such a notice, employment is unlawful.

Why employers still get it wrong

Most breaches arise not from deliberate evasion but from operational weaknesses. In sectors with high staff turnover, checks are rushed or postponed, and key records go missing. Employers often assume that a National Insurance number proves status (it does not), or that an external agency has taken responsibility for verification. Delegation is frequently misunderstood. Even when a third party performs the check, the legal duty remains with the hiring business.

In larger organisations, inconsistency is a recurring problem. HR teams may design robust processes, but local managers apply them unevenly. The Home Office takes a clear position: if a compliant check cannot be evidenced, it is treated as if it never took place. For sponsor licence holders, the stakes are even higher, as any breach can lead to suspension or revocation of the licence and immediate disruption to recruitment.

The compliance landscape after the 2024 reforms

The 2024 Code of Practice marked a turning point in the Home Office’s enforcement approach. Penalties for employing a person without permission increased from £20,000 to £60,000 per worker for repeat offences, and from £15,000 to £45,000 for a first breach.

These figures illustrate the Government’s intent to make non-compliance commercially painful. The reputational damage of being named in enforcement reports can last even longer than the financial impact. For regulated sectors, or businesses bidding for public-sector contracts, any published finding of illegal working may threaten wider professional standing.

The cumulative effect is that RTW compliance must now be treated as part of corporate governance and risk management, rather than a stand-alone HR procedure.

Digital ID

The proposed Digital ID system forms part of the UK’s Digital Verification Framework, which aims to create secure, interoperable credentials that individuals can use to prove identity and status across multiple services. In principle, this could make verification faster and more reliable, reducing the administrative burden of document inspection and the risk of forgery.

For employers, the potential advantages are obvious – instant verification, improved accuracy, and a uniform process across immigration categories. But Digital ID will not displace the employer’s duty to carry out checks correctly or to retain proof. During a lengthy transition, some workers will present Digital IDs while others will rely on existing methods, requiring employers to operate dual systems.

Managing that overlap introduces new risks. Employers must ensure equal treatment for individuals who do not yet hold a Digital ID, to avoid discriminatory hiring practices. Data protection and cybersecurity obligations will also intensify as more personal information flows through digital platforms. Any convenience achieved through automation must still comply with the UK GDPR’s principles of lawfulness, fairness and security.

Strengthening systems today

Rather than waiting for the digital transition, employers should strengthen their RTW controls now. Best practice includes:

• Comprehensive policy review, ensuring internal procedures mirror the latest Home Office guidance and that evidence retention is mandatory.
• Training and awareness – all staff involved in recruitment should understand the legal significance of each check.
• Internal audits – periodic reviews confirm that records are complete, legible, and accessible in the event of inspection.
• Clear accountability – each check should be linked to a named responsible person; assumptions are where breaches occur.
• Secure record-keeping – centralised HR systems should flag visa expiry dates and automate reminders for follow-up checks.

For sponsor licence holders, these measures are not optional. The Home Office expects proactive oversight, and poor record-keeping remains one of the most common reasons for compliance action.

Preparing for the digital future

Employers can start planning for Digital ID by assessing how identity data is currently stored, who has access to it, and how digital credentials might integrate with HR systems. During the transitional period, consistency will be essential: whether verification is digital or manual, every check must be completed to the same standard and supported by clear, retrievable evidence.

Organisations that treat right to work verification as part of wider governance by integrating it into recruitment, data protection and audit frameworks, will find the eventual shift to digital systems straightforward. Those relying on informal practices are likely to struggle when scrutiny increases.

A measure of governance and integrity

Right to work compliance is more than an administrative requirement; it is a marker of a business’s integrity and resilience. Getting it right protects both the organisation and the fairness of the labour market. Digital ID may modernise the process, but it will not alter the underlying principle: the responsibility for lawful employment remains squarely with the employer.

In a digital era, compliance is not simply about avoiding penalties. It is about building systems and cultures that demonstrate diligence, accountability and respect for the rule of law. Those qualities will remain essential, regardless of how identity is verified in the years ahead.

Buckles Solicitors is a leading regional law firm with offices in Peterborough, Nottingham, Cambridge, Stamford and London. It offers a full range of legal services, including corporate law, commercial law, litigation and dispute resolution, employment law, commercial property law, family law, contentious probate, business immigration, medical negligence and private client matters. 

Claire Scanlan, is an experienced employment law solicitor with more than 20 years’ experience. She has a strong reputation for the quality of advice delivered to individuals and businesses on all aspects of the employment relationship, including workplace disputes, redundancy and restructuring, disciplinary issues and contract negotiations.

Photo by Alena Darmel on Pexels.