The £60,000 Hiring Mistake: How to Avoid an Illegal Working Penalty

You have found the right person. They interviewed well, they are keen, and they can start on Monday. Then somebody asks whether anyone has actually checked their right to work, and the room goes quiet.

It feels like admin right up until the moment it is not. Get it wrong, and you are not looking at a ticking off from the Home Office. You are looking at an illegal working penalty of up to £60,000 for one worker, and it can land whether or not you had the faintest idea there was a problem.

Here is the reassuring part. An illegal working penalty is almost entirely avoidable, and it is one of the few HR risks that is fully within your control. The process is clear: it takes about ten minutes per person, and once it is built into how you take somebody on, you will barely think about it again.

Below is how to get it right, what almost always goes wrong, and what is about to change on 1 October 2026.

What an illegal working penalty actually costs

Under the Immigration, Asylum and Nationality Act 2006, employing an adult who does not have permission to work in the UK is unlawful. If the Home Office finds that you have, and you cannot show that you carried out the correct check, you get a civil penalty.

Since 13 February 2024, the figures have been:

• Up to £45,000 per worker for a first breach in three years
• Up to £60,000 per worker for a repeat breach within three years

Read those two words again. Per worker. If three people on your payroll turn out not to have the right to work, that is three penalties, not one. For a business with twenty staff, that is not a number that stings. That is a number that ends things.

There is a separate criminal offence too, for employers who know, or have reasonable cause to believe, that somebody cannot legally work. That one carries up to five years in prison. And in a county where everybody knows everybody, the damage from a Home Office visit tends to outlast the fine by a very long way.

Your defence is the check, not the person

This is the bit that catches good employers out, and it is why an illegal working penalty so often lands on a business that did nothing dishonest. What protects you is not that your new starter turned out to be perfectly legitimate. What protects you is that you carried out a proper check, at the right time, in the right way, and kept the evidence.

That protection has a name. It is called a statutory excuse. Hold one, and you are not liable for an illegal working penalty even if the person is later found to be working illegally. Miss it, and you are exposed, however honourably you behaved.

Which is why "they showed me their passport and it looked fine" is not a defence. Nor is "they came recommended by a client we have worked with for years". Nobody is asking whether you were being sensible. They are asking whether you followed the process and whether you can prove it.

The three ways to check somebody’s right to work

There are three approved routes. Which one you use depends on the person in front of you, not on which one you find easiest. Choose the wrong route for that individual, and you have no defence against an illegal working penalty, however genuine they turn out to be.

A manual check of original documents

This works for anyone, including British and Irish citizens. You obtain the original documents, check them in the presence of the holder, and take a clear copy that you date and sign.

The acceptable documents sit in two lists in the Home Office guidance. List A covers people with a permanent right to work, such as a British passport or a birth certificate alongside an official document showing their National Insurance number. List B covers people whose permission to work is time-limited.

A photocopy emailed over by the candidate gives you nothing at all. The temporary arrangements allowed during the pandemic ended a long time ago.

The online check using a share code

Most people who are not British or Irish citizens now hold digital immigration status, an eVisa, rather than a physical card. They cannot hand you a document because they do not have one.

Instead, they generate anine-characterr share code from their UKVI account. Right-to-work codes always begin with the letter W. A code starting with any other letter was created for something else, such as right to rent, and it will not work for employment.

You enter the code and their date of birth into the government checking service. The code stays valid for 90 days and can be used more than once within that window.

Two things go wrong here more than anything else. First, you have to run the check yourself through the employer-facing service. A screenshot the candidate sends you is worth nothing. Second, you still need to look at the photograph on screen and satisfy yourself that it is the person in front of you, whether that is across a desk or on a live video call.

A digital identity check for British and Irish passport holders

Since April 2022, you have been able to use a certified provider to verify British and Irish passport holders remotely, using identity document validation technology. It earns its keep if you recruit in volume or take on people who are nowhere near your office.

If somebody cannot use a digital check, or would simply rather not, offer them a manual check instead. You must not treat them less favourably for it.

A right-to-work check that will hold up

Work through this every time, and you will end up with a statutory excuse rather than a hopeful filing system. It is the difference between an awkward afternoon and an illegal working penalty.

Keep the evidence for the whole of somebody’s employment and for two years after they leave, then destroy it securely. Holding it forever creates a data protection problem of its own.

What this looks like in practice

Say you run a small hotel near Salisbury and you are taking on a kitchen porter who holds a Skilled Worker visa with fourteen months left to run.

At the offer stage, you ask for his share code. He sends a nine-character code beginning with W, plus his date of birth. You enter both into the government service. The record confirms he can work, shows his photograph, and gives you an expiry date.

You compare that photograph to him on a video call, save the profile page as a PDF, note the date of the check and who carried it out, and file it. Then you put the expiry date into the shared calendar with reminders at 90, 30, and 14 days.

Ten minutes, start to finish. What you now hold is a statutory excuse that runs until his permission ends, plus a diary note that stops it from lapsing quietly. If the Home Office knocks in two years, you can produce the lot in under a minute. That one PDF and that one diary entry are the whole of your defence against an illegal working penalty.

Follow-up checks, the bit almost everybody forgets

If somebody’s permission to work is time-limited, your statutory excuse expires exactly when their permission does. Not when you get round to noticing.

You need to repeat the check before that date. If they have an application or an appeal outstanding with the Home Office at that point, you will not be able to check them online, so you use the Employer Checking Service instead. A Positive Verification Notice gives you a statutory excuse for six months, and then you check again.

The answer here is dull, and it works. Put every expiry date in a shared calendar with reminders well in advance. One missed date can undo a faultless process and leave you carrying an illegal working penalty for somebody you checked properly on day one.

Big changes are coming on 1 October 2026

If you use anybody other than direct employees, please read this bit carefully.

Section 48 of the Border Security, Asylum and Immigration Act 2025 comes into force on 1 October 2026, and it widens who counts as an employer for right-to-work purposes. From that date, the duty stretches beyond employees to cover workers, individual subcontractors, and businesses running online matching services that put service providers in front of customers.

The Home Office published a draft revised code of practice on 30 June 2026 setting out how this will work. Businesses sitting in a contractual chain will be expected to have written terms requiring right-to-work checks further down that chain, proper controls where a contract allows somebody to send a substitute, and sensible systems to confirm that the person actually doing the work is the person who was checked.

There is a change for anyone using a digital provider, too. From October, the provider must be registered on the Office for Digital Identities and Attributes register, with a note confirming it can carry out right-to-work checks. Sitting on that register for identity checks alone will not be enough.

The main employer guidance has not caught up with all of this yet, so expect more detail before the autumn. In the meantime, map out who is genuinely doing work for you and on what basis. If you already use casual staff, our guide to zero hours contracts is a useful companion piece, because the same people tend to fall into both sets of changes. Illegal working penalty exposure is about to reach a good deal further than most business owners assume.

Check everybody, or you swap one problem for a worse one

Check every single person you take on. That includes the ones who sound exactly like you and went to school two villages away.

The moment you only check the people whose name or accent makes you wonder, you have traded a capped fine for an uncapped one. Compensation in a race discrimination claim has no ceiling. There is a Home Office code of practice on avoiding discrimination while preventing illegal working for exactly this reason.

Consistency protects you twice over. It gives you your statutory excuse, and it keeps you well away from a tribunal.

Where this usually goes wrong in smaller businesses

In over twenty-five years of working with business owners, the same handful of failures come up again and again:

• The check happened after the first shift, because somebody was short-staffed and needed cover
• Nobody read the restrictions, so a student worked well beyond the hours their visa allowed
• The copy was taken but never dated or signed, which proves very little
• The follow-up date lived in one manager’s head, and that manager has since left
• The candidate emailed a screenshot of their own status page, and it was accepted at face value
• The paperwork was immaculate, but the person turning up to do the work was somebody else entirely

None of these are the actions of a bad employer. They are the actions of a busy one. This is precisely why an illegal working penalty catches out businesses that would never knowingly cut corners.

Turn it into a process and stop thinking about it

Nearly every illegal working penalty we come across could have been prevented by a process that fits on one side of an A4.

Write down who is responsible for the check, when in your recruitment process it happens, where the evidence lives, and who diarises the follow-up. A right-to-work policy sits naturally alongside your other policies and procedures, and putting it into your employee handbooks means it survives the person who currently does it moving on.

Make sure your employment contracts line up with what you actually do rather than describing a process nobody follows. It also belongs in your onboarding process as a gate that has to be passed before a start date is confirmed, not a form to be chased afterwards.

If you have never audited any of this, our HR audit checklist is a sensible place to start. For details, the Home Office employer guide to right to work checks on GOV.UK is the definitive source, and the codes of practice published alongside it set out exactly how the fines are calculated. Both are worth bookmarking.

Would your checks survive a Home Office visit?

Most business owners we speak to feel fairly confident about their newest starters and a lot less confident about the people who joined five years ago. That instinct is usually right.

If you would like somebody to look over how you are running your checks, tell you honestly where the gaps are, and help you get a simple process in place before the October changes land, we would be glad to help. It rarely takes long, and the peace of mind lasts. No jargon, no scare tactics, just a straight answer about where you stand.

Book a free consultation call or get in touch with the team. It is a far cheaper conversation than an illegal working penalty.