UK right to work digital identity checks: how to check your provider is approved for 1 October 2026

From 1 October 2026, an organisation that uses a digital provider to carry out right to work checks must use a registered right to work digital verification service provider, a RtW DVSP. Using an unregistered provider, or one registered for something else, means no statutory excuse. The civil penalty starts at £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years.

Most organisations will search the government register, find their provider's name on it, and conclude they are covered. That conclusion is frequently wrong. Certification on the register attaches to individual services, not to companies, and a provider can appear on it while the particular service you buy is not certified for right to work.

That requirement sits inside a much larger change to the Right to Work Scheme taking effect on the same day. The next section sets out the wider picture. The rest of the post covers who the provider rule reaches, why appearing on the register is not the test, the three ways the check goes wrong, and how to read a register entry properly.

What changes on 1 October 2026

At present, an organisation is generally liable for a civil penalty only where it directly employs someone who does not have the right to do the work in question, with a criminal sanction available where it knew or had reasonable cause to believe. Section 48 of the Border Security, Asylum and Immigration Act 2025 changes that in two ways at once.

The definition of employment expands. Section 48 inserts a new section 14A into the Immigration, Asylum and Nationality Act 2006. This means that, for the purposes of the civil penalty and related provisions, "employing" an individual can include engaging them under a worker's contract, engaging an individual sub-contractor, and certain online matching services that provide a service provider's details to potential clients or customers. The effect is to bring a wider range of non-traditional working arrangements within the right-to-work regime.

Liability can extend up a contractual chain. A new section 15A means civil penalty liability may reach beyond the employer holding the direct contractual relationship with the worker. Under the draft Code, the extended liability provisions apply in three situations: where a person contracted to provide work or services to a third party enters into a contract with another employer who supplies the workers to fulfil it; where an online matching service matches a service provider to a client or customer who then contracts with them; and where a contract permits the worker to substitute another individual to do the work.

Two qualifications matter for planning. Extended liability is a fallback rather than a first resort, the Home Office will seek to identify the direct employer first, and the extended provisions operate where that employer cannot be identified or the prescribed requirements have not been met. And for the newly in-scope arrangements, a civil penalty may only be imposed where the employment commenced on or after 1 October 2026.

For organisations that hold a sponsor licence, a right to work failure rarely stays contained. The draft Code lists being unable to sponsor migrants among the additional consequences that may follow a civil penalty for a direct employer, alongside director disqualification, business closure orders and, in the most serious cases, criminal conviction. The same breach can therefore put the licence in play alongside the penalty, which is why this is worth treating as a sponsor licence compliance question and not only an HR one.

Three draft documents sit underneath the change: the Code of practice on preventing illegal working and the Code of practice on avoiding unlawful discrimination, both published on 30 June 2026, and the Employer's guide to right to work checks, published on 16 July 2026. All are framed to take effect on 1 October, with final versions expected before then.

The rest of this post deals with one requirement inside that package: which digital providers an employer may use.

Who needs a registered right to work provider from 1 October 2026?

The obvious group is any organisation that runs digital identity checks on new hires instead of inspecting passports manually. But the requirement reaches further than that, in two directions that catch people out.

If you use the Home Office online checking service, you may still be in scope. Every right to work check has an imposter step: the employer has to satisfy itself that the person in front of it is the person the check relates to. That can be done in person or by video call. The draft Code of practice on preventing illegal working (June 2026) provides that where an employer wants to do it digitally through facial recognition technology, it must be carried out using a RtW DVSP. That applies to manual document checks and Home Office online checks alike. An organisation that has concluded it has no exposure because it does not use the digital document route may still be using a RtW DVSP for the likeness step.

If you rely on an agency or screening firm, the position is stricter than most assume. The Code states that an employer must not delegate responsibility for conducting right to work checks to a third party, and that where a check is performed by a third party such as a recruitment agency or professional adviser, the employer will not establish a statutory excuse. A prescribed check by a RtW DVSP is the single exception to that rule.

Two limits are worth stating. First, genuinely self-employed individuals who operate an independent business and contract directly with their own clients or customers remain outside the Right to Work Scheme. A business buying services from another business is also not, simply by doing so, required to carry out a right to work check. The position can be different where an individual obtains work through an intermediary or platform and does not operate an independent business of their own.

Second, extended liability is not the first route to a civil penalty. The Home Office will first seek to identify the person directly employing the worker. The extended-liability provisions become relevant where that person cannot be identified or the requirements for imposing a penalty on them have not been met.

Action: establish which populations you check digitally, and separately whether facial recognition is used anywhere in your onboarding, including inside a platform you did not procure for that purpose. Mapping this across entities is the same exercise as any other right-to-work and employer compliance audit, and is best done once across the group.

Why being on the OfDIA register is not enough

The requirement in the draft Code is specific. Where an employer chooses to engage a DVSP for right to work checks, the provider must be a RtW DVSP, registered on the Office for Digital Identities and Attributes register, with a note on the register confirming it can provide right to work checks.

The consequence is stated just as plainly. Among the circumstances in which an employer will not have a statutory excuse, the Code lists using the services of an unregistered DVSP, or of a DVSP that is not a right to work DVSP. It also lists cases where it is reasonably apparent that the output of the check is incorrect or does not contain the required information.

So the test is not whether a company appears somewhere on the register. It is whether the specific service being used carries the right to work certification, at the time the check is carried out. Those are different questions, and the register is built in a way that makes it easy to answer the first while believing you have answered the second.

Action: treat "our provider is on the register" as the start of the enquiry, not the end of it.

Three ways this check goes wrong

1. You checked the company, not the service

A single provider can hold several certified services, with different roles, different confidence levels and different certifications attached. Some hold certification for right to rent or for Disclosure and Barring Service checks and not for right to work. Certification against one supplementary code says nothing about another.

The register reflects this by listing services separately from providers, with distinct pages for each. Searching by company name and stopping at the first match is the most common way to get a false positive.

A worked example. Provider A appears on the register with three certified services: one for DBS checks, one for right to rent, and one identity service with no supplementary codes. An employer running right to work checks through any of them has a registered provider, and no statutory excuse.

2. You checked your supplier, but your supplier is not the certified party

Organisations rarely contract directly with the certified entity. Applicant tracking systems, HR platforms and background-screening firms commonly embed or resell someone else's identity service, and the register records whether a service is underpinning or white-labelled precisely because this is normal.

A worked example. An HR platform sells onboarding with "built-in right to work checks". The verification behind the button is Provider B's certified service, white-labelled. The employer's contract names the platform; the certificate names Provider B. That arrangement can be fine but only if the check is actually performed by the certified service and the employer can evidence which service that was.

This is where the no-delegation rule bites hardest. Because a RtW DVSP is the only permitted third-party route, an employer needs to be able to identify the certified service in its supply chain and evidence it, not merely point at a contract with a supplier it trusts.

3. You checked once

Certificates of conformity carry issue and expiry dates, and a service whose certification lapses comes off the register. A check carried out while the service was not certified is not a check that delivers what the Code requires, whatever the position was at procurement.

The next fifteen months make this more likely than usual. The final 1.0 release of the digital verification services trust framework was published on 9 June 2026 and comes into force from 1 September 2026, or from the date at least one conformity assessment body is accredited to certify against it. Existing certified services move across on individual timelines based on their current certification cycle, with at least fifteen months to uplift: at the next evaluation a service may stay on version 0.4 for a further year or move to 1.0, and at the evaluation after that it must uplift or lose certified status and be removed from the register.

A worked example. A provider certified in late 2024 holds a certificate expiring in November 2026. Checks run through its service in October are checks by a registered RtW DVSP. If recertification is not completed before expiry, the service comes off the register and a check run in December, in that gap, is a check by an unregistered provider.

A related trap sits alongside this one. Version 1.0 introduces the UK CertifID trust mark. Use of the mark is optional and signals certification against the trust framework, not right to work authorisation. A provider may hold right to work certification without displaying it, and displaying it does not establish right to work certification. Expect to see the mark in vendor marketing from this autumn.

Action: record your provider's certificate expiry date against your own hiring calendar, and require the provider to notify you of any change in certification status.

How do you check a provider on the OfDIA register?

The register is a public GOV.UK service, with separate views for all services and all providers. As at July 2026, OfDIA reported 46 providers offering 64 certified services. Open the entry for the service, not the company, and work through these fields.

Below the main block, the entry repeats each supplementary code with its own identity profile. That repetition is deliberate, a service can hold a different confidence level for right to work than for right to rent.

Action: capture and date a copy of the register entry for the service you use, and repeat that at each renewal. The register is live and entries change.

What does the provider do, and what stays with the employer?

Using a certified service meets part of the obligation without moving any of it to the provider.

The provider must give the employer a notification confirming whether the worker has the right to work, together with verification that it is registered to provide right to work checks. Where facial recognition is used, it supplies the image comparison.

What remains with the employer under the draft Code:

•     Satisfying itself that the photograph and biographic details in the output are consistent with the individual who is the subject of the check, and giving the worker a reasonable opportunity to verify their identity where the technology cannot

•     Retaining a clear copy of the check output for the duration of the employment and for two years afterwards, and retaining the facial recognition comparison alongside it where one was produced

•     Ensuring the employment offered is consistent with any restrictions the check discloses

Action: confirm the registration verification arrives with each check output automatically, and that your retention schedule covers it for the same period as the check itself.

IDVT, IDSP, DVS, DVSP, RtW DVSP: updating your policy wording

Five terms are in circulation and most right to work policies use an obsolete one. A policy instructing staff to use "an approved IDSP" no longer maps onto anything a reader can look up.

Action: search your right to work policy, onboarding scripts and supplier contracts for "IDSP" and "IDVT" and update the wording.

RtW DVSP procurement checklist before 1 October 2026

1.     Identify where digital checking is used, across all group entities and worker populations.

2.     Identify separately where facial recognition is used for the imposter step.

3.     Locate the specific service on the register, not the company.

4.     Confirm "Right to Work" appears under supplementary codes for that service.

5.     Check the underpinning or white-labelled field and establish which entity holds the certification.

6.     Record the certificate expiry date against your hiring and repeat-check calendar.

7.     Confirm that each check output contains the required DVS verification information, including confirmation that the service was certified and registered at the time of the check, and retain that information with the check record.

8.     Update policy wording that still refers to IDSPs.

9.     Brief HR, procurement and contract management together: this is a procurement question with an immigration consequence. For organisations hiring from abroad, this folds into the wider UK immigration compliance review cycle rather than needing a separate one.

What is still draft

Everything above rests on the three draft documents named earlier, none of which is final. The Code cross-refers to supporting guidance of 1 October 2026 for worked examples of contractual chains, online matching services and substitution.

Commentators have identified divergences between the draft guide and the draft Code that remain unresolved, including whether extended liability reaches contracts existing before 1 October 2026, whether partners and members of LLPs fall within the definition of a worker's contract, whether a personal service company can be an employer for Scheme purposes, and what evidence retention period applies to the extended liability statutory excuse.

The trust framework position is also moving, with version 1.0 expected to come into force on 1 September 2026 subject to conformity assessment body accreditation.

This post will be updated when the final Code and Employer's guide are published, and when the trust framework 1.0 position is confirmed.

Frequently asked questions

Do I have to use a digital provider for right to work checks from 1 October 2026?

No. The draft Code keeps the manual document check and the Home Office online checking service available, and states that using a DVSP is not mandatory. The registration requirement applies where an organisation chooses the digital route. Which method is available depends on the individual: holders of eVisas can only evidence their right to work through the Home Office online service, while a RtW DVSP check covers valid British and Irish passports and Irish passport cards, including up to six months past the expiry date, with passive authentication required where an expired passport is relied on. Where a worker's status derives from sponsorship under a work route, the online service is the route to a statutory excuse.

How do I check whether my provider is a RtW DVSP?

Search the OfDIA digital verification services register for the specific service rather than the company. Open the service entry and confirm that "Right to Work" appears under supplementary codes, that the roles certified against include identity, and that the certificate of conformity has not expired.

My provider is on the OfDIA register. Is that enough?

Not on its own. The register lists services rather than companies, and a provider may hold several services certified against different codes, roles and identity profiles. A service certified for right to rent or DBS checks is not thereby certified for right to work. The entry also records whether a service is underpinning or white-labelled, which matters where the contracting party is not the certified entity.

Can I rely on my recruitment agency's checks?

The draft Code states that an employer must not delegate responsibility for conducting right to work checks to a third party, and that where a check is performed by a third party such as a recruitment agency or professional adviser, the employer will not establish a statutory excuse. Prescribed checks carried out by a RtW DVSP in accordance with the Code are the exception. Where an agency is the direct employer of the worker, the analysis differs, and the position depends on the contractual arrangement.

Does the UK CertifID trust mark mean a provider is authorised for right to work checks?

No. Use of the mark is optional and signals certification against version 1.0 of the trust framework. Right to work authorisation is evidenced by the right to work supplementary code on the register entry. A provider may hold that certification without displaying the mark, and displaying the mark does not establish it.

What is the penalty for getting this wrong?

Where no statutory excuse is established, the draft Code sets a starting point of £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years. Reductions of £5,000 per worker apply for reporting a suspected illegal worker to the Home Office before it identifies them, and for active co-operation with the investigation. On a first breach, an employer that evidences effective right to work practices together with both of those factors receives a Warning Notice rather than a penalty; on a repeat breach a Warning Notice is not available. A Faster Payment Option reduces a first penalty by 30% where it is paid within 21 days.