Every employer in the UK has to confirm that a new hire is allowed to work here. For most businesses that still means asking a candidate to bring a passport into the office, photocopying it, writing the date on the copy, and filing it away. The process is slow, awkward to run across a distributed team, and built on a weak point: a person looking at a physical document is making a visual judgment about whether it is genuine, and that judgment is only as good as the training behind it. Get it wrong and the civil penalty is up to £60,000 per illegal worker.
Right to work digital identity checks replace that manual process with something more defensible. The employer sends a verification request, the candidate completes an identity check through a certified provider, and the employer receives a confirmed result with a digitally signed audit trail. No photocopier, and no scheduling around someone’s first day. Nobody is left relying on a line manager to spot a convincing forgery across a desk.
For the candidate, the experience changes too. Instead of digging out a passport and travelling to an office, they follow a link on their phone, confirm their identity in seconds, and carry on with their day. The first thing a new joiner does for your business is no longer an errand.
Since 6 April 2022 the Home Office has allowed employers to use certified Identity Service Providers for right to work checks on British and Irish citizens holding valid passports. The legal ground became firmer on 1 December 2025, when Part 2 of the Data Use and Access Act 2025 commenced and established the statutory framework for legally valid digital identity in the UK.
A correctly conducted right to work check gives you a statutory excuse. If an employee is later found to be working illegally, having carried out the prescribed check properly is your defence against the civil penalty, which currently runs to £60,000 per worker. The check is not optional administration. It is the thing that protects the business.
From 1 October 2026, a new code of practice is due to apply to all employment starting on or after that date, and to repeat checks carried out after that date. Under it, employers are expected to check every worker consistently through one of three permitted routes: a manual document check, the Home Office online checking service, or a certified Digital Verification Service. The same code requires that a digital service must not produce discriminatory outcomes, so a provider cannot work reliably for some groups and fail others. The consistency duty matters for distributed and high-volume hiring, where checks run by different managers in different places tend to drift apart.
The technical standard sitting under digital checks is the Digital Verification Services Trust Framework, the DVSTF. It sets the certification standards a provider must meet before it can carry out these checks, covering IT security, fraud prevention, risk management, and issue handling. Only providers certified under the framework and listed on the government’s public register qualify . The framework was renamed from the Digital Identity and Attributes Trust Framework, and the final 1.0 release was published on 9 June 2026.
The 1.0 framework comes into force once the first conformity assessment body is accredited, expected from around 1 September 2026. Providers already certified at the gamma (0.4) stage move across through a tailored delta uplift rather than a full re-audit. Providers certified against 1.0 will then be entitled to use the UK CertifID trust mark, a government-endorsed signal that the provider meets the statutory standard. That trust mark is forthcoming rather than live today, so for now the public register is the definitive way to confirm a provider’s status.
Digital identity verification right to work through a certified provider currently covers British and Irish citizens with a valid passport, including Irish passport cards. For this group the digital route is recommended rather than compulsory, but it is faster, more consistent, and easier to evidence than a manual check.
Everyone else proves their right to work through the Home Office online service. Biometric residence permits have been replaced by eVisas, and an eVisa holder cannot prove their status with a physical card. They share a right to work share code instead. The worker generates a nine-character code from their GOV.UK account, sends it to the employer, and the employer checks it on the Home Office service alongside the worker’s date of birth. The code is valid for 90 days from the point it is created.
For the worker, a right to work share code is a few taps in their immigration account. For the employer, it returns a profile to check against the person in front of them, plus a record to keep. The two routes, certified digital identity for British and Irish passport holders and the online share code for everyone else, together cover the whole workforce without a single photocopy.
The process starts when the employer sends a verification request, usually by email or text message. This can happen before the candidate’s first day, which removes the scheduling problem that comes with in-person document inspection. A business with staff spread across several sites can run right to work digital identity checks without anyone travelling to a central office.
From the candidate’s side, the next step is short. They follow a link to the provider’s verification journey. Depending on the provider this might mean confirming their identity through their bank, scanning a passport chip over NFC, or presenting a digital wallet credential. The verification typically completes in seconds, and an enhanced check returns a confirmed result in under 12 seconds.
The provider then returns a clear outcome confirming identity and eligibility to work, with a digitally signed evidence trail the employer keeps as the statutory record. Nothing has to be copied, posted, or stored in a filing cabinet. Against the manual version (find your passport, travel in or post a certified copy, then wait for sign-off) the saving for both sides runs to days.
The right to work duty has historically applied to direct employees. That is changing. The check requirement is being extended under the Border Security, Asylum and Immigration Act 2025 to cover gig-economy and zero-hours arrangements, including agency workers and sub-contractors in sectors such as construction, food delivery, courier work, beauty, and warehousing. Commencement is still to be confirmed, so the sensible read is that businesses relying on flexible and contracted labour should prepare now rather than wait.
The penalties mirror the existing regime: civil penalties up to £60,000 per worker, business closure notices, director disqualification, and, for the most serious offences, imprisonment. Enforcement has already stepped up. In 2025 the Home Office issued 2,438 civil penalties to employers, worth more than £130 million, alongside a sharp rise in illegal-working arrests and raids. For a business onboarding flexible workers at volume, a manual check run inconsistently across a supply chain is exactly the exposure the new rules are aimed at.
An employer inspecting a physical passport is making a probabilistic judgment. They look at a photograph, decide whether it matches the person in front of them, and hope the security features they were trained to recognise are present or absent for the right reasons. Photographic document scanning, whether done by a person or a machine, has no reliable way to confirm authenticity when the document itself is a fabrication.
Generative AI has made that worse. Producing a convincing fake document is cheaper and faster than it was two years ago. A well-made counterfeit passport will pass a visual check, and a digitally altered photo will match the person presenting it.
Credentials verified programmatically against the issuing authority’s records work differently. The check is deterministic, confirmed through cryptography rather than estimated from a photograph. When a provider verifies identity through a bank, it confirms data the bank already holds against the person in real time. There is no document to forge because the verification goes around the document entirely.
Completion rates follow the same logic. Bank and digital wallet verification reaches 80-90% completion, against 50-60% for passport chip-based processes. For an employer onboarding 500 people a month, that gap is the difference between 50 and 250 candidates stalled in the pipeline, waiting on a process they abandoned or could not finish.
Healthcare, education, and social care all require Disclosure and Barring Service checks alongside right to work verification. Both rest on the same question: is this person who they say they are.
For DBS checks the digital route is no longer just available. Identity verification through a certified IDSP is mandatory, and applicants verify digitally instead of presenting physical documents to a registered body. That is a stronger position than right to work, where the digital route is recommended. A DBS identity verification carried out through a certified provider uses the same infrastructure as a digital right to work check, so an applicant verified once can satisfy the identity stage of their DBS application without starting again.
Running both checks through the same certified provider gives you one workflow rather than two document-handling processes. The same evidence standard and audit format apply across both, and the fraud protection carries over because the underlying cryptographic verification is identical whichever check triggers it. For an employer processing hundreds or thousands of DBS checks a year, that consolidation removes the manual handling where errors creep in.
The verification methods open to right to work digital identity checks will widen as the UK’s digital credential infrastructure matures. The GOV.UK Wallet is already in use: the digital Veteran Card has been live since October 2025, and a digital driving licence has been in private testing since December 2025, with wider public availability expected during 2026.
For a driving licence checked through the digital route, the experience changes in the same direction as everything else. Instead of photographing a plastic card, uploading the image, and waiting for it to clear, the person opens the wallet, approves the request, and gets confirmation in seconds. The credential is cryptographically signed and checked against the issuing authority’s records, so it is deterministic rather than a best guess.
Certified providers are being enabled to test programmatic verification of digital driving licence credentials during 2026, with all government services due to offer a digital alternative by the end of 2027. Driving licences are held by around 75% of UK adults, so as that route opens it widens the share of the workforce that can complete a check through at least one certified method.
Can I use digital identity checks for right to work?
Yes. Since 6 April 2022 the Home Office has allowed employers to use certified Identity Service Providers for right to work checks on British and Irish citizens holding a valid passport, including Irish passport cards. The provider must be certified under the Digital Verification Services Trust Framework and listed on the public register. For everyone else, the check runs through the Home Office online service using a right to work share code.
What is a right to work share code?
A right to work share code is a nine-character code that a non-British or non-Irish worker generates from their GOV.UK immigration account to prove their right to work. They share it with the employer, who checks it on the Home Office online service against the worker’s date of birth. The code is valid for 90 days from when it is created. Biometric residence permits have been replaced by eVisas, so this online route is now the way most non-UK workers evidence their status.
What is an IDSP right to work check?
An IDSP right to work check is carried out by an Identity Service Provider that has met the standards set by the Digital Verification Services Trust Framework, covering IT security, fraud prevention, risk management, and issue handling. The final 1.0 framework was published on 9 June 2026 and comes into force once the first conformity assessment body is accredited, expected from around 1 September 2026. From that point, providers certified against 1.0 will be entitled to display the UK CertifID trust mark. The full list of certified providers and their roles sits on the public DVS register.
How long does a digital right to work check take?
The verification itself typically completes in seconds, and an enhanced check returns a confirmed result in under 12 seconds. The whole process, from the employer sending a request to receiving a confirmed result with a digitally signed audit trail, can be finished before the candidate’s first day, which removes the scheduling constraints of in-person document inspection.
The statutory framework for digital identity commenced on 1 December 2025. A new code of practice is due to apply to employment from 1 October 2026, with three permitted check routes and a duty to treat every worker consistently. The right to work requirement is being extended to gig-economy and supply-chain labour under the Border Security, Asylum and Immigration Act 2025, and enforcement against employers has risen, with more than £130 million in civil penalties issued in 2025. The regulator’s question is becoming one of authority, not appearance: can you prove the person was entitled to work, not just that a document looked right on the day.
Manual right to work checks sit on the wrong side of all of that. Review the public DVS register to find certified providers, and if your business also runs DBS checks, look at consolidating both through one provider so a worker verifies once and the second check is a tap. OneID was the first Identity Service Provider certified under the DVSTF, and the first to hold Orchestration Service Provider and Holder Service Provider roles, regulated by the FCA (FRN 928911), B Corp certified, ACCS accredited, and aligned with the Data Use and Access Act 2025. Clients including NatWest, Adobe, and Anna Money run identity verification on its infrastructure. To move your right to work digital identity checks off the photocopier, start with the DVS register and a provider that can run right to work and DBS through one journey.
Most customers who abandon a regulated sign-up never tell you why. They open the page, reach the point w...
A director needs to prove who they are to Companies House. They want to do it once, have it accepted fir...
A new director cannot be appointed until they have proved who they are. Existing directors are receiving...
