Skip to content
RTWComply

Right to Work Policy: What to Put in Writing

By Brian CrockerLast reviewed: 26 October 2026

Most right to work policies you can find online are somebody else's — a council's, an NHS trust's, a construction firm's, published because that organisation publishes its policies. They tell you what one employer decided. None of them tells you what the Home Office actually looks for, which is the only question that matters when you are writing your own.

The answer is unusually concrete. The Code of Practice names four things it will consider as evidence of "effective right to work practices" (its list "includes" them, so it is not closed), and having them is what turns a civil penalty into a Warning Notice. A right to work policy is how you write those four things down and how you prove, months later, that they were real.

This guide is for informational purposes only and does not constitute legal advice. For advice on your specific situation, consult a qualified immigration solicitor.

Why a policy is worth writing at all

A policy is not a legal requirement. It is a mitigation, and the mitigation is large.

The Code of practice on preventing illegal working sets out three mitigating factors a case-worker applies. The first two knock £5,000 each off a per-worker penalty. The third does something different:

"Where the employer demonstrates effective right to work practices, together with reporting and active co-operation, their civil penalty will be reduced to the minimum level of a Warning Notice (first breach only)."

This is the revised Code the Home Office laid before Parliament in draft on 30 June 2026, which SI 2026/700 brought into force on 1 October 2026; GOV.UK dropped "draft" from its title that day. We last checked it on 5 October 2026 — check the live Codes collection before you rely on a detail.

A Warning Notice instead of a Civil Penalty Notice, on a first breach that would otherwise start at £45,000 per worker. Two conditions sit on it and both are worth reading carefully: the third factor only operates together with the first two, and it is available on a first breach only. Nor does a Warning Notice wipe the slate — "A Warning Notice will be taken into account for future breaches within three years."

For a business with 5–15 staff, that is the difference between an unpleasant letter and an existential bill. See how a civil penalty is calculated for where the third factor sits in the arithmetic.

The four things the Code says it looks for

This is the part no employer's published policy contains, because no employer's published policy is trying to tell you how the assessment works:

"The Home Office will consider that the employer has effective right to work practices in place if they provide evidence of their general compliance with their responsibility to prevent illegal working. This includes:"

  • "having robust checking systems in place"
  • "consistent right to work checking processes"
  • "retention of records, and"
  • "a history of compliance with the requirements"

Four items, and note the lead-in: "this includes" is not a closed list. Your policy has one job — to be the document that makes each of them demonstrable to somebody who arrives without notice.

What the Code says it looks for What your policy section should establish The evidence that proves it
Robust checking systems Which of the three prescribed check routes you use, and for whom Named route per worker category; the check record itself
Consistent checking processes That the same steps run for every hire, in the same order, with no exceptions A single right to work checklist, used every time, with the steps ticked
Retention of records Where copies live, in what format, for how long, and who can retrieve them Unalterable copies, each with a secure record of the check date
A history of compliance That follow-ups happened on time, repeatedly, over years A dated register showing due dates met, not just checks done

The fourth is the one a new policy cannot fake and the one most employers under-build. A history of compliance is not a document you write; it is a record you accumulate. Which means the policy's real function is to start the clock on evidence you will want in three years.

What each section needs to say

1. Who gets checked

Everyone, before their first day of paid work, with no exceptions and no judgement calls. The employer's guide to right to work checks puts the discrimination duty in terms your policy can adopt almost verbatim. Employers should:

"be consistent in how they conduct right to work checks on all workers, including British citizens, regardless of nationality or perceived immigration status"

and should not:

"only conduct right to work checks on those who they consider are more likely to be migrants"

The guide is explicit about where that lands if you get it wrong: "the employer may be acting in a discriminatory manner, and it could be used as evidence against them in proceedings under the Equality Act 2010 or the Race Relations (Northern Ireland) Order 1997, as amended." Our guide to checking British citizens covers the misconception that drives most selective checking.

Quotations from the employer's guide in this article are taken from the final version the Home Office published on GOV.UK on 1 October 2026, in place of its 11 September 2026 draft. It states that it "came into force on 1 October 2026", and we last checked it on 5 October 2026. If a later version differs, the later version governs.

Since 1 October 2026 "everyone" is a wider set than it used to be. Section 48 of the Border Security, Asylum and Immigration Act 2025 extends the scheme:

"In sections 15 to 24, a reference to a person employing another person includes a reference to— (a) a person ('person A') engaging an individual ('individual A') under a worker's contract, (b) a person ('person B') engaging an individual sub-contractor ('individual B'), and (c) an online matching service ('person C') providing the details of an individual who is a service provider ('individual C') to potential clients or customers."

A policy written around "employees" is now under-scoped. Say "everyone who does work for us, however they are engaged", and let the 1 October 2026 rules define the edges.

One boundary is worth writing into the policy itself, because it saves work. The new categories are not backdated: both the guidance and the Code state that for a worker's contract, an individual sub-contractor or an online matching service, "a civil penalty may only be imposed where the employment commenced on or after 1 October 2026". The Code applies that boundary to the section 15A extended liability as well; the guidance frames the extended-liability side by contract date, applying its requirements "where the relevant contractual arrangements were entered into on or after 1 October 2026". So the policy applies to everyone you engage from that date forwards. Existing arrangements running before it do not attract a penalty under the new categories — and if you decide to check them anyway, check all of them rather than a selection: the guidance says employers should not "discriminate when conducting right to work checks".

2. Who does the checking

Name the roles. The guide allows internal delegation, carves out registered digital providers, and leaves the liability where it started:

"With the exception of prescribed checks carried out by a RtW DVSP, the employer is responsible for carrying out the check. This responsibility may be delegated to individuals or members of staff acting on behalf of the employer, including workers, agency workers, or others working under the employer's control, direction and who are accountable to the employer. However, the employer will remain liable for a civil penalty in the event the individual is found to be working illegally, and the check has not been carried out as prescribed."

So your policy should name who may run a check, name any registered right to work digital verification service provider you use, and say plainly that liability does not travel with the task. If a shift manager does your checks, what they know is what turns that delegation into the "consistent right to work checking processes" the Code is looking for — so record who has been briefed, on what, and when.

3. How the check is done

State which route applies to whom, because getting this wrong is the failure that voids an otherwise diligent check. The guide's manual route has three steps and all three must be complete before employment begins:

"There are three steps to conducting a manual document-based right to work check (including for follow-up checks). Employers need to complete all steps before employment commences in order to establish a statutory excuse."

Note the parenthesis: the same three steps govern follow-up checks, not just the first one. Your policy should record that the check happens in the holder's presence — "a physical presence in person or via a live video link", with the originals physically in hand — and that a screenshot or scanned copy is not a check, unless it is "official evidence of an individual's name and NINo in a digital format". Which list a document falls under, and the follow-up it carries, is the decision your policy should route people through rather than leave to memory — the documents list sets it out.

4. What gets recorded, and where

Two requirements, both quotable straight into a policy. First, employers must:

"make a clear copy of each document checked… in a format which cannot be manually altered. This can be electronically, in HTML or as a PDF, or in hardcopy."

"Employers should produce these document copies quickly in the event they are requested to demonstrate that they have performed a right to work check and retain their statutory excuse."

Retrievability is a stated requirement, not a nicety — which means "in a folder somewhere on the shared drive" is not a policy, it is an aspiration. Add the date rule too: employers must "retain a secure record of the date on which the check was conducted by either making a dated declaration on the copy or by holding a separate record", because "Simply writing a date on the copy document will not be sufficient". Our record keeping guide sets out the records an inspector will ask to see.

5. When follow-ups happen

For time-limited permission the date is fixed by the guide, not by you:

"Employers need to re-check the right to work of those individuals who have time-limited permission to work in the UK if they intend on continuing to employ them after their current permission expires… They must do this on, or before, the date their permission comes to an end."

Your policy should say where those dates are held, who reviews them and how often. This is the section that produces the Code's fourth evidence item, and it is the only section that gets stronger every year you keep it. The follow-up timeline calculator works out the due dates; follow-up right to work checks covers the mechanics.

6. Retention and destruction

Employers must:

"ensure all copies of documents are kept securely for the duration of the worker's employment and for two years afterwards. The file or document must then be securely destroyed."

A policy that covers collection but not destruction leaves you compliant with the Home Office and exposed on data protection. Right to work records: GDPR and retention covers the deletion trigger most employers never build.

7. What happens when a check does not clear

Write the escalation down before you need it, not during. Who is told, who decides, and what the person is told meanwhile. The two outcomes to plan for are a Positive Verification Notice from the Employer Checking Service, which gives you a six-month statutory excuse, and a Negative Verification Notice, which does the opposite — our guide to the Positive Verification Notice covers the first, and the Employer Checking Service guide covers when you have to ask at all.

Keep it one page and review it once a year

A right to work policy that runs to twelve pages will not be followed, and a policy that is not followed is worse than none — it is documentary evidence that you knew the standard and missed it. The four Code items fit on a single side. The value is in the register behind it, not the prose.

Review it annually and after any change to the scheme. The last two changes were substantial and neither was announced to employers individually: penalty levels tripled in February 2024, and the scheme's scope widened on 1 October 2026.

The bottom line

Write the policy to the Code's four items, because those are the four things the Code names: robust checking systems, consistent checking processes, retention of records, and a history of compliance. Cover who is checked (everyone, however engaged), who may check, how, what is recorded and in what format, when follow-ups fall due, when files are destroyed, and what happens when a check does not clear. Keep it to a page. Then spend your effort on the register underneath it — the fourth item is the only one you cannot write in an afternoon, and it is the one that takes a first-breach penalty down to a Warning Notice.

Sources

Stop tracking visa expiry dates in spreadsheets

RTWcomply will automate follow-up check reminders, visa expiry tracking, and build your Home Office audit trail. Join the waitlist for early access.

No spam. Unsubscribe any time. Privacy policy

Related guides

Right to Work Training: What It Actually Buys

Right to work training does not lower the standard you are judged against. What it does buy is worth more, and some of the material costs nothing.

HMRC Right to Work Checks: What HMRC Doesn't Do

HMRC does not run right to work checks — the Home Office does. What HMRC's role really is, and why a National Insurance number proves less than employers think.

Failed Right to Work Check: What to Do Next

A failed right to work check is usually two different situations. How to tell them apart, when to use the Employer Checking Service, and what the notices mean.