What happened to BRP cards, and why won't an expired one work?
BRPs were the plastic cards that held a migrant's photo, biometrics and visa details. The Home Office stopped issuing them on 31 October 2024, and most existing cards carried an expiry date of 31 December 2024. That date wasn't the end of someone's visa. It was the end of the card.
Status moved online. People whose BRPs expired on 31 December 2024 were encouraged to create a UKVI (UK Visas and Immigration) account so they can view their eVisa, which is the digital record of their immigration status. The card is gone. The permission to be here usually isn't.
For your checks, this matters in one blunt way. The employer's guide states that "a manual check of an original, expired BRP is not acceptable proof of right to work in the UK." So if someone shows you a BRP dated 31 December 2024 and asks you to photocopy it, that copy buys you nothing: no statutory excuse, and no defence if that person turns out to lack the right to work. You need the digital check instead, which I'll cover next.
How does an online right-to-work check actually work in 2026?
It runs in two halves. The worker proves their status, then you verify it.
The worker goes first. Using the "Prove your right to work to an employer" service, they sign into their UKVI account and generate a 9-character share code. Codes for employment begin with the letter W, so a code starting R or S won't work, because those belong to other services such as proving your right to rent. Each code lasts 90 days and can be reused as often as needed within that window.
Then you check it. You use the "Check a job applicant's right to work" service, enter the share code, and enter the worker's date of birth. The service shows you their photo and what work they're allowed to do. You confirm the photo matches the person, either in person or over a live video call, and keep a copy of the response with the date you checked.
The payoff is legal cover. The employer's guide is clear that a Home Office online right-to-work check gives you a statutory excuse against a civil penalty in the event of illegal working. Get the steps right and you're protected. Skip the photo match or check the wrong service, and you may not be.
What if the worker can't prove their status online?
Not everyone can produce a share code. Their eVisa might have a technical fault, or their case might be the kind the online service can't display. For those situations, you use the Employer Checking Service (ECS).
The employer's guide is direct about when to use it: contact the ECS where you are "unable to carry out a check using the online service, for example due to a technical issue with the individual's eVisa or digital immigration status." You submit a request, and if the person has the right to work, the Home Office issues a Positive Verification Notice (PVN).
Watch the clock on the PVN, because it doesn't last forever. The guidance is explicit that a PVN gives the employer a statutory excuse for six months from the date specified in the Notice. So a PVN isn't a one-time fix. If that worker stays employed and their status still can't be shown another way, you'll need a fresh check before the six months runs out. Diary it the day the notice arrives, because the statutory excuse evaporates the moment it lapses, and you're exposed again from that date forward.
What are the penalties if you get a right-to-work check wrong?
The numbers went up sharply in 2024, and they bite per worker, not per business.
The Code of Practice that came into force on 13 February 2024 sets the maximum civil penalty at £45,000 per worker for a first breach and £60,000 per worker for a repeat breach. "Repeat" means you've been issued a civil penalty or warning notice for a breach within the previous three years. For context, the old maximums were £15,000 and £20,000, so the ceiling roughly tripled.
The table below sets out the headline figures and where each one comes from.
The penalty is civil, but illegal working can also carry criminal liability where an employer knew or had reasonable cause to believe someone had no right to work. The defence against the civil penalty is the statutory excuse, and the only way to hold one is to run the check correctly and keep the evidence. Lose the paperwork and you can lose the excuse, even if the check itself was fine on the day.
| Item | Figure / rule | Source |
|---|---|---|
| Civil penalty, first breach | Up to £45,000 per worker | Code of Practice, 13 Feb 2024 |
| Civil penalty, repeat breach | Up to £60,000 per worker | Code of Practice, 13 Feb 2024 |
| Repeat-breach window | Penalty or warning notice issued in previous 3 years | Code of Practice, 13 Feb 2024 |
| Share code length | 9 characters, employment codes begin with 'W' | Employer's guide, 26 Jun 2025 |
| Share code validity | 90 days, reusable within that period | View and prove your immigration status |
| PVN statutory excuse | Lasts 6 months from date on the Notice | Employer's guide, 26 Jun 2025 |
Who still uses physical documents, and where does the digital rule not apply?
The eVisa shift covers people with digital immigration status. It does not cover everyone, and that's the honest caveat to all of the above.
British and Irish citizens can't get an online right-to-work share code. For them you check original documents, such as a passport, or use a certified identity service provider. The List A and List B document checks in the employer's guide still exist for these cases. List A documents show a continuous right to work with no follow-up needed. List B documents show a time-limited right, so you set a recheck date for when that permission expires.
Some holders of valid biometric residence cards or expired BRPs can still use those card details to sign into their UKVI account, but that's a login step, not the check itself. The check is the online result.
My one piece of opinion, grounded in the six-month PVN rule and the List B recheck rule: the digital switch removed the expiring plastic card but not the expiring deadline. You've simply traded a physical expiry date for a calendar one. The compliance work is the same. It's just moved into your follow-up system, and that system is now where checks get missed.