Right to work checks for hospitality: the boring 10 minutes that protects everything

It was a Tuesday in February at Harbourside, the slow kind, maybe eight covers in for breakfast. A man in a fleece walked in, asked for the manager, and produced a Home Office ID card. He was not there for a coffee. He was there because an ex-kitchen porter we had let go three months earlier had filed something with ACAS, and somewhere in that paperwork he had mentioned that we did not check his passport properly. So here we were.

We were lucky. Our files were okay. Not great, but okay. He sat at the corner table for two hours, went through the folder, asked who had done each check, asked to see the photocopies, asked why one of them was undated. By the time he left I had aged about five years. The fine for a single illegal worker at that point was up to £20,000. It is now £60,000 per worker for a repeat offence. We had eleven people on the books.

If you have never had this visit, I would like to spare you the experience. This is what I wish someone had sat me down and explained when I opened the first site.

Why this matters

The current civil penalty for employing someone without the right to work is up to £45,000 for a first breach and up to £60,000 per worker for repeat breaches. That is per person. If you have a kitchen of five and two of them are not checked properly, the maths gets ugly fast. The Home Office updated these figures in February 2024 and they have not got smaller since.

The other thing to understand is that this is not really about catching bad actors. The Home Office knows that most café and restaurant owners are not running illegal labour rings. What they are checking is whether you have a system. If your records are clean and dated and you can show your statutory excuse (the legal protection you get from doing a compliant check), you walk away fine even if it later turns out a document was fake. If your records are scrappy, you get fined whether or not the person was actually working illegally.

So the boring ten minutes at the start of someone's employment is not really about that person. It is about the £45,000 you do not pay later.

The three acceptable check types in 2026

There used to be one way to do this: photocopy the passport, sign and date it, file it. That changed in 2022 and it has shifted again since. Right now, in 2026, you have three options depending on who you are hiring.

1. Digital identity service provider (IDSP) for British and Irish citizens

If you are hiring someone with a British or Irish passport, you can use a certified IDSP to verify them. They take a photo of their passport on their phone, do a liveness check (a little selfie video), and the provider confirms the document is genuine and matches the person. You get a digital report. This is the path most operators now use because it is fast, the evidence is timestamped automatically, and you do not have to learn what a real UK passport looks like under UV light.

The catch: it has to be a certified provider on the gov.uk list. Not any old ID scanning app. And it only covers British and Irish citizens with valid passports.

2. Share code via gov.uk for everyone else

For anyone who is not a British or Irish citizen with a passport, the check happens through the Home Office online service. The candidate generates a share code at gov.uk/prove-right-to-work. They give you the code plus their date of birth. You go to gov.uk/view-right-to-work, enter the code and date, and you see their status: do they have the right to work, what restrictions apply (hours per week if a student, for example), and when the permission expires.

You print or save that page. Date it. Sign it. That is your statutory excuse. This covers EU settled status holders, sponsored workers, students, dependants, the lot.

3. Manual check (rare now, but still allowed in narrow cases)

The old-fashioned check (look at the original passport, copy it, sign and date) is now only valid for British and Irish citizens, and only if you are not using an IDSP. You take a clear copy of the photo page, write the date of the check on it, write the name of the person who did the check, and add a signed statement that the document appeared genuine and matched the holder.

Almost no one should be doing this in 2026. The IDSP route is faster and the evidence is harder to mess up. The only reason to keep manual checks in your toolkit is if your IDSP is down on a Saturday and someone needs to start a trial shift on Monday.

What you actually keep on file

This is where most operators get caught out. The check itself is straightforward. The paperwork around the check is what an inspector looks at.

For every employee, you need:

• A copy of the document or digital report (passport page, share code result page, or IDSP verification report).
• The date the check was carried out, in writing, on the copy itself.
• The name of the person who did the check (the manager, you, whoever).
• A signed or initialled statement confirming the document appeared genuine and matched the person presenting it.
• The retention clock: keep all of this for the duration of employment, plus two years after they leave. Minimum.

I would also recommend a one-page summary sheet at the front of each staff file: name, start date, check method, check date, document expiry (if applicable), follow-up check date (if applicable). When the inspector arrives, you do not want to be flicking through a folder. You want to hand them a sheet that says "here is what we did, here is where the evidence is".

One more thing on retention. If you bin a file the day someone leaves, you have just thrown away your statutory excuse. If the Home Office turns up six months later asking about a former employee, you have nothing. Two years post-employment is the floor. I kept ours for five.

Follow-up checks for time-limited status

Some people have permission to work in the UK that expires. Students on visas, skilled workers, anyone with a time-limited grant. When you do the initial share code check, the result page will tell you the expiry date.

Put a calendar reminder a month before it expires. Do a fresh share code check before the old permission lapses. If you let someone work past their expiry without a follow-up check, you lose your statutory excuse from that point forward, even if you did the first check perfectly. This is the bit that catches out kitchens hiring sponsored chefs and front-of-house teams hiring students.

Agency staff and contractors

This one surprises people. If you take on agency staff, in most cases the agency is responsible for the right to work check. They are the employer. But there are two things you need to do anyway.

First, get it in writing from the agency that they have done compliant checks on every worker they send you. A signed contract clause or a separate compliance letter. If you cannot evidence that you reasonably believed checks had been done, you can still get pulled into a penalty case.

Second, for self-employed contractors (a cleaner you pay through their own limited company, a freelance pastry chef invoicing you weekly), the rules get murky. If they are genuinely self-employed and providing services through their own business, you do not need to do a right to work check. If they are effectively working as an employee but on a contractor invoice (which happens a lot in hospitality and is its own legal mess), you probably do.

The safe play: if in doubt, ask for a share code. It costs the contractor nothing and takes you two minutes. Anyone who refuses on principle is telling you something.

Common mistakes

• Photocopying the passport but not dating it: An undated copy is not evidence. The inspector needs to see when you did the check, in writing, on the document itself. A folder full of clean photocopies with no dates is worth nothing.
• Checking on day one of the trial shift, not before: The check has to happen before the person starts working. A trial shift counts as work. If they cut their finger on a mandolin during a trial and you have not checked them, you have two problems instead of one.
• Trusting a National Insurance number as proof: A NI number proves nothing about right to work. People have NI numbers and no permission to work. Do not let your manager file an NI number and call it a check.
• Forgetting follow-up checks on visa expiry: The initial check is not a forever pass. If someone's permission expires and you carry on employing them with no fresh check, your statutory excuse evaporates from that date.
• Binning files when staff leave: Two years minimum after employment ends. The Home Office can ask about former staff. Without the file, you have no defence.
• Assuming the agency has it covered: Get the agency's compliance statement in writing. If they cannot produce it, find a different agency.