The Passport, the Share Code and the Start Date: Right-to-Work Checks Done Properly in 2026

There's a particular kind of Monday morning chaos that plays out in UK offices several times a year. A new starter is standing in reception with a coffee and a lanyard, and somewhere upstairs a manager has just realised that nobody has actually looked at their documents. Everyone smiles. Everyone assumes it will be fine.

It usually is fine. But "usually" is doing a lot of heavy lifting in that sentence — and once you understand how right-to-work checks are meant to run, the timeline stops feeling like paperwork and starts feeling something closer to insurance.

What a right-to-work check is really for

Two things happen at once. The employer satisfies itself that the person can legally do the job in the UK, and — provided the check is done properly — it gains a "statutory excuse" against a civil penalty if that later turns out to be wrong. Those penalties are not small. At the time of writing they run to £45,000 per worker for a first breach and £60,000 for repeat breaches.

Notice the tense there: done properly, in the right order. A beautifully filed check that happens on day three protects nobody.

Timing: before day one, not on day one

The check has to be finished before the person starts work. Not on the morning they arrive, not at the end of induction week — before. Once employment has begun, there is no statutory excuse to be had, however honest the oversight.

In practice that means building the check into the offer stage. A sensible rhythm looks like this: verbal offer, written offer with the check flagged as a condition, documents or share code within a week, check completed and recorded, contract signed, start date confirmed. Most HR teams aim to finish it within the 28 days before the start date, which is early enough to catch a problem while there's still room to move the date rather than cancel it altogether.

And if someone can start tomorrow? Do the check tomorrow morning, before they're on the clock. Rushing the start date is fine. Rushing the check is how things get missed.

The document list, and the things that don't count

The Home Office splits documents into two groups. List A means the person has a permanent right to work — a British or Irish passport, a certificate of naturalisation alongside a National Insurance number, or settled status proved through the online service. List B means time-limited permission, which carries a follow-up obligation later on.

Two changes from 2024 still catch people out in 2026. Biometric residence permits were retired at the end of that year, so a card in a wallet is no longer a valid way to prove status — the person needs a UKVI account and a share code instead. And a driving licence, a National Insurance card, a birth certificate on its own, or a photocopy of anything are not right-to-work documents. Nor, in most cases, is an expired passport.

How the share code actually works

The candidate signs in to GOV.UK, goes to their UKVI account and generates a code specifically for proving right to work to an employer. That distinction matters — codes are generated for a purpose, and one produced for a landlord or a letting agent won't do the job here.

The employer then uses the Home Office's online checking service, enters the code and the applicant's date of birth, and gets back a result setting out what the person is permitted to do and until when. Save that outcome — the reference number, the date, the details shown — because that is your record.

What does not work: a screenshot of the code, a forwarded email, a PDF the candidate has sent over, or a code that expired before anyone got round to checking it. The online service has to be used while the code is live, and the whole thing has to be wrapped up before the start date.

The traps worth knowing about

• Name mismatches. A marriage certificate, a deed poll, a passport in a maiden name — the record needs to reconcile. Ask, don't assume.
• Time-limited permission expiring mid-probation. If someone's visa runs out in month four, diary the follow-up check now, not when a calendar reminder fires in a panic.
• Agency and contractor staff. If you're the hirer, satisfy yourself that the agency has done the check, and get it in writing.
• Reusing an old check. A check from a previous stint can sometimes be relied on for a rehire, but only if it was done properly and — where permission was time-limited — the follow-up happened. When in doubt, do it again.
• Checking only some people. The rules apply to everyone you employ, not just the candidates whose names sound a particular way. Selective checking is a discrimination risk and a bad look.
• Storing too much for too long. Keep the record for the length of employment plus two years, and no longer. Lock it down, too — a scanned passport sitting in a shared inbox is a data protection problem waiting to happen.

When the system, not the person, is the problem

Sometimes the obstacle is technical: an eVisa that won't load, a status that hasn't linked to a newly renewed passport, a glitch on a Friday afternoon. In those cases the employer can use the Home Office Employer Checking Service, which will issue a Positive Verification Notice if the person does have the right to work. That notice gives a short window of protection — currently 28 days from the date printed on it — so it needs watching rather than filing.

And if the check reveals that someone genuinely cannot work in the UK, the answer is an honest conversation and, where possible, a different start date. Not a quiet workaround.

A pre-start checklist

For candidates:

• Make sure your UKVI account is live and your current passport is linked to it
• Generate a share code for proving right to work to an employer, and send it with your date of birth
• If you're using documents instead, bring originals — not photos of them
• Flag any name change, in advance, rather than being asked about it on the day

For employers:

• Decide who owns the check, and write it into the offer letter
• Complete it before day one, and record the date it was done
• Save the online result, or a dated copy of the document
• Diary any follow-up for time-limited permission
• Store securely, share narrowly, delete on schedule

None of this is glamorous. But five minutes of checking, done in the right order, is the difference between a smooth first day and a rather awkward conversation with a new colleague who has already been paid.