Welcome back to Compliance Pods for Legal Professionals, and just a reminder that the content of this podcast is for general information purposes only and does not constitute legal advice.So Buckle up. Because Here. We. Go. Hi Paul, let me start with the number that makes employers sit up straight: up to 20,000 pounds per illegal worker under the Immigration Act 2014 if you get right to work checks wrong. Not per investigation -- per worker. Per worker is the bit that bites, isn't it? 20,000 pounds isn't an abstract compliance figure. For a small firm, two bad hires and you're staring at 40,000 pounds plus the sort of reputational mess that has everyone suddenly speaking in very careful emails. Exactly. And the source material goes further. Under the Immigration Act 2016, in serious cases, you can also be looking at criminal charges, imprisonment, and unlimited fines. So this is not one of those nice-to-have HR admin jobs. This is legal risk management. Which is why I always smile -- grimly -- when someone says, "We saw the passport, so we're fine." That sentence has the same energy as, "I wore a helmet once, therefore I'm an Ironman." That's not how standards work. Yes. Seeing ID is not the same thing as obtaining a statutory excuse. And that distinction matters because the statutory excuse is what protects the employer against a civil penalty if, despite your checks, the person turns out not to have the right to work. Wait -- "statutory excuse" is one of those legal phrases people nod at and secretly don't enjoy. In plain English, that's your evidence that you followed the Home Office-prescribed process before the employee started? That's it. You do the prescribed check properly, you keep the evidence, and you've got a defence against the civil penalty. But if all you've done is glance at a document, or accept something by email because it felt convenient, that is NOT the same thing. And the scope catches people out. This isn't just permanent fee earners and support staff, is it? No -- and this is where small firms can be exposed without realising it. The obligation applies to permanent, part-time, and temporary staff. It also applies to unpaid workers and work experience. So if a practice says, "They're only with us for a couple of weeks," that does not switch the rules off. That "unpaid and work experience" point is the one I want listeners to hang onto. Because the dangerous assumption is: no salary, no employment risk. But the source says right to work checks apply there too. Correct. And all businesses are required by the Home Office to keep evidence of the checks they carry out, and to check the document is genuine and that the applicant is the rightful holder. So there are really two questions: is the person allowed to work, and is this actually THEIR identity? Which links to something a bit darker in the material -- modern slavery and human trafficking. The note about verifying bank accounts of new employees... that's a reminder this isn't just a paperwork ritual. There are real exploitation risks in the background. Yes, and that is worth saying plainly. Right to work checks are about immigration compliance, but they're also part of a broader due-diligence picture. Failing to do them properly creates legal risk, ethical risk, and reputational risk. Clients do not enjoy learning that their law firm cut corners on basic workforce controls. I had a conversation not long ago -- and honestly, it's such an easy mistake -- where someone said, "But we interviewed them on video, we saw them hold up the passport, what more do you want?" And I get why people think that. Remote hiring, busy teams, everybody trying to be efficient. But "we saw it on screen" feels compliant in a way that can be dangerously comforting. That's exactly the trap. The current rules are about whether you followed one of the accepted methods in the prescribed way. So the real question for firms in 2026 is not, "Did we see some ID?" It's, "Did we complete the correct process before employment started so that we can rely on a statutory excuse?" And if the answer is "sort of"... that's usually not the answer you want. Okay, so let's do the practical bit. If I'm running a small law firm in England and Wales, what are the three Routes that actually count before somebody starts work? There are three valid Routes. One: a manual right to work check. Two: a Home Office online check. Three: a right to work check using Identity Verification Technology -- IDVT -- through an Identity Service Provider, an IDSP. Three Routes. Manual, Home Office online, or IDVT through an IDSP. That's clean. Now, the thing that changed on 1 October 2022 -- that's the key date, isn't it? -- is that the Covid-adjusted process ended. Yes. The adjusted Covid process ended on 30 September 2022. That was the period when employers could receive ID documents by email or check them over video chat. From 1 October 2022, that stopped being good enough. And the source is very blunt: you cannot validate ID documents over video calls, and you cannot receive ID documents by email as your right to work process. Which will upset precisely everyone who got used to doing it that way. But the reason matters. On a video call, you might compare the face to the document, but you're not checking whether the document itself is genuine. Exactly. In person, you have a better chance of spotting tampering or missing security features like holographs. Over video, camera quality and lighting make that much harder. So if a firm still wants a remote process, the proper Route is a certified IDSP. And "certified" is doing a lot of work there. Not just any tech supplier with a slick website. Correct -- CERTIFIED. The source refers to the government's Digital Identities and Attributes Trust Framework, with certified providers independently assessed against that standard. If you're using IDVT, the statutory excuse only comes through if the IDSP has complied with the required steps as well. So let me try to play this back. If I've got a prospective employee with a valid British or Irish passport, I can use a certified IDSP to run the identity verification. But I do not just outsource my brain and wander off. Nicely put. Yes -- the employer still has obligations. You must obtain the output of the IDVT identity check from the IDSP, with a clear, legible copy of the check and the document in a format that cannot be altered. Then you review it. Is it an in-date valid British or Irish passport, or Irish passport card? Has the identity been verified? Do the photograph and biographic details match the person you've met? That last bit is the imposter check. And I like that phrase because it's a little bit spy novel, but it's actually very practical. Very practical. The guidance says you must satisfy yourself that the photograph and details -- for example date of birth -- on the IDSP output are consistent with the individual presenting for work, so they are not an imposter. That can be done in person or by video call. Important distinction: the VIDEO CALL can be used for the imposter check, not for validating the ID document itself. There it is. That's the line people miss. Video call for the person check, yes. Video call for the document validation, no. And the source gives the reason: bait-and-switch. Qualified worker does the process, somebody else turns up to do the job. Yes. And if names differ between documents, you have to establish why. Do not hire unless you're satisfied the documents relate to that person. If it's reasonably apparent the person is not the individual linked to the identity verified by the IDSP, you do not get a statutory excuse. What about non-British or non-Irish nationals? Because that's where the Home Office online service comes in. Right. For the Home Office online check, the candidate must obtain a share code. You then access the Home Office online system yourself, enter the share code and date of birth, and review the report. You must check the person in the report matches the individual you interviewed and that the report allows them to work legally. Then keep evidence by downloading the profile page as a PDF or HTML file. And this bit is annoyingly specific -- which usually means it's important. If an IDSP gets that Home Office online report on your behalf, the employer does NOT establish a statutory excuse. Precisely. The employer must obtain that report from the Home Office online service using the employee's share code. Finally, retention: keep the evidence securely for the duration of employment and for two years afterwards, then securely destroy it. So the memorable takeaway is this: right to work compliance is not "did we see a passport?" It's "did we use one of the three valid Routes, complete the imposter check, resolve inconsistencies, and keep unalterable evidence for employment plus two years?" If not, that 20,000 pounds number is no longer theoretical. So, from all at Legal Compliance Support tody:, stay compliant, Stay safe and we’ll catch you next time!
Audio Coursesby Jellypod