Most care home managers have done hundreds of right to work checks. The trouble is that the rules moved twice in two years, and a check that was fine in 2023 can now leave the home exposed. This is what right to work checks for care staff look like today, what changes on 1 October 2026, and how to bring your files up to standard before an inspection or a Home Office visit finds the gap for you.
Why the stakes went up
Since 13 February 2024 the civil penalty for employing someone who has no right to work is up to 45,000 pounds per worker for a first breach and up to 60,000 pounds per worker for a repeat (Immigration (Employment of Adults Subject to Immigration Control) (Maximum Penalty) (Amendment) Order 2024). One missed check on one night carer is a five figure fine.
The only defence is a statutory excuse, and you only have one if the check was done in the prescribed way before the person started work. A check done on day three, or a check that skipped a step, gives you nothing.
The three ways to do a check
The Home Office employer's guide to right to work checks sets out three routes and nothing else counts.
A manual check means you see the original document from List A or List B, check it in the presence of the holder, take a clear copy and write the date of the check on it. For British and Irish citizens this is usually a passport, or a birth certificate together with an official document showing a National Insurance number.
An online check uses a share code. The worker generates a nine character code starting with W through their UKVI account, gives you the code and their date of birth, and you run it on the Home Office online service. The code is valid for 90 days from issue, and you keep the profile page the service gives you. Anyone with an eVisa, which is now almost everyone with time limited permission, is checked this way.
A digital check uses a registered identity service provider and is only for holders of a valid British or Irish passport, including one that expired up to six months ago. It suits remote starters, and the home still keeps the result.
What no longer works
Biometric Residence Permits stopped being acceptable at the end of 2024. If a file holds a BRP copy as the only evidence, that worker needs an online check with a share code now, not at the next review. The same goes for a manual copy of an expired BRP, which the guidance says is not acceptable proof at all.
Copies of visas in passports, letters from solicitors and application receipts also do not work on their own. Where someone has an outstanding application, the route is the Employer Checking Service, which gives you a Positive Verification Notice and a statutory excuse for six months.
Follow up checks
Care homes run into trouble here more than anywhere. If a worker's permission has an end date, the home has to do a follow up check before that date. Put the expiry in the rota system or the HR system, whichever someone actually looks at, and set the reminder for six weeks ahead, because a new share code takes the worker time to sort out and the home cannot lawfully keep them on shift past the date.
Students on a visa have hours limits in term time. Skilled Worker visa holders sponsored by another employer can usually take supplementary work, but the conditions are on the visa, not on your assumptions, so check the online profile rather than the worker's word.
What changes on 1 October 2026
Until now the civil penalty scheme covered employees. From 1 October 2026 the Home Office extends it to people engaged under a worker's contract, individual sub contractors and workers found through online matching services, where the engagement starts on or after that date. The draft employer's guide of 11 September 2026 sets this out.
For a care home this catches the arrangements that were treated as somebody else's problem: the self employed activities coordinator, the maintenance contractor who comes in three days a week, the cook found through an app. If the person works for the home under a contract and is not on someone else's payroll, the home needs a check on file from 1 October.
Agency staff
If a worker comes through an agency and is employed or engaged by the agency, the agency is the employer for right to work purposes and carries the penalty. That only holds if the agency actually did a compliant check. Ask to see it. A proper agency will share the compliance file before the first shift, with the right to work evidence, the DBS certificate and training dates in it, and will tell you the expiry date of any time limited permission without being asked.
The guidance is clear that the employer cannot pass responsibility to someone else for its own direct hires. A check done by a recruitment agency on a candidate you then employ yourself does not give you a statutory excuse. Do your own check before the start date, every time.
A file audit you can do this week
Pull the right to work evidence for every current worker into one list with three columns: the route used, the date of the check, and any expiry. Anything with a BRP as the only evidence goes to the top of the list for an online check. Anything with an expiry in the next three months gets a follow up booked now. Anything where the date of the check is missing, or is after the start date, is a gap, and the honest answer is that the home has no statutory excuse for that person until a fresh check is done.
Records are kept for the length of employment and two years after it ends, then destroyed. That is a retention rule, not a suggestion, and the same file audit is the place to clear out what should already have gone.
Flamingo Workforce supplies support workers, care team leaders and nurses to care providers across the UK with the right to work check, enhanced DBS and training evidence shared before the first shift. If you would like cover while you bring your own files up to date, get in touch through flamingoworkforce.com/contact.