What the rule actually says #
GOV.UK is blunt about it.
You must check that a job applicant is allowed to work for you in the UK before you employ them.
The word that matters for an agency is "for you". The duty follows employment, so a temporary worker paid through the employment business is checked by the employment business, and a candidate placed permanently is checked by the client who hires them.
That is the legal position. It is not the commercial one. Clients ask to see evidence whether or not the duty is theirs, framework agreements often require it, and nobody wants the conversation that starts with a worker being turned away at a gate.
So the pack gets assembled once and then produced again and again, in whatever format each client's onboarding portal wants it. That duplication, not the check, is where the hours go.
The three routes, and why one process never covers everyone #
GOV.UK sets out three ways to carry out a check, and each one fails differently.
-
An online check using a share code
Fails when the candidate has not generated one, or generates one for the wrong purpose, or lets it lapse. A share code is not available for British or Irish citizens.
-
A manual check of original documents with the applicant present
Fails on availability, because it needs the person and the original document in the same place.
-
Identity document validation technology, through a certified identity service provider
Fails when a document is not of a type the provider can validate.
The consequence for a desk is that the "right to work step" in a process is really three different steps. A single checklist item hides all of that, which is why the tracker says "in progress" for four days.
What happens when permission is time limited #
Where somebody's permission to work has an end date, the check has to be repeated before it expires. For a permanent placement that is the client's problem. For a temp on your payroll it is yours, and it arrives as a date in the future that nothing naturally reminds you about.
Agencies that get bitten by this are rarely careless. They simply had the date in one system, the worker in another, and no single thing that looked at both. That is not an unusual way to run it.
57
UK agencies studied
Stack Logic, reported in Onrec, 1 September 2026
33
tracked right to work manually
Stack Logic, reported in Onrec, 1 September 2026
13
of those used spreadsheets
Stack Logic, reported in Onrec, 1 September 2026
The guidance itself moves #
Right to work checks: an employer's guide was first published on 16 May 2014 and was last updated on 11 September 2026. When we read it, a draft guide dated 11 September 2026 sat alongside a version dated 26 June 2025.
That is worth noticing if your internal process document was written against whichever version happened to be current when somebody built it. A process that quietly encodes old guidance is a real risk, and it is one that no amount of automation detects for you.
What the Conduct Regulations add on top #
Right to work is a separate duty from the agency rules, and the agency rules stack on top of it.
What regulations 19 and 29 require on top of the right to work check
Before an employment business supplies a work-seeker to a hirer, regulation 19 of the Conduct of Employment Agencies and Employment Businesses Regulations 2003 requires it to obtain confirmation of the work-seeker's identity, and that they have the experience, training, qualifications and any authorisation the hirer considers necessary or that the law or a professional body requires.
Regulation 29 then requires records of every work-seeker and hirer application to be kept for at least a year, and allows them to be kept electronically as long as they can be reproduced legibly and delivered within two business days.
Read those two together and the shape of the problem is clear. You are collecting overlapping evidence for two different regimes, from people who are not sitting in your office, and then storing it in a way that has to survive being asked for a year later. The same pattern shows up across the rest of the compliance pack.
Which parts of this run on rules #
Runs on rules
- Asking a candidate for what is missing. Same trigger, same request, same wording
- Prompting again when nothing arrives, which is the single most repeated job on a desk
- Recording what was produced and when
- Diarising an expiry date and raising it in time
- Producing the same pack for a second client. Mostly, once the pack exists in one place
Needs a person
- Deciding a document is genuine and belongs to this person. This is the check
- Deciding what to do when something does not line up
Exactly where judgement earns its keep, and where the liability sits.
That split is the whole point. The check is small and it needs a human. The scaffolding around the check is large, repetitive and mostly mechanical. If your consultants are spending afternoons on the second kind, the honest question is how many hours a month that is, which is what the free tools exist to count.
One thing we will not say #
We will not tell you that automating any of this makes your agency compliant. It does not. The duty is the employer's, the penalty follows the employer, and a faster chase only means the evidence arrives sooner.