Collect the employee's 9-character share code and date of birth before their first day of work; share codes are generated by the employee through the UK Visas and Immigration online service.
Navigate to the official GOV.UK employer right-to-work checking service (the authoritative tool for this check) and enter the share code and the employee's date of birth to retrieve their immigration status and work permission details.
Confirm that the status displayed shows the individual has the right to work for your type of role and that any restrictions (such as maximum working hours) are compatible with the position.
Record the outcome of the check, the date it was performed, and retain a copy of the check result as provided by the GOV.UK service — this documentation establishes the statutory excuse against civil penalties.
Note the share code validity: codes are typically valid for 90 days from generation; if a hire is delayed beyond expiry, a fresh code must be requested.
Set a reminder for time-limited right-to-work permissions (such as pre-settled status or visa expiry dates) so that follow-up right-to-work checks are conducted before the permission lapses.
Known gotchas
Only using the official GOV.UK checking service establishes the statutory excuse; using a third-party API aggregator for the verification check alone (without the official service record) may not provide the same legal protection.
British and Irish passport holders do not use share codes — attempting to obtain a share code from them is unnecessary and may confuse candidates; these workers are verified by checking their physical passport.
Failing to conduct a right-to-work check before employment begins (rather than on day one) can result in civil penalties of up to £60,000 per illegal worker even if a check is later performed.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp