A hiring manager wants a start date locked in for Monday. The candidate's visa paperwork is “basically sorted,” the recruiter says, and nobody wants to be the person who slows down an offer over what feels like admin. Six weeks later, an immigration enforcement visit turns that shortcut into a five-figure civil penalty and a candidate who has to stop working immediately.
That is the gap right-to-work and visa-sponsorship compliance sits in: a step that feels procedural until the one time it is not. This is a practical explainer, not legal advice — immigration and employment law is jurisdiction-specific, changes on short notice, and deserves a real conversation with qualified counsel before you rely on any of it for a specific hire.
What a Right-to-Work Check Actually Verifies
A right-to-work check confirms a specific worker is legally allowed to do the specific job they are being hired for, in that country, for that employer. It is not a background check or a credential check — it verifies immigration and work-authorization status through original documents, an online government service, or certified digital identity verification.
The distinction matters because agencies sometimes bundle it mentally with reference or background checks, as if it is one more box on the same list. It is not. A background check tells you about someone's history. A right-to-work check tells you whether employing them at all is currently lawful — and getting that wrong exposes the employer, not just the candidate.
The UK's Post-Brexit Right-to-Work Reality
UK employers now have three lawful ways to check right to work: a Home Office online share code for most non-British and non-Irish nationals, a manual check of original documents, or certified Identity Document Validation Technology. British and Irish citizens cannot get a share code, so they are checked manually or via IDVT instead.
This three-track system is a direct product of Brexit ending free movement — pre-2021, an EU passport was largely sufficient on its own. The official employer's guide to right to work checks splits acceptable documents into List A (permanent right to work, including British and Irish citizens and those with settled status) and List B (time-limited permission, which requires a follow-up check before the permission expires). The online checking service is the fastest of the three routes when a candidate holds digital immigration status, but it only works if the candidate actually generates and shares a valid code — a step that trips up recruiters unfamiliar with the process more often than the underlying check itself.
A right-to-work check is not proof someone is trustworthy. It is proof that employing them today, in this role, in this country, does not break the law.
What Happens When a Check Is Skipped or Done Wrong
Getting it wrong is expensive and specific, not vague. Current UK guidance states civil penalties of up to £60,000 per illegal worker for employers who have not carried out a compliant check — a figure worth confirming against the live gov.uk page rather than assumed, since these thresholds get revised.
The penalty framework exists specifically to reward employers who did the check properly even if the candidate turns out to have misrepresented their status. That is the entire logic of the system: a correctly performed, correctly documented check is a statutory excuse, while a skipped or sloppy one leaves the employer fully exposed regardless of whether the candidate acted in good faith. This is why the process matters as much as the outcome — a company that checks every hire consistently is in a completely different legal position than one that checks selectively, even if both employ the same illegal worker by accident.
Visa Sponsorship Adds a Second, Ongoing Layer
A right-to-work check is a single moment; visa sponsorship is an ongoing obligation. Employers holding a sponsor licence must track visa expiry dates, report role or salary changes, and monitor continued eligibility for as long as the sponsorship lasts — closer to a subscription than a one-time verification.
The EU picture runs on separate national systems rather than one shared framework. The EU Blue Card gives a common route for highly qualified non-EU hires across most member states, but the underlying sponsorship obligations, document requirements, and renewal timelines still vary country by country. An agency placing candidates across several EU markets is managing several separate compliance regimes at once, not one — which is precisely the kind of detail worth confirming with local counsel before a client commitment gets made on the assumption that “EU rules” are uniform.
| Task | Handled by software | Still needs a human |
|---|---|---|
| Capturing and storing document images | Yes | Spot-checking image quality and completeness |
| Tracking visa or permission expiry dates | Yes | Deciding what happens if a renewal is delayed |
| Sending renewal reminders | Yes | Following up when a candidate does not respond |
| Assessing whether a document looks genuine | Partial (IDVT for certain document types) | Judgment calls on unusual or borderline cases |
| Interpreting an ambiguous immigration status | No | Qualified immigration counsel |
| Responding to a Home Office or authority query | No | Legal sign-off required |
What Compliance Software Actually Automates
Compliance software handles the mechanical, repeatable parts: capturing document images at the right resolution, flagging expiry dates before they lapse, sending renewal reminders on a schedule, and keeping a timestamped audit trail of who checked what and when. None of that is judgment — it is logistics done consistently.
The value shows up most clearly at volume. One hire is easy to track in someone's head. Fifty hires across a dozen visa categories, each with a different expiry date and renewal window, is not — and that is exactly where a manual process quietly starts missing renewals, because nobody set a reminder for the one candidate whose visa expires on an unusual date. Software does not get tired or distracted by a busy week; a spreadsheet maintained by hand does.
What Still Needs a Human — and a Lawyer
Software cannot judge whether a document looks genuine when the pattern is subtle, interpret an ambiguous visa status, or decide how to respond to a Home Office query. Anything beyond a straightforward document check — appeals, sponsor licence audits, unusual immigration histories — belongs with qualified immigration counsel, not a dashboard.
A reminder before a visa expires is automation. A decision about what to do when it does is not — that call still belongs to a person who understands the specific case, not a rules engine.
This is the tradeoff worth being honest about: compliance software reduces the chance of human error on the routine ninety percent of cases, but it does not reduce legal liability to zero, and it certainly does not replace a lawyer for the cases that fall outside the routine pattern. A tool that flags a visa expiring in thirty days is genuinely useful. A tool that tells you whether a specific candidate's complicated immigration history clears them for a specific role is making a claim it cannot actually back up.
GDPR and the Document Retention Question
Right-to-work documents are personal data, so GDPR's storage-limitation principle applies on top of immigration rules. UK guidance says employers should keep copies for the duration of employment plus two years afterward — not indefinitely, and not deleted early, since both extremes create separate compliance problems.
The ICO's storage limitation guidance does not set a universal number for every category of data — it requires employers to justify why they are keeping something for as long as they are keeping it. For right-to-work documents specifically, the recognized practice mirrors the retention period set out in the government's own checking guidance, and the ICO's employment records guidance is the right place to check current expectations rather than relying on a rule of thumb that might have shifted. This is one of several data-handling questions that overlaps directly with GDPR compliance for recruitment agencies more broadly, and the same retention discipline described in candidate data retention rules applies to immigration documents just as much as CVs.
Yena does not provide immigration or right-to-work compliance features, and it should not be mistaken for one — that is a specialized category with its own vendors and its own legal obligations. What a recruiting CRM can reasonably do is keep a candidate's compliance status visible alongside the rest of their record, so a recruiter checking a sourced candidate's profile can see at a glance whether a right-to-work flag needs following up before a submission goes out — a visibility layer, not a substitute for the actual check. Agencies building out a fuller compliance checklist may also find the recruitment toolkit useful for organizing the surrounding process.
None of this removes the underlying obligation. Compliance software reduces error and creates a defensible paper trail; it does not transfer legal liability away from the employer, and it does not replace the judgment of someone qualified to interpret immigration law. Get the routine cases automated, budget real time and real legal advice for the cases that are not routine, and treat every stated penalty figure, retention period, and eligibility rule in this space as something to verify against the current official source before acting on it.
Frequently Asked Questions
Is right-to-work check software a legal requirement?
No single software is legally required — what's required is that the check itself happens correctly and on time, using one of the recognized methods. Software is a tool for consistency and audit trail; it does not substitute for actually running a valid check on every hire before their first day.
How often should visa sponsorship status be reviewed?
Sponsor licence holders are expected to monitor continuously, not just at the start of employment — visa expiry dates, role changes, and salary thresholds can all affect eligibility mid-employment. Most compliance tools set automated reminders 90, 60, and 30 days before an expiry date, but the review itself is a human decision.
Can an ATS handle right-to-work compliance?
Some ATS platforms store scanned right-to-work documents alongside a candidate's profile, which helps centralize records, but that is document storage, not compliance automation. Dedicated compliance tools add expiry tracking, reminder workflows, and audit logging that a general-purpose ATS usually does not build for, since it is a narrower, deeper problem.
What is the biggest right-to-work mistake agencies make?
Treating it as a one-time box to tick at onboarding instead of an ongoing record. The common failure is not skipping the initial check — it is losing track of time-limited permissions, missing a renewal, or letting document copies sit past the point they should have been reviewed or deleted.
Is this article legal advice?
No. This is a practical overview of how right-to-work and visa-sponsorship compliance generally works, based on published government guidance current at the time of writing. Immigration and employment law changes, varies by country, and depends on individual circumstances — always verify current requirements with qualified immigration or employment counsel.