Digital identity checks: what an agency may verify itself

Biometric residence permits stopped being issued on 31 October 2024, and a manual check of an expired one buys an agency no protection. Candidates still bring them to onboarding appointments. The Home Office's draft employer's guide of 16 July 2026 is blunt: "A manual check of an original, expired BRP is not acceptable proof of right to work in the UK". On the draft's account, the only route to a statutory excuse for that candidate is the Home Office online check.

Digital identity checks carry the next date. Using a certified provider is a recommendation under the guidance in force today. Under guidance published in draft, it becomes a condition of the digital route from 1 October 2026.

Three right to work routes, one DBS route, and what each costs

Every candidate file takes one of three routes, and the wrong one leaves you with no defence. The employer's guide of 26 June 2025, the version in force, sets out the three and splits eligibility in its own parentheses:

"1. a manual right to work check (all) 2. a right to work check using a digital verification service (British and Irish citizens only). 3. a Home Office online right to work check (non-British and non-Irish citizens)"

The manual check works for every nationality and needs nothing bought in. The Home Office impact assessment puts it at 7.5 minutes of administrative time and £2.44. The Home Office online check covers non-British and non-Irish citizens holding an eVisa, carries no fee, and runs to 5.5 minutes.

Digital identity checks are the narrowest route. The right to work supplementary code 1.0, published in pre-release, permits three documents: "A British passport, or An Irish passport, or An Irish passport card". Employer handling time falls to about a minute, against a provider fee the Home Office models at £2.50, an assumption rather than an observed price. The work moves instead of disappearing: the candidate's share goes from 2 minutes to 7.5 minutes on their own phone.

DBS identity checking is a fourth route, with a different regulator and three prescribed document combinations. Your own staff can do that checking, though submitting the application needs registered body status or an umbrella body.

You cannot delegate the check and keep the statutory excuse

Your clients cannot rely on your checks for their own direct hires. The employer's guide of 26 June 2025 names recruitment agencies directly:

"Other than where you use an IDSP for checks on British and Irish citizens who hold a valid passport (including Irish passport cards), you cannot establish a statutory excuse if the check is performed by a third party, such as a recruitment agency or your professional adviser"

That clause is protective and expensive at once. You are the employer under the Home Office right to work scheme.

The draft employer's guide of 16 July 2026 draws the line every compliance system sits behind. An employer may use a third party for "the technical aspects of the check, information gathering or specialised equipment". The responsibility for performing the check, "in order to obtain a statutory excuse from a civil penalty", remains "with them as the employer".

Getting the route wrong is priced by the code of practice in force since 13 February 2024. A first breach starts at £45,000 per illegal worker and a repeat at £60,000, both before mitigation. The figures are per worker, so one wrong routing decision is priced separately on every file it touched.

The published guidance on 1 October 2026, and its status

The October change rests on documents still in draft. The employer's guide of 26 June 2025 states today's position without ambiguity: "It is not currently mandatory for you to use a certified DVS". Annex C adds that this "will change in the near future".

The draft employer's guide of 16 July 2026 describes the changed position. Where an employer runs digital identity checks, "it is mandatory that the DVSP is registered on the Office for Digital Identities Attributes (OfDIA) register, and that they are able to provide right to work checks". The vocabulary moves too, from Identity Service Provider and Identity Document Validation Technology to right to work digital verification service provider.

The date comes from guidance. The draft employer's guide of 16 July 2026 is stated to come into force on 1 October 2026. The draft code of practice of 30 June 2026, the seventh version, says the same, and NHS Employers repeated it on 11 August 2026. No commencement instrument naming 1 October 2026, or section 48 of the Border Security, Asylum and Immigration Act 2025, was located in preparing this piece. The guide carrying the date is itself a draft. The version in force as at 23 August 2026 is the guide of 26 June 2025.

The scheme behind the register has its own trigger. The trust framework 1.0 and the right to work supplementary code 1.0 come into force "on the date the first conformity assessment body ('CAB') is accredited to certify against it", no earlier than 1 September 2026. No accreditation had been announced as at 23 August 2026. Certification also expires, and five providers lost theirs in April 2026 when their beta certificates ran out.

DBS already requires certified digital identity checks; right to work does not yet

An agency running DBS and right to work through one provider already works to two different rules. DBS digital identity verification guidance settles its side with one word. "RBs and ROs must use a DVS certified by an approved conformity assessment body (or 'CAB') against a current publication of both the trust framework and the supplementary code".

The right to work guide in force, dated 26 June 2025, still says certification is not currently mandatory there.

A digital check does not remove the rest of the record. The registered body still has to establish every previous name change and verify a current address against evidence dated within 90 days. It still needs a five-year address history and two years of audit trails. The regulated step is one line. The rest is yours.

Extended liability does not move the duty to your client

The duty stays with you while your worker is on someone else's site. Section 48 of the 2025 Act, in force on 1 October 2026 per the draft employer's guide of 16 July 2026, inserts extended liability into the Immigration, Asylum and Nationality Act 2006. NHS Employers describes the extension as primarily aimed at the gig economy.

Example 12 in that draft guide covers a business taking temporary workers from an employment business for its own operations. It concludes that the provisions "therefore do not apply to the manufacturing company or the employment business", and liability remains "with the employment business as the employer of the workers whilst they are on this assignment".

Substitute a hospital for the factory and a locum for the production worker. NHS Employers told the other side of the transaction the same thing: agencies remain responsible for right to work checks as the direct employer.

Your client's response is to ask you for evidence. The NHS Employers identity checks standard requires the employing organisation to "gain the necessary assurances from the staffing provider" that identity checks have been carried out to the NHS Employment Check standards. Where the placement sits with a CQC-registered provider, Schedule 3 to the 2014 Regulated Activities Regulations gives the same file a second audience.

Where the platform boundary actually falls

No software performs digital identity checks in the regulated sense, and none issues a statutory excuse. Credentially does not sit in that step and makes no claim to. That Home Office wording on technical support and specialised equipment marks out the ground for any system.

Inside that ground there is plenty to do. A requirement set can carry the routing decision, so the correct route is attached to a candidate before anyone opens the file. An eVisa holder gets the online check. A British or Irish passport holder who consents gets the digital route. Anyone who declines gets a manual check, which the draft employer's guide of 16 July 2026 requires you to offer without treating them less favourably.

Uploaded documents are classified and their data extracted, so a passport is recognised as one and its dates are read instead of retyped. Right to work verification sits in the same record as the DBS position, and compliance monitoring holds the dates that follow. Network Recruitment Wales has published compliance moving from 68 to 95 per cent over two months. The cost of clearing a placement can be modelled route by route in an onboarding cost calculator.

The same certificate, with the 30-day window in the record

A locum's enhanced DBS certificate is issued on 12 March. Nobody prompts registration on the DBS Update Service, which costs £16 a year and has to be joined within 30 days of issue. By late April the window has closed, with no retrospective fix.

In September a second client wants its own assurance. Without the Update Service the agency applies again, at £49.50, and then waits. DBS met the 14-day despatch standard 75.0 per cent of the time in 2025-26 against an 80.0 per cent target, having missed that target three years running.

Held as a dated task in Credentially, 12 March generates a prompt the same day. The candidate registers from their phone that evening. The five conditions for a later status check are already on file: original certificate seen, identity verified, written consent, matching level, matching workforce. In September the status check returns immediately and costs nothing. That one prompt is worth £49.50 avoided against a £16 registration, and a placement that starts without a second wait.

What to check in your own process before October

Five checks, all doable from your own desk this month.

• Find the provider running your digital identity checks and confirm it is on the OfDIA register, and against which supplementary codes. DBS and right to work are separate entries.
• Ask that provider when its current certificate expires and what it is certifying against next.
• Search your process documents and candidate-facing pages for IDSP and IDVT. NHS Employers has moved to the new vocabulary.
• Pull your last 50 right to work files and record which route each one used. A manual check on an expired biometric residence permit is a file with no statutory excuse behind it.
• Confirm your Update Service prompt fires on the day a certificate is issued.

Put the register check back in the diary for the week of 28 September, when whatever applies on 1 October can be confirmed against a published position instead of a draft.

References

1. Home Office, Employer's guide to right to work checks: 26 June 2025 (accessible). The version in force at the date of writing. Source for the three routes and their eligibility split, the third-party delegation clause, the physical possession requirement, and "It is not currently mandatory for you to use a certified DVS". https://www.gov.uk/government/publications/right-to-work-checks-employers-guide/employers-guide-to-right-to-work-checks-26-june-2025-accessible
2. Home Office, DRAFT: Employer's guide to right to work checks, 16 July 2026. Draft, stated to come into force 1 October 2026. Source for the expired BRP wording, the OfDIA register requirement, the RtW DVSP terminology, the technical support boundary and Example 12. https://assets.publishing.service.gov.uk/media/6a59ff43908b618a53702fc2/16_07_26_DRAFT_Employer_s_guide_to_right_to_work_checks__002_.pdf
3. Home Office, Code of practice on preventing illegal working: Right to Work Scheme for employers, 13 February 2024 (accessible). Source for the £45,000 first breach and £60,000 repeat breach starting points, both per illegal worker. https://www.gov.uk/government/publications/illegal-working-penalties-codes-of-practice-for-employers/code-of-practice-on-preventing-illegal-working-right-to-work-scheme-for-employers-13-february-2024-accessible
4. Home Office, Illegal working penalties: codes of practice for employers. Publication page last updated 30 June 2026, carrying the draft seventh version of the code, stated to come into force 1 October 2026. https://www.gov.uk/government/publications/illegal-working-penalties-codes-of-practice-for-employers
5. Home Office, Extension of prohibition on employment to other working arrangements: impact assessment (accessible). Published 7 May 2025, updated 2 December 2025. Source for 7.5 minutes and £2.44 on the manual check, 5.5 minutes on the online check, about one minute of employer time and a £2.50 central provider fee on the digital route, and worker times of 2 minutes and 7.5 minutes. https://www.gov.uk/government/publications/border-security-asylum-and-immigration-bill-2025-impact-assessment/extension-of-prohibition-on-employment-to-other-working-arrangements-impact-assessment-accessible
6. Border Security, Asylum and Immigration Act 2025, section 48. Inserts sections 14A and 15A into the Immigration, Asylum and Nationality Act 2006. https://www.legislation.gov.uk/ukpga/2025/31/section/48/enacted
7. Department for Science, Innovation and Technology, UK digital verification services trust framework (1.0). Published 3 March 2026, last updated 9 June 2026. Source for the conformity assessment body trigger and the "no earlier than 1 September 2026" wording. https://www.gov.uk/government/publications/uk-digital-verification-services-trust-framework-1-0
8. Department for Science, Innovation and Technology, Supplementary code for digital right to work checks (1.0) pre-release. Published 9 June 2026. Source for the three permitted documents. https://www.gov.uk/government/publications/supplementary-code-for-digital-right-to-work-checks-1-0/supplementary-code-for-digital-right-to-work-checks-1-0-pre-release
9. Office for Digital Identities and Attributes, 2026 annual report on the operation of Part 2 of the Data (Use and Access) Act 2025. Source for five providers losing certification on 1 April 2026 when their beta certificates expired. https://www.gov.uk/government/publications/office-for-digital-identities-and-attributes-2026-annual-report/ofdia-2026-annual-report-on-the-operation-of-part-2-of-data-use-and-access-act-2025
10. GOV.UK, Find registered digital identity and attribute services. The OfDIA register. Last updated 1 December 2025. https://www.gov.uk/guidance/find-registered-digital-identity-and-attribute-services
11. Disclosure and Barring Service, ID checking guidelines for Standard/Enhanced DBS check applications from 22 April 2025. Source for the three prescribed document routes. https://www.gov.uk/government/publications/dbs-identity-checking-guidelines/id-checking-guidelines-for-standardenhanced-dbs-check-applications-from-22-april-2025
12. Disclosure and Barring Service, DBS digital identity verification guidance. Last updated 10 July 2026. Source for the mandatory certification wording, and for the obligations that survive a digital check on name history, address evidence dated within 90 days, five-year address history and two-year audit trail retention. https://www.gov.uk/government/publications/dbs-identity-checking-guidelines/dbs-digital-identity-verification-guidance
13. GOV.UK, DBS check requests: guidance for employers. Last updated 1 July 2026. Source for registered body status requiring more than 100 checks a year, and for the umbrella body route. https://www.gov.uk/guidance/dbs-check-requests-guidance-for-employers
14. Disclosure and Barring Service, DBS Update Service: employer guide. Last updated 23 January 2026. Source for the £16 annual fee, the 30-day registration window, the immediate free status check and the five conditions an employer must satisfy. https://www.gov.uk/government/publications/dbs-update-service-employer-guide/dbs-update-service-employer-guide
15. Disclosure and Barring Service, DBS fees are changing in December. Published 8 November 2024, effective 2 December 2024. Source for the £49.50 enhanced check fee and the £16 Update Service fee. https://www.gov.uk/government/news/dbs-fees-are-changing-in-december
16. Disclosure and Barring Service, Annual Report and Accounts 2025-26, Table 1. Source for enhanced certificates despatched within 14 days at 75.0 per cent against an 80.0 per cent target in 2025-26, and 77.1 per cent and 75.6 per cent in the two preceding years. https://assets.publishing.service.gov.uk/media/6a58bbf931fb6daf3141383f/ARA_2025-2026.pdf
17. NHS Employers, Right to work extension scheme guidance. Published 11 August 2026. Source for agencies remaining responsible for right to work checks as the direct employer. https://www.nhsemployers.org/articles/right-work-extension-scheme-guidance
18. NHS Employers, Identity checks standard. Last updated July 2026. Source for the assurance the employing organisation must obtain from the staffing provider, and for the move to DVSP terminology in the July 2026 revision. https://www.nhsemployers.org/publications/identity-checks-standard
19. The Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Schedule 3. Source for proof of identity being required in respect of persons employed. https://www.legislation.gov.uk/uksi/2014/2936/schedule/3/made
20. Credentially, Network Recruitment Wales case study. https://www.credentially.io/blogs/case-study-network-recruitment-wales