Share codes: Digitizing the UK right to work
In the UK, as in many countries, businesses must verify a prospective employee’s right to work in the country before hiring them. Failure to complete this verification can result in significant fines — and potentially even jail time.
Until fairly recently, verifying a non-UK, non-Irish citizen’s right to work required collecting and verifying a physical immigration document like a biometric residence permit or card. But with these documents being sunset to make way for electronic visas (eVisas), countries need a new strategy for completing right to work verifications.
That’s where share codes come into play.
Below, we take a closer look at what share codes are and how they work on both the employee and employer side of the equation. We also discuss how Persona can help UK employers digitize their employee hiring and onboarding processes, including verifying a prospective employee’s right to work.
But first, a little regulatory background
As the world spends more and more time online — banking, making purchases, consuming media, communicating with one another, and even applying for jobs — it’s become increasingly clear that individuals need a reliable way of establishing trust and proving their identities in digital spaces.
Recognizing this, in 2021, the UK government began developing a new framework for digitizing many identity-based services: the Digital Identity and Attributes Trust Framework (DIATF). The overarching goal of this framework is to govern the future use of digital identities as a replacement for physical documents within the UK, making it easier for citizens to verify themselves using modern technology.
Under this framework, UK employers have been allowed to leverage certain certified identity verification providers’ identity document verification technology (IDVT) to verify a person’s right to work and complete pre-employment DBS checks since April 2022. The catch? This was only possible for UK and Irish citizens.
Today, a similar change is coming for non-UK, non-Irish citizens who are currently working or seeking work in the UK. That’s because physical UK biometric residence permits (BRPs) are set to expire on December 31, 2024, to be replaced with eVisas. This leaves share codes as the primary way for businesses to verify immigrant employees’ right to work.
Simply put, employers need a process to collect and verify share codes if they intend to employ workers who are non-UK, non-Irish citizens.
What are share codes?
A share code is a 9-digit, randomly-generated alphanumeric code that links an individual to a UK immigration record.
Non-UK, non-Irish citizens generate share codes (more on this below) and provide them to prospective employers to prove their right to work in the country. Meanwhile, employers use share codes to perform a share code check and verify the prospective employee’s right to work.
Share codes used to prove an individual’s right to work begin with the letter W — for example, [WZY 7HW P2X]. Share codes generated for other purposes begin with an R or S and cannot be used to check an individual’s right to work.
Share codes allow an employer to perform right to work verifications without needing to collect and verify physical immigration documents like a biometric residence permit or a passport. As such, they're an important part of digital employment compliance.
How do share codes work?
Though this article is primarily focused on the employer side of the equation, it’s important to understand how a prospective employee generates a share code so you can understand how share codes work and how they’re used for right to work verification.
Employee share code requirements
When a non-UK, non-Irish citizen needs to prove their right to work in the country, they need to generate a share code to share with their prospective employer.
To do so, they first need to log into their UK Visas and Immigration (UKVI) account. Any individual who has applied for a visa (including an eVisa) has a UKVI account. To sign in, the individual must select the type of identity document they used to complete their visa application (e.g. their passport, national identity card, or biometric residence card/permit). After choosing the document type, they’re prompted to enter the corresponding ID number, followed by their date of birth and a security code sent to either their phone or email address on record.
Once logged in, the individual can review their immigration status and request a share code. Because the share code is linked to an official immigration record — which itself is linked to underlying identity documents — it can serve as a proxy for those documents during right to work verification.
Employer share code requirements
In order to complete a share code check, employers must collect the prospective employee’s date of birth and share code. Then, they enter this information into the online share code checking service provided by the UK Home Office. Share codes expire 90 days after being generated; if the share code provided by a prospective employee has expired, they will need to generate and provide a new one.
Performing a share code check will retrieve relevant portions of the prospective employee’s immigration record, including their:
Name
Portrait
Date of birth
Whether they have the right to work in the UK
Work restrictions, including how many hours they’re allowed to work
Work conditions, including the types of work they are not allowed to perform
The employer should then use this information to verify the prospective employee’s right to work. Importantly, the employer must verify that the portrait in the record matches the prospective employee’s actual face either in person or via video call. This is an important part of ensuring that the individual is not posing as someone else.
Employers are required to retain evidence of the share code check for the duration of the individual’s employment, plus an additional two years. Evidence includes a copy (either print or digital) of the profile generated during the share code check.
If the prospective employee’s right to work is limited to a certain period of time, employers are required to perform an additional check shortly before the expiration date to determine whether the right to work has been extended.
Right to work and Persona
At the end of the day, your business is free to determine how it will meet UK employment compliance, including verifying the right to work for non-UK, non-Irish citizens applying for jobs. These decisions should be based on your business’s risk tolerance and will likely involve discussions with stakeholders in your human resources, compliance, and legal teams.
The good news? You don’t have to go at it alone. As a certified UK Right to Work IDVT vendor, Persona can help your business:
Complete digital identity verification of UK citizens: Collect and verify prospective employee passports for verification purposes
Facilitate share code checks for non-UK, non-Irish citizens: Collect the data (name, date of birth, share code) necessary to perform a share code check prior to employment
Automate followup verifications: Schedule or automate the reverification of employees whose right to work is limited to a specific period of time
Meet recordkeeping obligations: Safely record and store identity evidence as required under UK employment law
Interested in learning more about how Persona can help you digitize, streamline, and automate your company’s hiring and employee onboarding processes? Start for free or get a demo today.
In the UK, the term “right to work” means that a person has the legal right, or permission, to be employed in the country. All UK and Irish citizens automatically have the right to work. Whether immigrants to the country have the right to work depends on the type of visa they were granted when they settled in the country.
A right to work check, or right to work verification, is the process employers complete before hiring someone to ensure that the person has the legal right to be employed in the country.
If you are looking for a vendor to perform right to work checks for your UK business, you must work with a company certified to do so. The UK government maintains a list of all IDV vendors that have been certified to provide these services, which can be accessed here.
Persona has been certified by the Kantara Initiative under the UK Digital Identity & Attributes Trust Framework (DIATF) and right to work and right to rent schemes.
As an employer, if you don’t perform right to work checks — or perform them incorrectly — and end up employing someone who doesn’t have the right to work in the country, you can be fined up to £60,000 for each illegal worker. UK Immigration Enforcement may also publish your business details, resulting in reputational harm.
Penalties are steeper if you employ someone you knew or had “reasonable cause to believe” did not have the right to work in the UK. This includes potential jail time of up to five years in prison, and a fine with no upper limit, which is determined on a case-by-case basis.
Share codes are valid for up to 90 days, after which point they can no longer be used to perform a right to work check. If a potential employee provided you with a share code and you were unable to verify their right to work before the code expired, they will need to generate and provide you with a new code.
Share codes are used to verify an individual’s immigration status. While employees use share codes to verify a person’s right to work in the UK, landlords also use share codes to verify a person’s right to rent in the country, and educators use the codes to verify a person’s right to study. The codes may also be used to verify whether or not a non-UK citizen is eligible for certain public services.