UK Civil Penalties for Illegal Working: How Employers Can Reduce Risk and Respond to a Notice

Civil penalties for illegal working remain one of the most common and financially significant enforcement risks faced by UK employers. The regime is designed to incentivise robust right to work compliance by imposing monetary penalties on employers who employ a person who does not have the right to work in the UK, or who is working in breach of their immigration conditions. For HR teams, in-house counsel and business owners, the practical question is not simply “what does the law say?”, but how to build a defensible compliance system and how to react calmly and strategically if a Home Office civil penalty notice lands.

This article explains how civil penalties work, how to reduce the likelihood of a penalty through prevention and record-keeping, and what sensible next steps look like after a Home Office notice. It is written for employers; it does not address criminal liability in detail, but it is important to understand that civil penalties sit alongside (and do not replace) potential criminal offences where there is knowledge or reasonable cause to believe illegal working is taking place.

The legal framework in brief: what is a UK “civil penalty for illegal working”?

The civil penalty regime is principally rooted in the Immigration, Asylum and Nationality Act 2006. In broad terms, an employer may be liable to a civil penalty for illegal working if it employs an adult who is disqualified from employment by reason of their immigration status. Disqualification can arise because the individual has no immigration permission, has leave that does not permit work, or has leave that permits work only within limits (for example, restricted hours, restricted role types, or restricted employer) and the person is working outside those limits.

The system is intentionally strict. Liability is not limited to situations where the employer deliberately hired someone without permission. The central protection available to an employer is the “statutory excuse”: a defence created by carrying out compliant right to work checks in the prescribed manner and within prescribed timeframes, and by keeping the prescribed records.

In practical terms, this means that “we took a copy of their passport” is not, on its own, a reliable defence. A statutory excuse depends on the type of status the worker holds and whether the Home Office requires an online check (for digital eVisas, Biometric Residence Permits/Cards in relevant periods, and many non-UK nationals), allows a manual document check (in limited circumstances), or requires an Employer Checking Service verification (for certain pending applications or statuses).

Understanding the “statutory excuse”: why process matters more than intent

The most important concept for employers is that civil penalty risk is largely process-driven. The Home Office will ask: did the employer carry out the prescribed right to work check before employment began, did the employer perform repeat checks where required, and can the employer produce adequate records?

A statutory excuse is usually built on three pillars: (i) the check was done correctly, (ii) it was done at the correct time, and (iii) the employer retained the correct evidence in a clear and retrievable format. If one element is missing, the employer may lose the protection even if it acted in good faith.

Timing is especially important. A compliant right to work check is, in general, a “before employment commences” exercise. If the individual starts work first and the check is completed later, the statutory excuse may not be available for the period of illegal working (and in some cases at all), leaving the employer exposed.

Repeat checks are another frequent failure point. Some individuals have time-limited permission to work, and employers must diarise and complete follow-up checks before the permission expires. Where a follow-up check is missed, an employer can become liable for the period after expiry even if the initial onboarding check was perfectly compliant.

Online checks have their own pitfalls. Where the Home Office requires an online check, relying on physical documents will not usually create a statutory excuse. Employers should ensure the online profile confirms the person’s right to work and any conditions, and that the employer retains evidence of the check (typically a PDF or screenshot output generated at the time) in a way that is linked to the individual and dated.

Prevention in practice: building a right to work system that stands up under scrutiny

Good compliance is less about a single “perfect” check and more about a repeatable system that produces consistent outcomes, even when staff change or recruitment surges.

A sensible system usually begins with clear role allocation. Someone must “own” right to work compliance within the organisation, with documented responsibility for training, audits and escalation. If checks are decentralised across departments, the risk is that different teams adopt different standards and records become inconsistent.

Training should focus on the mechanics that commonly lead to penalties: understanding which checks are permitted for which statuses; identifying work restrictions and how they interact with the role; recognising when to use the Employer Checking Service; and knowing when a repeat check is required. Training should not be a one-off. Where there is staff turnover, a structured induction module and periodic refreshers are often critical to maintaining a consistent approach.

Diarising and work allocation controls are equally important. If a person has time-limited permission, the business should have a reliable reminder system, backed by a process for what happens if evidence is not produced in time. In a well-controlled environment, the consequence of a missed follow-up check is not an emergency scramble on the day leave expires; it is a managed escalation weeks in advance.

Employers should also ensure that right to work checks are integrated into recruitment workflows. A common operational weakness is where HR undertakes checks but line managers allow individuals to “start early” due to business pressure. If that happens, the compliance system is not actually controlling the risk. A robust process makes commencement conditional on a completed check, with senior sign-off required for any exception (and in most cases, exceptions should not exist).

Record-keeping: what to keep and why it matters

Civil penalty cases often turn on evidence. Even where an employer did carry out a compliant check, inability to produce a clear record can undermine the statutory excuse. The Home Office will not typically accept vague assurances; it will look for dated records that demonstrate compliance at the relevant time.

Records should be legible, complete, and stored securely for the required retention period. They should also be retrievable quickly. In practice, retrieval matters because civil penalty correspondence is time-limited. If you cannot locate the check evidence within days, your ability to respond effectively is compromised.

Good record-keeping also includes evidence that the check related to the person who actually performed the work. This becomes especially relevant where there are multiple sites, agency arrangements, or where individuals have similar names. Employers should ensure that the record is clearly associated with the employee’s HR file and includes the date of the check and the identity of the checker.

Where online checks are used, employers should retain the Home Office online check output in a durable form. Relying on the ability to recreate an online view later is risky because status can change, and the compliance question is what the employer knew (and could evidence) at the time of the check.

Common triggers for civil penalties and how to reduce them

From an enforcement perspective, civil penalties commonly arise from a small number of repeat scenarios: follow-up checks not completed; incorrect check type used (for example, manual check where online required); misunderstanding of conditions (such as Student working limits); and reliance on third parties without adequate oversight.

Student working is a particularly common source of inadvertent non-compliance because the restriction is often hour-based and term-time dependent. A practical risk control is to obtain and retain evidence of term dates (for example, from the education provider) and to ensure rotas are actively managed so the individual does not exceed permitted hours. It is not enough to know that a person “has a right to work”; employers must ensure that the work offered and the hours required are permitted.

Agency and subcontractor labour can also create exposure. Depending on the structure, more than one entity may be treated as an employer for illegal working purposes. Where labour supply chains are used, businesses should ensure contractual terms require compliant checks, but also that there is real-world verification through audits. A paper-only approach is unlikely to be persuasive if the Home Office concludes that illegal working was foreseeable.

If you receive a civil penalty notice: first steps and immediate risk management

Receiving a referral notice or a civil penalty notice can be disruptive, but early decisions matter. A measured response begins with triage: identify the individuals in question, the alleged periods of illegal working, and the checks you actually performed. The objective is to understand whether you have a statutory excuse, a partial excuse (for some periods but not others), or a mitigation case.

You should also consider immediate workforce risk. If the individual is still working and you have reason to believe they may not have the right to work, continuing to employ them can compound exposure and may create broader legal risk. However, suspension or termination decisions should be handled carefully. Employers must avoid discriminatory assumptions and should follow a fair process. In many cases, an urgent re-check via the correct route (including use of the Employer Checking Service where applicable) is a sensible initial step while legal advice is sought.

Alongside the civil penalty process, employers with sponsor licences must consider sponsor compliance implications. A civil penalty can trigger Home Office scrutiny of wider HR systems and may be relevant to sponsor licence action. Even employers without a sponsor licence should be conscious that civil penalty outcomes can affect reputational risk, public procurement eligibility, and internal governance.

Responding to the notice: objections, mitigation and avoiding avoidable mistakes

The Home Office civil penalty process is deadline-driven. Typically, the employer will be invited to pay, object, or in some cases take advantage of a reduction for early payment. The right approach depends on the strength of the statutory excuse evidence and the accuracy of the Home Office’s allegations.

An objection is not simply a statement that the business is reputable or that the worker seemed genuine. It should engage with the legal test: what checks were undertaken, when, by whom, and why they were compliant with the prescribed process. If the employer relies on an online check, the objection should include the check output and demonstrate that it relates to the correct person and date. If an Employer Checking Service response was obtained, that should be provided and analysed in relation to the alleged period.

Where the statutory excuse is not available, mitigation becomes important. The Home Office may take account of factors such as proactive cooperation, self-reporting in appropriate cases, robust compliance improvements, and the extent to which the business acted promptly once concerns arose. Mitigation is not a substitute for the defence, but it can affect the penalty level. Employers should be careful not to make avoidable admissions that undermine their position, particularly where the factual picture is incomplete or where there may be misunderstandings about who the legal employer was.

If the penalty is imposed and the employer disagrees with the outcome, there may be routes to challenge, including escalation to court, depending on the procedural stage and the statutory framework engaged. The cost-benefit analysis is fact-sensitive: it requires a clear view of the evidence, the penalty quantum, collateral consequences (including sponsor licence risk), and management time.

Longer-term remediation: using the experience to reduce future exposure

Even where an employer succeeds in reducing or avoiding a penalty, the process often reveals operational weaknesses. Remediation should be practical and documented. That usually means revising right to work policies so that they reflect current Home Office requirements, refreshing training with a focus on the specific failure point, auditing a sample of existing staff files (particularly those with time-limited status), and implementing a diarised follow-up system that is independently monitored.

Where the business operates at multiple sites, standardising templates and centralising record storage can materially reduce risk. Equally, where checks are delegated, there should be a clear escalation route for complex cases, such as individuals with pending applications, administrative reviews, or those who cannot access an online status promptly.

Conclusion

Civil penalties for illegal working are rarely about a single dramatic mistake; they usually arise from small process gaps that go unnoticed until enforcement action begins. The best protection is a statutory excuse built on correct check type, correct timing, and reliable record-keeping, supported by training and a follow-up system for time-limited permissions. If a notice is received, the priority is to gather evidence, assess whether the statutory excuse applies, manage immediate workforce risk lawfully, and respond within deadlines with a legally structured objection or mitigation case.

If you are facing civil penalties for illegal working or you would like advice on strengthening your right to work checking procedures and record-keeping, our immigration barristers can provide tailored guidance based on your organisation’s circumstances.

Contact Our Immigration Lawyers in Switzerland

If you have received a Home Office civil penalty notice for illegal working, or you would like advice on strengthening your right to work checking procedures and record-keeping, our immigration barristers can provide tailored guidance based on your organisation’s circumstances. Contact us via our form.

Frequently Asked Questions: UK Civil Penalties for Illegal Working

What is a civil penalty for illegal working?

A civil penalty for illegal working is a financial penalty imposed on employers who employ someone without the legal right to work in the UK or in breach of their visa conditions.

How can employers establish a statutory excuse right to work?

An employer can establish a statutory excuse right to work by carrying out compliant right to work checks in the prescribed manner before employment begins and retaining the required records.

What are right to work checks for employers?

Right to work checks for employers are prescribed checks to confirm a worker’s immigration status, which may involve online checks, manual document checks, or using the Employer Checking Service depending on the individual’s status.

What should I do if I receive a Home Office civil penalty notice?

If an employer receives a Home Office civil penalty notice, they should identify the individuals involved, review the right to work checks carried out, assess whether a statutory excuse applies, and respond within the required deadlines.

How can employers avoid an illegal working fine for employers?

Employers can avoid an illegal working fine for employers by carrying out correct right to work checks before employment starts, completing repeat checks where required, and maintaining clear and retrievable records..