From the 1st of October the rules regarding how businesses must verify a new employee’s Right to Work in the UK had changed. Businesses are now able to use a certified Identity Service Provider (IDSP) like Credas to verify an individual’s identity for Right to Work checks.
This replaces the Covid-19 adjusted process introduced by the Home Office which ended on 30th September 2022 and which allowed for ID documents to be received via email or video chat.
Credas is one of only a few companies that are certified for both ‘Right To Work’ and ‘Right to Rent’ checks against the Home Office requirements of the UK DIATF.
What does the regulation say?
In the UK all businesses are required to check whether a new employee is legally allowed to work in the UK before they start.
There are clear guidelines as to what is expected of businesses and if they follow these guidelines they can establish a statutory excuse against a civil penalty in the event that they employ someone who does not have the legal right to work in the UK.
To establish a statutory excuse a business must do one of the following before a new employee starts:
- a manual right to work check
- a right to work check using Identity Verification Technology (IDVT) via the services of an Identity Service Provider (IDSP)
- a Home Office online check
What does this mean for businesses?
Businesses will obtain a statutory excuse where they can demonstrate that they have complied with all the statutory requirements to conduct Right to Work checks. Where they have used an IDSP, the statutory
excuse will only be obtained where that IDSP has also complied with the required steps.
For businesses to be able to rely upon the IDVT identity check carried out by an IDSP to prove eligibility for the purpose of a RTW check and obtain a statutory excuse, a valid British or Irish passport (including passport cards) must be provided to the IDSP and checked by them using IDVT for the purposes of identity verification.
Where an IDSP is used, businesses retain obligations that they must comply with under the RTW Scheme. The business still needs to complete the following steps before the employment starts to ensure a prescribed check has been undertaken, in order to establish a statutory excuse.
- Use an IDSP to check a prospective employee’s valid British or Irish passport (or Irish passport card) using IDVT.
- Obtain an output of the IDVT identity check from the IDSP containing a copy of the IDVT identity check, and the document checked, in a clear, legible format that cannot be altered.
- Carry out their own due diligence to satisfy themselves to a reasonable belief that their chosen IDSP has completed the check correctly in the prescribed manner.
- Satisfy themselves that the photograph and biographic details (for example, date of birth) on the output from the IDVT identity check are consistent with the individual (i.e. the information provided by the check relates to the individual and they are not an imposter).
- Where names differ between documents, the business must establish why this is the case and must employ that individual unless they are satisfied that the documents relate to them. A statutory excuse will not be obtained where it is reasonably apparent that the prospective employee is not the individual linked to the identity which was verified by the IDSP.
- Businesses must retain this information securely for the duration of the employment and for one year afterwards. The copy must then be securely destroyed.
Why has the government stopped the use of video calls for ID verification?
The recent change in legislation prevented the use of video calls for ID verification. With more and more businesses offering remote working this method had proven popular as a means to validate an employees ID so why has the government changed their minds?
Firstly, the initial legislation that allowed the use of video calls was brought in a special exception during the covid pandemic and was never intended to be brought permanently into legislation.
The main reason is that whilst you might be able to confirm the likeness between an individual and their ID document on a video call, there are no checks being undertaken on the ID document to confirm whether the document is genuine or not.
In person, it’s a lot easier to see if an ID document has been tampered with or is missing any hard-to-replicate security features such as holographs. Over a video call, the quality of the camera and lighting makes it difficult to determine whether a document is genuine.
Under the new legislation, remote checks should be done via a certified IDSP.
What is a certified IDSP?
A IDSP or Identity Service Provider is a business that offers identity verification through a range of methods including using biometric facial recognition, machine reading and NFC technology.
Over the last few years IDV technology has been widely adopted across multiple industries playing a vital role in combatting fraud and money laundering. Due to this widespread adoption and the varying degrees of capabilities between vendors, the UK Government developed a new Digital Identities and Attributes Trust Framework (DIATF) that set out clear standards IDSP should adhere to.
The Trust Framework also introduced a new accreditation programme that allowed IDSPs to be independently assessed against the standard and be awarded certification if successful. All certified IDSPs can be found on the DCMS website allowing businesses to easily choose a suitable supplier.
In conclusion
If you use an IDSP certified to do Right to Work checks, and once they do the check you review the report to check
1. It’s an in-date valid UK/Irish passport
2. The identity has been verified
3. The identity matches the person you met during the viewing..
and you keep all the data for the duration of the employment + 1 year; you’re fine.
