A technical detail in the Home Office’s revised Right to Work regime is set to reshape how HR and compliance teams choose their verification partners.
According to SmartSearch, under the updated rules, a digital Right to Work check only establishes a statutory excuse if the identity service provider is both registered with the Office for Digital Identities and Attributes (OFDIA) and certified specifically for the Right to Work use case. General registration is insufficient, as is certification for any other purpose.
This shifts the selection of a digital verification provider from a routine procurement exercise into a compliance risk decision. The gap between a certified and an uncertified supplier has nothing to do with features or cost. It determines whether a business can defend itself if a check later proves flawed.
The certification regime rests on the Digital Identity and Attributes Trust Framework (DIATF), which sets a shared standard for digital identity providers. It is overseen by OFDIA, part of the Department for Science, Innovation and Technology, and providers are independently assessed against technical, security, operational and governance criteria.
The Home Office tightened the rules further in its September 2026 guidance. Where checks are purchased through an intermediary such as a reseller or integrated platform, that intermediary must disclose which registered digital verification service provider (DVSP) is actually performing the check.
Since 1 October 2026, certified providers sit inside the operational safe harbour, while those outside it cannot deliver a statutory excuse, regardless of how advanced their technology is.
The stakes are significant. A statutory excuse protects businesses from civil penalties if a worker is later found to lack the right to work, provided the correct check was carried out, evidence retained and appropriate action taken. Without it, firms face penalties of £45,000 per worker for a first breach and £60,000 per worker for repeat breaches.
Businesses are being urged to question their current suppliers. Key points include whether the provider is OFDIA-registered, certified specifically for Right to Work under DIATF, and, if bought through an intermediary, which registered DVSP sits behind the service.
Firms should also confirm integration with the Home Office online checking service, support for eVisas and share codes, a robust audit trail, the speed to handle substitute worker verification, and whether biometric checks, NFC chip reading and anti-fraud tools come as standard. If the first three questions cannot be answered yes, in writing and with evidence, a switch may be needed soon.
Credas, the identity verification platform within the SmartSearch group, is DIATF-certified and carries the DIATF trustmark. Its Right to Work offering includes biometric NFC chip reading, real-time facial recognition, coverage of 2,500 identity document types, Home Office integration with eVisa support, mobile and browser-based access, and a fully evidenced audit trail. Its clients include the NHS, PA Media, the Nuclear Decommissioning Authority, Indeed Flex, the FCSA and Traveline Cymru.
The regime has moved from a light-touch check to a certified, evidence-based obligation. Firms still relying on uncertified tools after 1 October may find their position difficult to defend.
Read the full SmartSearch post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
