Using an Identity Service Provider for digital right to work checks

What is the scope for using an IDSP to perform a compliant right to work check?

IDSPs provide identity document validation technology (IDVT) that can be used to carry out the digital identity verification element of a compliant right to work check for holders of valid British and Irish passports and passport cards only.

Employers retain responsibility for ensuring right to work check compliance and cannot outsource this to an IDSP. An employer's guide to right to work checks, which is the official guidance issued by the Home Office, does however state that if an employer uses a ‘certified’ IDSP, the Home Office will accept that the IDSP is able to carry out digital identity verification to the government’s recommended minimum of a Medium Level of Confidence. In practice using a certified IDSP minimises the risk the Home Office may find the IDSP’s technology is not robust enough to provide a reliable identity verification.

Crucially, the employer must check that the details of the IDVT check output (which is produced in the form of a report with the prospective employee’s passport details and image included) are consistent with the appearance of the prospective employee who is presenting for work. This is not likely to be included within the IDSP’s workflow, necessitating the production of a separate record to confirm the visual check has taken place. This could be in the form of an endorsement on the IDVT output, or by creating a separate record in a format that cannot subsequently be altered.

The visual check record should:

• Confirm that the appearance of the prospective employee is consistent with the details and image in the IDVT output;

• Identify who carried out the visual check, either by live video link or in person (the checker must be a direct employee of the employer); and

• Confirm the date of the visual check (as this will be the date the right to work check will be considered complete).

Prospective employees can opt out of using an IDSP, even if they hold a valid British or Irish passport and must not be treated less favourably if they do. They should be offered a manual right to work check instead.

How is a digital right to work check carried out using an IDSP?

Broadly, the process is as follows:

• The individual uploads a copy of their passport/passport card and an image of themselves to the IDSP’s app/portal;

• The IDSP returns a report on the authenticity of the document, which is shared with the employer;

• The employer retains a clear copy of the report in a format that cannot be altered;

• The employer satisfies themselves that the photo and the biographic details of the person presenting for work are consistent with the details in the report and makes a record of having completed this check; and

• The employer checks on any inconsistencies on names or other details and obtains evidence that resolves these.

Evidence of the right to work check must be retained, in a format that cannot be altered, for the duration of the employment plus two years.

Who are the certified IDSPs?

Although the enabling legislation for IDSP use has been in place since 6 April 2022, there was an initial delay in IDSPs becoming certified. Since the first IDSP was certified in June 2022, further providers have been added to the list maintained by the Department for Digital, Culture, Media and Sport on an ad hoc basis.

Some of the certified IDSPs provide their services direct to employers. At least one, HooYu, offers its product indirectly through two partners, Vetting.com and Veremark.

What services do the IDSPs offer?

Many of the IDSPs offer a range of services beyond IDVT for right to work checks, such as know your customer software and other business process technology products. What other products may be suitable for a business will depend on that business’s industry sector and other profile characteristics.

How are the services priced?

The various IDSPs use different pricing models, which makes comparing them complex.

Some providers have an account setup cost and per user licence fees, some use pre-paid bundles of transactions with credits expiring after a fixed period of time.

Employers will need to make cost calculations based on forecast volume usage. This will mean deciding the point at which the IDSP will be used in the right to work check process for prospective employees, and whether to use their systems for repeat checks.

At one end of the spectrum, IDVT provided through an IDSP could be used only once a job candidate has been identified as holding a valid British or Irish passport. On the other end, the HR portal offered by an IDSP could be used to manage the right to work records for all prospective job candidates and employees requiring repeat right to work checks.

What should employers be doing to prepare for the end of adjusted right to work checks?

Even if employers opt to use an IDSP, they will still need to put processes back in place to carry out compliant manual right to work checks after the COVID-19 adjusted right to work check process ends on 30 September 2022. This is because IDSPs only provide products to carry out compliant checks on valid British and Irish passports (including Irish passport cards).

From 1 October 2022, aside from any documents that have been verified using an IDSP, an employer must review the original documents that are contained in List A or List B of the Home Office’s current right to work checklist in order to obtain a statutory excuse against liability for an illegal working civil penalty (which can be up to £20,000 per worker). Note that the checklist was significantly updated from 6 April 2022 to remove biometric residence permits (BRPs), biometric residence cards (BRCs) and frontier worker permits from the lists of acceptable documents for manual checks. Holders of these documents must have their right to work checked using the Home Office’s online system, which is separate from IDVT and free for employers to use.

It remains to be seen whether there will be another last-minute request from businesses to further extend the adjusted process, but employers should plan for a return to compliant manual checks. This will mean ensuring there are processes in place to receive, review and return original evidence of right to work. It will however still be possible for a compliant manual check to be carried out with the employee or prospective employee present by live video link rather than in person.

Tips for employers considering using an IDSP

• Be aware that using an IDSP will not completely remove the need to carry out manual right to work checks, so a plan must be in place to carry out fully compliant manual right to work checks from 1 October 2022, taking into account the requirement for the person carrying out the check to handle original documents;

• Consider whether and how the use of an IDSP fits into the business’s overall strategy covering IT systems for onboarding staff, managing right to work check compliance and minimising the risk of identity document fraud;

• Use a robust procurement process to determine the scope of services desired and to select a vendor – this is likely to require budgetary sign-off from senior level stakeholders and engagement across the IT and HR functions;

• Take into account that IDSPs currently can only contribute to compliant right to work checks for valid British and Irish passport holders, although the scope of their available services (and the associated cost per transaction) may extend considerably beyond this;

• Ask whether the IDSP has capability to build the visual check element of the process into their product’s workflow, or make sure this is incorporated into the business’s overall process for checks using an IDSP – some providers may be able to achieve this using one of their other products (e.g. e-signature), but at an additional cost;

• Consider the current composition of the business’s workforce and future recruitment plans when forecasting the likely volume of checks for valid British and Irish passport holders over the term of the agreement with the IDSP, and comparing the overall cost of each IDSP contract;

• Consider the timing of setting up commercial arrangements with an IDSP, taking into account that the list of certified IDSPs is still expanding and competitive providers may not yet have finalised their accreditation;

• Consider the pros and cons of using a trial to evaluate a provider, including whether to run full manual checks (or adjusted manual checks to 30 September 2022) in parallel during the trial period; and

• Enquire about the scope to negotiate on pricing and contract term as some of the initial providers have indicated a degree of flexibility on this.

If you have any queries about IDSPs or carrying out right to work checks, please get in touch with a member of our Immigration Team.