Hidden within the Home Office’s revised Right to Work regime is a technical requirement that many businesses may overlook, but which could carry significant financial consequences.
According to SmartSearch, for a digital Right to Work check to provide a statutory excuse, the identity service provider must be both registered with the Office for Digital Identities and Attributes (OFDIA) and certified specifically for the Right to Work use case. Registration on its own does not qualify, and neither does certification obtained for another purpose.
What might appear to be a minor procurement detail is in fact one of the most consequential decisions HR and compliance teams will face this year. Choosing a digital verification provider is no longer simply a supplier selection exercise.
It has become a question of compliance risk, where the distinction between certified and uncertified providers determines whether a business can defend itself if a check later proves flawed.
The Digital Identity and Attributes Trust Framework (DIATF) sets a common standard for digital identity providers across the UK. It is overseen by OFDIA, part of the Department for Science, Innovation and Technology, and providers seeking certification undergo independent assessment against technical, security, operational and governance criteria. Crucially, Right to Work certification is separate from general OFDIA registration.
In its September 2026 guidance update, the Home Office introduced an additional requirement.
Where businesses purchase digital verification service provider (DVSP) checks through an intermediary, such as a reseller or integrated platform, that intermediary must clearly disclose which registered DVSP is performing the check. Since 1 October 2026, only certified providers fall within this operational safe harbour, regardless of how advanced alternative technologies may be.
The statutory excuse protects employers from civil penalties if a worker is later found not to have the right to work, provided the correct check was completed, the evidence was retained and appropriate action was taken. Without it, businesses relying on uncertified providers face full exposure: £45,000 per worker for a first breach and £60,000 per worker for repeat breaches.
Employers should ask their providers whether they are OFDIA-registered, certified for Right to Work under DIATF, and, where intermediaries are involved, which registered DVSP carries out the checks.
Other considerations include integration with the Home Office online checking service, support for eVisas and share codes, robust audit trails, rapid substitute worker verification, standard biometric and NFC chip reading, and broad document coverage. Providers unable to confirm the first three points in writing should prompt urgent review.
Credas, part of the same group as SmartSearch, is DIATF-certified and carries the DIATF trustmark. Its platform includes biometric NFC chip reading, integrated anti-fraud checks, real-time facial recognition, coverage of 2,500 identity document types, Home Office integration and full audit trails. Its clients include the NHS, PA Media, the Nuclear Decommissioning Authority, Indeed Flex, the FCSA and Traveline Cymru.
The regime has shifted from a light-touch process to a certified, evidence-led obligation. Firms that moved early have reduced their exposure, while those that did not may struggle to defend their position.
Read the full SmartSearch post here.
Copyright © 2026 FinTech Global
