A friend of mine took on a weekend barista last summer. Lovely lad, started the Saturday, worked three shifts before anyone thought to ask about paperwork. No drama, no inspection, nobody knocked on the door.

But here's the thing. If that lad hadn't had the right to work in the UK, my friend would have been on the hook for up to £60,000. Not a typo. Per worker.

This is the obligation almost nobody talks about, and it lands the moment you hand someone an apron.

The penalty that quietly tripled

In February 2024 the Home Office tripled the civil penalty for employing someone who doesn't have the right to work in the UK.

First breach: up to £45,000 per illegal worker (it used to be £15,000)
Repeat breach: up to £60,000 per illegal worker, if you're found to have done it again within three years (up from £20,000)

These are charged per worker. Hire two people without checking and the maths gets ugly very quickly.

And this isn't aimed at people knowingly breaking the law. The civil penalty exists precisely for employers who didn't check. You don't have to have done anything dodgy. You just have to have skipped a step.

The good news is the protection is genuinely simple. It's called a statutory excuse, and you earn it before the person ever starts.

The statutory excuse, in plain English

If you carry out a correct right to work check before employment begins, and you keep the evidence, you have what's called a statutory excuse. That means even if it later turns out the person didn't have the right to work, you're protected from the civil penalty.

Skip the check, or do it wrong, and you have no excuse. It's that binary.

So the whole game is: do one of three accepted checks, do it properly, do it on time, keep the proof. Let's go through the three.

The three ways to check

There is no fourth option. A glance at a passport while you're rushed off your feet does not count.

1. The manual document check

You look at the person's original documents (a British passport is the common one) in their presence, satisfy yourself they're genuine and that the photo and dates match the person in front of you, then take a clear copy and record the date you made the check.

It has to be the original, with the person there (in person or over a live video call while you hold the copies). A photocopy posted to you on its own does nothing.

2. The Home Office online check

For anyone with a digital immigration status (EU Settlement Scheme, most visa holders, and others) you use the online right to work service. They give you a share code, you enter it along with their date of birth, and you see their status straight from the Home Office.

For these workers the online check is usually the only valid route. An old physical card is not enough on its own.

3. Identity document validation technology (IDVT)

For British and Irish citizens with a valid passport, you can use a certified identity provider to verify the document digitally. They run the check using technology that authenticates the passport, and you keep their report. Handy if you're hiring remotely or want to take the eyeballing out of it.

What you actually need to keep

A check you can't prove is a check you didn't do. Keep:

A clear copy of the documents, or the online check profile / IDVT report
The date you made the check, written on it (this matters, because it proves you checked before they started)
The records for the whole time they work for you, plus two years after they leave

One more piece people miss: if someone has time-limited permission to work (a visa with an end date), you have to do a follow-up check before that date. Diarise it the day you hire them. When their permission expires and you haven't rechecked, your statutory excuse expires with it.

A scrap of paper in a drawer is not a system. This is exactly the sort of record StaffBrik is built to hold, with each employee's check evidence and expiry dates sitting alongside the rest of their file, so a follow-up date never quietly slides past you.

The mistakes that catch cafés out

In hospitality the risk isn't usually the salaried manager whose paperwork went through HR. It's the casual end of the rota, where everything happens fast.

Skipping checks for casual, weekend or seasonal staff. A three-week summer hire needs exactly the same check as a permanent one. If you're taking on extra hands for the busy months, build the check in before their first shift, not after.
Checking after they've started. Once they've worked a single shift unchecked, you've already lost the statutory excuse for that period. The check has to come first.
Forgetting the follow-up check. Time-limited permission runs out. If you don't recheck before it does, you're back to square one.
Relying on a photocopy. A copy of a passport with no online check (where one was needed) and no record of the date is not a valid check.

Build it into onboarding and forget about it

The fix isn't to remember harder. It's to make the check a fixed step that has to happen before anyone is added to the rota, the same way you'd never let someone near the till without a quick handover.

A simple onboarding order that works:

Verbal yes from the candidate
Right to work check (one of the three above) and copy filed with the date
Follow-up date diarised if their permission is time-limited
Then contract, rota, apron

While you're setting up that checklist, it's worth costing the hire properly too. Our new hire calculator shows what someone really costs once you add the bits that don't appear on their hourly rate, and right to work compliance sits alongside the other duties that land the day you employ someone, like pension auto-enrolment. It's all part of the wider employment law picture every café operator is now working inside.

A right to work check takes about five minutes. The penalty for skipping it can take £60,000. That's the worst risk-to-effort ratio in your whole business, and it's entirely avoidable. Do the check, keep the proof, do it before day one. Every time.

Ed O'Brien has run Hunters Cake Company for 17 years across cafés in Witney, Burford, and a bakery in Carterton, Oxfordshire. He's building Brikly - modular tools that give independent café owners the same data the big chains have, without the big chain price tag.