A specialist warehousing and logistics agency in the Midlands supplies temporary operatives to a national retailer. One of the operatives, supplied via the agency's contract with the retailer, is stopped during a routine Home Office compliance visit at the retailer's distribution centre. The operative cannot produce evidence of the right to work in the UK; investigation shows the share-code check on file was for a different individual, and the document scan against which the agency's onboarding consultant believed the check had been completed was a year out of date and related to a previous, lapsed visa. The Home Office serves a Referral Notice on the agency — as the agency, not the retailer, is the IANA "employer" of the temp. The civil penalty is calculated at £45,000. The retailer, separately, terminates the supply contract, withholds an invoice run of £62,000, and writes to the agency claiming reputational damage and reciprocal breach of warranty in the MSA. The agency's principal picks up the phone to its broker.
The first question the broker has to answer is what, of the loss the agency is now facing, will the PI policy actually pay. The civil penalty itself will not be insurable. What might be insurable is the third-party claim from the retailer. The defence costs of responding to the retailer's claim almost certainly will be. The agency's own onward action against the consultant or against its document-verification provider may also engage cover. None of those is automatic, and the answers turn on the wording of the policy in force at the time of the failing — not the wording in force when the claim is notified. This article walks through how UK right-to-work law sits across the recruitment sector, where the recruiter's exposure crystallises, and how a well-structured PI policy responds (or doesn't).
This is a cluster article supporting our main pillar guide on PI insurance for UK recruitment consultants, which sets out the broader framework of cover for the sector.
The statutory framework — IANA 2006 and the statutory excuse
The Immigration, Asylum and Nationality Act 2006 ("IANA 2006") creates the civil-penalty regime for employing an adult subject to immigration control who does not have permission to do the work in question. The criminal-offence regime under section 21 applies where the employer knew or had reasonable cause to believe the person did not have the right to work; the civil regime applies on a strict-liability basis where there is no statutory excuse.
The statutory excuse is the recruiter's central defence. It is established by carrying out the prescribed checks before employment commences and retaining the evidence in line with the Home Office Code of Practice on Preventing Illegal Working, updated most materially in 2022 to reflect the move to digital share-code checks for biometric residence card and biometric residence permit holders. A check carried out properly, recorded properly, and retained for two years after the employment ends establishes the statutory excuse and is a complete defence even if the worker subsequently turns out not to have had the right to work.
The headline penalty figures changed materially in February 2024. The civil penalty is now up to £45,000 per illegal worker for a first breach (previously £15,000) and up to £60,000 per illegal worker for a repeat breach within three years (previously £20,000). A single non-compliant placement can produce a six-figure exposure where the worker has been supplied across multiple sites or shifts.
Who is the "employer" for right-to-work purposes?
This is the question that catches recruiters most often, and it splits cleanly along the Conduct Regs line between Employment Agency and Employment Business work.
For permanent placement work — where the agency operates as an Employment Agency and introduces a candidate to a hirer who then engages the candidate directly — the agency is not the "employer" for IANA purposes. The hirer is. The agency may still, as a matter of contract or as a matter of professional standard, conduct pre-engagement right-to-work checks, but the statutory obligation, the statutory excuse, and the civil-penalty exposure sit with the hirer.
For temporary and contract supply — where the agency operates as an Employment Business and engages the worker itself (whether under a contract of employment or a contract for services) and then supplies the worker to a hirer — the agency is the employer for IANA purposes. The full statutory obligation sits on the agency. The hirer is not the IANA employer of the agency's temp, even though the hirer is supervising the day-to-day work. This is the structure under which most UK contract supply operates, and it is the structure that produces the agency's primary civil-penalty exposure.
The position becomes more complicated where the agency operates a payroll-only or umbrella-intermediated supply to a hirer. Where an umbrella company is the contracting employer of the worker, the umbrella carries the IANA obligation and the agency's exposure is reduced — but a Home Office investigator looking at the supply chain may still scrutinise the agency's verification of the umbrella's processes. The agency's reputational and contractual exposure does not disappear simply because the technical IANA employer is further along the chain.
The "agency labour" question has been the subject of recurring confusion. The position is that the agency that engages the worker and supplies that worker to the hirer is the IANA employer. The hirer does not "share" or "joint" the IANA obligation with the agency, although the hirer may take its own checks for contractual or due-diligence reasons. Where a worker is genuinely engaged by the hirer directly and the agency simply introduces — the Employment Agency model — the position reverses.
What a compliant right-to-work check looks like
The Home Office's Code of Practice prescribes one of three routes to the statutory excuse, and the recruiter must choose the right route for the worker's status:
A manual document check is appropriate for British and Irish citizens and for any worker whose entitlement is evidenced by a List A or List B document specified in the Code (passport, certain forms of identity card, certain residence documents). The check requires the recruiter to obtain the original document, check it in the presence of the holder, satisfy itself that the document is genuine and that the holder is the person to whom the document was issued, and retain a clear copy in a format that cannot subsequently be altered, with the date of the check recorded on the copy.
A digital share-code check through the Home Office online right-to-work service is now the mandatory route for most workers with eVisa, biometric residence permit, biometric residence card or settled-status evidence. The worker provides the recruiter with a nine-character share code; the recruiter enters the share code and the worker's date of birth into the Home Office service; the service returns a profile page confirming the worker's entitlement to do the work in question. The recruiter must verify that the photo on the profile page is the person physically present, and retain a clear copy of the profile page. The validity period of the check is governed by the duration of the worker's permission shown on the profile page.
An Identity Document Validation Technology (IDVT) check via a certified Identity Service Provider (IDSP) has been a permitted route since April 2022 for British and Irish citizen workers holding a valid passport (including expired passports for British and Irish citizens). The IDSP must be certified to the level set out in the Home Office's published list, the IDVT process must include both document verification and likeness verification, and the recruiter must retain the IDSP's check report. This route has been particularly material for recruiters operating remote onboarding, and the IDSP certification framework has been the subject of repeated Home Office guidance updates through 2023 and 2024.
The check must be carried out before employment commences, not on the first day, not "as soon as practical". A late check does not retrospectively establish the statutory excuse. The penalty for getting this wrong, even where the worker turns out to have the right to work, is that the agency loses the strict-liability defence and is then exposed to the civil-penalty regime if the worker subsequently proves not to be entitled.
Follow-up checks are required where the worker's permission has a time limit. The follow-up must be conducted before the existing permission expires, and the agency's onboarding system needs to track expiry dates and trigger the follow-up workflow proactively. Recruiters operating contract supply books with significant non-British/Irish populations should pay particular attention to this — a follow-up missed by a week is enough to vacate the statutory excuse.
How PI insurance responds — and where it doesn't
A recruitment PI policy is built around the words "civil liability arising from the provision of professional services". It is not built around statutory penalties. That phrasing is the key to understanding which parts of the right-to-work exposure are insurable and which are not.
The civil penalty itself is not insurable. This is settled as a matter of public policy in English insurance law — an insurer cannot indemnify an insured against a fine or penalty imposed by a regulator for the insured's own conduct, because to do so would defeat the deterrent and penal purpose of the regime. The Home Office civil penalty under IANA 2006 falls squarely within this principle. No respectable PI insurer will write cover for the penalty itself, and any wording that purports to do so should be looked at very carefully because it may not be enforceable.
The defence costs of the civil-penalty proceedings are a more nuanced question. Some PI wordings do extend to cover the legal costs of responding to a Referral Notice or Civil Penalty Notice from the Home Office, particularly where the agency is contesting whether the statutory excuse was established. Others do not. This is a wording-specific question and one of the items worth flagging at renewal if the agency is operating a contract supply book with material non-British/Irish populations. Where defence-costs cover is available it is usually subject to an inner limit and may sit within a separate "regulatory investigation costs" extension rather than the main professional liability limit.
Third-party civil claims from the hirer are insurable. This is where most of the meaningful PI exposure crystallises. As in the opening scenario, an end-client whose business is disrupted by a Home Office compliance visit — or by the discovery that an agency-supplied worker is not entitled to be working — will frequently bring a contractual claim against the agency. The claim may be framed as breach of warranty in the MSA (most MSAs contain a warranty that the agency has complied with IANA 2006 and conducted compliant checks); as breach of an indemnity (most MSAs contain an indemnity from the agency to the hirer in respect of immigration-related losses); or as straightforward negligence in the provision of recruitment services. PI responds to these claims provided the agency's underlying conduct is negligence-based rather than wilful or fraudulent. The defence costs are almost always covered; the damages and settlements are covered up to policy limit.
The agency's own onward claim against a third party — for example, against an IDSP provider whose IDVT process failed, against a documents-verification consultant, or against the consultant inside the agency who conducted (or failed to conduct) the check — is not a PI matter; it is the agency pursuing its own loss. PI is third-party liability cover and does not respond to the agency's first-party costs. A separate commercial litigation insurance product or after-the-event cover may apply but those are not standard recruitment-sector covers.
How PI sits alongside General Liability and Employment Practices Liability
Right-to-work failures rarely exist in isolation. A Home Office compliance visit that surfaces a right-to-work failing often also surfaces tax, NMW, working time, or modern slavery concerns; the agency's exposure on each of those sits on a different policy. A clear understanding of the policy architecture matters at the moment of claim notification.
Commercial General Liability (CGL) / Public Liability responds to third-party bodily injury and property damage arising from the agency's operations. It is not engaged by an immigration compliance issue unless there is a separate bodily-injury or property-damage element — which is unusual but does occur, for example where a worker without a valid visa is also separately injured at the hirer's site and the agency is drawn into multiple lines of claim. The two policies will respond on different bases and a coordinated notification is sensible.
Employer's Liability responds to the agency's exposure to its own employees. Where the worker is engaged by the agency under a contract of employment, an injury to the worker engages EL. The immigration status of the worker is not material to the EL exposure — EL responds to the injury claim regardless of whether the worker was entitled to be working — but the discovery of an immigration issue during an EL investigation can produce a parallel PI exposure if the hirer brings its own claim. Again, coordinated notification.
Errors and Omissions (E&O) cover is often used interchangeably with PI in the US-influenced market, but the UK convention is that the two are the same product, with PI being the more commonly used label for professional-services classes. The substantive cover is the same. Where an agency has both a PI policy and a separately-purchased "E&O" wording — for example as part of a US parent's global program — the two may overlap, and the broker's role at renewal includes mapping the two against each other to ensure neither double-cover nor uninsured gap.
Employment Practices Liability (EPL) is the agency's cover against claims by its own employees, which is a different question from claims by the agency's clients or by candidates the agency has placed. A claim by a worker the agency itself employs that the agency discriminated against the worker on the basis of nationality during the right-to-work check process — for example, treating a worker differently because of perceived immigration status, which is a discrimination question under the Equality Act 2010 rather than an immigration-compliance question — would be an EPL matter, not a PI matter.
The point is that the right-to-work failure rarely produces only one claim, and the agency's broker should be reviewing the policy architecture as a whole rather than at the level of the individual policy.
What underwriters look at on the right-to-work question
A recruitment PI underwriter writing or renewing a temp/contract-supply book will ask about the agency's right-to-work process as part of its standard underwriting. The maturity of the answer materially affects the price and terms.
Underwriters typically want to see, in writing: the agency's standard operating procedure for right-to-work checks (who does them, when, what the checklist is); the choice of route — manual, share-code, IDVT — and where IDVT is used, which IDSP and what the certification status is; the system for tracking time-limited permissions and triggering follow-up checks; the file retention policy (the legal minimum is two years after employment ends but most agencies retain longer for general data-retention reasons); the training programme for onboarding consultants on right-to-work rules; whether the agency has ever been the subject of a Referral Notice, a Civil Penalty Notice, or a Home Office compliance visit, and if so what the outcome was; and the agency's process for dealing with workers whose status changes during the engagement (sponsor-licence holders changing employer, Skilled Worker visa holders being placed into supplementary employment, students taking on additional hours during vacation).
Agencies that can answer those questions briskly and in writing get materially better terms than agencies whose process lives in the head of an onboarding consultant.
How Apex helps
Apex Insurance Brokers is an independent, FCA-authorised broker placing PI cover for UK recruitment agencies. We talk through right-to-work and the wider Conduct Regs picture with directors as part of every renewal submission, and we know the wordings in the market that handle the IANA exposure with the most sense — including which insurers will treat defence costs as part of the main limit, which carry separate regulatory-investigation extensions, and which will offer commentary on the agency's standard operating procedure as part of the underwriting dialogue.
We are not tied to any one insurer, we do not promise particular outcomes, and our remuneration is disclosed before cover incepts. Our Terms of Business page sets out the basis of our service, and our Complaints page sets out how to raise any concerns.
What to do next
If you are running an Employment Business book with material non-British/Irish populations, the next ninety days before renewal is the moment to document your right-to-work process and to think about whether the policy in force properly covers the third-party-claim exposure that flows from a Home Office compliance event. The civil-penalty figures from February 2024 onward mean that the financial stakes have moved decisively past the point where "we have always done it this way" is a defensible answer.
To talk through your agency's right-to-work exposure and how it interacts with PI, contact us or see our recruitment consultants sector page.
Frequently asked questions
Will my PI policy pay the Home Office civil penalty if my agency is found to have employed someone without the right to work?
No. Civil penalties imposed by a regulator on the insured itself are not insurable as a matter of English insurance law — to indemnify them would defeat the deterrent purpose of the regime. The penalty is therefore the agency's own cost. What may be insurable, depending on wording, is the legal costs of contesting the Civil Penalty Notice (some policies extend to regulatory investigation defence costs); and what is normally insurable is any third-party civil claim brought against the agency by the hirer or by another party in the supply chain arising from the same incident.
Is the agency or the end-client the "employer" for right-to-work purposes when a temp is supplied?
Where the agency operates as an Employment Business — engaging the worker itself and supplying the worker to the hirer — the agency is the IANA employer of the worker. The full statutory obligation, the statutory excuse, and the civil-penalty exposure sit on the agency. The hirer is not the IANA employer of the agency's temp, although the hirer may conduct its own checks for contractual or due-diligence reasons. Where the agency operates as an Employment Agency on a permanent placement — introducing the candidate, who is then engaged directly by the hirer — the hirer is the IANA employer.
What is the current maximum civil penalty per illegal worker?
Since the February 2024 uplift, the maximum civil penalty is £45,000 per illegal worker for a first breach and £60,000 per illegal worker for a repeat breach within three years. These figures are materially higher than the £15,000 / £20,000 figures that applied previously, and the uplift has driven a sharpening of underwriter, end-client and recruiter behaviour through 2024 and 2025.
Are digital share-code checks now mandatory for biometric residence card holders?
Yes — since April 2022 the digital share-code route through the Home Office online right-to-work service is the prescribed route for workers whose entitlement is evidenced by a biometric residence permit, biometric residence card, eVisa, or settled-status grant. Manual document checks for those workers no longer establish the statutory excuse. The recruiter must obtain a nine-character share code from the worker, run it through the Home Office service together with the worker's date of birth, verify that the photo on the resulting profile matches the worker physically present, and retain a clear copy of the profile page with the date of the check recorded.
What is an IDVT check and when can I use it?
Identity Document Validation Technology — IDVT — is a permitted route to the statutory excuse, available since April 2022, for British and Irish citizen workers holding a valid (or, for British and Irish citizens, expired) passport. The check is delivered through a certified Identity Service Provider (IDSP) and must include both document verification and likeness verification to the level specified in the Home Office's published list. The IDSP's report must be retained on file. The IDVT route does not apply to non-British/Irish workers.
Does my PI cover the defence costs of a Home Office Civil Penalty Notice?
Sometimes — it depends on the wording. Some recruitment PI policies include a regulatory investigation costs extension that picks up the legal costs of contesting a Civil Penalty Notice; others do not. Where it is included, the cover is typically subject to an inner limit and may require the insurer's consent to instruct counsel. This is one of the items worth flagging explicitly at renewal if your agency operates a contract supply book with material non-British/Irish populations.
If the hirer sues my agency because a supplied worker turned out not to have the right to work, will PI respond?
Yes, in the ordinary course — the hirer's civil claim against the agency is third-party liability arising from the agency's provision of professional services, and a recruitment PI policy is built to respond to claims of that kind. The cover responds to the defence costs and to any damages or settlement up to policy limit, subject to the agency's own conduct being negligence-based rather than wilful or fraudulent. The civil-penalty figure that may sit alongside the hirer's claim remains uninsurable, but the hirer's claim itself is in scope.
Related guides
- Recruitment consultants PI insurance — UK guide 2026 (pillar)
- IR35 status determination and the recruiter's PI exposure
- Recruitment consultants sector page — speak to a broker
About Apex Insurance Brokers — Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority, FCA firm reference 724952. Registered in England and Wales, Companies House 07014570. Last reviewed: May 2026.
This guide is general information about Professional Indemnity Insurance for UK recruitment agencies and employment businesses and is not advice tailored to any individual firm's circumstances. For advice on your own renewal please speak to a broker — contact@apexinsurancebrokers.co.uk or 0117 325 0027.
FAQPage JSON-LD (hand-rolled — add via Yoast Custom Field or theme injection)
{
"@context": "https://schema.org",
"@type": "FAQPage",
"mainEntity": [
{
"@type": "Question",
"name": "Will my PI policy pay the Home Office civil penalty if my agency is found to have employed someone without the right to work?",
"acceptedAnswer": {
"@type": "Answer",
"text": "No. Civil penalties imposed by a regulator on the insured are not insurable as a matter of English insurance law. The penalty is the agency's own cost. What may be insurable, depending on wording, is the legal costs of contesting the Civil Penalty Notice. What is normally insurable is any third-party civil claim brought against the agency by the hirer or by another party in the supply chain arising from the same incident."
}
},
{
"@type": "Question",
"name": "Is the agency or the end-client the employer for right-to-work purposes when a temp is supplied?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Where the agency operates as an Employment Business — engaging the worker itself and supplying the worker to the hirer — the agency is the IANA employer. The full statutory obligation, the statutory excuse, and the civil-penalty exposure sit on the agency. Where the agency operates as an Employment Agency on a permanent placement, the hirer is the IANA employer."
}
},
{
"@type": "Question",
"name": "What is the current maximum civil penalty per illegal worker?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Since the February 2024 uplift, the maximum civil penalty is £45,000 per illegal worker for a first breach and £60,000 per illegal worker for a repeat breach within three years. These figures are materially higher than the £15,000 / £20,000 figures that applied previously."
}
},
{
"@type": "Question",
"name": "Are digital share-code checks now mandatory for biometric residence card holders?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Yes. Since April 2022 the digital share-code route through the Home Office online right-to-work service is the prescribed route for workers whose entitlement is evidenced by a biometric residence permit, biometric residence card, eVisa, or settled-status grant. Manual document checks for those workers no longer establish the statutory excuse."
}
},
{
"@type": "Question",
"name": "What is an IDVT check and when can I use it?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Identity Document Validation Technology — IDVT — is a permitted route to the statutory excuse, available since April 2022, for British and Irish citizen workers holding a valid passport. The check is delivered through a certified Identity Service Provider and must include both document verification and likeness verification. The IDVT route does not apply to non-British/Irish workers."
}
},
{
"@type": "Question",
"name": "Does my PI cover the defence costs of a Home Office Civil Penalty Notice?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Sometimes — it depends on the wording. Some recruitment PI policies include a regulatory investigation costs extension that picks up the legal costs of contesting a Civil Penalty Notice; others do not. Where included, the cover is typically subject to an inner limit and may require the insurer's consent to instruct counsel."
}
},
{
"@type": "Question",
"name": "If the hirer sues my agency because a supplied worker turned out not to have the right to work, will PI respond?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Yes, in the ordinary course. The hirer's civil claim against the agency is third-party liability arising from the agency's provision of professional services, and a recruitment PI policy is built to respond to claims of that kind. The cover responds to defence costs and to any damages or settlement up to policy limit, subject to the agency's conduct being negligence-based rather than wilful or fraudulent."
}
}
]
}