Home Office publishes FAQ guide for REC members

Following conversation with our members, the REC submitted a number of questions to the Home Office on the use of the new Identity Document Validation Technology (IDVT) for the purposes of conducting a right to work (RTW) check. These questions covered a range of business and commercial aspects of IDVT including how a check would be conducted, whether a recruiter could be their own certified IDVT provider and several other similar queries. After pressure from the REC, the Home Office has now responded to these questions on behalf of our members with this additional FAQ guidance.

1. Given the volume of right to work checks recruitment business undertake, would it be possible for them to be accredited as a service provider?

Section 10.1 (Roles and responsibilities) of ‘UK digital identity and attributes trust framework – alpha version 2’ on GOV.UK: - version outlines the definition of an Identity Service Provider (IDSP).

For a recruitment business to be certified to provide the identity element of digital right to work checks they would have to meet the criteria in the current version of the trust framework. They would also need to demonstrate that they are capable of meeting the guidance for the Right to Work Scheme and/or DBS Scheme, depending on the scheme they wished to join. Any organisation seeking to be certified as an IDSP should follow the guidance on GOV.UK: ‘Digital identity certification for right to work, right to rent and criminal record checks’

2. Typically, how long is it estimated that the UKAS accreditation process will take?

• Five certification bodies have been selected to certify IDSPs.

• IDSPs interested in becoming certified should contact these bodies to start the certification process. The length of the process will vary according to the IDSP’s service and the particular certification body. Certification bodies should be able to provide an estimate to individual IDSPs. The Government and UKAS will not be involved in defining the time required for certification.

• Full details of the accreditation and certification processes is defined as follows:
• Certification bodies express an interest in being recognised to certify identity service provides for the Right to Work, Right to Rent, and DBS Schemes.
• UKAS selected certification bodies (5 certification bodies were recognised in March 2022 - a list of certification bodies can be found on this page).
• IDSPs are able to engage certification bodies in order to obtain certification.
• Certification bodies audit the IDSPs against the Trust Framework and relevant scheme rules.
• IDSPs become certified to provide digital identity checks.
• IDSPs begin commercial relationships with relying parties.
• IDSPs start performing checks.

3. If a business is able to become an IDSP, could they commence this process at any time?

IDSPs are welcome to engage certification bodies to start the process at any time. There is no deadline to begin the certification process. Once certification is obtained, IDSPs can build commercial relationships with relying parties and start performing digital identity checks.
 

4. What is the actual process for a right to work – who (worker or employer) will upload the documents, and how will the result be delivered, i.e.an image or specific wording?  Will the process be similar to current migrant online services via a share code?

The process above is one example of the type of technology in use at the moment and how it works. This is taken from the EUSS ID Checking app.

The process for right to work checks is set out in guidance,

IDSPs will have differing processes, including how their technology can interact with recruitment and on-boarding processes which the employer (relying party) will establish when procuring their chosen IDSP.

Where an IDSP is used, employers retain obligations that they must comply with under the RTW Scheme. The employer needs to complete the following steps before employment commences to ensure a prescribed check has been undertaken, in order to establish a statutory excuse. The process is as follows:

• Use an IDSP to check a prospective employee’s valid British or Irish passport (or Irish passport card) using Identity Document Validation Technology (IDVT).
• Obtain an output of the IDVT identity check from the IDSP containing a copy of the IDVT identity check, and the document checked, in a clear, legible format that cannot be altered.
• Carry out their own due diligence to satisfy themselves to a reasonable belief that their chosen IDSP has completed the check correctly in the prescribed manner.
• Satisfy themselves that the photograph and biographic details (for example, date of birth) on the output from the IDVT identity check are consistent with the individual presenting themselves for work (i.e. the information provided by the check relates to the individual and they are not an imposter).
• Where names differ between documents, the employer must establish why this is the case and must not employ that individual unless they are satisfied that the documents relate to them. A statutory excuse will not be obtained where it is reasonably apparent that the prospective employee is not the individual linked to the identity which was verified by the IDSP.
• Employers must retain this information securely for the duration of employment and for a further two years after the employment has ended. The copy must then be securely destroyed.  

5. Is the MRZ the item that is checked to confirm identity checks by the IDSP?

IDSPs can carry out digital identity verification to a range of standards or levels of confidence. The Home Office recommends that employers only accept checks via an IDSP that satisfy a minimum of a Medium Level of Confidence as defined in GPG45.

The IDSP must take all reasonable steps to check the validity of the document and take all reasonable steps to verify the prospective employee is the rightful holder of the document.

6. Are businesses to assume that no video call needs to take place specifically to confirm an eligibility check?

The employer needs to satisfy themselves that the photograph and biographic details (for example, date of birth) on the output from the IDVT identity check are consistent with the individual presenting themselves for work (i.e. the information provided by the check relates to the individual and they are not an imposter).

Where an IDSP is used, employers do not have to see physical documents that were provided by the applicant for the RTW check.

7. What will any auditor expect to be able to view to confirm Statutory Defence?

The process is explained in this Right to Work Checks employer guidance.

Employers will obtain a statutory excuse where they can demonstrate that they have complied with all the statutory requirements to conduct right to work checks. Employers must retain this information securely for the duration of employment and for a further two years after the employment has ended.

8. Will there be a requirement to validate the documents and date stamp, or will this be visible on the documents if the employer has to download a copy?

Please see response to question 7.

Employers must make clear copies of each document in a format which cannot manually be altered and retain the copy securely: electronically or hard copy. Employers must also retain a secure record of the date on which they made the check. Simply writing a date on the copy document does not, in itself, confirm that this is the actual date when the check was undertaken. If the employer writes a date on the copy document, they must also record that this is the date on which they conducted the check.

Employers must retain copies of:

1.    Passports: any page with the document expiry date, the holder’s nationality, date of birth, signature, immigration permission, expiry date, biometric details, photograph and any page containing information indicating the holder has an entitlement to enter or remain in the UK (visa or entry stamp) and undertake the work in question (the front cover no longer has to be copied).

2.    All other documents: the document in full, including both sides of an Immigration Status Document and an Application Registration Card.

All copies of documents taken should be kept securely for the duration of the worker’s employment and for two years afterwards. The copy must then be securely destroyed.

9. How long is the end-to-end process to confirm the identity aspect of the check anticipated to take – given it will likely take longer than a video call?

This may vary depending on the agreement between the employers and their chosen IDSP.

10. What is the anticipated timeframe for a) implementation, b) accreditation of providers, c) opportunity to arrange commercial terms with service providers?

As per response to question 2, the Government and UKAS will not be involved in defining the time required for certification or arranging the commercial terms.

11. What are the costs associated with using an IDSP and does the Home Office have any plans to introduce a charge for the online right to work checking service?

The costs of using an IDSP will vary depending upon an employer’s chosen provider and their business needs. This may be determined via contractual arrangements between employers and IDSPs. The employer would meet the cost as the ‘relying party’.

The Home Office has no plans to regulate the costs charged by IDSPs as this is a private contractual arrangement between the employer and their chosen provider.  We will, however, continue to look closely at feedback and lessons which can be applied to further develop and improve the initiative for the benefit of all.

There are currently no plans to introduce a charge for the use of the Home Office online right to work checking service.

The use of IDVT is not being mandated. It provides an alternative option for those who wish to continue to carry out checks remotely. Employers can continue to rely upon manual checks of physical documents if they do not wish to use an IDSP.

12. Will this be a set cost per check, or will this be a commercial decision by the provider?

The costs of using an IDSP will vary depending upon an employer’s chosen provider and their business needs. This may be determined via contractual arrangements between employers and IDSPs.

We continue to receive communications from other employers and their representative bodies advising that, for them, this does represent a more cost-effective practice than to carry out manual checks of original documents. Employers can continue to rely upon manual checks of physical documents if they do not find the use of IDVT suits their business model.