Hidden within the Home Office’s revised Right to Work regime is a technical requirement that many businesses may overlook, but which could carry significant financial consequences.

According to SmartSearch, for a digital Right to Work check to provide a statutory excuse, the identity service provider must be both registered with the Office for Digital Identities and Attributes (OFDIA) and certified specifically for the Right to Work use case. Registration on its own does not qualify, and neither does certification obtained for another purpose.

What might appear to be a minor procurement detail is in fact one of the most consequential decisions HR and compliance teams will face this year. Choosing a digital verification provider is no longer simply a supplier selection exercise.

It has become a question of compliance risk, where the distinction between certified and uncertified providers determines whether a business can defend itself if a check later proves flawed.

The Digital Identity and Attributes Trust Framework (DIATF) sets a common standard for digital identity providers across the UK. It is overseen by OFDIA, part of the Department for Science, Innovation and Technology, and providers seeking certification undergo independent assessment against technical, security, operational and governance criteria. Crucially, Right to Work certification is separate from general OFDIA registration.

In its September 2026 guidance update, the Home Office introduced an additional requirement.

Where businesses purchase digital verification service provider (DVSP) checks through an intermediary, such as a reseller or integrated platform, that intermediary must clearly disclose which registered DVSP is performing the check.

Source link