2026



CMS.DataEngine.CollectionPropertyWrapper`1[CMS.DataEngine.BaseInfo]
Profile Image Verifile
October 6, 2026
Blog Article Image

Right to Work Checks: Can You Use a Screening Company That Is Not on the Government's Register?

Since 1 October 2026, a digital right to work check must be carried out by a provider listed on the government's register of digital identity providers. The rule has left some employers asking whether they can still use a screening company that does not appear on that register. They can, as long as the screening company works with a registered provider and tells them which one. The Home Office's guide for employers describes this arrangement in a single paragraph on page 31.

Key takeaways

  • What changed on 1 October 2026. A digital identity check for right to work must be carried out by a provider listed on the government's register.
  • What a screening company must tell you. The Home Office's guide says a screening company that is not certified itself must tell you which certified and registered provider it works with, and which service carries out the check.
  • How to check for yourself. Every digital check report must show the provider's name and a link to its page on the register, according to the Home Office.
  • Where Verifile fits. Yoti carries out the identity part of our digital right to work checks, and Yoti is on the register. Verifile's digital right to work reports show Yoti's name and a link to its page on the register.

What changed on 1 October 2026

Employers have been able to use digital identity providers for right to work checks since 2022. A provider checks a candidate's passport digitally and matches their face to the passport photo. The Home Office's guide says face matching can make the check quicker, especially when someone is hired remotely.

The Home Office's code of practice for employers, in force from 1 October 2026, adds a condition. The provider must be listed on the government's register, and its entry must show that it can do right to work checks.

The Office for Digital Identities and Attributes (OfDIA) keeps the register, whose full name is the digital verification services (DVS) register.

The condition matters because a right to work check, done properly, is what protects an employer from a civil penalty of up to £60,000 for each illegal worker. The Home Office calls that protection a statutory excuse, and its guide says that if a digital check does not follow the rules, the employer "will not establish a statutory excuse".

Why a screening company may not be on the register

The register lists the companies certified to carry out the digital identity check. A screening company that uses a certified provider, without being certified itself, will not appear on the register. Searching the register for the screening company's name will find nothing, and the entry to look for is the provider's.

What the Home Office guide says

The Home Office's guide for employers says a screening company that is not certified itself must tell you which certified and registered provider it works with, and name the service that carries out the check.

The paragraph that says so is on page 31, in the part of the guide headed "Conducting a right to work check using a RtW DVSP", just before the heading "What checks are RtW DVSPs permitted to do?". RtW DVSP stands for right to work digital verification service provider, the guide's term for a digital identity provider.

"If an employer procures a RtW DVSP’s service through another organisation which is not itself certified (for example, a referencing or screening agency), that organisation must clearly state that it is working with a certified and registered RtW DVSP and identify the service carrying out the check. This ensures that the employer knows which certified and registered DVSP is being used. The certification, registration or trust-marked status of a RtW DVSP, or any other DVSP, must not be misrepresented."

How to check for yourself

The guide lists what every digital check report must give the employer, and three of those items concern the register:

  • the provider's name, as it appears on its certificate
  • a "Yes" confirming the provider is registered
  • a link to the provider's page on the register

The link takes you to the provider's entry on the register. The guide also says the employer, not the provider, remains responsible for the check being done properly.

How this works at Verifile

Verifile is a screening company of the kind the guide describes. Yoti carries out the identity part of our Right to work (Digital) and Right to work (Digital & Conditional) checks for candidates with a valid British or Irish passport. Yoti's service, Yoti IDV, is on the register as certified for right to work checks.

Verifile itself is not on the register, because Yoti, not Verifile, carries out the identity check. Every digital right to work report we send shows the three items above, with Yoti as the provider and a link to Yoti's entry on the register.

A search of the register for Yoti finds Yoti IDV.

Next steps for employers

  1. Ask your screening company which certified and registered provider carries out its digital right to work checks, and which service it uses. The guide says the screening company must tell you.
  2. Look up that service on the digital verification services register, and check that "Right to Work" is listed under "Supplementary codes", the register's list of the checks a service is certified for.
  3. Make sure your digital check reports show the provider's name, a "Yes" confirming it is registered, and a link to its page on the register.

Key sources

  1. Home Office, "Employer's guide to right to work checks", 1 October 2026. The paragraph on screening companies is on page 31. Read here
  2. Home Office, "Code of practice on preventing illegal working: Right to Work Scheme for employers", 1 October 2026. Read here
  3. Office for Digital Identities and Attributes, digital verification services register, the entry for Yoti IDV, read on 5 October 2026. Read here

Read More
CMS.DataEngine.CollectionPropertyWrapper`1[CMS.DataEngine.BaseInfo]
Profile Image Verifile
| Verification Chronicles
September 28, 2026
Blog Article Image

Verification Chronicles: The Careless Copycat

Somewhere, somebody has finished a degree and posted a photograph of the certificate on LinkedIn. The gown, the grin, the paper held up to the camera. Every summer, LinkedIn fills with the same photograph.

That photograph is also a security document, taken in good light, and published where anyone can find it.

A case we handled at Verifile began with a photograph like that one.

A candidate had applied for a job at a multinational bank, and the bank asked us to verify his degree.

We'll call him Adam*.

The lesser award

Adam declared a Bachelor of Science in Finance from the University of Reading, awarded about eighteen months earlier. Last October our client asked us to verify the degree.

What Adam achieved through the University of Reading was not a bachelor's degree. It was a Certificate of Higher Education in Business, or in the university's own words, "a lesser award".

The Department for Education puts a Certificate of Higher Education at the same level as the first year of a bachelor's degree. A bachelor's degree with honours is two levels higher and takes three years. Adam had about one year of study, and he had claimed three.

There was even more in the university's record. Adam had begun a pharmacy degree at Reading a few years earlier and left it without finishing, then started again with the finance course in mind.

He had been a student at Reading. He had claimed a bachelor's degree he did not have.

The certificate

Most checks would stop there. We had the answer our client had asked for, and the discrepancy was plain.

Nevertheless, we went further because a discrepancy that size can also be somebody's mistake, and a mistake left uncorrected would cost Adam his career. We asked Adam for a copy of his bachelor's degree certificate, so the document itself could go in front of the university.

He sent the certificate the next day.

Almost nobody really looks closely at a degree certificate. You look at it, the crest is in the right place, the name matches the CV, and you move on to the next thing in the pile. This certificate would have passed that look. It gave Adam a 2:1, and nothing about it invited a second glance.

We sent the certificate to the University of Reading and asked whether the certificate was theirs. The answer came back within the week.

"I can verify that the information we have already given is correct... The University cannot verify the attached document as official.

The University considers that the document may be forged and is therefore undertaking further investigations. The student number on the certificate does not match this student's name.

We will then undertake further investigations and submit these to the Head of Governance and the University Secretary for a review."

One line in there did the work. The student number on the certificate does not match this student's name. The student in question was Adam.

This certificate carried Adam's name above somebody else's student number. And Adam had a student number of his own, because he really had studied at Reading.

The number that belonged to somebody else

Curiosity got the better of our team. One of them went looking through other Reading certificates, to see where that student number might have come from. Hundreds of images came back, which is what happens when you search for a document that thousands of people are proud of. Among them was a LinkedIn post from a real graduate, holding up their certificate, exactly the photograph anybody would take.

The student number on that graduate's certificate was also the student number on Adam's.

What our team felt was shock, and then a kind of amusement at the lengths Adam had gone to.

A graduate in cap and gown holding a degree certificate up to the camera on a university lawn.
Illustration created with AI. Every summer LinkedIn fills with this photograph, and everything printed on the certificate is in it.

Now the typography made sense. The course name and the date both sit in the wrong typeface, and those are two of the three things Adam had to change. The third was the name. The student number did not have to be changed at all, so Adam left the student number where it was, and the student number was the one thing on the page that led back to a real person.

We do not know how many employers had taken this certificate at face value before us. Or background screening providers.

What we could not finish

The University of Reading's last word referred the matter to its Head of Governance and University Secretary, and the university never told us what they decided. Nobody put the graduate's LinkedIn post to Adam, and we never learned what our client did next.

What settled this case was not a close reading of the document. It was asking the University of Reading, because the university was the only party that could confirm the award. And it was going back a second time when the first answer did not add up, because accuracy has to work in both directions. The same second look that caught Adam is what would have cleared him, had the university been the one who got it wrong.

The certificate that made all of this possible had been sitting in public the whole time, in good light, at a resolution somebody else could work from.

Names and certain details have been changed for confidentiality.

Verification Chronicles is our record of the cases that come through our verification team, real files, names changed, told as they happened. We publish them because the next employer to see one of these should recognise it faster than we did.

Read more episodes →

Read More
CMS.DataEngine.CollectionPropertyWrapper`1[CMS.DataEngine.BaseInfo]
Profile Image Verifile
| Verification Chronicles
September 28, 2026
Blog Article Image

Verification Chronicles: The Family Resemblance

If you have a degree, your certificate is likely to be in a drawer at home, or in a folder of old paperwork. You looked at it properly on the day it arrived and probably not since.

That sheet of paper stands for three years of work, and your family came to watch you collect it. Your name is printed in the middle.

Take the name off and the page would fit anybody.

One of our cases at Verifile was about the name on a certificate. A property firm had offered a candidate a job as a client onboarding analyst, and asked us to verify the law degree on her application.

We'll call her Rachel Marian Doyle*.

A routine verification

Rachel had declared a Bachelor of Laws (LLB) from Southampton Solent University, awarded more than fifteen years earlier. The verification began the way most of them do. The university needed her signed consent, we asked her for it, and she returned it promptly.

Before the university would confirm anything, it wanted to see the certificate itself. That request is routine and does not mean anyone is suspicious. A degree awarded that long ago may not be in a university's electronic records, and somebody has to go and check the paper records.

Rachel sent her certificate over and we passed it on.

The university did not confirm the degree. Instead, it asked us a question. The certificate said Marion Doyle, but our request was for Rachel Marian Doyle. Had Rachel been awarded the degree under the name Marion Doyle?

A degree certificate reading MARION DOYLE beside a driving licence reading DOYLE, RACHEL MARIAN.

A careful reader would have found nothing wrong with that certificate, because there was nothing wrong with it. The crest, the wording, the signatures and the year were all exactly what they should be. Only the name did not fit, and the name was the one thing Rachel had an explanation for.

The most ordinary explanation in the world

Rachel told us she had been known as Marion Doyle while she was studying.

Taken on its own, a different name at university is not a red flag and it should not be treated as one. Plenty of people go by a middle name rather than a first one. Spellings drift, families use one form while the paperwork uses another, and the name somebody used at nineteen is often not the name on their passport at forty. We see this constantly, and almost every time there is nothing behind it.

What is harder to explain is being formally enrolled under that name. A university registers a student under the name on their documents, not the name their friends use. And the name on the certificate was not simply her middle name. It was her middle name spelt with one different letter.

Rachel's passport does not carry the middle name at all. Her driving licence carries it as Marian.

Then Rachel did something candidates in her position rarely do. She sent a second document to support the first, a university student card in the name on the certificate, with Rachel's photograph on it.

The card has a thin red box printed on it for the photograph. The photograph does not sit inside the box. It crosses the printed line on two sides.

We noted where the photograph sat and carried on, because a photograph in the wrong place is something you can see and not something you can prove. But the second document did keep the case open. A document sent to prove another document proves nothing until the university that holds the record confirms it.

The date of birth

A university verification is usually finished in days. This one had been running for almost a week and had produced a new question at every step, and by this point it had stopped feeling routine.

The university replied once more. Before it would say anything about the degree, it wanted the date of birth of the person who had earned it.

We took the date from Rachel's passport and her driving licence, which both show the same date, and sent it that afternoon.

The answer arrived the same day.

“Hello - unfortunately, we do not have a candidate on our records with the name '[Marion Doyle]' with the date of birth [removed].”

Whose certificate was it

A forged certificate would have carried Rachel's own name. Carrying the right name is the entire point of forging a certificate, and a forger who prints the wrong name has created a problem where none existed.

Our team could see only one explanation. The certificate is real, it records a real degree, and the woman who earned it is not Rachel.

The student card needs explaining too. Rachel did not only hold that woman's degree certificate. She also held that woman's student card, from the same university and the same year as the certificate. A student card does not get passed around. It stays with the person it was issued to, or it is thrown away.

Nobody holds a stranger's student card. People who share a house hold each other's.

They also share a surname.

We have seen family names used this way before, near-identical names inside one family, and a relative's certificate is the explanation that fits the facts. Nobody established it, and nobody asked the university to.

One question is still open. Somewhere there is a woman who earned that law degree, and either she handed over her certificate and her student card, or she has no idea that any of this happened.

The part that stays with you

Look again at what Rachel did after the university's first question.

She was asked to explain the name, and she explained it. She was asked to prove the explanation, and she found a document and sent it in. She was asked for a date of birth, and she gave the real one, from her real passport, for the university to check.

The university pushed back twice, with a sharper question each time, and Rachel kept going.

In the end, the answer was in documents we already had. Rachel's passport and driving licence, which we verified at the start, carried her date of birth, and the university had no Marion Doyle with that date on its records.

Names and certain details have been changed for confidentiality.

Verification Chronicles is our record of the cases that come through our verification team, real files, names changed, told as they happened. We publish them because the next employer to see one of these should recognise it faster than we did.

Read more episodes →

Read More