Buried in the detail of the Home Office's updated Right to Work regime is a technical point that most businesses will read once and move past. For digital Right to Work checks to establish a statutory excuse, the identity service provider must be registered with the Office for Digital Identities and Attributes (OFDIA) AND certified specifically for Right to Work. Registration alone is not enough. Certification for a different purpose is not enough.

At first glance, this looks like a procurement footnote. In practice, it is one of the most important commercial decisions any HR or compliance team will make this year.

It turns the choice of digital verification provider from a supplier selection into a compliance risk decision. The difference between a certified and an uncertified provider is not a matter of features or pricing. It is the difference between whether your business has a defensible position when a check turns out to have missed something.

Why certification exists

The Digital Identity and Attributes Trust Framework, better known as DIATF, is the government's mechanism for setting a common standard across digital identity providers. OFDIA, which sits within the Department for Science, Innovation and Technology, is the body that administers it. Providers seeking certification are independently assessed against a defined set of technical, security, operational and governance requirements.

What matters for Right to Work specifically is that providers also hold certification for the Right to Work use case, not just general OFDIA registration. The two are different.

The Home Office added a further requirement in its September 2026 guidance update. Where DVSP checks are bought through an intermediary rather than directly from the DVSP, the intermediary must clearly disclose which registered DVSP is actually carrying out the check. If your business uses a reseller or an integrated platform to run its Right to Work checks, you need to know which registered DVSP sits behind that platform.

From 1 October 2026, this is the operational safe harbour. Providers inside it establish the statutory excuse. Providers outside it, however capable their technology may be, do not.

What a statutory excuse actually is

The statutory excuse is the legal protection a business has if a Right to Work check turns out, in hindsight, to have missed something.

Under the rules, businesses that carry out the required check in the required way, retain the required evidence, and act on it appropriately, are protected against civil penalties even if the worker later turns out not to have the right to work. Without a statutory excuse, that protection does not apply. A business that relied on an uncertified digital verification provider and later discovered a worker did not have the right to work would find itself carrying the full penalty exposure. That is £45,000 per worker for a first breach, £60,000 per worker for a repeat breach, regardless of how sophisticated the verification technology was or how confidently the provider marketed its accuracy.

The questions to ask your current provider

If your business currently uses a digital verification supplier for Right to Work, or if you are evaluating suppliers now, the following short list of questions will tell you where you stand.

• Are you registered with the Office for Digital Identities and Attributes?
• Are you certified specifically for Right to Work under the DIATF framework?
• If we buy checks through an intermediary, which registered DVSP is actually carrying out the check?
• Are you integrated with the Home Office online checking service?
• Do you support the full range of digital immigration status checks, including eVisas and share codes?
• Can you evidence the audit trail we will need under the extended liability model?
• Can you handle substitute worker verification at the pace the new rules require?
• Do you provide biometric verification, NFC chip reading and anti-fraud protection as standard, rather than as optional add-ons?
• Can you cover the range of identity documents our workforce actually presents?
  
  

If your provider cannot answer yes to the first three questions in writing, with evidence, the conversation about switching providers needs to happen soon.

Where Credas fits within SmartSearch

SmartSearch and Credas sit within the same group, and Credas is the identity verification platform within the group built specifically for Right to Work and digital identity verification at scale.

Credas is DIATF-certified and carries the DIATF trustmark. Its Right to Work platform offers:

• Government-certified checks, ready for the current regime
• Biometric NFC chip reading and integrated anti-fraud checks as part of the standard process, not add-ons
• Real-time facial recognition that confirms the person submitting the check is the person in the document
• Coverage across 2,500 types of identity document
• Integration with the Home Office online checking service and support for eVisas and digital immigration status checks
• A mobile app and browser-based portal, so checks can be completed at the pace substitute worker verification requires
• A clear, evidenced audit trail across every check, retrievable when your compliance team or a Home Office investigator needs it
  
  

Credas already works with organisations including the NHS, PA Media, the Nuclear Decommissioning Authority, Indeed Flex, the FCSA and Traveline Cymru, across sectors where Right to Work checks need to work at scale, at pace, and to the standard the new rules require.

The commercial reality of the choice

The Right to Work regime has moved from a light-touch check to a certified, evidence-based obligation. Businesses that stayed with uncertified tools after 1 October are now in a position they may not want to defend if a check is later challenged. Businesses that moved to a certified provider before October have taken a straightforward step that meaningfully reduces their exposure.

If you would like to see how Credas works, or you would like a 20-minute conversation about where your current setup stands against the new rules, book time with our team.