Buried in the detail of the Home Office's updated Right to Work regime is a technical point that most businesses will read once and move past. For digital Right to Work checks to establish a statutory excuse, the identity service provider must be registered with the Office for Digital Identities and Attributes (OFDIA) AND certified specifically for Right to Work. Registration alone is not enough. Certification for a different purpose is not enough.
At first glance, this looks like a procurement footnote. In practice, it is one of the most important commercial decisions any HR or compliance team will make this year.
It turns the choice of digital verification provider from a supplier selection into a compliance risk decision. The difference between a certified and an uncertified provider is not a matter of features or pricing. It is the difference between whether your business has a defensible position when a check turns out to have missed something.
The Digital Identity and Attributes Trust Framework, better known as DIATF, is the government's mechanism for setting a common standard across digital identity providers. OFDIA, which sits within the Department for Science, Innovation and Technology, is the body that administers it. Providers seeking certification are independently assessed against a defined set of technical, security, operational and governance requirements.
What matters for Right to Work specifically is that providers also hold certification for the Right to Work use case, not just general OFDIA registration. The two are different.
The Home Office added a further requirement in its September 2026 guidance update. Where DVSP checks are bought through an intermediary rather than directly from the DVSP, the intermediary must clearly disclose which registered DVSP is actually carrying out the check. If your business uses a reseller or an integrated platform to run its Right to Work checks, you need to know which registered DVSP sits behind that platform.
From 1 October 2026, this is the operational safe harbour. Providers inside it establish the statutory excuse. Providers outside it, however capable their technology may be, do not.
The statutory excuse is the legal protection a business has if a Right to Work check turns out, in hindsight, to have missed something.
Under the rules, businesses that carry out the required check in the required way, retain the required evidence, and act on it appropriately, are protected against civil penalties even if the worker later turns out not to have the right to work. Without a statutory excuse, that protection does not apply. A business that relied on an uncertified digital verification provider and later discovered a worker did not have the right to work would find itself carrying the full penalty exposure. That is £45,000 per worker for a first breach, £60,000 per worker for a repeat breach, regardless of how sophisticated the verification technology was or how confidently the provider marketed its accuracy.
If your business currently uses a digital verification supplier for Right to Work, or if you are evaluating suppliers now, the following short list of questions will tell you where you stand.
If your provider cannot answer yes to the first three questions in writing, with evidence, the conversation about switching providers needs to happen soon.
SmartSearch and Credas sit within the same group, and Credas is the identity verification platform within the group built specifically for Right to Work and digital identity verification at scale.
Credas is DIATF-certified and carries the DIATF trustmark. Its Right to Work platform offers:
Credas already works with organisations including the NHS, PA Media, the Nuclear Decommissioning Authority, Indeed Flex, the FCSA and Traveline Cymru, across sectors where Right to Work checks need to work at scale, at pace, and to the standard the new rules require.
The Right to Work regime has moved from a light-touch check to a certified, evidence-based obligation. Businesses that stayed with uncertified tools after 1 October are now in a position they may not want to defend if a check is later challenged. Businesses that moved to a certified provider before October have taken a straightforward step that meaningfully reduces their exposure.
If you would like to see how Credas works, or you would like a 20-minute conversation about where your current setup stands against the new rules, book time with our team.