Fixing the right to work gap in distributed hiring

{ "body_markdown": "## The liability of the honor system\n\nMost recruitment teams treat right to work checks as a final administrative hurdle rather than a compliance anchor. In a company of 150 people, the cost of a single civil penalty for hiring an unauthorized worker can exceed 20,000 pounds in the UK or 2,500 dollars per violation in the US. Despite these risks, the standard operating procedure at many mid-sized firms remains dangerous. Recruiters often accept blurry photos of passports via email or Slack, file them in a Google Drive folder, and assume the job is done.\n\nThis manual approach creates two specific problems. First, it lacks an audit trail. If a government inspector asks why a specific employee was cleared, an email from a recruiter saying "looks good" is not a valid defense. Second, it fails the remote test. Under current regulations, simply seeing a scan is rarely enough. In the UK, the Home Office requires specific digital identity service providers (IDSPs) for British and Irish citizens, or the use of share codes for other nationalities. In the US, the Form I-9 must be completed within three business days of the first day of work, and while remote verification is now an option for E-Verify users, the documentation requirements are rigid.\n\n## Establishing a single source of truth\n\nTo fix this, you must stop treating document collection as a task for the recruiter. It is a data integrity task. The first step in your planning phase is to centralize where these documents live. You should not store sensitive identity documents in your Applicant Tracking System (ATS) unless that system has a dedicated, encrypted compliance module. Instead, use a specialized verification tool or a secure HR Information System (HRIS) like Workday, Rippling, or HiBob that triggers a workflow the moment an offer is accepted.\n\nYour plan must dictate that no employee can be assigned a start date in the payroll system until the compliance officer has marked the right to work check as complete. This creates a hard stop. If the recruiter cannot bypass the system to onboard a candidate, the risk of a missed check drops to zero. \n\n## The three-step verification architecture\n\nWhen planning your new workflow, divide the process into three distinct stages: collection, verification, and retention. \n\n### Stage 1: Collection\n\nStop asking candidates to email their documents. Email is not secure, and it leads to version control issues. Use a secure portal where candidates upload high-resolution files directly. Your instructions must be granular. Tell the candidate to include all four corners of the passport page and to ensure there is no glare from the camera flash. For US hires, provide the list of acceptable documents (List A or a combination of B and C) upfront so they do not provide a Social Security card when they intended to use a passport.\n\n### Stage 2: Verification\n\nIn Europe, and specifically the UK, manual checks are becoming obsolete for digital-first companies. You should integrate an IDSP that uses NFC technology to read the chip in a passport. This removes human error. For US-based roles, if your company is not already enrolled in E-Verify, you should do so. It provides an extra layer of certainty by matching I-9 information against Department of Homeland Security and Social Security Administration records. \n\nIf you are hiring remotely in a region that requires physical inspection, do not ask the candidate to mail their passport. In the US, you can use authorized representatives. This can be any person you designate to act on your behalf to inspect the documents in person. The liability remains with you, so you must provide this representative with a clear checklist and a video link to explain what they are looking for.\n\n### Stage 3: Retention and expiration tracking\n\nThe most common compliance failure is not the initial check, but the failure to track expirations. A visa that was valid on the start date might expire in 18 months. Your plan must include an automated notification system. Set alerts for 90, 60, and 30 days before a document expires. This gives the legal team enough time to start a visa renewal or for the employee to provide updated evidence of their right to work. Do not rely on a spreadsheet for this. Spreadsheets do not send push notifications and they are prone to deletion.\n\n## Training the front line\n\nRecruiters are your first line of defense, but they are not immigration lawyers. Your internal documentation should include a simple decision tree. If a candidate provides a Document X, then the recruiter must follow Path Y. \n\nFor example, if a candidate in the UK provides a Share Code, the recruiter must know that they have to perform the check via the official government portal while the candidate is present on a video call to verify the photo matches the person. They should not just print the result and file it. They must record the date the check was performed and sign off on the likeness. \n\n## Managing the data footprint\n\nData privacy laws like GDPR in Europe and various state laws in the US (like CCPA) require you to delete identity data when it is no longer needed. However, immigration law requires you to keep it for a specific period (usually the duration of employment plus one year, or three years from the date of hire, whichever is longer). \n\nYour plan must reconcile these two. Set a recurring quarterly audit where the HR Manager reviews the files of terminated employees. If the retention period has passed, the documents must be purged from your secure storage. Keeping these documents longer than necessary is a liability, not a safety net.\n\n## The cost of doing it right\n\nMoving to a structured, tool-based verification process has a cost. You will likely pay a fee per check to an IDSP or a subscription fee for a compliance platform. However, when you compare this to the manual hours spent by recruiters chasing documents, the reduction in administrative friction is significant. \n\nMore importantly, you are protecting the organization from catastrophic fines and the loss of its ability to sponsor visas. In a competitive market for talent, being unable to hire international experts because your compliance records are a mess is a strategic failure. Build the process now, enforce it through your HRIS, and move compliance from a manual headache to a silent, automated background process." }