What is a “statutory excuse” – and why should you care?

Where IDSPs fit in: when can you use a digital provider?

Under current Home Office rules, employers can use an Identity Service Provider (IDSP) to carry out right to work checks using Digital Identity Document Verification Technology (IDVT) – but only for:

• British citizens with a valid passport

• Irish citizens with a valid passport or Irish passport card

For everyone else (eVisas, share codes, non-UK/Irish nationals), you must use:

• A Home Office online check, or

• A manual document check, depending on the person’s immigration status

So IDSPs are not a replacement for the whole RTW regime – they’re a specific route for a specific group of workers. But they are squarely in scope of the Home Office guidance and the statutory excuse rules.

Certified vs non-certified IDSPs: what’s the difference?

Here’s where it gets crucial.

The Home Office:

• Does not strictly require you to use a certified IDSP

• Strongly recommends certified providers because they’ve been independently assessed against the government’s digital identity standards – specifically GPG45 at a minimum of Medium Level of Confidence (MLC)

What really matters is this:

To rely on an IDVT check for your statutory excuse, the process must meet the Home Office-prescribed standards, including the GPG45 methodology at the appropriate level of confidence.

If you:

• Use an IDSP that doesn’t actually follow GPG45 MLC, or

• Configure or use them incorrectly (e.g. the wrong level of confidence, no proper image match, missing records),

then you have not carried out a compliant RTW check for statutory excuse purposes – even if you “used an IDSP”.

Certification is therefore a strong signal that:

1. The IDSP has been independently checked against the right standards

2. Their process is aligned with what the Home Office expects for RTW checks

Using a non-certified provider isn’t automatically unlawful – but it moves the burden onto you to prove that their process was genuinely GPG45-compliant if you’re ever challenged.

The real risk: losing your statutory excuse

The June 2025 employer guidance spells out the position: to establish a statutory excuse, employers must follow the specified RTW check routes and standards. If IDVT is used, that includes the GPG45-based digital route.

If:

• Your IDSP doesn’t meet GPG45 at Medium Level of Confidence; or

• The identity evidence is not properly matched to the person in front of you; or

• You don’t keep the correct records of the check;

then from the Home Office’s perspective, no compliant right to work check took place.

And if no compliant check took place, then:

You do not have a statutory excuse under the Immigration, Asylum and Nationality Act 2006.

That is the crux:

• It’s not enough to say “we used a digital provider”.

• You must be able to say “we used a provider and a process that clearly meets the Home Office standards.”
  
  

A quick checklist for employers

If you’re using – or thinking of using – an IDSP for right to work checks, ask yourself:

1. Can the provider clearly evidence GPG45-compliant checks at Medium Level of Confidence for RTW?

2. Do they give you a clear, auditable output (report + passport image) that you can retain as evidence?

3. Do your internal processes still include the required “face to face” step (in person or live video) to confirm the person matches the identity verified by the IDSP?

4. Are your HR teams trained on when they can (and can’t) use an IDSP vs manual or online checks?

5. Could you explain this process to a Home Office officer tomorrow and show records that demonstrate compliance?

If the answer to any of those is “not really”, your statutory excuse is at risk.

How Xertilox helps de-risk digital right to work checks

At Xertilox, we’ve built our identity platform around the standards the Home Office and the wider government ecosystem are moving towards – not just the bare minimum to “get a tick in the box”.

Our approach to right to work for British and Irish citizens:

• GPG45-aligned checks designed to meet the Medium Level of Confidence recommended in the Home Office guidance for digital RTW checks

• Biometric and document checks that go beyond simple picture-matching, helping to spot fraud, tampering and look-alike risks early

• Clear, auditable reports for every check, so you can evidence your process years down the line

• Built-in workflows that make it easy for HR and hiring managers to follow a consistent, compliant process, every time

We can’t remove your legal responsibilities – the employer always remains liable in the eyes of the Home Office – but we can:

• Reduce the risk that a digital check is deemed non-compliant

• Shorten onboarding time while staying within the rules

• Give you clean evidence if your checks are ever scrutinised

What you should do next

If you’re an employer, HR lead or compliance owner, now is the time to:

1. Review your right to work policy and processes against the 26 June 2025 Home Office guidance.

2. Audit any current IDSPs you use: can they prove GPG45-compliant checks at the right level of confidence?

3. Train managers and recruiters on when to use IDSPs, when to use online checks, and when a manual check is still required.

If you’d like to understand how Xertilox can help you protect your statutory excuse while modernising your onboarding, get in touch:

👉 Email: info@xertilox.com

We’ll walk you through how our checks map to the Home Office guidance and how you can bake compliance into your everyday hiring – not scramble for it after a Home Office visit.