You Place Them. You’re Liable. Did You Actually Verify Them?
recruitment agencies in the UK
penalty per illegal worker placed
to verify with Certifyd
The reality of recruitment agencies in the UK.
Identity verification for recruitment agencies must go beyond document checks. Certifyd uses bi-directional authentication — both the agency and the candidate cryptographically prove their identity to each other in real time. The system verifies not just the candidate’s name, but that their identity is device-bound and cannot be transferred, cloned, or faked by a deepfake. When placing a candidate, the agency confirms their verified identity and right-to-work status, creating a tamper-proof record that satisfies both client requirements and regulatory obligations.
The UK has over 30,000 recruitment agencies, placing millions of workers annually. Under the Immigration, Asylum and Nationality Act 2006, agencies share legal liability with employers for right-to-work compliance. A civil penalty of up to £60,000 per illegal worker can be levied against both the agency and the hiring company. The Fair Work Agency (launching April 2026) will consolidate enforcement and increase inspection frequency.
Deepfake candidates are no longer hypothetical. AI-generated personas are appearing in video interviews, and fabricated CVs that pass initial screening are increasingly common. Agencies that verify candidates through video calls and document scans are using methods that AI can now defeat. Device-bound cryptographic authentication is the only verification method that cannot be synthesised or spoofed.
For agencies, Certifyd transforms identity verification from a cost centre into a competitive advantage. Clients increasingly demand assurance that placed candidates are who they claim to be. An agency that can provide cryptographically verified candidate identities — with tamper-proof placement records — differentiates itself from competitors still relying on photocopied passports and video calls.
This is broken.
Here's why.
Agencies carry legal liability for right-to-work compliance, even when the client is the employer of record.
Deepfake candidates and fabricated CVs are passing through traditional screening processes.
Document-based verification (photocopied passports, scanned IDs) doesn’t prove the person presenting is the document holder.
When a placed candidate’s identity is questioned, the agency has no cryptographic proof of who they verified.
Simple verification.
Every time.
Agency registers as an Organisation on Certifyd and invites candidates to verify during onboarding
Each candidate registers their device, creating a cryptographic key pair bound to their identity
At placement, the candidate’s identity, right-to-work status, and agency membership are confirmed in real time
A tamper-proof placement record is created: who was verified, when, and under whose organisational authority
Ready to see it in action?
Book a demo or tell us about your needs.
“We ask ‘right to work?’ and they say yes. Three weeks later — graduate visa, needs £20k sponsorship. We had to start over.”— HR Manager, tech company
Common questions.
Yes. Under the Immigration, Asylum and Nationality Act 2006, recruitment agencies share liability with end employers for ensuring that placed workers have the right to work in the UK. If an illegal worker is placed, both the agency and the client can face civil penalties of up to £60,000 per worker. The Fair Work Agency (from April 2026) will have enhanced powers to inspect agencies and demand evidence of compliance.
Deepfake technology can synthesise faces and voices for video interviews, and AI can generate convincing CVs and cover letters. Certifyd bypasses these attack vectors entirely by using device-bound cryptographic authentication. A candidate’s identity is tied to their physical device through a passkey — you cannot deepfake a cryptographic challenge. If the candidate can’t verify through their registered device, they are not who they claim to be.
During the standard agency registration process, candidates are invited to create their Certifyd identity. They register their device (creating a cryptographic key pair) and the agency adds them as a member with a defined role. This takes minutes and only needs to happen once. From that point forward, the candidate can verify their identity in 30 seconds for any placement, any client, any location.
Yes. When a candidate is placed, the agency can provide the client with a Certifyd verification record confirming the candidate’s identity and right-to-work status. This gives clients confidence without requiring them to repeat the verification process. The record is tamper-proof and timestamped, providing auditable evidence for both the agency and the client.
Explore more use cases.
Verify every candidate before placement
Book a demo to see how Certifyd works for your team, or tell us about your verification needs and we'll get back to you within 24 hours.
Read: Deepfake Candidates in Recruitment