The Right to Rent scheme was created by Part 3, Chapter 1 of the Immigration Act 2014 (sections 20 to 37) and rolled out across England on 1 February 2016. The duty is unambiguous: under section 22, a landlord must not authorise an adult to occupy premises under a residential tenancy agreement if that adult is disqualified by reason of their immigration status. The scheme was sharpened by the Immigration Act 2016, which introduced criminal liability under section 33A for landlords who know, or have reasonable cause to believe, that they are letting to a person without the right to rent. The maximum sentence is five years' imprisonment alongside an unlimited fine.
The financial exposure rose steeply in February 2024. A first breach now attracts a civil penalty of up to £5,000 per lodger and £10,000 per occupier, with repeat breaches reaching £10,000 per lodger and £20,000 per occupier. These figures replaced the old £80 and £1,000 thresholds, and the Home Office has visibly stepped up enforcement since 2023, focusing on landlords who kept no records or accepted photocopies. Your defence against all of this is the statutory excuse: complete a prescribed check correctly, retain the evidence, and the penalty cannot land even if the tenant later turns out to have lied or lost their status. The Home Office sets out exactly how to establish that excuse in its Right to Rent code of practice published on GOV.UK.
Two recent developments matter. Since October 2022, checks for British and Irish citizens run through IDVT identity service providers, while non-British nationals are verified almost entirely through the GOV.UK online share code service against their eVisa. And under the Renters' Rights Act 2025, a Home Office notice that an occupier has lost the right to rent now feeds directly into the new Ground 7B mandatory possession route, which is why your initial paperwork and your possession strategy need to be joined up from day one. The referencing side, by contrast, is governed not by housing statute but by the UK GDPR and the Data Protection Act 2018: you may only collect what is necessary, you must tell the applicant why, and you must not keep it longer than the lawful basis allows.