The Definitive Guide to UK Visa Sponsor Record-Keeping & Appendix D Compliance

Every licensed UK sponsor operates under two parallel, uncompromising obligations: keeping the right records, and keeping them correctly. The Home Office treats gaps in documentation as evidence of non-compliance, regardless of whether the underlying employment activity was lawful.  

With compliance visits rising steadily across the UK, this guide covers exactly what your global mobility team must retain, how long to keep it, and how to avoid the most common record-keeping pitfalls that lead to licence revocation.

Why Employers Must Prioritize Immigration Record-Keeping

Record-keeping is not just an administrative task; it is a core legal obligation tied to holding a UK Sponsor Licence. The Home Office views physical and digital documentation as the primary evidence of your compliance with immigration laws.  

• Evidence of Systemic Compliance: During unannounced or announced Home Office audits, caseworkers look for "systemic gaps". If critical documents like payslips, contracts, or right-to-work checks are missing for a significant portion of your sponsored workforce (e.g., 40%), it can trigger immediate licence suspension or revocation.  
• Preventing Massive Civil Penalties: Robust records prove you have verified every employee's legal right to work. Failure to maintain these records can result in civil penalties of up to £60,000 per illegal worker.  
• Protecting Your Sponsorship Privilege: Holding a licence is legally considered a "privilege," not a right. The Home Office treats missing documentation as non-compliance, even if the worker is entirely lawful.  
• Audit Readiness in 10 Days: With licence revocations scaling upward, having a centralized, digital record-keeping infrastructure ensures you can respond to UK Visas and Immigration (UKVI) requests within strict deadlines; typically 10 working days. Jobbatical platform helps you manage all this seamlessly.

Appendix D Requirements: What Employers Must Keep

Appendix D of the Home Office's Worker and Temporary Worker sponsor guidance sets out the mandatory records for every sponsored worker. Your compliance files must be divided into four core pillars:  

1. Right-to-Work Documents

• A clear copy of the worker's current passport (photo page and any relevant visa/entry stamps).  
• eVisa Share Code Verification Records: This includes the date checked and the unique checking service reference.  
• For workers with time-limited permission, the documented date of their next re-verification (as share codes expire every 90 days).  

2. Certificate of Sponsorship (CoS) Records

• The unique CoS reference number assigned to the worker.  
• The exact job title, Standard Occupational Classification (SOC) code, salary, and start date recorded on the CoS (checklist).  
• Any subsequent CoS issued if the worker changed roles or entities within your company.  

3. Employment and Payroll Documents

• The signed employment contract or written terms of employment.  
• Payslips or payroll records confirming the exact gross salary paid each pay period.  
• Records of any changes to working hours, salary, or location—alongside digital proof that these updates were reported via the Sponsorship Management System (SMS) within the mandatory 10-working-day deadline.  
• Comprehensive absence records for sponsored workers, including any unpaid leave that triggers a salary change reportable obligation.  

4. Contact and Personal Details

• The worker's current UK residential address and phone number—updated dynamically whenever they move.  
• The worker's emergency contact details.  
• The worker's National Insurance (NI) number (once issued).  

Compliance Note: Appendix D is updated periodically by the Home Office. Ensure your internal HR compliance calendar mandates a review of the official gov.uk sponsor guidance every 6 months to avoid relying on outdated processes.  

Advanced Compliance Requirements for HR Teams

To remain completely audit-ready, global mobility teams must account for modern workplace structures that go beyond basic documentation.

1. Appendix D vs. UK GDPR: Balancing Data Retention and Privacy

• Retaining sensitive documents (passports, payslips, home addresses) for years creates natural friction with UK GDPR’s data minimization principles. 
• However, because retaining data to comply with Home Office audits falls under the "legal obligation" lawful basis for processing, immigration requirements override standard deletion timelines.

Important: HR teams should implement clear automation within their document management systems to auto-delete Appendix D files exactly 2 years and 1 day after a worker leaves, ensuring they do not inadvertently breach GDPR via over-retention.

2. Record-Keeping Evidence for Hybrid and Remote Workers

• The Home Office heavily scrutinizes hybrid working. If a sponsored employee works from home multiple days a week, keeping just their home address is insufficient.
• HR must actively maintain a history of the worker’s regular work location and monitor attendance. 
• This requires keeping signed remote working agreements, IT log-in geo-records, or desk-booking system data to prove the worker is physically in the UK and attending work as outlined in their CoS.

3. Inheriting Sponsor Records During M&A and TUPE Transfers

• When a company acquires another business, the new sponsor inherits full liability for the sponsored workers and their past records. 
• During a TUPE transfer, you must report the organizational change via the SMS within 20 working days.
• Crucially, you must secure all historical Appendix D files (old CoS, historic right-to-work checks, past payslips) from the seller during this window.
• If the acquired company had missing or flawed records, your business can be held liable during a future UKVI audit.

4. Tracking Third-Party and Client Site Placements

• If your sponsored workers are placed at client sites (common for IT consultancies and engineering firms), the Home Office will check that your company is not acting as an illegal employment agency.
• Your record-keeping must include copies of the formal commercial contracts between your business and the third-party client. 
• These documents must explicitly detail the project duration and prove that your company retains full HR control (payroll, line management, leave approvals) over the worker.

Retention Periods: How Long Must You Keep Sponsorship Records?

Your retention periods are strictly defined by Appendix D. You must ensure records are stored accessibly and not archived in a way that prevents immediate retrieval during a surprise inspection.  

The eVisa Transition: Digital Compliance Post-December 2026

Physical Biometric Residence Permits (BRPs) are being phased out entirely by December 31, 2026. This completely reshapes your digital record-keeping strategy:  

• Ditch BRP Copies: Stop storing BRP scans as your primary right-to-work evidence. Moving forward, online eVisa share code verification records are the only legally recognized format.  
• Log Timestamps and User Details: Ensure your document storage system logs verification records with explicit timestamps and user details. A standalone screenshot or a manual spreadsheet entry without a verifiable date will not stand up during a UKVI audit.  
• Onboarding Checklist Integration: Make UKVI account setup a mandatory part of your pre-boarding and onboarding checklists. Workers who have not transitioned their status to a digital UKVI online account cannot generate a share code, which halts the compliance chain.  

7 Critical Sponsor Record-Keeping Mistakes (And How to Fix Them)

These are the failures the Home Office identifies most frequently during compliance visits. Each is entirely avoidable with the right workflows:  

1. Mistake: Storing BRP copies instead of eVisa verification records.  
   • Fix: Conduct a comprehensive audit of your active right-to-work files. Ensure every current sponsored worker has a valid, digital eVisa share code verification record on file.  
2. Mistake: Siloed records stored in individual email inboxes or local hard drives.  
   • Fix: Centralize all compliance records in a shared, access-controlled cloud system (or leverage a dedicated platform like Jobbatical). If an HR manager or Level 1 User abruptly leaves the company, records must remain instantly retrievable.  
3. Mistake: No proof of the date a right-to-work check was performed.  
   • Fix: Every right-to-work check must be explicitly logged with the exact date it was carried out, the specific share code used, and the full name of the internal staff member who verified it.  
4. Mistake: Payroll records mismatching the CoS due to deductions or bonuses.  
   • Fix: The Home Office monitors immigration salary compliance on a strict per-pay-period basis. Run an automated monthly reconciliation comparing actual gross pay against the CoS salary threshold for every sponsored worker. Flag and report discrepancies immediately.  
5. Mistake: Outdated contact and personal details.  
   • Fix: Build an annual or bi-annual contact detail re-confirmation step into your sponsored worker compliance calendar. UKVI expects you to hold up-to-date residential addresses at all times.  
6. Mistake: Deleting records the moment an employee departs.  
   • Fix: Retain all standard files for the trailing period (sponsorship duration + 1 year) and right-to-work logs for 2 years post-employment. Hard-code these retention periods into your document management system rather than deleting files upon departure.  
7. Mistake: Shared SMS credentials among multiple HR team members.  
   • Fix: Shared credentials are a severe compliance violation. Every individual SMS user must have their own unique login credentials. Terminate access immediately when an employee moves out of a global mobility role.

Pro Tip: If you discover a compliance gap during an internal quarterly audit, report it proactively through the SMS and explicitly document your corrective action. The Home Office views voluntary disclosure far more favorably than failures uncovered during a surprise inspection.

Making Your Sponsor Records Audit-Ready: The Quarterly Checklist

The sponsors who navigate UKVI audits smoothly are those who treat their compliance records as live, dynamic data points rather than archival files. Implement this checklist every quarter:  

‍

Disclaimer: Immigration rules change quite frequently; please verify with official sources or contact us for the latest info before making any decisions.