Right to work checks are expanding in October 2026: What you need to know

12 August 2026

From 1 October 2026 UK right to work checks and liability for failing to prevent illegal working expand beyond traditional employment to cover subcontractors, gig workers and supply chains. What should you do now to avoid penalties?

A significant update to UK right to work checks comes into force on 1 October 2026. It may substantially change processes and policies your organisation needs to have in place to maintain its right to work and sponsor licence compliance.

Currently, a business is generally only liable for a civil penalty (or a criminal sanction if it’s done knowingly or with reasonable cause to believe) if it directly employs an illegal worker. From 1 October 2026, that changes in two important ways:

• The definition of “employment” is expanding. Right to work checks will be required for a wider range of working arrangements including some casual, agency-style and gig economy engagements.
• A brand new “extended liability” regime is being introduced. Your organisation can face a civil penalty of up to £60,000 per worker even where you do not directly employ or engage the worker. For example, where you have subcontracted a contract for work or services you have entered into with a third party, and illegal working occurs further down a the chain of subcontracts.
  These changes were made via section 48 of the Border Security, Asylum and Immigration Act 2025, and are to be implemented in October. This summer, the Home Office published its new draft codes of practice on preventing illegal working (including the right to work scheme, and preventing unlawful discrimination), and a related draft Employer’s guide to right to work checks.  All of these give us a good idea of how employers can prepare for the changed regime this autumn when we expect final codes of practice to be published.

Below I outline the changes and answer questions about how organisations can protect themselves. Feel free to reach out if you have any other questions.

What are the main right to work changes from 1 October 2026?

Organisations will need to protect themselves against a civil penalty for failing to prevent illegal working in four types of working arrangement.  These are categorised as:

• traditional contracts of employment
• worker’s contracts
• individual sub-contractors; and
• workers listed on online matching services (such as gig economy platforms).

Extended liability means hefty civil penalties can reach beyond the direct employer to businesses that subcontract work, online matching services, and businesses whose contracts permit workers to substitute their labour for another worker’s.

Businesses exposed to extended liability can protect themselves through meeting rigorous prescribed requirements, including

• specific contractual terms;
• substitution controls; and
• identity verification systems.

If your business uses a digital identity provider for checks, from 1 October 2026 it must now be a registered “RtW DVSP” – a Right to Work Digital Verification Service provider registered on the Office for Digital Identities and Attributes (OfDIA) register, and specifically authorised for right to work checks.

The changes apply to engagements commencing on or after 1 October 2026. Working arrangements which started before that date are excluded (though contracts of employment remain subject to the existing rules as now).

Please reach out if you need assistance and we would be very happy to provide expert guidance, including training and updated HR policies.

What are the penalties for illegal working?

The penalties are serious: up to £60,000 per illegal worker, potential sponsor licence revocation for licensed sponsors, and where a business knew or had reasonable cause to believe a worker did not have the right to work, criminal liability can ensue – which can mean an unlimited fine and up to five years’ imprisonment. Immigration Officers also have the power to issue an illegal working closure notice which will immediately shut down your business premises for up to two days, which can then be extended for up to 12 months via an illegal working compliance order issued by the Court.

Who will now need a right to work check? The expanded definition of “employment”

From 1 October 2026, the following working arrangements are deemed to be “employment” when considering whether a worker has been employed without the requisite right to work. This applies to a companies, organisations, businesses or other entities (save for some exceptions where the guidance will refer to an individual).

1. Contract of employment.

This already applies to employers under the current rules. Nothing changes for your permanent and fixed-term employees: you must continue to carry out compliant right to work checks before employment commences.

2. Worker’s contract

For example: Worker A agrees to perform work or services personally for Company A, and Company A is not a client or customer of any profession or business undertaking carried on by Worker A. In this case Worker A is deemed to be employed by Company A, which can be liable for a civil penalty if Worker A does not have the right to work.

In practice this captures many casual, zero-hours and temp arrangements. The Home Office’s own example is someone who registers with an employment agency supplying temporary staff to bars and restaurants in busy periods: the employment agency is the “employer” for right to work purposes and must carry out the checks. Most traditionally self-employed workers should not be in scope of this provision. However, the Home Office will consider the nature of the arrangement, including how the work is arranged and supplied, rather than the label applied to it: describing an individual as self-employed is not enough.

3. Individual sub-contractor

For example: Worker A enters into a contract for work or services with Company A. Company A has itself been contracted by Company B to provide the same work or services, and Worker A has no direct relationship with Company B. Worker A is deemed to be employed by Company A, which can be liable for a civil penalty if Worker A does not have the right to work. Company B is not liable.

The Home Office use an example of an individual who signs up to a delivery platform, logs into an app and accepts jobs as they choose. In this case the delivery platform is treated as the employer and is responsible for the check.

4.Online matching services

For example: Company A keeps a register of workers (providing, or seeking to provide, work or services for remuneration) for the purpose of matching them with potential clients or customers. It provides an online service through which potential clients or customers can submit enquiries to be matched with suitable service providers, and it charges a fee or commission for making those matches. By providing Worker A’s details on its platform, Company A is deemed to be employing them and can be liable for a civil penalty if Worker A does not have the right to work. The end clients or customers are not liable.

The Home Office use an example of a homeowner using an online matching service to find a cleaner. The matching service – not the homeowner – is treated as the employer and responsible for the check.

Who is out of scope? Genuinely self-employed workers and personal service companies

The new regime is not intended to capture individuals operating an independent business in their own right, either in their own name or through their own company, who contract directly with clients or customers for the provision of goods or services.  This only applies where the arrangement is for the purchase of goods or services, and expressly not for the employment of an individual to carry out work or services.

The Home Office’s draft guidance gives two working examples:

• The self-employed plumber. A member of the public engages a plumber who advertises directly to the public and works for multiple customers. No right to work check is required.
• The personal service company. A graphic designer is engaged by a client company for a specific project through the designer’s own personal service company, which contracts and invoices business-to-business. No check is required by the client company.
  One important warning: as noted above, UKVI will consider the nature of the arrangement: how the work is arranged, supplied and performed in practice, rather than the label applied to it. Describing an individual as “self-employed” will not be determinative. Workers who are not genuinely operating an independent business in their own right still fall within scope.

What is “extended liability” and could my business be caught?

Extended liability is a brand new heading of liability that runs concurrently with the right to work scheme. Under the new section 15A Immigration, Asylum and Nationality Act 2006, amended by section 48 of the 2025 Act, your organisation can receive a civil penalty of up to £60,000 per worker even where you are not directly employing the worker. Liability may be extended under three arrangements:

1. Subcontracting chains

Company A contracts Company B to provide work or services. Company B subcontracts some or all of that work to Company C, which employs workers to carry it out. Both Company B and Company C can be liable for a civil penalty if Company C’s workers do not have the right to work. The same continues down the chain for Companies D, E, F, and beyond where there is further subcontracting. Company A as the end user at the top of the chain is not liable.

The Home Office provides an example of a property developer who wins a contract to build new homes and engages other businesses through a chain of contracts to supply bricklayers and groundworkers. The developer may be treated as the employer of anyone in that chain.

2. Online matching

Company A is an online matching service which matches Company B with Client/Customer C.  Company B then contracts directly with Client/Customer C. Both Company A and Company B may be liable if Company B’s workers do not have the right to work. Client/Customer C is not liable.

The Home Office give an example of a homeowner using a matching service to find an electrician; the contract is between the homeowner and the electrical business, but the matching service may still be treated as the employer of the worker who does the job.

3. Substitution
Company A engages Worker A, and the contract permits Worker A to substitute another individual (Worker B) to carry out the work in their place. Company A may be liable if Worker B does not have the right to work, even where it has no direct relationship with Worker B.

The Home Office use the example of an individual signing up to a food delivery platform as a self-employed contractor. Their contract permits substitution and they routinely ask a friend to do deliveries in their place. The platform may be treated as the employer of both the individual and any substitute.

So, who could the Home Office penalise for illegal working from October?

From 1 October, effectively your business can be liable for the decisions of the people you subcontract to or the workers you engage. The Home Office has stated in the draft code of practice that it will only act here where it cannot otherwise identify the person with a direct contractual relationship with the worker in question. The statutory position, however, allows it to act against all parties involved in a chain of subcontracts and it is not legally restricted from penalising only the direct contractual relationship.

Your business will still be exposed to the risk. The draft code of practice and employer’s guide state that the extended liability provisions may apply also where the prescribed requirements have not been satisfied. One possible interpretation is that, where a subcontracting chain has entirely failed to implement those requirements, the Home Office may consider itself entitled to pursue all parties involved in that chain.

Sectors particularly affected will include construction (where subcontracting the actual build, installation and finishing is routine), logistics and warehousing, facilities and outsourced services delivered onward to clients, and gig economy platforms – which have been the most publicly visible target of the legislation. The government has maintained that the legislation is catching up with the modern way in which many people work and are engaged – including gig economy arrangements – in its determination to crack down on businesses using people who do not have the right to work in the UK.

Which arrangements are out of scope of extended liability?

Extended liability should not apply to every business that purchases work or services from another business. It does not apply to clients, customers or end-users at the top of the chain who are purchasing work or services for their own business operations and not providing anything onward to a third party. Contracts that are not for the supply of work or services, such as a supply of goods or a pure supply of workers, should also be out of scope. The draft guidance gives four examples:

• Purchasing a service for your own use. A retailer contracts a facilities management company to clean its supermarkets; the facilities company employs the cleaners. The retailer is purchasing a service for its own operations and is not passing the work onward, so extended liability does not apply to it. Responsibility stays with the facilities management company as the employer.
• Purchasing labour as opposed to a contract for work or services. A manufacturer takes on temporary production workers from an employment business to cover increased demand, integrating them into its own operations for the duration of the assignment. Extended liability applies to neither party: the manufacturing company is obtaining workers for use within its own business operations and is not responsible for providing the work or services onwards to a third party as part of a contractual chain, and the role of the employment business is limited to the supply of workers rather than being under a contract to provide work or services. In this case, the Home Office explains that the employment business would be directly liable as the employer and must carry out compliant right to work checks on those workers.
• Supply of goods. A food producer supplies sandwiches to a retailer and staffs its factory through an employment business. The producer is supplying finished goods, not work or services, so extended liability applies to neither the producer nor the retailer. Direct responsibility remains with the employment business as the employer.
• A food ordering platform. A platform provides technology and ordering services to a takeaway, but the takeaway uses its own delivery staff. The platform is not engaging the delivery workers, so extended liability does not apply to it. Responsibility remains with the takeaway as the direct employer.

How can my business protect itself? Statutory excuse against extended liability

Compliant right to work checks only protect a business against direct liability. For extended liability, businesses will from October establish a statutory excuse only by meeting the following prescribed requirements in full, before the work or service commences. These prescribed requirements must be implemented and followed in practice. Reliance on contractual provisions alone will not be sufficient.

1. Contractual terms and conditions (written statement)

Five prescribed terms must be incorporated into the contract or a written statement with the employer or service provider down-chain. In summary, these must:

1. require compliant right to work checks to be carried out on any individual employed to perform the work or service before they start (NB: this includes the above expanded definition of employment, for the purposes of the right to work scheme);
2. prohibit further subcontracting without your prior written consent, with equivalent right to work obligations replicated in any permitted subcontracts;
3. permit you to audit the down-chain party’s compliance with the right to work scheme;
4. enable enforcement action where illegal working is identified and no statutory excuse has been established – including, but not limited to, suspension or termination of the contract; and
5. require co-operation with any Home Office illegal working investigation, including providing information about the make-up of the contractual chain and the details of each business in it.

A subcontracting entity may, as part of meeting these requirements, rely on assurances from down-chain employers / service providers that compliant right to work checks have been carried out, but, they will need to have taken reasonable steps to satisfy themselves that those assurances are reliable (and that the prescribed requirements are in fact being met).

Crucially, contractual terms alone are not enough. To establish a statutory excuse, you would need to show that appropriate arrangements are in place and operating effectively in practice, and that you have taken reasonable and proportionate steps to satisfy yourself that the requirements are actually being met as set out under the contract. Keep clear, comprehensive records, including contracts, audit records, assurance information, compliance reviews and evidence of action taken where concerns arose. These will be crucial to establish a defence and mitigate reputational damage if illegal working is ever identified in your supply chain.

2. Substitution controls

Where contracts permit substitution, five prescribed processes must be implemented before work commences, ensuring:

1. a compliant right to work check is carried out on any substitute;
2. responsibility for the check is never delegated to the individuals doing the work (even where that individual is operating a business on their own account);
3. no individual may carry out work or services as a substitute before their right to work has been verified;
4. contractual sanctions exist where a substitute is known or believed to be working illegally; and
5. that identity verification confirms the worker and any registered substitute are the same individuals who were checked.

These processes must have been implemented and maintained in a reasonable and proportionate manner, and the substitution controls must reflect how the working arrangements operate in practice.

3. Identity verification

There must be proportionate systems and processes to ensure the individual who turns up to carry out the work is the same individual on whom a right to work check has been conducted. Examples include identity cards or workplace passes, facial recognition technology via a registered RtW DVSP, biometric or attendance management systems, and re-verification at set intervals – the Home Office recommends at least once in any 24-hour period or shift.

What advice might you need to protect yourself from illegal working liability?

We recommend looping in your commercial contracts colleagues early, so they understand that from 1 October 2026 certain commercial contracts the business enters into can result in liability even where the business itself has done nothing wrong.

Template contracts will need re-drafting or new annexes and commercial advisors should coordinate with specialist immigration advisors for wherever the work or services will begin on or after 1 October 2026.

We also would suggest you audit your full workforce (including subcontractors, agency staff, casual and outsourced workers etc) as well as your right to work policies and run these past an immigration adviser.

What is changing for digital right to work checks? IDSPs become “RtW DVSPs”

If you rely on a digital identity verification provider (previously known as an IDSP, now a “Digital Verification Service Provider” or DVSP) to establish or maintain a statutory excuse from 1 October 2026, it is now mandatory – not merely recommended – that the provider is a registered “RtW DVSP” on the Office for Digital Identities and Attributes register. The provider must be registered and specifically authorised for right to work checks, not just, for example, general identity checks.  Many background checking organisations subcontract this function to a registered provider. If it is not immediately obvious whether yours qualifies, make enquiries now and if it does not, arrange to switch.

Other digital changes worth noting:

• Impersonation and imposters. During the check, employers must take reasonable and proportionate measures to verify the worker’s identity and ensure the person turning up to work is the same person on whom the check was carried out. Facial recognition technology via a RtW DVSP can help manage this risk. Such measures are not mandatory, but they may be taken into account by UKVI when considering the circumstances of any case of fraud or impersonation.
• Passive authentication. A RtW DVSP can now verify an expired British or Irish passport (or Irish passport card) up to six months past its expiry date by checking the validity of the document’s chip. Previously, an expired passport required a manual check.
• Digital NI number evidence. Official digital evidence of a name and National Insurance number (such as a screenshot or email) may now be accepted when used in combination with an acceptable List A or B document.

What should employers be doing before 1 October 2026? Your action checklist

Things you should consider actioning now:

1. Report this up the line. This is a board-level risk and compliance matter given its complexity, its impact on commercial arrangements and the resources it will demand, not simply another HR process update.
2. Map your workforce. Categorise the ways your organisation engages workers, employees, agency staff, outsourced workers, subcontractors, seasonal and casual labour, zero-hours workers, platform and gig workers against the definitions in the new code and guidance, and identify which will be affected. You cannot manage liability you have not identified and you may want to run these past a business immigration adviser.
3. Categorise your contracts. Assess which commercial contracts are vulnerable to extended liability, then loop in your immigration and commercial contracts advisors early. Review template contracts to build in the prescribed requirements, and review existing contracts to manage downstream liability for engagements starting on or after 1 October 2026.
4. Check your digital provider. If you rely on a DVSP/IDSP for right to work checks, confirm it is registered and specifically authorised for right to work checks on the OfDIA register. If not, plan to switch.
5. Update policies and onboarding well in advance. Existing right to work policies will be out of date by 1 October 2026 and relying on them will expose the organisation to liability. Update onboarding systems so every new in-scope worker is identified.
6. Consider identity verification systems. Businesses using in-scope subcontractors, online matching services or contracts permitting substitution will need proportionate systems to verify workers’ identities: ID cards or passes, facial recognition, biometric or attendance systems.
7. Train your gatekeepers. HR, managers, operations and procurement staff will be at the forefront of these arrangements. They need to understand the new scheme, the expanded definitions, and what they must do differently to protect the business.
8. Engage with the Home Office and immigration lawyers. Key personnel in the sponsorship system are being invited to online familiarisation events in August and September 2026 and UKVI is offering an online right to work course and a Document Fraud awareness course. These are worth attending if you have access, though you may find advice tailored to your business by a specialist immigration law firm considerably more useful, as the quality of UKVI training can vary.

Resources which are available in draft before 1 October 2026:

• Draft code of practice on preventing illegal working: right to work scheme for employers
• Draft code of practice for employers avoiding unlawful discrimination while preventing illegal working
• Draft employer’s guide to right to work checks

How we can help

These changes will require most organisations to rethink how they engage workers, contract with suppliers and evidence compliance well before 1 October 2026. We are already helping employers audit their workforce arrangements, redraft contracts, update right to work policies and train HR and procurement teams on the new scheme.

If you would like expert, tailored guidance, including training, updated HR policies and contract reviews, please get in touch. We would be very happy to help you prepare.

Frequently asked questions

This article is based on the draft code of practice (30 June 2026) and draft Employer’s guide to right to work checks (16 July 2026). Final versions are expected before 1 October 2026 and we will update this guidance accordingly.

James Lamont advises private individuals and businesses on all areas of immigration and nationality law. He has successfully advised a broad range of business sectors including tech, finance, entertainment and education. For private clients, James provides advice ranging from highly complex and unusual applications requiring discretion from the Home Office to integrated global mobility projects for family offices and high net worth clients, including elements of business immigration law where applicable.