From 1 October 2026, the obligation to carry out right to work checks will expand beyond traditional employees to a much wider range of working arrangements. Businesses that engage workers, individual sub-contractors, gig or platform workers, or labour through supply chains will need to understand whether they are now caught by the regime and, where they are, make sure the right checks and contractual protections are in place.
The financial exposure is significant. Civil penalties can reach £45,000 per worker for a first breach and £60,000 per worker for a repeat breach. For businesses that rely heavily on contingent labour, agency staff, sub-contractors or platform models, the risk can be material.
What is changing
Section 48 of the Border Security, Asylum and Immigration Act 2025 widens the right to work regime beyond conventional employment relationships. The Act received Royal Assent on 2 December 2025, and the Home Office draft Code of Practice was updated on 30 June 2026. The draft Code is framed to come into force on 1 October 2026, and separate commencement regulations now bring section 48 into force on that date.
The existing regime already applies to employees working under a contract of employment. An employer must carry out a right to work check before employment starts and can face a civil penalty if it employs someone illegally without a “statutory excuse”. A statutory excuse is the protection obtained by carrying out a prescribed check, at the right time, in the right way, on the person who is actually doing the work. This baseline does not change but Section 48 adds to it in two important ways.
1. It widens who counts as an “employer” for right to work purposes
The duty to check, and the primary liability if the check is not done properly, will now also apply to businesses that engage individuals:
- under a worker’s contract, broadly where the individual undertakes to perform work personally and the other party is not the client or customer of the individual’s own business;
- as an individual sub-contractor in a contractual chain; or
- through an online matching service or platform that matches service providers with clients or customers for a fee or commission.
Each of those arrangements can now be treated as “employment” for the purposes of the right to work scheme. The issue will not simply be whether a check was done, but whether it was done in the prescribed way, before the work started, by the correct party, and on the person actually carrying out the work.
2. It introduces “extended liability”
Extended liability is separate from the direct duty to check. It can make a business further up a contractual chain liable for illegal working even where it has no direct contractual relationship with the worker. It applies in specific contractual-chain, online matching and substitution arrangements, including where a business contracts to provide work or services to a customer and then uses another employer or labour supplier to provide the workers who carry out that work.
The Home Office will first look for the employer with the direct contractual relationship with the worker. Extended liability is designed to operate where that employer cannot be identified, or where the prescribed requirements in the Code have not been met. A business upstream in the chain will only have a statutory excuse against extended liability if it has met the prescribed contractual, substitution and identity-verification requirements in full and can evidence that compliance.
Genuinely self-employed individuals operating in business on their own account, trading in their own name or through their own business, and contracting directly with clients or customers, remain outside scope. So do businesses acting purely as the end-user, client or customer of a service, provided they are not themselves supplying the work or services onwards to a third party as part of a chain.
When it applies
For employees under a contract of employment, the existing right to work regime continues as before.
For worker’s contracts, individual sub-contractors and online matching service arrangements, civil penalty exposure under the expanded regime applies where the engagement starts on or after 1 October 2026. The new Code will also apply when a check, follow-up check, or prescribed contractual-chain requirement is required on or after 1 October 2026 in order to establish or retain a statutory excuse.
Takeaway point: do not wait until October 2026. Businesses using contingent labour, contractors, agency staff, sub-contractors or platform models should start mapping their arrangements now.
The key question: sub-contractor, worker or genuinely self-employed?
For many businesses, this will be the hardest part of the new regime.
The draft Code makes clear that genuinely self-employed individuals who are in business on their own account are not caught. This includes traditional business-to-business contracts for the purchase of a service, where the arrangement is for the service itself rather than the employment of an individual to carry out the work. However, that exclusion does not cover individuals who obtain work through an intermediary, platform or similar arrangement where they are not operating an independent business in their own right.
The label in the contract will not decide the point. A contract that calls someone “self-employed” or a “contractor” may help evidence the parties’ intention, but it will not be conclusive if the reality of the arrangement is different.
In borderline cases, the analysis may feel familiar to anyone used to employment-status or IR35-style questions, although the immigration question is separate. Relevant practical questions are likely to include:
- Does the individual have to do the work personally?
- Can they send someone else, and if so, how does that substitution actually work?
- Are they genuinely running their own business, with their own clients, equipment, pricing and commercial risk?
- Are they integrated into your workforce or service-delivery model?
- Are they working through a platform, intermediary or supply chain rather than contracting with customers as an independent business?
None of those factors will necessarily be decisive on its own. The position may turn on the fine detail of how the arrangement operates in practice.
Takeaway point: do not assume that a “self-employed” or “contractor” label puts an engagement outside the scheme. Look at the working arrangement itself, especially where there is personal service, platform work, or a labour-supply chain. Keep a record of your reasoning for borderline cases.
A separate point for sponsor licence holders
This is not simply a civil penalty issue. Sponsor licence holders also need to consider their separate sponsor record-keeping obligations.
Appendix D to the sponsor guidance requires sponsors to retain evidence of right to work checks for any worker they employ, whether or not sponsored, and any worker they sponsor, whether or not they are the employer. Where the sponsor is the employer, the check also supports the statutory excuse under illegal working legislation. Where the sponsor is not the employer, or where the worker is sponsored in a self-employed capacity, the sponsor may not be carrying out the check for statutory-excuse purposes, but must still carry it out, or obtain and retain evidence of it, for sponsor compliance purposes.
That means sponsor licence holders should not treat the new draft Code as the only relevant source of risk. A failure to retain right to work evidence may also create sponsor compliance issues.
Agency staff and platforms
Agency staff
Where an agency supplies staff, it will usually be the agency, as the direct employer or labour supplier, that is responsible for carrying out the right to work checks. A business using the staff may simply be the end-user or client of the agency’s service.
However, the position can become more complex depending on how the labour is used.
If the workers are used only to support your own business, you are more likely to remain a pure end-user. If, however, the workers are used to help deliver a service that you have promised to your own customer, you may form part of a contractual chain. It is those chains that the extended liability provisions are designed to address. The draft Code expressly says the extended liability provisions do not apply to persons acting solely as end-users, clients or customers, but that protection depends on not being under a contract to provide the work or services onwards to a third party.
We expect this to be an area where further guidance will be particularly important, especially where agency labour is used to deliver services to a customer rather than merely support the end-user’s own business.
Where you are part of a labour-supply chain, the safer approach is to treat the agency as a labour supplier and put in place the prescribed contractual protections. Those terms should require checks to be carried out, restrict further subcontracting, include audit rights, allow enforcement action where illegal working is identified and no statutory excuse exists, and require cooperation with any Home Office investigation. A simple assurance that “checks are done” is unlikely to be enough unless it sits within a proper compliance framework and you can evidence that the prescribed requirements have been met.
Even where you are confident that you are only an end-user, it remains good practice to require agencies to carry out checks on everyone supplied and to provide evidence on request. That is sensible from an operational, reputational, safeguarding, health and safety, insurance and business-continuity perspective.
Online matching services and platforms
Online matching services and platform businesses are treated differently.
Where a business, in the course of trade, keeps a register of service providers, provides an online service to match them with potential clients or customers, and charges a fee or commission for making those matches, the platform itself can be treated as the employer of the service providers for right to work purposes.
That is a significant change for gig-economy and platform operators, many of whom may not previously have treated right to work checks as part of their onboarding model. It also reinforces the importance of identity verification. The Home Office has already highlighted the use of robust identity and verification checks in the gig-economy context.
Whether a particular platform or online matching model is caught will depend on how the arrangement actually works, not simply on the terminology used in the contract or user terms.
What employers and labour users should do now
1. Map your workforce and labour supply
Identify everyone who carries out work for you or as part of your service delivery. Categorise them by engagement type: employee, worker, individual sub-contractor, agency worker, platform/gig worker, genuinely self-employed consultant, or supplier under a business-to-business services contract.
Then identify where you are acting as a pure end-user and where you are using labour to deliver your own contractual obligations to another customer.
2. Extend your right to work process
Right to work checks should no longer be treated as an employee-only onboarding step. Businesses should review whether checks need to be built into onboarding for workers, individual sub-contractors and platform/service-provider arrangements.
Checks must be carried out using one of the prescribed routes: a manual document-based check, a Home Office online check, or, where permitted, a check using a registered Right to Work digital verification service provider.
3. Review supplier, agency and subcontractor contracts
Contracts with agencies, sub-contractors and other labour suppliers should be reviewed against the draft Code’s prescribed requirements.
In broad terms, the written terms should:
- require prescribed right to work checks on individuals performing the relevant work or services;
- prevent further subcontracting without prior written consent;
- require equivalent right to work obligations to be flowed down into any permitted subcontracting;
- permit audits of right to work compliance;
- allow enforcement action, including suspension or termination, where illegal working is identified and no statutory excuse exists; and
- require cooperation with Home Office investigations, including information about the chain of contracts and the entities involved.
Those terms need to be in place before the relevant work or service starts. They also need to be more than boilerplate: businesses should be able to show they have used, monitored and enforced them in practice.
4. Deal with substitution clauses
Substitution is a particular risk area.
Where a contract allows a worker to send someone else in their place, the employer will only obtain a statutory excuse if appropriate processes are implemented before the work starts. Those processes must ensure that any substitute is checked, that responsibility for the check is not delegated to the worker, that the substitute does not start work before their right to work is verified, and that the worker and any registered substitute are the same individuals in respect of whom checks have been carried out.
This does not mean every business must introduce disproportionate controls. The draft Code says the Home Office will consider whether substitution processes were implemented and maintained in a reasonable and proportionate way, including where substitution occurs without the employer’s knowledge or control, or because of fraud despite suitable mitigations and controls.
5. Check identity throughout, not just at the start
For contractual-chain, platform and substitution arrangements, the draft Code expects businesses to maintain proportionate systems and processes to ensure that the individual doing the work is the same person on whom a right to work check has been conducted.
The Code gives examples such as identity cards or workplace access passes, facial verification technology, biometric or attendance management systems, checks against training records, qualifications or licences, and re-verification at set intervals. Depending on the work, this may include re-verification when a worker starts a shift or new assignment, or at another appropriate interval, subject to ensuring that re-verification is no less than once in any 24-hour period of activity where that requirement is relevant.
Businesses should therefore review how they confirm the identity of contingent workers in practice, especially in higher-risk environments or where work is allocated remotely, via an app, through a platform, or through a subcontracted chain.
6. Train the people now caught by this
The expanded regime will affect more than HR.
Procurement teams, site managers, operations teams, contract managers, platform onboarding teams and anyone who engages or supervises contingent labour will need to understand the new rules. They should know when to escalate a borderline status issue, what contractual protections are required, and why a casual assurance from a supplier may not be enough.
7. Keep checks consistent and non-discriminatory
The separate Code of Practice on avoiding unlawful discrimination continues to matter. Employers should be consistent in how they conduct right to work checks, should not check only those who appear likely to be migrants, and should not make assumptions based on colour, nationality, ethnic or national origins, accent, surname or length of residence in the UK. A discrimination claim can lead to compensation with no upper limit.
A note of caution
The Code is still in draft, and the Home Office supporting guidance is expected to include worked examples for contractual chains, online matching services and substitution clauses. Some practical detail may therefore change when the final Code and supporting guidance are published.
However, the direction of travel is clear. Section 48 has now been commenced for 1 October 2026, and the draft Code is framed to come into force on that date. Businesses should therefore plan on the basis that the expanded right to work regime will apply from 1 October 2026.
If you would like help mapping your workforce, reviewing your supplier and contractor arrangements, or updating your right to work processes ahead of 1 October 2026, please get in touch with a member of our Immigration team here.
The information on this site about legal matters is provided as a general guide only. Although we try to ensure that all of the information on this site is accurate and up to date, this cannot be guaranteed. The information on this site should not be relied upon or construed as constituting legal advice and Howes Percival LLP disclaims liability in relation to its use. You should seek appropriate legal advice before taking or refraining from taking any action.
