Right to Work Checks after 1 October 2026: The New Rules for Workers, Sub-Contractors and Platforms

At a glance

• The Right to Work Scheme now covers workers, individual sub-contractors and online matching services, not only employees.
• Businesses in contracting chains, platforms and engagers who allow substitution can face "extended liability" for workers they never engaged directly.
• The rules apply to engagements and contracts starting on or after 1 October 2026.

Introduction

Until 1 October 2026, right to work checks were essentially an obligation owed in respect of employees. A business using a self-employed courier, a labour supplier's operatives or a cleaner booked through an app usually had no duty to check them. That gap has now closed.

This article is for employers, contractors, recruitment businesses and digital platforms.

What changed, and where the rules come from

The civil penalty regime sits in sections 15 to 25 of the Immigration, Asylum and Nationality Act 2006 (IANA 2006). Section 48 of the Border Security, Asylum and Immigration Act 2025, which received Royal Assent on 2 December 2025, amends that Act in two important ways from 1 October 2026:

1. A wider meaning of "employer". A new section 14A treats a business as employing an individual not only under a contract of employment, but also where it engages them under a worker's contract, engages them as an individual sub-contractor, or, as an online matching service, supplies their details to potential clients or customers.
2. Extended liability. A new section 15A allows a civil penalty to be imposed on a business that has no direct contract with the person working illegally, in certain chains of contracts, platform arrangements and substitution arrangements.

The detail is found in three Home Office documents that took effect on the same day: a revised Code of Practice on preventing illegal working, a revised Code of Practice on avoiding unlawful discrimination, and the updated Employer's guide to right to work checks, finalised and published on 1 October 2026.

Who now has to carry out checks

For right to work purposes only, a business is now an "employer" if it engages someone in any of the following ways. The question is always the substance of the arrangement and how it works day to day; calling someone "self-employed" or a "partner" in the paperwork does not take them outside the Scheme.

• Contract of employment: employees and apprentices, as before. The employer carries out the check.
• Worker's contract: the individual agrees to do the work personally, and the business is not simply one of their own clients or customers. The business that engages the worker carries out the check (for temporary staff, usually the employment business that contracts with them).
• Individual sub-contractor: the individual contracts with a business that has itself agreed to provide, or arrange, the work for someone else. The business that engages the sub-contractor, for example an app-based courier or delivery operator, carries out the check.
• Online matching service: a business that keeps a register of service providers, lets customers request a match online, and charges a fee or commission for each match. The platform carries out the check.

To illustrate: a domestic cleaning app that matches a householder with an individual cleaner, and takes a commission, must now check that cleaner. A courier firm that engages drivers on a self-employed, per-drop basis must check those drivers. A hospitality staffing business that places casual bar staff on short assignments must check each of them.

Who is still outside the Scheme? The Home Office accepts that a genuinely independent business is not caught. That covers an individual running their own trade who contracts directly with customers, such as a locksmith or a decorator hired by a householder, and, depending on how it operates in practice, a client buying a defined service from another business under an ordinary business-to-business contract. Contracting through a limited company does not by itself take an arrangement out of scope: the Home Office looks at who actually performs the work and how the arrangement runs. Work carried out wholly outside the UK is also outside scope.

When do the new duties start to bite? They are not retrospective. For workers, individual sub-contractors and platform arrangements, a civil penalty can only follow where the engagement began on or after 1 October 2026. The extended liability requirements likewise apply to contractual arrangements entered into on or after that date. That said, businesses should be cautious: renewing or materially varying an existing arrangement may amount to a new engagement, and checking existing contractors voluntarily, in a consistent and non-discriminatory way, is sensible risk management.

How to carry out a compliant check

A check only protects you if it is done in the prescribed way, and before the person starts work. Done properly, and maintained through any follow-up checks that fall due, it gives you a "statutory excuse": a defence to a civil penalty if the individual later turns out not to have permission to work. The excuse is not available if you know the person is not permitted to do the work, if it is reasonably apparent that a document is false or not theirs, or if you discover illegal working and continue the engagement regardless. You may not insist on a particular method; the individual should be given a fair opportunity to prove their right to work in a way that suits their circumstances.

There are three prescribed methods.

1. The Home Office online check (share code)

This is now the main route for most non-British, non-Irish nationals, because the Home Office has replaced physical immigration documents with eVisas. The individual generates a right to work share code (it begins with "W" and lasts 90 days). You enter it, with their date of birth, on the GOV.UK "check a job applicant's right to work" service, confirm that the photograph is of the person in front of you (in person, by live video, or through a registered digital provider's facial matching), confirm any restrictions on hours or type of work, and save the profile page as a PDF or HTML record. Viewing the individual's own screen or a printout is not enough. Biometric Residence Permits stopped being issued on 31 October 2024, and an expired BRP can no longer be relied on.

2. A manual document check

You must hold the original document from the Home Office's List A or List B, examine it in the holder's presence (in person or by live video link), satisfy yourself that it is genuine and belongs to them, and keep a clear copy. A scan, photograph or video view of a document is not sufficient, with a limited exception for digital proof of a National Insurance number used alongside another document. This route is now mainly used for British and Irish citizens.

3. A registered digital verification provider (RtW DVSP)

Employers can use an identity technology provider to verify British and Irish citizens who hold a passport or Irish passport card that is current or expired by no more than six months. An expired document can only be accepted if the provider verifies its chip electronically (passive authentication); providers are not obliged to offer this, it cannot be done if the chip is damaged, and a cancelled (clipped) passport is never acceptable. Anyone who cannot or does not wish to use a digital route must be offered a manual check instead. From 1 October 2026, the provider must appear on the government's digital verification services register (maintained by the Office for Digital Identities and Attributes) as certified for right to work checks. Using a provider does not transfer responsibility: if the check is defective, the employer has no defence. Any facial recognition used as part of any check must also be supplied by a registered provider.

When the Home Office must verify status for you

Where a person cannot produce acceptable documents or a working share code, for example because they have a pending in-time application, appeal or administrative review, hold an Application Registration Card, have status issued in a Crown Dependency, or are a long-term resident who arrived before 1988, you should use the Employer Checking Service. A Positive Verification Notice gives a six-month defence, after which a further check is needed. The service aims to reply within five working days.

Records

Keep evidence of every check securely for the whole engagement and for two years after it ends, then destroy it securely. For manual checks you must record the date the check was made, either through a dated declaration on the copy confirming the date of the check or a separate contemporaneous record; simply writing a date on the photocopy is not enough. Be ready to produce records quickly if the Home Office asks.

Extended liability: when you can be fined for someone else's worker

The business with the direct contract still has primary responsibility for the check. But a penalty can now travel up the chain in three situations:

• Contracting chains. You have contracted to deliver work or services to a client and you engage another business to supply the people who do it. A main contractor on a building project using groundworks and labour sub-contractors, or a facilities firm that has won a contract and outsources part of it, are typical examples.
• Platforms. An online matching service connects a customer with a service provider, the customer contracts with that provider, and the provider sends one of its own people to do the job.
• Substitution. Your contract with an individual allows them to send someone else in their place, as is common in delivery and courier models.

The Home Office has confirmed that extended liability does not apply simply because you buy services for your own business. An office that hires a cleaning contractor for its own premises, or a factory that takes temporary staff from an employment business for its own production line, is not treated as the employer; the cleaning contractor or employment business remains responsible.

In practice, the Home Office will usually look for the direct employer first. The risk to those higher up the chain is greatest where the direct employer cannot be identified, where there are several layers of intermediaries, or where records are missing.

How to establish a defence against extended liability

You must have three things in place before the work starts, and be able to show that they work in practice, not just on paper.

1. A written statement of contract terms (contracting chains and platforms). Your contract with the business below you must, in substance:

• oblige it to carry out prescribed right to work checks on everyone who performs the work;
• prohibit further sub-contracting without your prior written consent, and require equivalent obligations to be passed down if consent is given;
• give you audit rights over its right to work compliance;
• allow you to act, for example by suspending or terminating, where illegal working is found without a statutory excuse, and require it to have equivalent rights against its own workforce; and
• require it to co-operate with any Home Office investigation, including by identifying every business in the chain.

2. Substitution controls (where substitution is allowed). Every substitute must be checked before they do any work; the check must not be left to the individual who is being substituted, even if they are described as running their own business; there must be contractual consequences if a substitute is working illegally; and you must be able to show that the person doing the work is the person who was checked.

3. Identity verification. Proportionate systems to confirm that the person actually working is the person whose right to work was checked. Options include ID passes, facial recognition through a registered provider, attendance or biometric systems, licence and training record checks, and re-verification at regular points. The Home Office recommends re-verifying at least once every 24 hours or shift, although an alternative system can be used if it gives equivalent assurance. This confirms that the right person has turned up; it is not a repeat of the right to work check, which is made before work starts and again only when a follow-up check falls due.

You may rely on assurances from businesses in your chain, but only if you have taken reasonable steps to satisfy yourself that those assurances are reliable. Keep audit records, compliance reviews and evidence of how concerns were followed up.

Follow-up checks

Where a person's permission to work is time-limited, you must re-check on or before the date it ends if you want to keep them working. The follow-up need not use the same method as the first check. No follow-up is required for someone with indefinite leave, or with settled or pre-settled status under the EU Settlement Scheme, provided the original check was done properly.

An expired visa does not always mean a person has lost the right to work. If they applied to extend their permission before it expired, section 3C of the Immigration Act 1971 continues their existing permission and conditions while the application, and any appeal or administrative review, is pending. Give them a fair chance to prove this, using a share code or, if that is not possible, the Employer Checking Service, before taking any action against them.

Checking without discriminating

The new scope does not change the duty to treat everyone alike. Check every new starter, worker, contractor and platform user, including British citizens, at the same stage and consistently, using an appropriate prescribed method for the evidence they hold. Do not decide who to check based on accent, surname, nationality or appearance, and do not refuse someone because they cannot use a digital route. An Employment Tribunal can award uncapped compensation for race discrimination.

What is at stake

• Civil penalty: up to £45,000 per illegal worker for a first breach, and up to £60,000 per illegal worker for a further breach within three years. The same figures apply to the newly covered categories and to extended liability.
• Criminal offence: knowingly employing an illegal worker, or having reasonable cause to believe they lack permission, carries up to five years' imprisonment and an unlimited fine.
• Business disruption: closure notices and compliance orders, and for licensed premises the loss of an alcohol or late-night refreshment licence.
• Sponsor licence: sponsors face suspension or revocation of their licence, which may end the lawful employment of every sponsored worker they have.

A practical checklist for businesses

1. Map your workforce. List everyone who does work for you or through you, including casual staff, self-employed individuals, agency supply, sub-contractor labour and platform users.
2. Classify each arrangement. Decide whether you are the direct employer, whether extended liability could apply, or whether you are simply buying a service for your own use.
3. Check every new engagement made on or after 1 October 2026 before work starts, using one of the three prescribed methods.
4. Review your contracts. Update sub-contracts, supply agreements and platform terms to include the required right to work provisions, and control onward sub-contracting.
5. Deal with substitution. Review substitution arrangements and implement appropriate approval, checking and identity controls. Removing an existing contractual substitution right should be assessed separately, as it can have wider employment status and commercial consequences.
6. Verify identity on the ground with passes, sign-in systems or a registered digital provider.
7. Audit and keep records. Diary follow-up checks, audit your supply chain and keep evidence for the engagement plus two years.
8. Train your staff so that those carrying out checks apply them consistently and lawfully.

How Morgan Hill Solicitors can help

Our immigration and employment teams advise employers, contractors, recruitment businesses and platforms on every part of the illegal working regime. We can review your working arrangements, redraft sub-contracting and platform terms to meet the new requirements, design right to work and substitution procedures, train your staff, and act for you if you receive a Home Office referral notice or civil penalty. We also advise sponsor licence holders facing compliance visits, suspension or revocation.

To discuss your business's position, please contact our team at any of our offices in Ilford, Central London, Romford or Manchester.

Sources and further reading

• Home Office, Employer's guide to right to work checks, 1 October 2026
• GOV.UK, Right to work checks: an employer's guide
• Border Security, Asylum and Immigration Act 2025, section 48 (inserting sections 14A and 15A into the Immigration, Asylum and Nationality Act 2006)

This article is for general information only and reflects the law and Home Office guidance as at 4 October 2026. It is not legal advice and should not be relied on for any particular situation; please seek advice on your own circumstances.