From 1 October 2026 UK right to work checks and liability for failing to prevent illegal working expand beyond traditional employment to cover subcontractors, gig workers and supply chains. The new laws redefine employer liability and protection against illegal working penalties. It is crucial organisations understand their full exposure and how to protect themselves from serious sanctions and they may need advice from commercial contract lawyers, as well as employment and immigration advisers when it comes to staying compliant.

We are offering a free webinar and Q&A which you can attend on along with colleagues to find out more about how liability is expanding and what you can do to protect organisations. If you miss it, there will be a recording.

(Click here to register for the webinar on Thursday, 24 September, 12:00 pm)

(You can read more about the right to work changes here.)

What is changing?

Currently, a business is generally only liable for a civil penalty (or a criminal sanction where it acts knowingly or with reasonable cause to believe) if it directly employs an illegal worker. Section 48 of the Border Security, Asylum and Immigration Act 2025, which amends the Immigration, Asylum and Nationality Act 2006, changes that in two ways from 1 October 2026. 

  • From 1 October 2026, the definition of "employment" for right to work expands to cover worker's contracts, individual subcontractors and online matching services matching workers to clients, in addition to traditional contracts of employment.
  • A new "extended liability" regime means a business can face a civil penalty of up to £60,000 per illegal worker found in its subcontracting chain, through an online matching service it operates, or under a substitution clause — even with no direct relationship with the worker.

The Home Office published draft codes of practice on preventing illegal working and a draft Employer's guide to right to work checks this summer. Together they give a clear picture of how the regime will operate. Businesses that map their exposure with employment, contract and immigration advice to ensure compliance this autumn will be far better placed than those treating this as a routine update to the checking process. 

Who now requires a right to work check?

From 1 October, four working arrangements are deemed "employment" for right to work purposes:

  1. Contracts of employment. The regime continues unchanged for permanent and fixed-term employees.
  2. Worker's contracts. An individual agrees to perform work or services personally for a business that is not a client or customer of the individual's own business, capturing many casual, zero-hours and temp arrangements. The Home Office's example is an agency supplying temporary bar and restaurant staff: the agency must carry out the checks.
  3. Individual subcontractors. An individual contracts with a business that has itself been contracted by a third party to provide the work, with no direct relationship between individual and third party. The Home Office's example is a delivery rider accepting jobs through an app: the platform is treated as the employer.
  4. Online matching services. Platforms that keep a register of workers, match them with clients through an online service and charge a fee or commission. The matching service, not a person or organisation using it to find a cleaner, is treated as the employer.

Genuinely self-employed individuals operating an independent business in their own right, such as a plumber advertising directly to the public, remain out of scope. The Home Office will, however, look at how work is arranged, supplied and performed in practice: the label "self-employed" is not in itself enough.

What is extended liability?

From 1 October, a business can be treated as employing whoever performs work, even with no contractual relationship with, or knowledge of them in three situations:

  1. Subcontracting chains. Where a business is contracted to provide work or services and subcontracts any part of it, every business in the chain below the end user can be liable for illegal workers anywhere further down. The end user at the top of the chain is not liable.
  2. Online matching. A matching service has extended liability for the right to work of the workers of the service providers it matches with clients, alongside those businesses' own direct liability. The client is not liable.
  3. Substitution. Where a contract permits a worker to send a substitute, the engaging business will be liable if the substitute lacks the right to work

The draft code states the Home Office will act under extended liability only where it cannot otherwise identify the party with a direct contractual relationship with the worker. Yet the statutory position permits action against all parties in a chain of subcontracts. The Home Office also states that extended liability may apply where the new prescribed requirements have not been carried out. Understanding and implementing those requirements in full this autumn therefore matters, and businesses in sectors from construction and logistics to film and TV may have subcontracting chains and working relationships that bring them into scope.

What isn’t extended liability?

Extended liability does not catch every purchaser of services: it does not apply to end users buying services for their own operations, and contracts that are not for the supply of work or services — a supply of goods, or a pure supply of workers - should also be out of scope. The draft guidance gives four examples:

  1. Purchasing a service for your own use. A retailer engaging a facilities management company to clean its supermarkets is not passing the work onward, so extended liability does not apply to it; responsibility rests with the facilities company as employer of the cleaners.
  2. Purchasing labour rather than work or services. A manufacturer taking temporary production workers from an employment business obtains workers for its own operations rather than providing work onwards in a chain - neither party has extended liability, and the employment business is directly liable as employer and must carry out compliant checks.
  3. Supply of goods. A food producer supplying sandwiches to a retailer supplies finished goods, not work or services. Extended liability applies to neither, and direct responsibility remains with the employment business staffing the producer's factory.
  4. A food ordering platform. A platform providing only technology and ordering services to a takeaway that uses its own delivery staff is not engaging the workers; the takeaway remains the direct employer.

What are the penalties?

Up to £60,000 per worker working without permission; potential sponsor licence revocation, with the loss of sponsored workers that follows; and, where a business knew or had reasonable cause to believe a worker lacked the right to work, criminal liability carrying an unlimited fine and up to five years' imprisonment. Immigration officers can also issue an illegal working closure notice shutting premises for up to 48 hours, extendable by court order for up to 12 months.

How can organisations protect themselves?

Compliant right to work checks continue to give employers a statutory excuse against civil penalties for direct employment. A statutory excuse against extended liability requires prescribed requirements to be met in full before work commences, across three areas:

  1. Contractual terms obliging the down-chain party to carry out compliant checks; prohibiting further subcontracting without prior written consent, with obligations flowed down into any permitted subcontract; conferring audit rights; enabling suspension or termination where illegal working is identified and requiring cooperation with Home Office investigations.
  2. Substitution controls ensuring every substitute is checked before starting work; that responsibility for checks is never delegated to the workers themselves and that contractual sanctions apply if a substitute works illegally.
  3. Identity verification systems confirming the worker is the person who was checked, with re-verification recommended at least once a shift.

Contractual drafting alone will not suffice. Organisations must show these arrangements operate in practice and take reasonable steps, supported by records of contracts, audits, assurances and remedial action, to satisfy themselves that requirements are met.

Digital right to work checks: IDSPs become "RtW DVSPs"

From 1 October 2026 it is mandatory - not merely recommended - that any digital identity verification provider relied on for a statutory excuse is registered and specifically authorised for right to work checks (a "RtW DVSP") on the Office for Digital Identities and Attributes (OfDIA) register. Two helpful changes accompany this: a RtW DVSP may verify an expired British or Irish passport up to six months past expiry by validating the document chip, and official digital evidence of a name and National Insurance number may be accepted alongside an acceptable List A or B document.

What to do now

These changes involve more than HR departments. HR, operations, managers and procurement should be trained on the expanded definitions and new processes.

Organisations should categorise every engagement - employees, agency staff, outsourced workers, subcontractors, casual, zero-hours, platform and gig workers - against the new definitions, taking expert immigration advice where arrangements may create exposure. 

Right to work policies should be redrafted. Identity verification may need implementing where subcontracting, matching services or substitution clauses are in use. 

Commercial contracts exposed to extended liability should be identified and redrafted where necessary, with the prescribed requirements built into templates and downstream liability addressed for work starting on or after 1 October. 

Contract lawyers may be need to incorporate prescribed requirements into contracts where work and services are being subcontracted. Employment advice may be needed on any kind of worker’s contract with a substitution clause which will need to be revisited with the prescribed requirements in mind. Immigration advice may be needed too to ensure that organisations understand their exposure and to assist with drafting new right to work protocols fit for the post 1 October regime.

Contact us if you have any questions about these changes. We expect a busy few weeks!