UK Right to Work Rules Are Expanding to Cover Contractors From 1st October 2026

From 1st October 2026, the UK's right-to-work duty reaches further than most businesses think. Section 48 of the Border Security, Asylum and Immigration Act 2025 extends the illegal working regime beyond direct employees to cover workers, individual sub-contractors, and people engaged through online matching or gig platforms - arrangements many businesses assumed were someone else's responsibility further down the chain.

Here's what actually changed, what the checks require, and where the gaps usually sit in a contractor or agency supply chain.

Key takeaways

• From 1st October 2026, the duty to prevent illegal working extends beyond direct employees to cover workers, individual sub-contractors, and people engaged via online matching or gig platforms.
• Civil penalties remain up to £45,000 per illegal worker for a first breach and up to £60,000 for a repeat breach, under section 15 of the Immigration, Asylum and Nationality Act 2006, with criminal liability possible in knowing cases.
• A compliant check must happen before work starts, using one of three accepted methods: a manual document check, the Home Office online checking service, or a registered Right to Work Digital Verification Service Provider (DVSP) check
• Passing a correct check before work starts establishes a statutory excuse against a civil penalty - it isn't automatic, and it must be earned through the prescribed process.
• The extended scope specifically targets contractor and agency supply chains, where checks have often been assumed to sit with whichever party is 'closest' to the worker, rather than clearly assigned.

What actually changed on 1st October

Until now, the illegal working regime centred on conventional employment - the duty to check sat clearly with the direct employer. Section 48 of the Border Security, Asylum and Immigration Act 2025 extends that duty to a wider set of working arrangements: workers' contracts, individual sub-contractors, and people engaged through online matching services or gig and platform work.

Why this lands squarely on contractor and agency supply chains

The businesses most exposed by this change aren't the ones with straightforward direct employment. They're the ones with layered supply chains - an agency supplying workers to a client, a sub-contractor bringing in their own labour, a platform matching individuals to work - where it's genuinely unclear, in practice, who was supposed to check what.

• Where a worker is engaged through an agency, the duty and liability can extend up the chain if the correct check wasn't completed anywhere along it.
• Individual sub-contractors, previously outside the conventional employment check, are now explicitly in scope.
• Businesses using online matching or gig platforms to source labour are drawn into the same duty, even where no traditional employment relationship exists.

None of this requires a business to have acted in bad faith. It requires the check to have happened, correctly, before the work started - regardless of how many parties sit between the business and the individual actually doing the work.

What a compliant check actually requires

Three methods currently establish a statutory excuse, and which one applies depends on the worker's status:

• Manual document check - examining original, valid documents (such as a passport showing right of abode or no time limit on stay) in the individual's physical presence, following the prescribed steps.
• Home Office online check - using the official GOV.UK employer checking service with the worker's share code and date of birth, generally required where a worker holds an eVisa.
• Registered Right to Work Digital Verification Service Provider (DVSP) check - a certified digital identity verification route, available for British and Irish citizens where permitted.

Whichever method applies, the check has to happen before work starts. A correct check carried out late, or one that confirms someone can work but not specifically that they can do the work in question, doesn't establish the statutory excuse.

Mapping where the gaps actually sit

In a layered supply chain, the most common gap isn't a missing process - it's an assumed one. Each party in the chain often believes another party has already completed the check, and nobody has actually confirmed it.

• Confirm, for every category of worker in your supply chain, who is contractually and practically responsible for the check.
• Verify the check method matches the worker's actual status - a manual check where an online check was required doesn't establish the excuse.
• Confirm records are retained for the required period, and that follow-up checks happen where a worker's permission is time-limited.
• Where checks are delegated - to branch managers, agencies, or subcontractors - confirm those checks are actually being carried out to the required standard, not just assumed to be happening.

If you use contractors, agency workers, or sub-contracted labour anywhere in your supply chain, now is the time to confirm exactly where these checks are happening - and where they might not be.

FAQs

Does the right-to-work duty apply to contractors, not just employees?

Yes, from 1st October 2026. Section 48 of the Border Security, Asylum and Immigration Act 2025 extends the duty to cover workers, individual sub-contractors, and people engaged via online matching or gig platforms, not only conventional employees.

What's the penalty for getting a right-to-work check wrong?

Civil penalties remain up to £45,000 per illegal worker for a first breach and up to £60,000 for a repeat breach, under section 15 of the Immigration, Asylum and Nationality Act 2006, with criminal liability possible where the employer knowingly employed someone without the right to work.

Which right-to-work check method should we use?

It depends on the worker's status: a manual document check for those with eligible physical documents, the Home Office online checking service for eVisa holders, or a registered Digital Verification Service Provider check for British and Irish citizens where that route is permitted.

Who is responsible for the check in an agency or subcontractor arrangement?

This should be confirmed explicitly rather than assumed. The extended regime can draw liability up a contractual chain where the correct check wasn't completed anywhere along it, so responsibility needs to be clearly assigned and evidenced, not left to whichever party is assumed to be closest to the worker.

What should we do first to prepare?

Map every category of worker in your supply chain and confirm, in writing, who is responsible for their right-to-work check and which method applies. Gaps are most common where checks have been delegated or assumed rather than explicitly assigned and verified.