Right to Work Checks After 1 October 2026: Who Must Check, and Who Can Now Be Fined 

The law on right to work checks changed significantly on 1 October 2026. If your business uses freelancers, sub-contractors, agency workers or platform labour alongside permanent employees, the new rules apply to you, and the penalties for getting it wrong start at £45,000 per worker.

Section 48 of the Border Security, Asylum and Immigration Act 2025 is now in force. It has expanded the definition of who counts as an “employer” for illegal working purposes and introduced a new section 15A to the Immigration, Asylum and Nationality Act 2006, creating a framework for fines to travel up the contractual chain to businesses that never directly engaged the worker at all.

This guide explains every change employers, HR teams, recruitment agencies, sub-contracting businesses and online platforms need to understand. It covers who must check, what the checks involve, how to protect your business with a statutory excuse, and the practical steps you should be taking right now.

Key Takeaways

• The duty to carry out right to work checks no longer applies only to employees. From 1 October 2026, it extends to workers, individual sub-contractors and online matching services.
  
• A new extended liability regime means civil penalties can reach businesses higher up the contractual chain, even where they had no direct relationship with the worker.
  
• Civil penalties are up to £45,000 per illegal worker for a first breach and up to £60,000 for a repeat breach within three years.
  
• There are four prescribed check methods. Using the wrong one, or using the right one incorrectly, means no statutory excuse.
  
• Biometric Residence Permits (BRPs) are no longer acceptable as proof of right to work. Workers with eVisas must use the Home Office online checking service.
  
• The changes apply only to contractual arrangements entered into on or after 1 October 2026. There is no retrospective obligation to re-check existing workers engaged before that date.
  

The Legislation Behind the Changes

The changes stem from Section 48 of the Border Security, Asylum and Immigration Act 2025 (BSAI 2025), brought into force by the Immigration, Asylum and Nationality Act 2006 (Right to Work) (Commencement No. 4) Regulations 2026 (SI 2026/683).

The BSAI 2025 inserts new sections 14A and 15A into the Immigration, Asylum and Nationality Act 2006 (IANA 2006). Section 14A expands the scope of who falls within the right to work checking regime. Section 15A creates a new form of extended liability that can catch businesses further up the supply chain.

A revised Code of Practice on Preventing Illegal Working, now in its seventh edition, came into force alongside these provisions, supported by an updated Employer’s guide to right to work checks published on GOV.UK.

Who Must Now Carry Out Right to Work Checks

For nearly two decades, the legal duty to check a person’s right to work rested on employers, meaning businesses that engaged individuals under a contract of employment. That narrow scope created an obvious gap. Businesses using freelancers, contractors or platform workers could largely avoid the regime, even where those individuals were performing the same work as employees.

From 1 October 2026, the duty extends to three additional categories of working arrangement.

Workers Under a Worker’s Contract

A worker’s contract, as defined under section 230(3)(b) of the Employment Rights Act 1996, covers individuals who personally perform work or services but are not employed under a full contract of employment. This includes many casual workers, zero-hours workers and individuals engaged on a freelance basis where there is a personal service obligation.

Individual Sub-Contractors

Where a business engages an individual directly to provide work or services as a sub-contractor, that business must now carry out a right to work check. This applies regardless of the label used in the contract. The Home Office assesses the substance of the arrangement, specifically what actually happens day to day, not the paperwork.

Online Matching Services

Platforms that connect individual service providers with clients or customers are now within scope. If a platform operates an online matching service and pairs a worker with an end user, the platform has a duty to ensure right to work checks are conducted.

How the Home Office Determines Status

Labels matter far less than reality. The updated Employer’s guide to right to work checks includes detailed guidance on assessing working arrangements, drawing on factors such as:

• Whether the individual must perform the work personally
  
• The degree of control the engaging business exercises over how and when the work is done
  
• Whether the individual is integrated into the business
  
• Whether the arrangement involves mutuality of obligation
  

The Home Office has made clear that IR35 determinations are not decisive. A worker classified as outside IR35 for tax purposes may still fall within the right to work checking regime if the substance of the arrangement involves personal service.

Extended Liability: How Fines Can Travel Up the Chain

The most significant development for businesses operating through supply chains is the new extended liability regime under section 15A of the IANA 2006.

Under the previous rules, only the business with the direct contractual relationship with the worker was liable for illegal working penalties. That is still the starting position. The direct employer, or the business that engages the worker under a worker’s contract or sub-contractor arrangement, remains primarily responsible for conducting the check.

The new point is that, where that direct check was not properly carried out, civil penalty liability can extend to businesses higher up the chain.

Three Situations That Trigger Extended Liability

The Home Office guidance identifies three scenarios.

Contract chains. A business is contracted to deliver work or services to a third party and uses another employer’s workers to fulfil that contract. If the employer at the bottom of the chain fails to carry out proper right to work checks, the business that contracted with them, and potentially any business further up the chain that is supplying work or services onwards, can be penalised.

Consider a construction project. A main contractor engages a sub-contractor to provide plastering services. The sub-contractor brings in individual workers. If the sub-contractor does not check those workers’ right to work, the main contractor may face a civil penalty, even though it never had a direct relationship with the workers.

Online matching services. A platform pairs a service provider with a customer, and those two then contract with each other directly. If the service provider lacks the right to work and no proper check was done, the platform can face extended liability.

Substitution. Where a contract allows the engaged individual to send someone else in their place, and they do, the engaging business can be liable if the substitute’s right to work was not checked before they started.

Important Exclusions

Extended liability does not apply to every business in a chain. A business that is purely the end client or customer, and is not itself supplying the work or services onwards to a third party, falls outside these provisions.

For example, a restaurant that hires a catering agency to supply waiting staff is using those staff for its own internal operations. If the agency fails to check a worker’s right to work, the restaurant is not caught by the extended liability rules, because it is not supplying services onwards to another business.

Civil Penalties and Criminal Offences

The financial consequences of non-compliance are severe and have increased substantially in recent years.

Civil Penalties

A civil penalty notice can be issued where an employer (or business within the extended scope) has employed or engaged a person who does not have the right to work, or who is working in breach of their conditions.

Breach Type	Penalty Per Illegal Worker
First breach	Up to £45,000
Repeat breach (within 3 years)	Up to £60,000

Penalty Mitigation

There are specific steps a business can take to reduce the penalty:

• Reporting the suspected illegal worker to the Home Office before the investigation begins reduces the penalty by £5,000, provided the business obtains a Unique Reference Number (URN) as evidence of the report.
  
• Active co-operation with the Home Office investigation can reduce the penalty by a further £5,000.
  
• Early payment (paying within 21 days of a civil penalty notice) triggers a 30 per cent reduction on first-breach penalties.
  
• In cases where the business can demonstrate it had effective right to work checking procedures in place generally, and the failure was an isolated lapse, the Home Office may issue a Warning Notice instead of a financial penalty for a first breach.
  

Objection and Appeal Rights

An employer has 28 calendar days from the date of a civil penalty notice to lodge an objection with the Home Office. If the objection is unsuccessful, the employer can appeal to the county court (or equivalent) within a further 28 days. However, the 21-day early payment window runs concurrently, meaning a business that wants to object must decide quickly whether to pay the reduced amount or pursue the objection at the risk of paying the full penalty.

Criminal Offences

Where an employer knows, or has reasonable cause to believe, that a person does not have the right to work and employs or engages them anyway, the employer commits a criminal offence under section 21 of the IANA 2006. The maximum penalties are:

• On conviction on indictment: up to five years’ imprisonment and/or an unlimited fine
  
• On summary conviction: up to 12 months’ imprisonment and/or an unlimited fine
  

The individual who works illegally also commits an offence, punishable by up to six months’ imprisonment and/or an unlimited fine.

Other Consequences

Beyond financial penalties and criminal prosecution, non-compliance can result in:

• Illegal working closure notices, forcing the business to shut
  
• Director disqualification proceedings
  
• Revocation of alcohol, late-night refreshment or taxi/private hire vehicle licences
  
• Seizure of the worker’s earnings as proceeds of crime
  
• Publication of the employer’s details on GOV.UK
  
• Negative effects on the business’s ability to obtain credit and future immigration-related applications
  

The Statutory Excuse: Your Only Protection

A statutory excuse is the only legal defence against a civil penalty for employing or engaging a person who does not have the right to work. It is obtained by carrying out the prescribed right to work check correctly, before the work begins, and keeping proper evidence.

A check done after work has started offers no protection. A check done using the wrong method offers no protection. A check where the records are incomplete, undated or unclear offers no protection, even if the worker turns out to have had full permission all along.

The Four Prescribed Check Methods

The method of checking is determined by the individual’s immigration status, not by employer preference. Using the wrong method for a given individual means no statutory excuse can be established.

1. Manual document check

This method is now largely confined to British and Irish citizens who present a passport or other acceptable document. The process requires the employer to:

• Obtain original documents from List A or List B in Annex A of the Employer’s guide (not copies, not photographs, not digital images)
  
• Check the documents in the holder’s physical presence
  
• Satisfy itself the documents are genuine, belong to the person presenting them, and allow the person to do the work offered
  
• Make a clear, legible copy of each document
  
• Record the date of the check on the copy or in a separate, linked record
  
• Retain the copies securely for the duration of the engagement and for two years after it ends
  

2. Home Office online check

This method is mandatory for anyone whose immigration status is held as an eVisa. It is also the correct method for workers who hold or have held a Biometric Residence Permit (BRP), a Biometric Residence Card (BRC), or a Frontier Worker Permit.

The process works as follows:

• The worker generates a share code through the GOV.UK “prove your right to work” service. Share codes start with the letter “W” and contain nine characters. Codes starting with “R” or “S” are for other purposes and must not be accepted for right to work checks.
  
• The employer enters the share code, along with the worker’s date of birth, into the GOV.UK employer checking service.
  
• The service displays the worker’s immigration status, any work restrictions, and a photograph.
  
• The employer must confirm that the photograph matches the person in front of them.
  
• The employer records its own full business name against the check, saves or prints the profile page, and records the date.
  

Share codes are valid for 90 calendar days from the date of generation. If a code has expired, the worker must generate a new one.

BRPs are no longer acceptable evidence. The Home Office stopped issuing BRPs on 31 October 2024, and expired BRPs do not give a statutory excuse. Workers who previously held a BRP should now have an eVisa, and the correct check method is the online service.

3. Digital identity verification service

This is an alternative method available only for British and Irish citizens relying on a valid passport or Irish passport card. The identity check is carried out by a certified Identity Service Provider (IDSP) registered with the Office for Digital Identities and Attributes (OfDIA).

The employer retains full liability for the check. A failure by the IDSP is, in legal terms, a failure by the employer.

4. Employer Checking Service (ECS)

This method is used where the worker cannot produce documents or generate a share code. Common situations include:

• An application for leave to remain is pending with the Home Office
  
• An appeal or administrative review is outstanding
  
• The worker holds a non-digital Certificate of Application under the EU Settlement Scheme
  
• The worker holds an Application Registration Card
  
• The worker arrived in the UK before 1988 and has no documentary proof of status
  

The employer contacts the Home Office Employer Checking Service with the worker’s details. A Positive Verification Notice (PVN) confirms the person has the right to work and provides a statutory excuse for six months only. A Negative Verification Notice (NVN) means the person does not have an outstanding application or the right to work, and no statutory excuse is established.

Time-Limited Permission: Restrictions, Students and Follow-Up Checks

Work Restrictions

For any worker with limited leave, the employer must confirm that the permission covers the specific type of work being offered and any restriction on hours. This is particularly important for:

• Student visa holders, who are typically limited to 20 hours per week during term time and may work full-time only during vacations. The employer must obtain evidence of term and vacation dates from the educational institution.
  
• Dependant visa holders, who may have restrictions on the type of work they can undertake.
  
• Graduate visa holders, who have unrestricted work rights for the duration of the visa but whose permission is time-limited.
  

Follow-Up Checks

Where a worker’s permission is time-limited, the employer must carry out a follow-up check on or before the expiry date. If no new permission can be shown, the employer must use the Employer Checking Service to determine whether a further application is pending. No follow-up checks are required for workers with settled status or indefinite leave to remain.

The 28-Day Grace Period

The Employer’s guide provides a 28-calendar-day grace period in limited circumstances. Where an employer has reasonable grounds to believe that the worker has made an in-time application for further leave, or that an appeal or administrative review is pending, the existing statutory excuse continues for 28 days while the employer takes steps to verify the position.

This grace period ends early if a Negative Verification Notice is received. It does not apply to pre-employment checks. It applies only to follow-up checks on existing workers.

Section 3C Leave

Where a worker makes an in-time application to extend their leave before their current permission expires, section 3C of the Immigration Act 1971 automatically extends their existing leave (on the same conditions) until the application is decided, and through any appeal or administrative review period. The worker continues to have the right to work on the same terms.

The employer should use the Home Office online checking service or the Employer Checking Service to verify the position. A Positive Verification Notice will provide a statutory excuse for six months.

The Transitional Rule Most Employers Are Missing

One of the most important, and most widely overlooked, aspects of the 1 October 2026 changes is the transitional provision.

The expanded scope of the right to work checking regime applies only to contractual arrangements entered into on or after 1 October 2026. There is no retrospective obligation.

In practical terms, this means:

• Workers already engaged under existing contracts before 1 October 2026 do not need to be re-checked under the new regime (though existing checking obligations for employees continue to apply as before).
  
• New engagements of workers, sub-contractors and individuals through online matching services from 1 October 2026 onwards must comply with the expanded checking requirements.
  
• Extended liability provisions apply only to contracts entered into on or after 1 October 2026.
  
• Renewals and extensions of existing contracts from 1 October 2026 should be treated as new arrangements and checked accordingly.
  

This transitional rule provides breathing space, but it should not be treated as a reason to delay action. Every new engagement from 1 October 2026 must comply, and the volume of non-employee working arrangements in most businesses means the transition affects a significant portion of the workforce.

Defending an Extended Liability Claim

A contractual clause stating “the sub-contractor is responsible for right to work checks” is not, by itself, a defence. The statutory excuse against extended liability has its own prescribed requirements, all of which must be in place before the work or service begins.

The Three Prescribed Requirements

Written contractual statement. For contract chains and online matching services, the engaging business must include a prescribed written statement in its contract. This statement must contain the specific terms required by the Home Office guidance, including an acknowledgement of the right to work checking obligation and a commitment to comply.

Substitution controls. Where a contract permits the engaged individual to send a substitute, the engaging business must have controls in place to ensure that the substitute’s right to work is checked before they begin work.

Identity verification at the point of work. The business must have a working system for confirming that the person who actually turns up to do the work is the same person whose right to work was checked. The Home Office recommends proportionate measures, which may include identity cards, attendance systems, or facial recognition through a registered DVSP. Re-verification should take place at least once per 24-hour period or shift.

The Evidence Burden

Beyond having these requirements in place, the business must be able to demonstrate that:

• The procedures exist in documented form
  
• They work in practice, not just on paper
  
• The business took reasonable and proportionate steps to satisfy itself that checks were being conducted
  
• Evidence is available and can be produced on request
  

TUPE Transfers and the Checking Obligation

Where a worker transfers to a new employer under the Transfer of Undertakings (Protection of Employment) Regulations 2006 (TUPE), the new employer has 60 calendar days from the transfer date to carry out a fresh right to work check.

However, this 60-day grace period applies only to employees, not to workers, sub-contractors or individuals engaged through online matching services. For non-employee workers who transfer as part of a TUPE arrangement from 1 October 2026 onwards, the new employer must carry out a right to work check before they begin work.

Non-Discrimination Obligations

The Equality Act 2010 applies to right to work checks as it does to any other workplace process. Employers must not discriminate on the basis of race, nationality, ethnic origin or any other protected characteristic when deciding who to check or how thoroughly to check them.

In practice, this means:

• All prospective workers must be checked, not only those who appear to be from a particular background
  
• The same checking process must be applied consistently to everyone
  
• Assumptions about a person’s right to work based on their name, appearance, accent or nationality are unlawful
  
• A person should not be asked to produce additional or different documents beyond those required by the prescribed lists
  

Failure to apply checks consistently can expose the business to discrimination claims as well as undermining any statutory excuse, since the Home Office may question whether checks were genuinely embedded in the business’s processes.

High-Risk Sectors

Certain industries face particular scrutiny because of historically higher rates of illegal working. These include:

• Hospitality: hotels, restaurants, takeaways, catering
  
• Construction: particularly through complex sub-contracting chains
  
• Agriculture and food processing: seasonal and migrant labour
  
• Cleaning and facilities management: outsourced contract labour
  
• Care sector: domiciliary care agencies, care homes
  
• Gig economy and platform work: delivery, ride-hailing, task-based services
  

Businesses in these sectors should expect a higher likelihood of Home Office compliance visits and should ensure their checking processes are robust, documented and readily auditable.

Sponsor Licence Implications

For businesses that hold a sponsor licence, the consequences of illegal working go beyond civil penalties. A finding of illegal working, even a single instance, can trigger a review of the sponsor licence. Possible outcomes include:

• Suspension of the licence, preventing the business from issuing new Certificates of Sponsorship
  
• Revocation of the licence, requiring sponsored workers to find a new sponsor or leave the UK
  
• A 12-month cooling-off period before the business can reapply, during which no sponsored workers can be employed
  

The Home Office has made clear that sponsor licence holders are expected to maintain the highest standards of compliance. A failure in right to work checking demonstrates a failure of the compliance systems that underpin the licence.

Practical Compliance Steps for Employers

The following steps provide a framework for ensuring compliance with the expanded right to work checking regime from 1 October 2026.

1. Map every working arrangement. List every category of individual doing work for your business: permanent employees, fixed-term employees, casual workers, zero-hours workers, agency staff, freelancers, individual sub-contractors and platform workers. For each, determine whether the relationship involves personal service.

2. Identify your position in any supply chain. If your business supplies work or services to a third party using other employers’ workers, you may face extended liability. Map the chain and identify where checking responsibilities sit.

3. Review all contracts entered into from 1 October 2026. Ensure contracts with labour suppliers, sub-contractors and platform arrangements include the prescribed written statement required for the extended liability defence.

4. Audit substitution clauses. Check every contract for a substitution provision. If one exists, establish controls to ensure a substitute’s right to work is checked before they start work. If substitution is not genuinely needed, consider removing the clause. A silent contract is treated as not permitting substitution.

5. Implement identity verification at the point of work. Introduce a system for confirming that the person who turns up is the person whose right to work was checked. This is particularly important for businesses using agency or sub-contracted labour.

6. Confirm the correct check method for each individual. Match each worker’s immigration status to the correct check method. In particular, ensure that anyone with an eVisa is checked through the Home Office online service, not by inspecting an expired BRP.

7. Diarise expiry dates and PVN renewal dates. Set up a system to flag upcoming expiry dates for time-limited leave and Positive Verification Notices, with enough lead time to carry out follow-up checks or ECS requests before the deadline.

8. Audit existing records. Review right to work files for completeness. Every file should contain a clear, legible copy of the checked document (or a saved profile page from the online service), the date of the check, and a record of who carried it out. Missing dates or unreadable copies are enough to lose the statutory excuse.

9. Train all relevant staff. Right to work checks are no longer solely an HR responsibility. Procurement teams, operations managers, site supervisors and anyone involved in engaging flexible labour need to understand their obligations.

10. Prepare for Home Office compliance visits. Keep records organised and accessible. Be ready to demonstrate not just that checks were done, but that the business has a working system of compliance that is applied consistently.

Common Mistakes That Cost Employers Their Statutory Excuse

Even businesses that take right to work compliance seriously can make errors that destroy their statutory excuse. The most frequent include:

• Accepting photocopies or scanned images instead of original documents during a manual check
  
• Not recording the date of the check on the document copy
  
• Using an expired BRP as evidence instead of directing the worker to the online service
  
• Accepting a share code that starts with “R” or “S” (only codes starting with “W” are valid for right to work)
  
• Failing to confirm the photograph matches the person during an online check
  
• Not saving the profile page from the online checking service
  
• Missing the follow-up check deadline for workers with time-limited permission
  
• Applying checks inconsistently, such as checking some workers but not others, or applying a more rigorous process to workers of certain nationalities
  
• Relying on a contractual clause to pass responsibility for checks without meeting the prescribed requirements for the extended liability defence
  
• Failing to use the Employer Checking Service when a worker cannot produce documents or a share code, and dismissing them instead
  

Frequently Asked Questions

1. Do I need to re-check all my existing sub-contractors from 1 October 2026?

No. The expanded checking requirements apply only to contractual arrangements entered into on or after 1 October 2026. Existing engagements pre-dating that date are not retrospectively caught. However, any new contract, renewal or extension from 1 October 2026 should be treated as a new arrangement and checked accordingly.

2. Can I rely on my sub-contractor’s assurance that they have checked their workers?

Not without more. A verbal assurance or a simple contractual clause does not meet the prescribed requirements for the extended liability defence. You must include the prescribed written statement in the contract, have substitution controls in place, operate an identity verification system at the point of work, and be able to demonstrate that these procedures function in practice.

3. What if a worker’s BRP has expired but they say they have an eVisa?

Direct them to the Home Office online service at GOV.UK to generate a share code. You cannot accept an expired BRP as evidence of right to work. If the worker is unable to generate a share code, use the Employer Checking Service.

4. Does a worker’s IR35 status determine whether I need to check them?

No. The Home Office has stated explicitly that IR35 determinations do not decide whether the right to work checking duty applies. The test is based on the substance of the working arrangement, specifically whether personal service is required, not the tax classification.

5. What happens if I discover that a worker does not have the right to work?

You should not continue to engage the worker. Report the matter to the Home Office and obtain a Unique Reference Number, which may reduce any penalty by £5,000. Take advice before dismissing, particularly where the worker disputes the position or claims to have a pending application. A premature dismissal can give rise to employment tribunal claims.

6. How long must I keep right to work records?

Records must be kept securely for the entire duration of the engagement and for two years after the engagement ends. This applies to copies of documents, saved profile pages from online checks, ECS correspondence, and any other evidence of the check.

7. Can I use a digital identity service provider for all workers?

No. Digital identity verification through a certified IDSP is available only for British and Irish citizens who hold a valid passport or Irish passport card. Workers with eVisas must be checked through the Home Office online service. Workers who cannot produce documents must be checked through the Employer Checking Service.

8. What is a Positive Verification Notice and how long does it last?

A Positive Verification Notice (PVN) is the Home Office’s confirmation, through the Employer Checking Service, that a person has the right to work. It provides a statutory excuse for six months only. A further check must be carried out before the six months expire. If the worker’s position has not been resolved by then, another ECS request should be made.

9. Are there any reductions available if I receive a civil penalty notice?

Yes. Reporting the worker to the Home Office with a URN reduces the penalty by £5,000. Active co-operation with the investigation can reduce it by a further £5,000. For first breaches, paying within 21 days of the penalty notice triggers a 30 per cent reduction. In some cases, a Warning Notice may be issued instead of a financial penalty if the business had generally effective procedures and the failure was isolated.

10. Does the 60-day TUPE grace period apply to sub-contractors who transfer?

No. The 60-day grace period for TUPE transfers applies only to employees. Non-employee workers, including those engaged under worker’s contracts or as sub-contractors, who transfer as part of a TUPE arrangement from 1 October 2026 onwards must have their right to work checked before they begin work with the new employer.

Read More

• Right to Work Share Code 2026: Everything You Need to Know
• UK ILR New Rules 2026: How April Changes Impact Skilled Worker Visa Holders
• Certificate of Sponsorship (CoS) UK 2026: Types, Costs and Employer Compliance Guide