Right to Work from 1 October 2026: A Readiness Guide for Employers

Key Takeaways

• From 1 October 2026, the duty to prevent illegal working extends beyond employees. Section 48 of the Border Security, Asylum and Immigration Act 2025 widens the meaning of "employer" to include engaging someone under a worker's contract, engaging an individual sub-contractor, and operating an online matching service.
• The single most misunderstood point: for these new categories a civil penalty can only be imposed where the engagement commenced on or after 1 October 2026. You do not have to retrospectively check contractors already working for you before that date.
• A new extended liability provision means a business can be penalised for illegal working by someone it has no direct contract with, where it sits upstream in a chain of contracts, runs an online matching service, or engages a worker under a contract permitting substitution.
• Extended liability is a backstop, not the first port of call. The Home Office will seek to identify the employer holding the direct contractual relationship first, and only look upstream where that employer cannot be identified or the prescribed requirements have not been met.
• To hold a statutory excuse against extended liability you must meet three prescribed requirements in full: a written statement of contractual terms, substitution controls, and identity verification systems. All must be evidenced.
• Genuinely self-employed people in business on their own account remain outside the scheme, as do ordinary business-to-business contracts for the purchase of a service. Someone obtaining work through a platform or intermediary who is not running an independent business is not outside it.
• Using a digital provider remains optional, but if you do use one it must be a Right to Work DVSP on the Office for Digital Identities and Attributes register, with a note confirming it can provide right to work checks. Using an unregistered provider destroys your statutory excuse.
• Penalties are unchanged at up to £45,000 per worker for a first breach and £60,000 for a repeat breach, but they now reach a far wider population. WPC HR's compliance software records checks for employees and contractors alike with dated, tamper-evident evidence, and our Sponsor Licence Compliance Audit tests whether your arrangements would hold up.

Introduction

For nearly two decades the duty to prevent illegal working stopped at the edge of the payroll. If someone was your employee you checked them, and if they were a contractor, an agency worker or someone found through a platform, the duty generally sat elsewhere or nowhere. That ends on 1 October 2026.

The Government laid the regulations on 30 June 2026, alongside a written ministerial statement confirming that the reforms "introduce, for the first time, an extension of the Right to Work Scheme and the associated civil penalties for non-compliance, to cover companies who contract workers or individual sub-contractors to provide services under their company name, such as agency workers or workers in the gig economy". The Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026 bring section 48 into force on 1 October 2026, described by the Home Office as being in line with the common commencement date for businesses.

This guide is written for the six weeks before that date. It sets out precisely what changes, who is caught and who genuinely is not, the transitional rule that most commentary is getting wrong, the three requirements you must meet to protect yourself against the new extended liability, and a practical plan to be ready. Our earlier article on the gig economy and construction changes covered the announcement, and our group has set out the position for gig economy and construction workers on the main WorkPermitCloud site. This one is about what to do.

The context matters too. Enforcement is running at record levels, with over £74 million in civil penalties issued to the end of June 2026, as our group covers in its analysis of immigration raids and £74 million in fines. A wider scheme arriving during a period of intensive enforcement is a combination worth taking seriously.

One note on status. The revised Code of Practice was published on 30 June 2026 and remains in draft, described as the seventh version of the code and stated to come into force on 1 October 2026. The commencement date for the underlying legislation is fixed by regulations, but you should check the published codes of practice for the final version before relying on the detail.

What Actually Changes on 1 October

The change is structural rather than procedural. The way you carry out a right to work check is not changing. What is changing is who you have to check and who can be held liable.

A wider definition of employer

Section 48 amends the Immigration, Asylum and Nationality Act 2006 and inserts a new section 14A. The effect is that references to a person employing another individual now also include:

• engaging an individual under a worker's contract;
• engaging an individual sub-contractor; and
• providing, through an online matching service, the details of an individual who is a service provider to potential clients or customers.

A worker's contract is defined as a contract, other than a contract of service or apprenticeship, under which an individual undertakes to perform work or services personally for another person, and where that person is neither a client nor a customer of any profession or business undertaking carried on by the individual. The Code notes that this definition is broader than the definition of worker in section 230(3)(b) of the Employment Rights Act 1996, so employment law categorisation is a guide but not a decisive answer.

A new extended liability

Section 48 also inserts a new section 15A, which allows civil penalty liability to extend beyond the employer holding the direct contractual relationship with the worker. This is the genuinely novel part of the reform and is covered in its own section below.

The Transitional Rule Most Commentary Is Missing

This deserves its own section because it changes the size of the job in front of you.

The Code states that in relation to employment under a worker's contract, as an individual sub-contractor, or in the case of an online matching service providing the details of a service provider to clients or customers, a civil penalty may only be imposed where the employment commenced on or after 1 October 2026. It confirms that this applies both to liability arising directly under section 15 and to liability arising under the extended liability provisions in section 15A.

In plain terms: the new duty bites on engagements that start on or after 1 October 2026. It does not reach back and impose a penalty in respect of a contractor who has been working for you since March. That is a meaningful relief for labour-heavy businesses, and it means your priority is your onboarding process rather than a frantic audit of everyone already on site.

Two important qualifications. First, this transitional protection applies to the new categories. For workers engaged under a contract of employment nothing changes, and liability has run since 29 February 2008 as it always has. Second, the Code also applies when determining liability where a repeat check on an existing worker is required on or after 1 October 2026 in order to retain a statutory excuse, so time-limited permissions still need following up in the ordinary way.

Who Is In Scope, and Who Is Genuinely Not

Getting this judgement right is the heart of the exercise. The Code is unusually clear, and it cuts both ways.

The Code then closes the obvious loophole. It states that the self-employment exclusion "does not include individuals who obtain work through an intermediary, platform, or similar arrangement where the individual is not operating an independent business in their own right". Describing someone as self-employed in a contract does not make them so. What matters is whether they are genuinely running their own business.

The other exclusion worth understanding is the end-user one. If you simply buy a service and do not pass it onwards under a contract to a third party, the extended liability provisions do not apply to you. A company that engages a cleaning firm for its own offices is in a different position from a facilities management business that subcontracts cleaning it has itself been contracted to provide.

Extended Liability: Penalised Without a Contract

Section 15A allows liability to be imposed on a business that has no direct contract with the worker. It applies in three defined situations:

1. Where a person is under a contract to provide work or services to a third party and enters into a contract with another employer who employs workers to carry out all or part of that work.
2. Where an online matching service matches a service provider with a client or customer, and the service provider then contracts with that client or customer.
3. Where an employer engages an individual and the contract permits that individual to substitute their work or services to another individual in their place.

In those circumstances, the person contracted to provide the work, the online matching service, or the employer in the case of a substitution clause, may be treated as employing any individual who personally provides the work or services.

It is a backstop, not the default

This is reassuring and often lost in the commentary. The Code says the Home Office will, in the first instance, seek to identify the employer who holds the direct contractual relationship with the worker. Extended liability operates "as a mechanism to ensure responsibility in cases of illegal working where that employer cannot be identified, or the prescribed requirements set out in this section have not been met".

Where the Home Office cannot identify the direct employer, or the prescribed requirements have not been met, liability may be imposed on another person upstream in the chain. In deciding whether to do so it will have regard to the nature of the contractual arrangements and the extent to which each party has complied with the prescribed requirements. Crucially, a person not in a direct contractual relationship will establish a statutory excuse where the prescribed requirements have been met in full and can be evidenced.

So the protection is available, but it is conditional and it is documentary. You must retain sufficient evidence of the steps taken and produce it on request.

The Three Prescribed Requirements

These are what you build between now and October. All three must be met in full.

1. Contractual terms and conditions (written statement)

Where you are contracted to provide work or services to a third party and then contract with another employer to deliver them, or where you run an online matching service, you must have a written statement in place before the work or service commences. It must set out terms requiring the other party to:

• conduct prescribed right to work checks on any individual employed to perform the relevant work or services;
• not further subcontract without your prior written consent, and to replicate equivalent right to work obligations in any permitted subcontracting;
• permit you to audit their compliance with prescribed right to work checks;
• enable you to take enforcement action where illegal working is identified and no statutory excuse has been established, which may include suspension or termination of the contract; and
• co-operate with any Home Office investigation, including by providing information about the purpose and make-up of the chain of contracts, and details of each employer or service provider involved such as official name, company type, registered address or principal place of business and company registration number.

The Code makes two further points. You may put in place arrangements to obtain assurance from others in the chain that checks have been carried out, provided you ensure the requirements are actually met. And the provisions are not limited to a single tier of contracting, so the obligations need to flow down the chain rather than stopping at your immediate counterparty.

2. Substitution controls

Where a contract permits substitution, you only obtain a statutory excuse where you have implemented, before the work commences, processes ensuring that:

• a prescribed right to work check is carried out on any substitute;
• responsibility for those checks is not delegated to the individuals carrying out the work, including where the contract describes them as operating in business on their own account;
• no individual works as a substitute before their right to work has been verified;
• contractual provisions exist, which may include suspension or termination, for where you or the worker know or have reasonable cause to believe a substitute is working illegally, including where the substitute has failed to comply with a request to complete a check; and
• throughout the engagement you ensure the worker and their registered substitute are the same individuals who were checked, using identity verification systems.

The Code offers a note of realism here. The Home Office will have regard to whether you implemented and maintained these processes in a reasonable and proportionate manner, including where substitution occurs without your knowledge or control, or where someone commits fraud to circumvent your checks despite suitable mitigations. Equally, where the controls do not reflect how the arrangement actually operates in practice, that will be taken into account against you. Paper processes that everyone ignores are worse than useless.

3. Identity verification

You must maintain proportionate systems and processes to ensure the person actually doing the work is the person who was checked. The Code suggests these may include:

• identity cards or workplace access passes;
• facial verification technology, including through registered Right to Work DVSPs;
• biometric or attendance management systems;
• verification against training records, qualifications or licences relating to the role; and
• re-verification of identity at set intervals, for example at the start of a shift or when a new assignment or task is allocated.

For sectors where a different person can plausibly turn up to do the work, this is the requirement that will demand the most operational change.

Digital Verification and the DVSP Rule

The ministerial statement confirmed that the regulations "introduce updated requirements for the use of digital verification service providers (DVSPs) mandating that when choosing to use digital verification for a right to work or right to rent check, that it must be carried out using government registered providers".

Read that carefully, because the nuance matters. Using a digital provider is not mandatory. The Code is explicit that employers and workers can still use the other checking methods. But if you do choose to use one, it must be a Right to Work DVSP registered on the Office for Digital Identities and Attributes register, with a note on the register confirming it can provide right to work checks. Registration for identity checks alone is not enough.

The consequence of getting this wrong is severe and explicit: the Code lists using the services of an unregistered DVSP, or a non-Right to Work DVSP, among the circumstances in which an employer will not have a statutory excuse. If you use a provider today, checking its registration status is a five-minute task that protects a £45,000 exposure.

Where facial recognition is used, the provider supplies a comparison verifying the document image against the individual, and you must retain that comparison alongside the output of the check. You must also give the worker a reasonable opportunity to verify their identity if the technology cannot match the images. Records are kept for the duration of the engagement plus two years.

What Has Not Changed

It is as important to know what you do not need to rebuild.

• The three checking methods are unchanged: a manual document check, a Home Office online check using a share code, or a check through a registered Right to Work DVSP. Our guides to right to work checks and share code checks remain current, as does our group's complete guide to right to work checks for UK employers.
• The Employer Checking Service continues for cases where a worker cannot provide documents or a share code, producing a Positive Verification Notice valid for six months, with the service aiming to respond within five working days.
• Penalty levels are unchanged at up to £45,000 per worker for a first breach and £60,000 for a repeat breach within three years, before mitigation. The objection and appeal routes are also unchanged, and our group explains them in its guide to challenging an illegal working civil penalty notice.
• The three mitigating factors are unchanged: reporting a suspected illegal worker and obtaining a Unique Reference Number reduces the penalty by £5,000 per worker, active co-operation reduces it by a further £5,000, and on a first breach effective right to work practices alongside both of those results in a Warning Notice rather than a fine. Our guide to illegal working civil penalties explains the framework.
• Checks must still be applied consistently to every worker to avoid discrimination under the Equality Act 2010.

Your Readiness Plan

With roughly six weeks to go, this is a sequencing problem rather than a research problem. The order below front-loads the work that takes longest.

Weeks one and two: map and decide

1. List every way labour reaches your business: employees, workers, individual contractors, agency staff, subcontractors, platform-sourced people and anyone engaged through an intermediary.
2. For each arrangement, decide whether it is in scope. Test the substance, not the label. Ask whether the individual performs the work personally, and whether they are genuinely running their own business.
3. Identify where you sit in any chain. Are you an end-user buying a service, or are you contracted to provide services onwards? The answer determines whether extended liability can reach you.
4. Flag every contract containing a substitution clause. These carry the heaviest new obligations.

Weeks three and four: paper and systems

1. Draft the written statement terms and get them into new contracts, covering all five required elements, and make sure they flow down beyond the first tier.
2. Design your substitution controls, including how a substitute gets checked before starting and who is responsible, which must not be the worker.
3. Choose your identity verification method and make sure it works at the point of work, not just at onboarding.
4. If you use a digital provider, confirm it is on the OfDIA register with the right to work note. If it is not, change provider or change method.

Weeks five and six: people and proof

1. Brief procurement, operations and site managers. Most of these decisions are made by people who have never thought about immigration compliance.
2. Set up your evidence trail now. The statutory excuse against extended liability depends on being able to produce proof of compliance on request.
3. Run a dry run: pick one contract chain and try to produce everything the Home Office would ask for.
4. Diarise a review for late October to catch what the first few weeks reveal.

Five Common Misconceptions

How Can WPC HR Help?

The practical difficulty with this reform is not understanding it, it is evidencing compliance across a workforce that no longer fits neatly on a payroll. The statutory excuse against extended liability depends entirely on being able to show what you did and when. WPC HR's HR compliance software records right to work and share code checks for employees and contractors alike with a dated, tamper-evident audit trail, tracks time-limited permissions and prompts follow-up checks, applies the same process consistently to every engagement so there is no discrimination risk, and keeps the evidence retrievable in seconds rather than reconstructed under pressure. If you would like a specialist to review how labour actually reaches your business and whether your arrangements would establish a statutory excuse, our Sponsor Licence Compliance Audit examines your workforce and gives you a prioritised plan before the deadline rather than after an enforcement visit.

📞 Call us: 020 8087 2343
📅 Book a free compliance audit: wpchr.co.uk/sponsor-licence-compliance-audit
🔗 See the platform: wpchr.co.uk/hr-compliance-software-features

Conclusion

The 1 October 2026 reform redraws the boundary of the right to work regime around the way people actually work. Personal service, not payroll status, is now the test, and liability can follow a chain of contracts rather than stopping at the first one. For businesses built on agency labour, subcontracting or platform models, that is a genuine change in exposure.

Two things should steady the nerves. The duty applies to engagements commencing on or after 1 October, so this is a forward-looking obligation rather than a retrospective audit. And the protection against extended liability is clearly defined: a written statement with the right terms, real substitution controls, and identity verification that works at the point of work. Do those three things properly, keep the evidence, and you have a statutory excuse.

Six weeks is enough time if you start with the mapping. Where you would rather have a system capture the evidence automatically and an expert confirm your arrangements hold together, that is exactly what WPC HR is built for.

Glossary