Right to Work Records for Contractors: The Files, Process and Training HR Needs

Key Takeaways

• From 1 October 2026 the Right to Work Scheme reaches individuals engaged under a worker's contract, individual sub-contractors and people matched to customers by an online matching service. Section 48 of the Border Security, Asylum and Immigration Act 2025 was commenced by SI 2026/683 and the prescribed requirements sit in SI 2026/700.
• Only the guidance is still draft. The Employer's guide to right to work checks was republished in draft on 11 September 2026 and comes into force on 1 October 2026. The duty is confirmed law; the explanation of it is not.
• Scope and records are two different jobs. Our sister firm WorkPermitCloud has published the classification question in full. This post covers what HR builds, files and trains people on once the answer is yes.
• The substance test should produce a dated document. The draft guidance sets out eight assessment factors and says no single one is determinative, so the record to keep is an engagement type assessment naming the assessor, the contract terms and how the arrangement actually operates.
• The written statement required by the new article 5B of the Immigration (Restrictions on Employment) Order 2007 is a separate document that must exist before work starts, not a clause in a contract. It must require five terms in your supplier contract, including a ban on further subcontracting without your written consent.
• Substitution is a rolling record, not an onboarding task. The guidance expects a check on every substitute, records showing each substitution was authorised through your process, and records identifying who actually did the work and for what period.
• Identity re-verification now has a recommended frequency: at least once in any 24-hour period or shift of work, proportionate to the risk of substitution or impersonation.
• A facial recognition check creates its own two-year record. Where a registered provider carries one out, you must obtain copies of both facial images in an unalterable format and the provider's confirmation that they match, and retain them for at least two years after the employment ends.
• Three retention clocks now run side by side: right to work copies for the engagement plus two years then secure destruction, Appendix D sponsor records on a shorter timetable, and the contractual and audit evidence behind extended liability, for which nothing is prescribed.
• Delegation is confirmed and so is your liability. The 11 September 2026 draft clarifies that checks may be delegated to staff, workers and agency workers under your control, and that you remain liable if a check was not carried out as prescribed, which makes the training record part of your evidence. WPC HR's HR compliance software holds contractor and employee checks in one dated, tamper-evident record, and our sponsor licence compliance audit tests whether those files would stand up.

Introduction

There are just over two weeks left. On 1 October 2026 the Right to Work Scheme stops ending at the edge of the payroll, and businesses that engage contractors, sub-contractors, agency labour and platform workers become responsible for a population they have never had to evidence. Most teams have spent the summer on whether a given engagement is caught. Far fewer have worked out what the file looks like afterwards.

That second question decides the civil penalty. A statutory excuse is not a state of mind or a sensible policy. It is a set of documents you can produce, dated correctly, showing that the right thing happened before work started and kept happening after. The draft guidance says as much: a business relying on extended liability "should not rely on contractual terms alone" and must show that arrangements are "operating effectively in practice".

One point on status, because it is where most commentary goes wrong. The Act and the regulations are confirmed law. Section 48 has been commenced for 1 October 2026, and the prescribed requirements were made on 24 June 2026 and laid before Parliament on 30 June 2026. The Employer's guide is the only part still in draft, republished on 11 September 2026. If the final guide differs, what changes is the explanation, not the obligation.

This guide covers the operational side: logging the substance test against a real contract file, the written statement as a document HR keeps rather than a clause legal drafts, how substitution and identity records get written on a rolling basis, who owns each part between HR, procurement and legal, how it sits alongside Appendix D record keeping, and what staff need to be trained on.

Is This Engagement in Scope? One Paragraph, Then the Records

The classification question is real and not trivial. Section 48 inserts a new section 14A into the Immigration, Asylum and Nationality Act 2006, bringing three further arrangements into the meaning of employment, and a new section 15A letting penalty liability reach a business with no contract with the worker at all. Against that sits a carve-out for individuals running an independent business who contract directly with clients. Our sister firm WorkPermitCloud has set out the classification test, the carve-out and the extended liability mechanics in full, so we will not repeat them here.

Two of our own posts sit either side of this one. The gig economy and construction guide covers sector exposure, and our readiness guide to 1 October 2026 covers the transitional rule and the plan to the deadline. This post starts where they stop, at the filing cabinet, and assumes the answer on scope is yes.

What Is Confirmed, What Is Still Draft, and What Each One Governs

HR teams are being asked to build a process against a moving set of documents, and it helps to know which document does what. Two of the six below create obligations. The rest explain them or price the consequences.

You can therefore build against the regulations with confidence today. The parts most likely to move are the worked examples, the assessment factors and the identity verification recommendations, because those are guidance rather than prescription and have been redrafted once already. The retention periods, the written statement terms and the substitution rules sit in the regulations and will not move.

Logging the Substance Test Against a Real Contract File

Assess the engagement type, not the individual

The most common mistake in early contractor compliance projects is running the assessment person by person. It does not scale, produces inconsistent answers for people on identical terms, and invites the discrimination risk the revised code warns about. Assess the engagement type instead, meaning the template, the supply route and the operating model. One assessment then covers everyone engaged on those terms.

The draft guidance is explicit that labels do not settle it: "Consideration should be given to the substance of the arrangements and how they operate in practice. The contractual description or label adopted by the parties involved will not, by itself, determine what responsibilities may arise under the Scheme." Your record therefore has to capture two things for each factor, what the paperwork says and what actually happens. Where they diverge, the second is what gets assessed.

The eight factors, and what to write against each

The guidance lists eight factors and states that no single one is determinative. Turned into a record, they give you a workable assessment form. The middle column is the part most teams miss.

What the assessment record should contain

The header matters as much as the analysis. Six fields carry the weight: the engagement type and contract template, the date, the name and role of the assessor, the conclusion in one line, the basis for it, and the review trigger. A conclusion without a date is worth little when the question is whether you had taken reasonable steps at the time illegal working was found.

Keep the conclusion to one of four outcomes, because ambiguity spreads downstream. In scope, direct check required. Out of scope, independent business. Extended liability applies, prescribed requirements needed. Or unresolved pending advice, with a named owner and a date. The fourth is better than a confident guess, provided it does not sit there for six months.

When the assessment has to be redone

Treat the assessment as living. Four events should trigger a fresh one: a change to the contract template, a change to how the work is resourced, a new tier in the chain, and a reissue of the Employer's guide.

The Written Statement as a Document HR Keeps

What it is, and when it has to exist

This is the part of the reform most likely to be mishandled, because it looks like a legal task and gets treated as one. Article 5B of the 2007 Order, inserted by SI 2026/700, requires that before the work commences the upstream party "has produced a written statement which requires the following terms to be included in the contract" with the supplier. The statement is a document in its own right, not the contract, and it is not satisfied by the contract eventually containing the right words.

Two consequences follow. It must be dated, and that date must precede the start of the work, including work by a substitute. And because it is a document rather than a clause, somebody has to own the file it lives in. Legal produces the template and moves on, procurement's record is the contract, and it is HR or compliance that will be asked to produce it.

The five terms, and what the file needs to show for each

The guidance sets the terms out as a list of five. Read against the regulation the fourth carries two obligations, so it is worth splitting in your own records.

Assurances, and the reasonable steps behind them

You may rely on a supplier telling you the checks have been done, "provided that they have taken reasonable steps to satisfy themselves that those assurances are reliable". The load-bearing words are the last nine. An annual signed declaration with nothing behind it is an assurance with no reasonable steps attached.

What reasonable steps look like varies with the size and complexity of the chain. A sensible minimum is a dated assurance naming the population it covers, a sample verification against a few individual check records, and a note of what you did when something did not match. The guidance lists "information showing how concerns were identified and acted upon" among the things you may be asked for, which tells you it expects that second half to exist.

The audit right nobody exercises

Term three is the one that quietly fails. Audit rights get drafted, signed and never used, and an unexercised audit right is evidence of a clause rather than of a system. Decide at the point of contract who owns the audit, how often, and what a failure triggers.

Substitution Records on a Rolling Basis

Substitution is why a contractor file cannot be a static onboarding pack. Where a contract permits it, article 5B requires processes, in place before work commences, ensuring a prescribed check on any substitute, that the check is not delegated to the individual doing the work, that no substitute works before verification, that enforcement provisions exist against the worker, and that for the duration of the engagement the worker and their registered substitute remain the individuals whose right to work was checked.

That last requirement is continuous, so the record has to keep being written. The guidance sets out seven types of evidence you may be asked for, and almost all are generated during the engagement rather than at the start.

One line deserves its own note, because it changes who can be given the task. Responsibility for the check on a substitute "is not delegated to individuals carrying out the work or services, including where the contractual arrangement describes that individual as operating in business on their own account". A platform that asks a rider to verify their own replacement has not met it.

When substitution was never permitted and happens anyway

If your contracts forbid substitution and someone sends a stand-in regardless, extended liability is not the mechanism that catches it. The guidance says the Home Office will consider whether a prescribed check was carried out on the worker directly engaged, and points to its material on impersonation. This is an identity failure rather than a substitution failure, and the answer is the same: a record of who was actually on site, and of what you did when you found out.

Identity Re-verification and the Evidence Behind It

The third prescribed requirement is proportionate systems and processes ensuring that the individual carrying out the work is the individual who was checked. Systems should match the nature of the work, the level of risk and the contractual arrangements, so a firm with a handful of named consultants and a multi-site labour supply operation are not expected to build the same thing.

What the systems can be

The guidance names five: identity cards or workplace passes, facial recognition through a registered provider, biometric or attendance management systems, checks against training records, qualifications or licences, and re-verification at set intervals. Most organisations already run two of those for other reasons. The work is usually not buying a system but connecting an existing one to the right to work record, so the two can be produced together.

On frequency the guidance gives a number. Re-verification "may include when a worker starts a period or shift of work or when they have requested, or are allocated, a new piece of work or job role", and "the Home Office recommends that this occurs at least once in any 24-hour period or shift of work". It adds that the frequency should be proportionate to the risk, and that equivalent assurance through other controls is acceptable. Treat 24 hours as the benchmark you depart from with a written reason.

You may rely on another party's systems in the chain, "provided that they have taken reasonable steps to satisfy themselves that those systems are effective". Record what you did to satisfy yourself, because the reliance is only as good as the step behind it.

The facial recognition record that must survive two years

SI 2026/700 adds a retention obligation that is easy to miss, because it sits inside the digital verification amendments rather than the contractor provisions. Where a registered provider conducts a facial recognition check, the employer must obtain copies of the facial image from the document and of the person "in a format that cannot subsequently be altered", obtain confirmation that the images are of the rightful holder, and "securely retain clear copies of those images and that confirmation for a period of not less than two years after the employment has come to an end".

Two points sit with it. If you rely on digital facial recognition to satisfy the identity element of a manual or online check, it must be provided by a registered provider. And you must obtain two separate confirmations from that provider: that it is registered with a note that it provides right to work services, and that the services comply with the right to work supplementary code. Both confirmations are records. File them with the check, not the procurement contract. Our guide to share code checks covers the online route these sit alongside.

Retention: Three Clocks Running at Once

Most HR retention policies were written for one of these clocks and quietly apply it to all three. That is how sponsors lose files they were required to keep and keep files they were required to destroy, both of which are findings.

One formatting rule is worth repeating, because it invalidates otherwise good files. You must retain a secure record of the date the check was conducted, and the guidance says in terms that "simply writing a date on the copy document will not be sufficient as it does not, in itself, confirm that this is the actual date when the check was undertaken". The wording it gives is: "The date on which this right to work check was made: [insert date]". A system-generated timestamp does the same job better, because it cannot be back-dated.

For sponsors, the interaction with Appendix D record keeping is the part to get right first. Sponsored workers already sit inside a structure the Home Office inspects. Contractors now sit inside a different one, with a longer retention period and different evidence. Keeping both in one system with two retention rules is straightforward. Keeping them in two systems with one policy is where files go missing.

Who Owns This: HR, Procurement or Legal

Contractor right to work compliance fails at the seams between departments rather than inside any one of them. Legal drafts terms and does not see how the arrangement runs. Procurement onboards the supplier and does not hold the statutory excuse. HR holds the excuse and does not sign the contract. Nobody owns the audit. The value of the allocation below is less in the allocation itself than in leaving no row unowned.

Two rows get argued over. The written statement sits with HR or compliance rather than legal, because the obligation is to have produced and retained a dated document before work starts. Checks on substitutes sit with whoever authorises the substitution, because the timing requirement is absolute: no substitute may work before verification, and a request routed to a central HR inbox on a Friday evening will not meet it.

Training the People Who Actually Carry Out the Checks

The 11 September redraft put delegation beyond doubt, and in doing so made training an evidential matter. Responsibility for a check "may be delegated to individuals or members of staff acting on behalf of the employer, including workers, agency workers, or others working under the employer's control". The guidance then closes the loop: "the employer will remain liable for a civil penalty in the event the individual is found to be working illegally, and the check has not been carried out as prescribed".

Who needs training, and it is wider than HR

List the people who will physically look at a document or a share code output from 1 October. In a business with contractors that list runs well beyond HR: site and depot supervisors, agency liaison staff, platform operations teams, anyone who authorises a substitution or issues a site pass, and any third party acting under your direction. Each can create or destroy a statutory excuse.

What the training has to cover

Six things, and the sixth gets left out most often. The three prescribed check types and when each applies. The date declaration rule and the copy rule, in the exact wording. What to do when a document does not match the person in front of you. The substitution rule, including that the check cannot be handed to the worker. The escalation route, and who can stop work. And consistency: checks applied to everyone in an engagement type, including British citizens, regardless of nationality or perceived immigration status.

That last point is not a soft skill. The revised code of practice on avoiding unlawful discrimination takes effect on the same date and is explicit that employers should not "only conduct right to work checks on those who they consider are more likely to be migrants". Compensation in a tribunal claim has no upper limit. A business that responds to 1 October by checking only the contractors it feels uncertain about creates one exposure while closing another.

What the training record should show

Four fields make a training record useful in an investigation: who attended and their role, the date, the version of the guidance they were trained on, and a competency sign-off rather than attendance alone. Add a refresh trigger tied to the reissue of the Employer's guide, so the final version landing on 1 October produces a dated update rather than nothing.

What You Would Be Asked to Produce

The evidence lists in the draft guidance amount to a document request, and together they give one test for whether the project is finished: could you produce all of it, for a named engagement type, within a working day. That means the contracts and substitution terms, the dated written statement, audit records and findings, assurances received and the steps behind them, the checks and authorisations for substitutes, the record of who did the work and when, the identity verification evidence, and proof that you acted where substitution happened outside the process. Our guide to Home Office compliance visits sets out how the request usually arrives.

Penalty levels in the revised draft code are unchanged at up to £45,000 per worker for a first breach and £60,000 for a repeat breach, before reductions. If a notice has already been issued, our guide to illegal working civil penalties sets out the calculation, the mitigating factors and the deadlines.

How Can WPC HR Help?

The work in front of most HR teams before 1 October is not complicated, but it is wide, and it produces records that must be held consistently across populations currently living in different places. WPC HR's compliance software keeps employee, sponsored worker and contractor checks in one structure, with system-generated dates that cannot be back-dated, separate retention rules for right to work and Appendix D records, expiry alerts, and a tamper-evident audit trail.

If you would rather test the position before the deadline than after it, our sponsor licence compliance audit reviews contractor and supply chain files the way a compliance officer would: whether assessments are dated and evidenced, whether written statements exist and pre-date the work, whether substitution and identity records match how the arrangement runs, and where the retention policy is applying the wrong clock. Where the question is still whether an engagement is in scope, our sister firm WorkPermitCloud's right to work check service covers the classification and the checks.

Get in touch with our team via our contact page.
📞 Call us: 020 8087 2343
📅 Book a free compliance audit: wpchr.co.uk/sponsor-licence-compliance-audit
🔗 See the platform features: wpchr.co.uk/hr-compliance-software-features

Conclusion

The reform that lands on 1 October 2026 is usually described as an extension of right to work checks. For an HR team it is better understood as an extension of right to work records. The check has not changed. What has changed is the number of people it applies to, the number of documents that must exist before work starts, and the fact that several of them are continuous.

Three things are worth doing this month if nothing else gets done. Write a dated assessment for each engagement type, so your position on scope is evidenced rather than assumed. Produce the written statements for arrangements that need them, dated before the work starts. And name an owner for every row in the ownership table, particularly the audit right.

The Act and the regulations are settled. The guidance is still draft and will be reissued, so build against SI 2026/700 and treat the guidance as the Home Office telling you how it will read your files. On that reading, the file is the excuse. There is nothing else to produce. Our free right to work check tool and free HR compliance audit tool are a reasonable place to start before the deadline.

Glossary