The UK's right-to-work regime changed in a way that affects far more businesses than many realise. As of 1 October 2026, compliance obligations extend well beyond traditional employees to recruitment agencies, staffing businesses, and any organisation that uses contractors, agency workers, platform-based workers and or subcontracting arrangements to get work done. For the recruitment sector, where these ways of working are the norm rather than the exception, now is the time to act.
In brief
- A wider definition of "employment" brings workers' contracts, individual subcontractors within contracting chains, and online matching platforms within scope of the illegal working regime for the first time.
- Liability now travels up the supply chain: where a worker at the bottom of a subcontracting chain lacks the right to work, every business in that chain may be exposed to civil penalties, even without a direct contractual relationship with the worker.
- A new extended statutory excuse is available but demands significant compliance effort: businesses must have the right contractual terms, substitution controls, and identity verification systems in place before any work begins. Failing to meet even one prescribed requirement may leave the business without a defence.
- Digital verification providers must now be specifically authorised for right to work checks on the Office for Digital Identities and Attributes register — general identity verification authorisation alone is not sufficient.
- This is no longer just an HR issue: procurement, legal, operations, and supply chain functions all carry direct compliance implications and must be engaged in a coordinated response as of 1 October 2026.
The background
The starting point remains unchanged: under section 15 of the Immigration, Asylum and Nationality Act 2006, it is unlawful to employ someone in the UK who does not have the right to work here. If an employer conducts a compliant right to work check and that check is properly carried out, they will obtain a statutory excuse. This means that if it later transpires that the worker did not have the right to work, the employer cannot be penalised, provided the check was done correctly.
What has changed is not that core principle, but rather who it applies to.
Section 48 of the Border Security, Asylum and Immigration Act 2025 significantly expands the categories of working arrangement caught by the illegal working regime, extending beyond traditional employee-employer relationships.
This provision came into force on 1 October 2026.
In short: the rules as to what constitutes a compliant check remain broadly the same, but the universe of businesses required to conduct those checks - and exposed to liability if they do not - has grown considerably.
Importantly, these changes apply only to contractual arrangements entered into on or after 1 October 2026. There is no statutory obligation to amend existing contracts that pre-date this date. Nevertheless, businesses should consider reviewing their current agreements as a matter of best practice to ensure alignment with the new requirements and to help minimise any ongoing compliance risk.
What is changing
A wider definition of "employment"
As of 1 October 2026, the scope of 'employers' who may be subject to an illegal working penalty expanded to include not only those who employ an individual under a contract of employment, but also those who:
- Engage an individual under a 'worker's contract': these cover individuals providing work or services to a business under a contract that does not amount to a contract of employment but nonetheless involves a degree of personal service and subordination to the engaging party. Genuinely self-employed professionals who contract directly with their own clients fall outside of this category. The distinction is important, as it is the nature of the relationship, not the label applied to it, that determines which category applies.
- Engage an 'individual subcontractor' within a contracting chain: where an individual is engaged as part of a chain of contracts, with each party having been contracted by another to deliver the same or related work or services. In practical terms, this means that where a business engages a subcontractor, and that subcontractor in turn engages its own subcontractors, the business at the top of the chain may be exposed to liability in respect of a worker at the bottom of that chain, even where no direct contractual relationship exists between them. This may be problematic to apply in practice, and businesses should review supply chains and procurement processes and seek advice where required.
- Operate an 'online matching service: businesses that connect individual service providers with clients or customers, including gig economy platforms, will now be treated as employers for these purposes. This extends to any substitutes the service provider is permitted to use under their arrangements.
For example, a worker registered with a recruitment agency that supplies temporary staff to bars and restaurants, engaged by the agency under a contract for services and accepting short-term hospitality assignments, as and when offered, would fall within the "worker's contract" category. In these circumstances, the recruitment agency would be the organisation responsible for conducting the right to work check.
Who is not in scope
Genuinely independent self-employed professionals who contract directly with their own clients, without any supply chain, platform, or intermediary involvement, are generally outside the scope of the new regime, provided the arrangement is correctly classified and is truly arm's-length in nature. Importantly, a business that simply purchases services from such a provider does not, by virtue of that transaction alone, become liable under the extended regime.
The word "genuinely" is significant here. The classification of a working arrangement will be scrutinised on its actual characteristics, not merely on how it is labelled. An arrangement described as independent self-employment but which in practice exhibits the features of a worker's contract or subcontracting arrangement may fall within scope regardless of the label applied to it.
It is crucial to note that, for the recruitment sector, standard agency supply arrangements fall outside the extended regime. Where an employment business directly engages agency workers and supplies them to a hirer's own operations, the employment business remains responsible for conducting the right to work check. The new provisions apply only where a business forms part of a contracting chain that provides work or services onwards to a third party, not where it is simply sourcing workers for use within its own operations.
Liability travelling up the supply chain
This is arguably the most consequential change. Under the previous rules, civil penalty liability for illegal working was tied to the business with the direct employment relationship. The new rule breaks that link. In practical terms, this means:
- In a subcontracting chain, if Company A subcontracts work to Company B and Company B's workers do not have the right to work, both Company A and Company B may be liable. This will also extend further down the chain to Companies C, D, and E. No business in the chain is automatically insulated simply because it does not directly employ the workers.
- Where an online matching platform (Company A) connects a service provider (Company B) with a client, both the platform and the service provider may face liability if Company B's workers lack the right to work.
- In substitution arrangements, if a worker is replaced by a substitute under a contract that permits substitution, the engaging business may be liable for that substitute's right to work, even if it has no direct contractual relationship with the substitute at all.
The Employers' guide indicates that extended liability is most likely to be triggered where the Home Office cannot identify the business that has a direct contractual relationship with the worker in question. However, the practical effect is that every business within the chain remains exposed so long as that party cannot be identified. This places a significant premium on contractual due diligence and supply chain visibility.
Establishing a statutory excuse under the new rules
The statutory excuse framework remains in place for businesses that directly employ workers in the traditional sense. Provided a compliant right to work check is carried out before employment commences, the employer will have a statutory excuse against any civil penalty if it later emerges that the worker did not have the right to work.
For the new categories of arrangement caught by the extended liability provisions, such as subcontracting chains, substitution arrangements, and online matching platforms, a separate statutory excuse is available. However, it is important to understand that this excuse is not automatic. It is available only where a business satisfies all of the prescribed requirements set out below, and those requirements must be met before work begins. Failing to meet even one of them may leave the business without a defence to a civil penalty.
The three areas in which prescribed requirements must be satisfied are as follows:
- Contractual terms: Before work commences, a written agreement must be in place between the parties. This agreement must incorporate five mandatory provisions. In broad terms, these require the other party to carry out right to work checks, prohibit further subcontracting without prior written consent, and ensure that equivalent right to work obligations flow down through any permitted subcontracting arrangements. The intent is to ensure that compliance obligations do not fall away as work passes further down a contracting chain. For recruitment businesses, this means that terms of business with clients and engagement terms with workers alike will need to incorporate the prescribed provisions. Standard industry template terms should accordingly be reviewed against the new requirements to ensure they remain fit for purpose.
- Substitution controls: Where a contract permits substitution, that is, where one worker may be replaced by another to carry out the same work, several mandatory process requirements must be implemented before any substitution takes place. They include ensuring that a (i) right to work check is conducted for any substitute worker, (ii) that the responsibility for carrying out those checks cannot be passed to the workers themselves, and that (iii) no substitute may begin work until their right to work has been positively verified.
- Identity verification: Businesses must have proportionate systems in place to ensure that the individual who carries out the work is the same person whose right to work was checked. This is designed to prevent scenarios where checks are conducted on one individual, but the work is performed by another. The draft Employers' guide identifies five acceptable methods, including identity cards, workplace access passes, facial verification technology, use of registered digital verification service providers, and periodic re-verification of identity at set intervals.
The new extended statutory excuse is a meaningful protection, but it comes with a significant compliance burden. Businesses must have the right contracts, the right processes, and the right verification systems in place, all before any work starts.
Digital checks: new requirements
Where a business uses a digital verification service provider to conduct right to work checks, and wishes to rely on those checks to establish or maintain a statutory excuse, it must, as of 1 October 2026, ensure that the provider it uses meets two distinct requirements:
- The provider must be registered on the Office for Digital Identities and Attributes register; and
- The provider must be specifically authorised for right to work checks, not merely authorised for general identity verification purposes.
The distinction between the two is important. A provider may be registered on the register and authorised to carry out identity checks in a broader sense, but that alone will not be sufficient. The authorisation must extend specifically to right to work purposes. Businesses that currently use a digital verification provider should therefore confirm - with that provider directly if necessary - that their authorisation covers right to work checks specifically. If it does not, arrangements to switch to a compliant provider should be made (It is worth noting that many background-checking organisations subcontract the digital verification function to a registered and authorised provider, so the position may not always be immediately apparent from the existing contractual arrangements).
In a welcome and practical development, British and Irish passports (and Irish passport cards) are now accepted for digital identity verification checks up to six months past their expiry date.
Penalties
The civil penalty framework remains in place and continues to carry significant financial consequences. A business found to have employed a worker without the right to work may face a penalty of up to £60,000 per illegal worker. For businesses that have previously been penalised and have failed to remediate, repeat breaches may attract even higher penalties. Conducting a compliant right to work check and being able to demonstrate that it was carried out correctly, provides a statutory excuse and protects the business against such a penalty, even if it later transpires that the worker did not in fact have the right to work.
Beyond civil penalties, criminal liability may arise where there is reasonable cause to believe that a business knew, or had reasonable grounds to believe, that illegal working was taking place. This is a higher threshold than mere non-compliance, but the consequences are considerably more severe. Criminal liability can result in unlimited fines and, for individuals within the business, such as directors, managers, or those with oversight responsibility, the risk of custodial sentences. This means that personal liability for senior individuals is a real consideration, not merely a theoretical one.
Why this is no longer just an HR issue
Perhaps the most important message to take from the breadth of these changes is that immigration compliance can no longer be treated as the sole responsibility of the HR or compliance function. For recruitment businesses in particular, the extension of the regime means that the decisions made by procurement, commercial teams when structuring client engagements, by operations when managing worker supply, by legal when drafting contracts, and by supply chain teams when managing contracting overseeing subcontracting arrangements all carry direct compliance implications.
Each of those functions now has a role to play in ensuring the business is protected. Recruitment businesses that continue to treat right to work compliance as an HR administrative task, without engaging the wider organisation, are likely to find themselves exposed, particularly in multi-tiered staffing arrangements where the risk of extended liability is greatest.
Next steps
We recommend the following steps to ensure that your company is prepared ahead of the change's introduction:
- Conduct a 'census' i.e., identify all categories of workers engaged by the business, including employees, contractors, agency workers, subcontractors and platform workers. Compare these arrangements against the revised definitions in the Code of Practice to determine which relationships fall within the expanded regime and where liability may arise. This assessment will also inform subsequent policy updates and staff training.
- Review template agreements, including terms of business, client contracts, and subcontractor agreements, to include the contractual provisions needed to support a statutory excuse under the new rules, including where subcontracting, substitution or online matching arrangements apply. Existing contracts should also be reviewed to identify and manage potential compliance risks.
- Revise right to work policies and procedures to reflect the new legal framework. Continuing to rely on existing policies after 1 October 2026 that date may expose the organisation to civil penalties.
- (if applicable) Check if digital identity service provider is registered on the Office for Digital Identities and Attributes register and authorised to carry out right-to-work checks. If checks are outsourced through a background screening provider, verify that any subcontracted verification services also meet these requirements.
- Train staff responsible for conducting right to work checks on the expanded scope of the regime, the new worker categories, and the requirements for establishing a statutory excuse.
- Review your procurement processes to determine whether third party vendors you engage with are compliant and/or will be able to assist you maintain compliance with the changes.
- Seek legal advice to review all the above for surety that you will be compliant.
The changes now require a coordinated response across procurement, legal, operations and HR functions. For recruitment businesses, compliance should be treated as an ongoing obligation rather than a one-time exercise, and organisations are advised to keep their arrangements under regular review as further guidance emerges.
Please note that this article is for general information purposes only. It cannot be relied upon and does not constitute legal advice.
For further information contact: