Extension of right to work checks beyond employees from 1 October 2026

Our previous blog highlighted that the UK Government had announced plans to extend the scope of right to work checks to a broader range of working arrangements than is currently the case. 

The Government has now responded to its consultation on extending the right to work regime and published draft updated versions of: (i) the Code of Practice on preventing illegal working; (ii) the Employer’s guide to right to work checks; and (iii) the Code of Practice for employers: avoiding unlawful discrimination while preventing illegal working. The changes will take effect from 1 October 2026.

Penalties for illegal working

All employers in the UK are subject to the preventing illegal working regime. If it transpires that you have employed someone who is not entitled to work in the UK in the capacity you have employed them:

• you could face a civil penalty;
• it will be a criminal offence if you knew or had reasonable cause to believe that the individual did not have the appropriate immigration status.

Conducting appropriate right to work checks gives you a defence against the civil penalty (known as a statutory excuse). Civil penalties are up to £45,000 per illegal worker for a first breach and up to £60,000 per illegal worker for a repeat breach. If an employer has a sponsor licence, being issued with a civil penalty could also result in the revocation of that licence (meaning that any sponsored workers must cease working for them).

What is the difference between the Code of Practice and the Employer’s guide?

The updated statutory Code of Practice on preventing illegal working (the Code) will apply when (i) determining liability for checks (including follow up checks); or (ii) calculating the penalty amount where the breach occurs on or after 1 October 2026. 

The Code is supplemented by the Employer’s guide to right to work checks (the Guidance), which was updated on 16 July 2026. This provides examples and guidance to employers on the new rules. 

New provisions on direct contractual relationships v extended liability provisions

There are two main areas of change that UK employers need to be aware of in relation to right to work checks. Firstly, there are a broader range of individuals who are in scope for right to work checks where there is a direct contractual relationship with a worker. Secondly, there may be liability for illegal working breaches for the first time in relation to non-direct contractual arrangements (referred to as ‘extended liability’ provisions).

Extension of right to work checks beyond employees where there is a direct contractual relationship

A key change is the expanded definition of 'employer' which is used in the Code in situations beyond a traditional direct employment relationship. From 1 October 2026 the illegal working legislation will apply where an organisation:

• employs an individual under a contract of employment (contract of service or apprenticeship);
• engages an individual under a worker’s contract;
• engages an individual sub-contractor; or
• operates an online matching service and provides details of an individual service provider to clients or customers.

The term ‘employer’ is used in the Guidance even where there is no employment relationship. ‘Worker’s contract’ also has a wide meaning - any non-employee contract whereby the individual undertakes to perform work or services personally for another person (whether or not that person is mentioned in the contract), and where that person is not a client or customer of any profession or business undertaking carried on by the individual. Examples in the Guidance include temporary agency workers, delivery platform workers and cleaners engaged through an online matching service.

The genuinely self-employed, operating an independent business and contracting directly or via a personal service company with clients or customers, will be excluded. Employers may need to consider those they engage on a self-employed basis to determine whether they are either in scope of this new definition of worker, or whether there is a risk of the self-employed contractor being misclassified. Where that happens, there could now be exposure to a civil penalty in some cases (as well as wider risks of misclassification under employment law).

Where the working arrangement allows the individual to supply a substitute, that substitute must also be checked before starting work. Where this applies, employers will now need to ensure that there is process for doing such a check.

These changes will apply where employment commences on or after 1 October 2026 and will mean that right-to-work checks will need to be caried out on a broader range of arrangements. The aim is to clamp down on illegal working in a wider part of the labour market including gig/platform work, zero-hours work, subcontracting, and intermediary or labour-supply arrangements. Please contact us for advice about how these new arrangements will apply to you.

Non-direct contractual arrangements and extended liability

A new concept of ‘extended liability’ will apply to non-direct contractual arrangements entered into on or after 1 October 2026, meaning that businesses higher up a contractual supply chain may become liable for civil penalties even where they do not directly engage the individual who is working illegally. This is a really significant change and the first time that this concept has applied.

When can liability be extended?

The Code and Guidance indicate that from 1 October 2026 liability can be extended to the following non-direct contractual relationships:

1. Where a person is under a contract to provide work or services to a third-party, and enters into a contract with another employer who employs the workers to carry out all or part of the work or services required to fulfil that contract (example 7 in the Guidance – chain of contracts to deliver construction work);
2. Where an online matching service matches a service provider with a client or customer to provide work or services, and the service provider enters into a contract with the client or customer (example 8 in the Guidance – online matching service for electrical services); or
3. Where an employer employs an individual to provide work or services, and the contract permits that individual to use a substitute to carry out the work or services in their place (example 9 in the Guidance – food delivery platform).

The “employer” who has the direct contractual relationship with the worker remains responsible for carrying out a right to work check and establishing a statutory excuse.

Where illegal working is identified, the Home Office will first try to identify the employer with the direct contractual relationship with the individual. If they cannot be identified (e.g. because of a lack of documentation or due to the number of intermediaries), the Home Office will consider the contractual arrangements and may impose a civil penalty on another entity ‘upstream’ in the chain of contracts in relation to the works / services.

The Home Office may consider the following factors when deciding whether to extend liability: the structure of the contractual arrangements; the role each person performs; which person is responsible for providing or arranging the work or services; what contractual arrangements were in place; whether those requirements operated effectively in practice; and the evidence available at the time illegal working was identified.

Who is not in scope?

The Code states that the provisions on extending liability to non-direct contractual arrangements “do not apply to persons who act solely as end-users, clients or customers of a service, or who commission or purchase work or services, where they are not under a contract to provide those work or services onwards to a third party as part of a chain of contracts”. Therefore, if an organisation is not part of a chain supplying work/services to a third party but is instead the end-user (for example they are using agency workers for their own purposes or purchasing a service for their own use e.g. a retailer contracting with a facilities management company to provide cleaning services) they will not be responsible for carrying out right to work checks and should not be exposed to the extended liability provisions. See scenarios 11-14 in the Guidance for examples of contractual arrangements not in scope for extended liability.

Statutory excuse against extended liability: what are the so called ‘prescribed requirements’?

A person who is not in a direct contractual relationship with the worker will however be able to establish a statutory excuse against extended liability for a civil penalty where the “prescribed requirements” (set out in both the Code and the Guidance) have been met in full and can be evidenced. They include the following (however note that this is a summary only – contact us for more information):

• Contractual terms and conditions (written statement) (applies to scenarios 1 and 2 above only): The employer/online matching service must have a written statement in place with the other employer/service provider before the work or service commences, and that statement must include specific terms and conditions as set out in the Code under 'Contractual terms and conditions (written statement)' including requiring the party they are contracting with to conduct right to work checks on any individual performing the relevant work/services; preventing further subcontracting without consent; and permitting audits and enforcement action, and requiring co-operation with the Home Office, in relation to right to work compliance.
• Substitution controls (scenario 3 above only, see the 'Substitution controls' section of the Code): The employer must carry out a prescribed right to work check for any substitute (who can’t carry out work or services before their right to work is verified). Also, the Code states that responsibility for right to work checks cannot be delegated, and it must be possible to suspend or terminate the contract if you know / have reasonable cause to believe that the substitute is working illegally.
• Identity verification systems and processes (all of the above, see the 'Identity verification' section of the Code): There must be ‘proportionate’ systems and processes in place to ensure the individual carrying out the work or services is the same person on whom a right to work check has been conducted (e.g. via workplace passes, facial verification, biometric or attendance management systems). Identity verification must be at set intervals – the Home Office recommends that this should be at least once in any 24-hour period or shift of work.

From 1 October 2026 there will be new focus from the Home Office on contractual chains, substitutions, and identity verification particularly for businesses using contractor and subcontractor arrangements, supply chains, gig economy platforms etc. Having the correct processes and supporting documentation in place will be key to compliance. 

In relation to direct contractual arrangements a civil penalty will only be imposed where the ‘employment’ commenced on or after 1 October 2026. Employment in this context covers engagement under a worker’s contract, engagement as an individual sub-contractor or, in the case of an online matching service, providing details of a service provider to a client.

In relation to non-direct contractual arrangements, a civil penalty under the extended liability provisions and the need to comply with the prescribed requirements will only apply where the contractual arrangements are entered into on or after 1 October 2026.

What does the revised Code of Practice for employers on avoiding unlawful discrimination while preventing illegal working say?

The Code of Practice for employers: avoiding unlawful discrimination while preventing illegal working has also been updated to factor in these new changes. This revised Code is relevant for employers across the whole of the UK and applies to all “employment” (noting the wider definition as mentioned above) commencing from 1 October 2026 (or repeat right to work checks after that date).

The Code recommends that right to work checks are undertaken consistently by “employers” on all workers including British Citizens – this will usually involve carrying out the same checks at the same stage of the process and not making assumptions about a worker’s ability to work.

The Code also recommends not treating applicants less favourably due to them having time-limited permission to work or stay in the UK.

Digital checks

When using a Digital Verification Service Provider for right to work checks, or facial recognition technology as part of the identity verification process, the provider will have to be a registered Right to Work Digital Verification Service Provider (details of the register can be found here). Use of an unregistered provider will not establish a statutory excuse.

What steps can we take to prepare?

• Audit your current workforce to ascertain which workers and labour arrangements might be caught by the new right to work regime.
• Identify what process to use for right to work check purposes. Many businesses now use Digital Identity Service Providers to undertake checks on British and Irish nationals. Such checks might be faster / more efficient for short-term engagements and may facilitate checks being carried out remotely for some workers. If using a digital service, ensure that it is registered.
• Audit your right-to-work policy and your recruitment and documentation retention processes.
• Review your contractual arrangements with third parties e.g. agencies, subcontractors and service providers who provide workers/employees pursuant to services that you provide to a third party. This is to ensure that responsibility for compliance with right to work checks (and the prescribed requirements) is allocated.
• Check your contracts for substitution clauses and put processes in place to ensure that a substitute has the right to work before they start working for you.
• Review systems and processes in place relating to the identity of workers provided by third parties (or via substitution) and ensure that they are the same person that a right to work check has been done on (for example, work access passes, attendance management systems).
• Ensure that you are able to evidence compliance with the relevant requirements – audit your contractual arrangements, records, assurance information, compliance reviews etc.

Webinar: Sweeping changes to right to work checks from 1 October 2026 – what HR need to know 

We ran a webinar on 3 September 2026 which focused on the upcoming changes and explained what they mean in practice: watch here. 

For further detail on any of these changes, or to discuss right to work checks generally, please contact Elaine McIlroy, Erin McLafferty or Gregor Craig-Murphy from Brodies Employment and Immigration team.

This blog was first published on 19 August 2026, and then updated in line with the revised Home Office guidance published on 11 September 2026.