UK right to work regime expands on 1 October 2026: what businesses should do now

From 1 October 2026, the Right to Work (RtW) regime expands beyond traditional employment to include worker contracts, individual sub‑contractors, and online matching services.

This critical shift means civil penalties of up to £60,000 per illegal worker may extend beyond the direct employer and, in some circumstances, up the supply chain.

To reduce this risk, employers should identify which non-traditional workers will be affected by the expansion, and in some cases, the employer may decide to carry out checks as a precaution, even where the scope is uncertain. Particularly where there is potential that an individual’s status may have been incorrectly assessed prior to or in light of the changes.

The expansion of extended liability should be a primary focus for organisations preparing for the new regime. Those who face extended liability will need to put in place written contractual terms, check the right to work for substitutes, and implement proportionate identity verification checks. They will need to ensure that the next party in the chain is also checking and monitoring for illegal working.

The Home Office has published draft RtW guidance and a code of practice explaining how the new provisions are likely to apply. Vitally, organisations who do not hold a direct contractual relationship with the worker will still need to have appropriate contractual assurance arrangements and controls in place.

What is changing?

Section 48 of the Border, Security, Asylum and Immigration Act 2025 adopts a broader definition of ‘employer’ than employment law. The employment law definition of employer is limited to those engaged under a contract of service or apprenticeship. The broader immigration definition will include, in addition to a contract of service or apprenticeship, the following:

• a ‘worker’s contract’: where a person provides work or services personally and the ‘employer’ is not a client or customer of the individual’s business;
• engaging an individual sub-contractor: where an individual has entered into a contract with a business to provide work or services, and that business has entered into a contract with a third party to provide the work or services, but the individual has not; and
• online matching services that keep a register of service providers and charge for matching them with clients.

Which business models are most likely to be affected?

The changes are especially relevant to organisations engaging workers outside traditional employment models, including:

• businesses using agency staff, labour suppliers or subcontracted services;
• contracting chains where work is passed through intermediaries;
• arrangements where a worker can provide a substitute;
• high-volume, shift-based or site-based operations where identity assurance is difficult to monitor in real time.

Self-employed and end user exemptions

The genuinely self‑employed, trading in their own name or as part of their own business, who contract directly with clients or customers will not be affected by these changes. The arrangement must be for the purchase of a service, rather than the employment of an individual to carry out work or services. However, arrangements where individuals obtain work through an intermediary, agency, platform or similar, will be included.

Also excluded are end-users who obtain services or work for their own benefit, and not to provide services onwards to a third party.

Extended liability

It is important to note that extended liability provisions create a separate compliance regime from the traditional Right to Work checking requirements.

A direct employer can establish a statutory excuse by completing a compliant Right to Work check on the individual. In a contractual chain, the direct employer remains responsible for that check. Parties further up the chain do not need to conduct the check themselves, but must satisfy the extended liability requirements detailed below.

Where extended liability applies, the Home Office will usually seek to enforce against the direct employer first. If that party cannot be identified or cannot demonstrate compliance, liability may move further up the chain. The direct employer’s compliance alone will not protect other supply chain parties from liability.

End users are not affected, although the Home Office has said that end users should still maintain appropriate controls and assurance arrangements.

How organisations can reduce extended liability risk

1. Contractual terms and conditions (written statement)

Where an organisation enters into a contract to provide work or services, and contracts a third party to provide or arrange that work, or where the organisation is an online matching service the organisation must put in place a written statement with the other employer before the work or service begins, in order to obtain a statutory excuse against a civil penalty if illegal working takes place.

The written statement must:

• require the direct employer to complete RtW checks on the engaged individuals;
• prohibit further sub‑contracting without written consent and include RtW provisions in any sub-contract;
• grant audit rights;
• permit reasonable enforcement action where illegal working is identified and there is no statutory excuse, including suspension/termination of the contract and equivalent suspension/termination provisions in the contract with the individual; and
• require co‑operation with Home Office investigations and the provision of required information.

The organisation must use identity verification measures (please see below).

2. Substitution controls

Where a contract permits an individual to send someone else to perform the work, the organisation must have processes in place to carry out a RtW check on the substitute before work commences, in order to establish a statutory excuse in the event that illegal working takes place. There must be contractual provisions in place including to suspend or terminate the contract where the organisation has reasonable cause to believe the person is working illegally. The responsibility for the check must not be delegated to the individual carrying out the work.

The organisation must use identity verification measures (please see below).

Identity verification measures

If the employer is in scope for extended liability and is either relying on (1) or (2) above, they must have proportionate systems and processes in place to ensure that the individual carrying out the work or services is the same individual on whom a RtW check has been conducted.

The systems and processes must be proportionate to the level of risk and contractual arrangements in place.

Acceptable systems may include:

• identity cards or workplace passes;
• facial recognition technology, including using registered RtW DVSPs;
• biometric or attendance management systems;
• checks against training records, qualifications or licences relating to the role; and
• identity re-verification at set intervals, recommended to be at least once in any 24-hour period or shift of work.

An organisation may rely on identity verification systems and processes operated by a third party including a registered RtW DVSP, but must take reasonable steps to satisfy themselves that those systems are effective and that the measures outlined above are being met.

Right to Work Digital Verification Service Providers (RtW DVSPs)

The draft code and employer guide update the existing Digital Verification Service (‘DVS’) terminology to that of RtW Digital Service Provider (‘RtW DVSP’).

From 1 October 2026, it will be mandatory to use a RtW DVSP registered with the Office for Digital Identities and Attributes (OFDIA), and which confirms that it can provide RtW checks.

From 1 October, RtW DVSPs will be able to conduct digital RtW checks on holders of expired British and Irish passports and Irish passport cards up to six months past the expiry date, where this is method is currently only permitted for valid passports.

RtW DVSPs will also be able to complete the ‘imposter check’ by using facial recognition technology to compare the worker’s facial image with the image on their RtW document, such as a passport.

In addition, a digital version of a National Insurance number issued by or on behalf of the government can now be relied on together with the other relevant document.

While it is welcome that digital checks are being widened, the concern with outsourcing the imposter check is how the organisation will verify that the person the RtW DVSP checked is the person who turns up for work without carrying out an imposter check themselves.

Unresolved questions

The release of the guidance has left open a number of unresolved questions as follows:

• do members of LLPs fall within the definition of ‘worker’s contract’?;
• will extended liability apply to contracts already in place prior to 1 October?; and
• for the purposes of retaining evidence of compliance with extended liability, what is the definition of the end of engagement?

What should organisations do now?

The new provisions may have substantial operational impacts for many organisations. Standard supplier terms, master services agreements, agency contracts and substitution clauses may all need review before the new regime takes effect.

With civil penalties of up to £45,000 per illegal worker, rising to £60,000 for repeat breaches, and potential sponsor licence consequences, organisations should act now to be prepared for 1October.

We recommend the following steps:

• Map staffing arrangements: identify who is the engager for each worker and whether they are in scope;
• Audit RtW processes: review onboarding, ongoing monitoring and document retention processes;
• Supply chain contracts: check if there are appropriate assurance provisions, audit and enforcement rights in place;
• Identity verification: check if this is in place if extended liability applies;
• Check RtW DVSPs: check if the RtW DVSP is OFDIA registered and confirms that they can provide RtW checks;
• Provide staff training: relevant teams which may require training include facilities, procurement, HR, operations and line managers;
• Enforcement response: prepare a process to respond quickly in the event of a Home Office information or compliance request;
• Seek specialist advice if unclear: particularly as further clarification is forthcoming on the implementation of the requirements, and if the organisation falls within the extended liability provisions.

How Bates Wells can help

The new provisions are likely to require significant changes to contracting, onboarding and compliance processes across many sectors. Organisations that engage workers through agencies, platforms, subcontracting arrangements or other non-traditional models should assess their exposure now and begin preparing for implementation before 1 October 2026. We are running a webinar on the changes and the steps you can take to comply on 3 September 2026 which you can sign up to here.

We can also assist with mock audits; assessing whether specific arrangements are in scope; draft contract wording; and providing staff training and materials. If you would like to discuss anything outlined in this article, please get in touch.

The material in this article is provided for guidance and general information only and is not intended to constitute legal or other professional advice upon which you should rely. In particular, the information should not be used as a substitute for a full and proper consultation with a suitably qualified professional. Please do contact the Bates Wells team if you require further advice.