From 1 October 2026, UK right to work checks extend beyond direct employees to workers under a "worker's contract," individual sub-contractors, and people supplied through an online matching service. This is now confirmed law (Section 48 of the Border Security, Asylum and Immigration Act 2025), the date is fixed, and it only applies to arrangements starting on or after 1 October 2026. Penalties stay at £45,000 per worker for a first breach and up to £60,000 for a repeat breach, unchanged since 2024, but far more businesses can now be exposed to them.
From 1 October 2026, the right to work check most employers know well starts to reach further than direct employees. Section 48 of the Border Security, Asylum and Immigration Act 2025 is now in force, extending the illegal working regime to workers engaged under a "worker's contract", individual sub-contractors, and people supplied through an online matching service, not just anyone on your own payroll. This is confirmed law, not a proposal still working its way through Parliament. The harder part was never the check itself, it's seeing your whole workforce clearly enough to know who needs one. Preparing now means building that visibility before the deadline, not after it.
This guide explains what's changing, who comes into scope, who's responsible for the check, and how to prepare.
This is a general guide to the changes, not legal advice. Speak to a qualified solicitor or immigration adviser before making decisions specific to your organisation.
Is the right to work check changing in 2026?
Yes. From 1 October 2026, right to work obligations extend beyond direct employees to three further categories: workers engaged under a "worker's contract" (broadly, anyone engaged to personally perform work for you, short of full employment), individual sub-contractors working within a supply chain, and people supplied through an online matching service. The change is set out in Section 48 of the Border Security, Asylum and Immigration Act 2025, which received Royal Assent in December 2025 and was commenced by statutory instrument earlier this year. The 1 October date is fixed, and the Home Office published its final employer's guide on 1 October 2026.
Who comes into scope?
The four categories that now matter are set out directly in the amended law. Direct employees were always in scope, and still are. Alongside them, the check now reaches anyone engaged under a worker's contract to personally perform work or services for you, short of a full employment relationship; individual sub-contractors, engaged to help deliver work you've promised to someone else; and anyone supplied through an online matching service, a business that keeps a register of providers and matches them to clients for a fee. Being casual or on a zero-hours contract doesn't, on its own, bring someone into this wider scope, it's the nature of the arrangement that decides that, not the type of contract. A genuinely independent professional or business relationship, one where you're buying a contracted-out service rather than directing the work day to day, generally sits outside it (more on that below).
When do the changes take effect?
1 October 2026, and that date isn't moving. What's worth knowing is that the change isn't retrospective: it applies to working arrangements that start on or after 1 October 2026. An engagement already running before that date doesn't need to be unwound or re-checked overnight. The government has been explicit that it wants "sufficient transition time before enforcement", so there's no case for treating this as a single hard deadline to panic about, but every reason to build the visibility now, because that's the part that takes longest.
Why is this harder than it sounds?
For most organisations the obstacle was never the check itself, it's visibility. The workers who reach you through suppliers, subcontractors and matching services are usually the least visible part of your workforce. Most employers can evidence checks for people on their own payroll. Far fewer can say, with confidence, who is working through a supplier today, under which contract, and through which entity. A useful model is to hold three things against every engagement: the Supplier you've contracted with, the Engagement itself (the specific work commissioned), and the Worker actually doing it, their employer, and the arrangement between them. Once you can see all three clearly, the check itself is largely a process.
The substitution trap.
One detail worth knowing on its own. If a contract lets a worker send someone else to do the job instead, that substitution clause is what pulls the arrangement into scope, even where the original relationship looked genuinely contracted-out. Where substitution is permitted, the engaging business can be treated as the employer of whoever actually turns up to do the work, including a substitute who was never part of the original agreement. The Home Office's own guidance frames the real protection here as control, having contractual terms that limit or prevent unauthorised substitution, and being able to evidence that control, rather than a single check the moment someone new arrives. It's easy to miss because a substitution can happen quietly, well after the original contract was signed off, so it's worth building a process that catches one the moment it's disclosed, not the moment someone new turns up on site.
Right to work and IR35: a similar question, not the same test.
Right to work and IR35 are separate legal tests, but they land on a similar, and now similarly wide, population. One question helps you think about both, even though it isn't part of either piece of legislation. Are you buying an outcome, a genuinely contracted-out service where the provider controls the workers? Or are you receiving a supply of labour, individuals engaged into and directed by your business? Where it's a genuine contracted-out service, responsibility generally sits with the provider. Where it's really a supply of labour, it's more likely to fall to you.
Do I need a check for genuinely independant contractors?
Often, no. Buying a service for your own internal operations, from a business or contractor who controls how the work gets done, isn't automatically pulled into the wider scope. A personal service company engaged for a standalone piece of graphic design work is a good example: no ongoing direction, no supply of labour into your business, generally no new obligation. What does bring an arrangement into scope is subcontracting work you've promised to someone else, being supplied with labour that's directed by you, or a substitution clause of the kind above. If you're not sure which side of that line an engagement sits on, that's worth resolving before 1 October, not after.
Who is responsible for carrying out the check?
Where a supplier delivers a genuine contracted-out service, responsibility generally sits with them. Where the arrangement is really a supply of labour, it's more likely to fall to the end client, even where there's no direct contract with the individual. Even where the check isn't strictly your obligation, you're expected to evidence appropriate due diligence, that you've seen and hold confirmation it was done. Relying on the assumption that a supplier has carried it out isn't enough on its own, and contractual flow-down only holds up when it's backed by written requirements to check, controls over further subcontracting, the same obligations passed further down the chain, and audit access if a supplier falls short.
What about digital identity checks?
For anyone holding a digital immigration status (an eVisa), the check runs through the Home Office's online service using a share code, nine characters, starting with W, valid for 90 days. Older codes starting with R or S are no longer accepted. You can also complete a check through a registered Right to Work Digital Verification Service Provider (an RtW DVSP), which can confirm identity using facial recognition matched against the document. That's a genuinely new part of the process for the widened population, because it introduces a "proportionate systems" requirement, evidence that the person doing the work is the same person who was originally checked, which matters more once substitutions and subcontracted labour are in scope.
What are the penalties for getting it wrong?
The maximum civil penalty for illegal working is unchanged: £45,000 per worker for a first breach, up to £60,000 for a repeat breach within three years, the same figures that have applied since February 2024. What changes from 1 October isn't the amount, it's who can be exposed to it. A far wider population of businesses now sits inside the regime, and enforcement has risen sharply in recent years, which is why visibility of the wider workforce matters now rather than later. For sponsor licence holders, a civil penalty typically also triggers a licence review, putting every visa that sponsor holds at risk, a bigger stake than the headline number alone suggests.
How should employers prepare?
The practical response is confirmed now that the Home Office's final employer's guide is published, and it's worth reading directly alongside the Home Office employer's guide to right to work checks. Build a single record against every engagement, covering the supplier you've contracted with, the specific work commissioned, and the worker actually doing it. Gather evidence in advance rather than at the gate, validated before a worker arrives or starts, and hold it on record for the duration of the engagement and normally for two years afterwards. A check isn't a one-off event either: the risk in a long-running engagement changes as time passes, worth reading alongside our piece on the hidden risk of "temporary" contractors who stay for years. Triage each request at the point of engagement, so it's routed into what it actually is, an employee, a worker's contract, a sub-contractor, or a matching-service arrangement, and the right check follows automatically. Back contractual flow-down with an audit trail rather than an assumption. And give line managers light, practical education on when a check is needed and why, since they're usually the ones who see a new arrangement first, our piece on getting managers to actually follow compliance process covers this well.
How CoComply can help.
The hardest part of right to work readiness is knowing who your external workforce actually is. CoComply classifies every engagement against the same four categories the law now uses, working out at the point it's added whether the check sits with you or your supplier. Where it's yours, the worker is taken through a check with TrustID, a certified Right to Work Digital Verification Service Provider on the OFDIA register, and you're prompted to confirm the final in-person identity match once it's complete. Where it's your supplier's, they can upload proof a check has already been done, or complete it on the platform themselves. Add a substitution once it's disclosed and the same check workflow triggers automatically, covering the new arrangement from that point. Evidence is held for the life of the engagement, and for up to two years afterwards while you remain a CoComply client, so you can show your workforce was covered, not just believe it. Be certain who's working for you.
This article reflects our understanding of the law as confirmed at the time of publication. Right to work requirements are detailed and continue to evolve, and this guide doesn't constitute legal advice. You should seek independent legal advice before making compliance decisions for your organisation.
Frequently asked questions.
Does a right to work check apply to contractors and freelancers?
It can, but not automatically. If you're buying a genuinely independent professional or business service, one where the contractor controls how the work gets done, it generally sits outside the extended regime. If someone is supplied into your business and works under your direction, or you're subcontracting work you've promised to someone else, a check is likely required from 1 October 2026.
What is a right to work share code, and how does it work?
A share code is what someone with a digital immigration status (an eVisa) gives an employer to run their right to work check online through the Home Office's service. Current codes are 9 characters and start with the letter W, and each one is valid for 90 days. Older codes starting with R or S are no longer accepted.
What's the maximum penalty for an illegal working breach?
Up to £45,000 per worker for a first breach and up to £60,000 for a repeat breach within three years. Those figures haven't changed since February 2024. What changes from 1 October 2026 is how many businesses can be exposed to them, not the amount itself.
Is a right to work check the same as an IR35 check?
No, they're separate legal tests. They often apply to a similar population of workers though, so one question helps assess both: are you buying a genuinely contracted-out outcome, or receiving a supply of labour you direct yourself? That question isn't part of either law, it's just a useful starting point.
Do zero-hours or casual workers need a right to work check?
They always have, if they were already effectively an employee. From 1 October 2026, the deciding factor isn't whether someone is casual or zero-hours, it's whether they're engaged under a worker's contract, as an individual sub-contractor, or through an online matching service. Those categories, not the type of contract, decide whether the wider obligation applies.
What happens if a contractor sends a substitute to do the work?
A substitution clause is what pulls the arrangement into scope, since the engaging business can be treated as the employer of whoever actually does the work, including a substitute. The government's own framing treats control as the real safeguard here, contractual terms that limit or prevent unauthorised substitution, evidenced if ever challenged, rather than a single mandatory check the instant someone new arrives. It's a genuinely new practical risk under the October 2026 changes, since a substitution can happen well after the original relationship was set up.
How long should right to work check records be kept?
Normally for the duration of the engagement, and for two years afterwards. Evidence should be gathered and validated before someone starts, not after, and kept on file rather than relying on memory or an assumption it was done.
Who's responsible for the right to work check, the employer or the supplier?
It depends on the nature of the arrangement. Where a supplier delivers a genuine contracted-out service, they're generally responsible. Where the arrangement is really a supply of labour directed by your business, responsibility is more likely to fall to you, even without a direct contract with the individual doing the work.
