A recruitment agency owner in Leeds recently told her accountant she didn't need to worry about right to work checks because she "doesn't employ anyone directly" — every worker on her books comes through a subcontractor. From 1 October 2026, that assumption stops holding up. Under the new rules, her business could face a civil penalty of up to £60,000 for a single worker further down that chain who turns out not to have the right to work in the UK, even without any contract between her and that person.
The change comes from Section 48 of the Border Security, Asylum and Immigration Act 2025, and it doesn't touch the basic rule that has existed since 2006: employing someone without the right to work is unlawful, and a properly conducted check gives the employer a statutory excuse against a penalty if things turn out to be wrong. What changes is who counts as an "employer" for these purposes. Until now, illegal working liability sat squarely with whoever held the direct employment contract, which is exactly why a subcontracting model felt like a safe distance to keep from this kind of risk. From 1 October, it extends to workers engaged under a worker's contract, individual subcontractors sitting anywhere in a contracting chain, and businesses that operate an online matching service — think gig platforms connecting a driver, cleaner or tradesperson with a customer. An updated draft Employers' guide covering the new requirements was published on 16 July 2026, and the Home Office's own framing of it makes clear this isn't a light-touch tidy-up: it's a genuine expansion of who can be penalised. If your business uses agency staff, freelance subcontractors, or a marketplace app to get work done, this is no longer someone else's compliance problem, and treating it as an HR footnote is how businesses end up on the wrong side of a penalty notice they never saw coming.
Who's actually caught by the wider definition
Genuinely self-employed professionals who contract directly with their own clients — no platform, no chain of subcontractors in between — stay outside the new regime, and that carve-out is real, not cosmetic. But the Home Office will look at what the arrangement actually is, not what the contract calls it. Three categories now fall inside scope:
- Anyone engaged under a worker's contract, meaning there's personal service and some degree of subordination even though it isn't full employment
- Individual subcontractors anywhere within a chain of contracts, where each party has been engaged by another to deliver the same or related work
- Online matching services, including gig economy apps, are now treated as employers in respect of the people they connect to work — and this extends to any substitute a worker is contractually allowed to send in their place
Call an arrangement "self-employed contracting" on the paperwork, and the label won't save you if the day-to-day reality is personal service with someone else calling the shots — an arrangement that looks like a worker's contract in practice falls inside the new regime whatever it's called on the invoice.
Liability now travels up the supply chain
No business in that chain is automatically shielded just because it never signed anything with the worker in question.
This is the part that catches most businesses off guard. Say a facilities company subcontracts cleaning to a smaller firm, and that firm's own worker doesn't have the right to work — under the old rules, only the smaller firm carried the risk. Under the new rules, the facilities company at the top can be exposed too, and so can anyone else in between, purely by virtue of being part of the same chain. The same logic applies to substitution: if a contract allows one worker to send a stand-in, the business that engaged the original worker can end up liable for that substitute's status too, even with zero contractual relationship to them.
The Home Office's draft guidance, published 11 September 2026, notes that extended liability is most likely to bite when it can't identify the business with the direct contractual relationship to the worker — so a company with clean, well-documented subcontracting agreements and a paper trail showing exactly who engaged whom is in a materially better position than one that can't produce that paper trail on request. That's a genuine mitigation, not a guarantee, and it's worth building now rather than after a Home Office visit.
The new statutory excuse has three parts — miss one and you have no defence
Businesses caught by the extended rules get access to a new statutory excuse, but it isn't automatic the way the traditional check is. It only applies if all three of the following are in place before work starts, not before the invoice is raised:
- A written agreement containing five specific mandatory provisions, covering right to work checks, restrictions on further subcontracting, and a requirement that the same obligations flow down to anyone further along the chain
- Where substitution is permitted, controls that force a right to work check on any substitute before they start, with that responsibility kept away from the worker themselves
- An identity verification system — a pass, a registered digital provider, facial verification technology, or periodic re-checks — proportionate enough to prove the person doing the work is the person who was actually checked
Redraft your subcontracting templates now, not at the next renewal date. A contract signed on 2 October under the old wording won't retroactively earn you the new excuse, and the gap between "we meant to update it" and "we updated it" is exactly where a £60,000 penalty lands.
Digital checks: one welcome change, one new hurdle
There's genuinely good news buried in the detail. British and Irish passports, and Irish passport cards, will now be accepted for digital identity verification up to six months past their expiry date — a small but practical fix for the number of checks that previously stalled over a passport that had lapsed by a matter of weeks.
The hurdle sits with whoever runs your digital checks. From 1 October, any digital verification provider you rely on for a statutory excuse must be both registered on the Office for Digital Identities and Attributes register and specifically authorised for right to work checks — general identity verification authorisation on its own no longer counts. Plenty of background-screening firms quietly outsource the digital verification step to a third party, so the authorisation you think you have might not be the one that actually applies. Ring your provider this week and ask them to confirm, in writing, that their right-to-work-specific authorisation is current.
What it costs if you get it wrong
The civil penalty ceiling is £60,000 per illegal worker, and it climbs further for a business that's been caught before and hasn't fixed the underlying problem. Criminal liability sits above that, reserved for cases where there's reasonable cause to believe the business knew, or should have known, that illegal working was taking place — and that carries unlimited fines plus the possibility of a custodial sentence for directors and managers with oversight responsibility. A compliant check, properly evidenced, remains the only reliable defence against both.
Getting ready before 1 October
Start with a proper audit rather than a guess: list every category of worker your business engages, including direct employees, agency staff, individual subcontractors and anyone reaching you through a platform, and map each one against the new definitions. From there, work through the practical steps in roughly this order — review and reissue subcontracting and supply agreements to include the five mandatory provisions, confirm your digital ID provider's authorisation status in writing, put substitution controls in place wherever your contracts allow a worker to send someone else, and train whoever actually conducts your checks on the expanded categories, because the person doing this at desk level is usually the last line of defence. Bring procurement and legal into this conversation now, even if right to work has always sat with HR. A procurement team signing off a new subcontractor without checking their compliance position, or a legal team reusing last year's template agreement, can undo everything HR gets right on its own side. None of this needs to be finished in a single afternoon, but every part of it needs to be started well before the last week of September — leaving it until the 30th is how businesses end up relying on paperwork that was never actually checked. A one-page compliance note circulated to whoever signs off new suppliers, however basic, tends to catch more risk in practice than a lengthy policy document nobody reads past the first paragraph.