Right to Work Checks 2026: New Illegal Working Rules for Employers, Contractors and Platforms

If your business uses workers, subcontractors, gig-economy labour, agency-style arrangements, online matching platforms or substitution clauses, you are in the right place. The Home Office is tightening the illegal working regime. From 1 October 2026, the right to work scheme is expected to reach well beyond ordinary employees.

This matters because a right to work mistake is no longer just an HR admin issue. It can expose a business to civil penalties, sponsor licence problems, reputational damage, contract disruption and, in serious cases, criminal investigation.

The updated draft Code of Practice on preventing illegal working was published by the Home Office in June 2026. It updates the January 2024 code and is intended to come into force on 1 October 2026. Until then, employers should continue to follow the code and guidance currently in force. However, businesses should prepare now, especially where work is delivered through subcontracting chains, platforms or substitute workers.

The core message is simple. A business must be able to prove that the correct right to work check was done at the correct time, by the correct method, on the correct person, and that the person actually doing the work is the person who was checked.

Book an Appointment

What is changing from 1 October 2026?

The most important change is the expansion of the right to work scheme to other working arrangements. The draft code confirms that the scheme will apply to employers who engage individuals under a contract of employment, a worker’s contract, as individual subcontractors, or through an online matching service that provides details of service providers to potential clients or customers.

The new regime also introduces extended liability. This means that, in certain contractual chains, a business may be treated as responsible for illegal working even where it is not the direct employer of the individual who carried out the work.

This is particularly important for businesses in construction, logistics, cleaning, hospitality, care, food delivery, warehousing, beauty services, maintenance, facilities management and other sectors where labour is often supplied through informal or multi-layered arrangements.

The Home Office will still look first for the employer with the direct contractual relationship. Yet liability may move upstream where that employer cannot be identified or where the required contractual and identity controls have not been properly implemented and evidenced.

Why employers should not wait until October 2026

Right to work compliance is evidence-driven. If the Home Office visits your site, receives intelligence, investigates a worker or audits your sponsor licence, your business may be asked to produce records quickly.

A good system cannot be created retrospectively. Contracts must be reviewed. Subcontracting clauses should be updated. Platform terms may need to be changed. Identity verification processes must be documented. Managers should be trained before the new rules are in force.

For sponsor licence holders, the risk is even higher. Illegal working concerns may lead to wider Home Office scrutiny of sponsor duties, recruitment systems, record-keeping and whether sponsored workers are genuinely employed and properly monitored.

The three lawful ways to conduct a right to work check

Employers must use a prescribed method. A casual review of a passport, a screenshot from a worker, a recruitment agency confirmation, or a copy of someone’s eVisa screen may not be enough.

Manual document-based check: the employer obtains acceptable original documents, checks them in the worker’s presence and retains a clear copy with the date of the check.
Home Office online check: the employer uses the official GOV.UK employer checking service with the worker’s share code and date of birth.
Registered Right to Work Digital Verification Service Provider check: the employer uses a registered RtW DVSP where that method is permitted.

Where a worker has an eVisa, the Home Office online right to work service will usually be the required route. Employers should not rely on the migrant-facing view of the worker’s own immigration account. The employer-facing check must be completed and retained.

For official practical guidance, employers can refer to the GOV.UK employer right to work checks guide.

What is a statutory excuse?

A statutory excuse is the employer’s protection against a civil penalty if a worker is later found to have been working illegally. It is not automatic. It must be earned by doing the prescribed check correctly and keeping the required evidence.

The check must normally be completed before work starts. For workers with time-limited permission, follow-up checks must be diarised and completed before the existing statutory excuse expires.

If the Home Office finds that a check was not done, was done late, was done using the wrong service, or was done on someone who was not the person actually working, the statutory excuse may be lost.

Who is now in scope?

The draft code uses a wider definition of “employer” for the right to work scheme. It includes traditional employment, worker contracts, individual subcontractor arrangements and online matching services.

This does not mean that every genuine business-to-business service contract will be treated as employment. The draft code says that individuals who are genuinely self-employed, operating in business on their own account and contracting directly with clients or customers, are not in scope of the scheme.

The practical difficulty is that many real-world arrangements sit in the middle. A business may describe someone as self-employed, but the working arrangement may still fall within the right to work regime if the individual is personally providing work through an intermediary, platform or similar arrangement rather than operating an independent business in their own right.

Extended liability in subcontracting chains

Extended liability is one of the most important parts of the 2026 changes. It may apply where a business contracts to provide work or services to a third party and then contracts with another employer to provide workers for that work.

In that situation, the upstream business may need more than a simple promise that “all workers have the right to work”. It may need written contractual terms, audit rights, subcontracting controls, cooperation clauses and evidence that identity verification systems are operating properly.

Where these controls are missing, weak or only theoretical, the business may struggle to establish a statutory excuse if illegal working is found in the labour chain.

Online matching platforms and service-provider models

The draft code specifically refers to online matching services. This is important for platforms that keep registers of service providers, match them with clients or customers and charge a fee or commission for making those matches.

A platform should not assume that it is safe simply because it says it is not the employer. If it falls within the statutory definition, it may need systems to ensure that right to work checks are carried out, contractual controls are in place and identity verification is reliable.

Platforms should review onboarding, service-provider terms, repeat checks, account sharing risks, substitute worker risks and how quickly they can produce evidence if the Home Office asks for it.

Substitution clauses: the hidden right to work risk

Substitution clauses are common in contractor agreements. They may also be used to support self-employment status. Under the draft code, they create a separate illegal working risk.

Where a contract allows a worker to send a substitute, the employer may only establish a statutory excuse if there are processes to ensure that a prescribed right to work check is carried out on any substitute before that substitute starts work.

Responsibility for checks should not be delegated to the original worker. A worker should not be allowed to decide, informally and without approval, who turns up to perform the work.

The business should also be able to show that the original worker and any registered substitute are the same individuals in respect of whom right to work checks were completed.

Identity verification is now central

The draft code makes identity verification a key part of compliance. It is not enough to check status once and then lose control of who is actually doing the work.

Proportionate systems may include workplace access passes, identity cards, attendance systems, biometric systems, facial verification technology, checks against training or licensing records, and re-verification at suitable intervals.

The right system will depend on the sector, the risk level and how the work is delivered. A small office employer will not need the same controls as a multi-site contractor using layered subcontractors. However, the system must be real, consistent and evidenced.

Common right to work mistakes that may destroy the statutory excuse

Relying on a recruitment agency, adviser or subcontractor to do the check without retaining the employer’s own statutory excuse.
Viewing the worker’s eVisa account instead of using the official employer online checking service.
Failing to check that the photo on the online profile matches the person who will do the work.
Allowing a student to work beyond permitted hours or failing to retain term and vacation dates.
Forgetting a follow-up check where permission is time-limited.
Using an unregistered DVSP or a provider not registered for right to work checks.
Accepting a document when it is reasonably apparent that it is false or belongs to someone else.
Allowing substitution without checking the substitute before work starts.
Using contract wording that looks compliant but is ignored in practice.
Failing to retain records for the required period.

Students, restricted work and follow-up checks

Students often create compliance risk because their permission may allow work only within specific hourly limits during term time. Employers must understand the restriction and retain details of academic term and vacation dates for the period of study during which the student will be employed.

If the worker has time-limited immigration permission, the business must complete a follow-up check before the permission expires. Where the worker has made an in-time application and cannot yet prove status digitally, the Employer Checking Service may be required.

A Positive Verification Notice can provide a time-limited statutory excuse. A Negative Verification Notice is a serious warning. If the employer continues to employ the worker after a negative response, civil and criminal risk may follow.

What happens if the Home Office suspects illegal working?

The Home Office may identify a suspected breach through an enforcement visit, intelligence, data sharing or other evidence. The case may then be considered by the Civil Penalty Compliance Team.

An employer may receive an information request and be asked to provide evidence of right to work checks, contractual controls, identity verification processes and any mitigating evidence. If liability is found, a Civil Penalty Notice may be issued with a Statement of Case.

The Home Office may issue a No Action Notice if the employer has established a statutory excuse. In some first-breach cases, a Warning Notice may be issued where the published criteria are met.

How much can the civil penalty be?

The current maximum civil penalty levels are severe. The draft code retains the penalty framework of £45,000 per illegal worker for a first breach and £60,000 per illegal worker for a repeat breach within three years.

Mitigation may reduce the penalty. Relevant factors include whether the employer reported suspected illegal working before the Home Office identified the worker, whether the employer actively cooperated with the investigation, and whether effective right to work practices were in place.

For a first breach, strong evidence of reporting, active cooperation and effective right to work practices may lead to a Warning Notice rather than a financial penalty. That is not guaranteed and depends on the facts and evidence.

Can an employer object or appeal?

Yes. If a Civil Penalty Notice is issued, the employer can object in writing. The grounds may include that the business is not liable, that a statutory excuse exists, or that the penalty amount is too high.

If the objection is unsuccessful, the employer may appeal to the County Court in England, Wales and Northern Ireland, or the Sheriff Court in Scotland. Strict deadlines apply. An appeal is not a fresh compliance exercise. The evidence should be organised carefully and legal advice should be taken quickly.

What employers should do now

Audit your workforce model. Identify employees, workers, individual subcontractors, platform workers, substitutes and labour supplied through chains.
Review contracts. Check whether right to work obligations, audit rights, subcontracting restrictions and Home Office cooperation clauses are strong enough.
Map who performs the checks. Make sure the business knows who is responsible, what method is used and where evidence is stored.
Check digital systems. Confirm whether any DVSP used is registered for right to work checks.
Control substitution. No substitute should start work before their right to work and identity have been verified.
Train managers. Site managers, HR teams and operational leads should know what to do before work starts.
Maintain records. Keep clear evidence for the duration of employment and for two years afterwards where required.
Diary follow-up checks. Time-limited permission must be monitored before it expires.
Avoid discrimination. Checks should be applied consistently and not based on nationality, accent, race, appearance or assumptions.
Prepare for investigation. Know where evidence is stored before the Home Office asks for it.

Right to work compliance and sponsor licence holders

If your business holds a sponsor licence, right to work compliance should be treated as part of wider sponsor licence risk management. A civil penalty can damage confidence in your systems. It may also prompt questions about reporting duties, recruitment records, sponsored worker monitoring and whether key personnel are exercising proper oversight.

Before the 2026 changes take effect, sponsor licence holders should review HR systems, sponsored worker files, right to work records, subcontracting arrangements and whether any sponsored worker is being supplied in a way that creates additional compliance risk.

How legal advice can help

Legal advice is useful before the Home Office becomes involved. It can help you identify whether your arrangements fall within the expanded scheme, correct weak contracts, build a practical evidence trail and reduce the risk of avoidable penalties.

Advice can also help where a worker’s status is unclear, an eVisa is not working, a student has restricted hours, an application is pending, an Employer Checking Service request is needed, or a civil penalty notice has already been issued.

For businesses with subcontracting chains or platform models, the key issue is usually not whether a policy exists. The real question is whether the business can prove that the policy works in practice.

Book an Appointment

Frequently Asked Questions

Do the 2026 right to work changes apply to ordinary employees only?

No. The draft code expands the scheme beyond ordinary employees. From 1 October 2026, it is expected to cover worker contracts, individual subcontractors and certain online matching service arrangements, as well as traditional employment.

Does a genuine self-employed contractor need a right to work check?

Not always. The draft code says individuals who are genuinely self-employed, operating in business on their own account and contracting directly with clients or customers, are not in scope. Borderline arrangements should be reviewed because labels in a contract may not reflect the legal reality.

Can we rely on a recruitment agency or subcontractor to do the check?

Usually no, if you are the employer responsible for the worker. Except where a prescribed RtW DVSP check is used correctly, delegating the check to a third party may mean you do not establish a statutory excuse.

What if a worker has an eVisa but cannot generate a share code?

If the online service cannot be used because of a technical issue or an unresolved digital status problem, the Employer Checking Service may be needed. The employer should not simply accept a screenshot from the worker’s account.

What is extended liability for illegal working?

Extended liability means a business upstream in a contractual chain may be liable where illegal working is found and the direct employer cannot be identified or the prescribed contractual and identity controls have not been met.

Do substitution clauses create right to work risk?

Yes. If a contract allows a worker to send a substitute, the business must ensure that any substitute has a prescribed right to work check before starting work. Responsibility should not be passed to the original worker.

How long should right to work records be kept?

Where a prescribed check requires retention, records should generally be kept securely for the duration of employment and for two years afterwards, then securely destroyed.

Can a civil penalty be challenged?

Yes. An employer can object to a Civil Penalty Notice and may appeal if the objection is unsuccessful. The grounds include lack of liability, the existence of a statutory excuse, or an incorrectly calculated penalty.

Can right to work checks be discriminatory?

Yes. Employers should apply right to work checks consistently and avoid decisions based on nationality, race, accent, appearance or assumptions about immigration status. A time-limited right to work should not be treated as a reason to reject someone automatically.

When should we take legal advice?

Take advice before the rules change if your business uses subcontractors, gig-economy workers, platform models, student workers, sponsored workers or substitution clauses. Urgent advice is recommended if the Home Office has contacted you or a civil penalty notice has been issued.

Topic-specific disclaimer

This article is for general information only. It is based on the Home Office draft Code of Practice published in June 2026 and the legal position reviewed on the date below. The final code, related guidance or Home Office practice may change. Right to work liability depends on the facts, the worker’s status, the checking method used, the timing of the check and the evidence retained. Legal advice should be taken before relying on this article in a specific case.

Last legally reviewed: 1 July 2026
By: Adam Sierant

Right to Work Checks 2026: New Illegal Working Rules for Employers, Contractors and Platforms