On 1 October 2026, the UK’s Right to Work regime changes. The scope of who must be checked, and who can be held liable, expands beyond traditional employees to cover agency workers, individual sub-contractors, and gig platform workers. Recruitment agencies and umbrella companies that do not update their processes and contracts before this date face civil penalties of up to £60,000 per worker.

In this article we set out what is changing, who is affected, and what you need to do before 1 October.

What the Border Security, Asylum and Immigration Act 2025 changes

Section 48 of the Border Security, Asylum and Immigration Act 2025 redefines “employer” for Right to Work purposes. The question is no longer “is this person my employee?” but “am I engaging this person’s labour?”

From 1 October, the duty to conduct Right to Work checks applies to businesses engaging individuals under:

• Worker’s contracts (agency workers, zero-hours, casual workers)
• Individual sub-contractor arrangements within labour supply chains
• Online matching services that connect service providers with clients for a fee or commission

Genuinely self-employed individuals operating independent businesses generally remain outside scope. However, the Home Office will look at the reality of the arrangement, not the contractual label. There are no transitional arrangements. Civil penalties apply to any engagement (under the broader definition) that begins on or after 1 October 2026.

Who is affected: extended liability up the supply chain

The Act introduces “extended liability.” This allows the Home Office to pursue businesses further up a contractual chain if the direct employer of an illegal worker cannot be identified, or if prescribed compliance requirements have not been met.

In practice, this means:

• Recruitment agencies placing workers through umbrella companies or directly with end-clients
• Umbrella companies as employers of record
• End-clients who sub-contract service delivery
• Contractors engaged under workers’ contracts or as individual sub-contractors

The liability flows both ways, as an agency cannot assume the umbrella company will handle compliance, and the umbrella company cannot assume the agency has done so. Each party in the chain must be able to demonstrate its own statutory excuse.

The penalties

The Home Office civil penalty structure is straightforward:

• £45,000 per worker for a first breach
• £60,000 per worker for a repeat breach within three years

These are per-worker figures. A single enforcement visit involving five workers without valid checks could result in a penalty of £225,000 or more. If an employer knowingly engages illegal workers, criminal prosecution can follow, carrying up to five years in prison and unlimited fines.

What “statutory excuse” requires

A statutory excuse is a business’s defence against civil penalties. It proves you conducted the correct checks before work began. Without it, the penalty applies regardless of intent. To establish a statutory excuse under the expanded regime, agencies and businesses in supply chains must include five mandatory terms in their written contracts with downstream suppliers.

These require the downstream party to:

• Perform compliant Right to Work checks on every individual before they start work
• Restrict further sub-contracting without prior written consent, with equivalent Right to Work obligations replicated in any permitted sub-contracts
• Permit audits of the downstream party’s Right to Work compliance
• Enable enforcement action (suspension or termination of the contract) if illegal working is identified without a statutory excuse
• Cooperate with Home Office investigations, including providing information about the contractual chain and the businesses involved

Employers must add these terms to existing contracts that will remain in force on or after 1 October 2026, whether through addendums, side letters, or replacement agreements.

Digital verification requirements

Employers choosing to verify Right to Work digitally must use a provider registered with the Office for Digital Identities and Attributes (OfDIA) and specifically authorised for Right to Work checks. Using a non-registered provider will not establish a statutory excuse.

Digital verification through a registered DVSP is one of three acceptable methods. The other two are:

• The Home Office online checking service (required for most non-British and non-Irish nationals)
• Manual document checks using original documents from the approved Home Office list

Whichever method you choose, the check must be completed before the worker’s first shift. Dated copies must be retained for the duration of the engagement plus two years.

What agencies must do before October 1

The deadline leaves limited time. Agencies should prioritise four actions:

1. Map your labour supply chain. Identify every category of worker you engage, including those sourced through third parties, platforms, or sub-contractors.

2. Update your contracts. Review and amend agreements with umbrella companies, sub-contractors, and platform providers to include the five mandatory terms. Existing contracts have no grace period.

3. Confirm your digital verification provider. If you use a DVSP for digital identity checks, verify that the provider appears on the OfDIA register and is authorised for Right to Work checks.

4. Train your teams. HR, compliance, and recruitment staff need to understand the expanded scope. The check obligation now extends beyond candidates on your payroll to every individual whose labour you engage.

What contractors need to know

Contractors engaged under workers’ contracts or as individual sub-contractors now fall within the scope of Right to Work checks. This means:

• Your agency or umbrella company will need to verify your Right to Work status before your first assignment under any new engagement from 1 October onwards
• If you have time-limited permission to work in the UK, expect repeat checks at appropriate intervals
• You may be asked to provide documents or use the Home Office online service as part of onboarding, even if you have worked with the same agency before

These checks protect you as well as the agency. A verified Right to Work status ensures your engagement is lawful and your position is secure.

How SmartWork supports compliance

SmartWork’s compliance infrastructure is built for this. As an FCSA-accredited and SafeRec-certified provider, SmartWork already conducts Right to Work checks using TrustID, a government-approved digital identity verification service, as standard practice across all worker categories. Our processes meet the expanded regime’s requirements, including record retention, follow-up checks for time-limited permissions, and full audit trails.

For agencies, working with us means you can be confident you meet your supply chain compliance obligations. For contractors, it means a straightforward onboarding process with no gaps in your Right to Work verification.

If you have questions about how the October 1 changes affect your business, or you want to review your supply chain compliance, contact the SmartWork team to arrange a consultation.

If you liked this article, please remember to follow us on LinkedIn, Facebook, and Twitter so you can see when we publish a new one. 

Sources:

https://knowledge.dlapiper.com/dlapiperknowledge/globalemploymentlatestdevelopments/2026/right-to-work-compliance-expands-beyond-employees-what-businesses-need-to-do-before-1-october-2026

https://www.lewissilkin.com/insights/2026/07/02/preventing-illegal-working-and-right-to-work-checks-what-changes-from-1-october-2026

https://www.gov.uk/government/publications/right-to-work-checks-employers-guide/draft-employers-guide-to-right-to-work-checks-16-july-2026-accessible

https://www.gov.uk/government/organisations/office-for-digital-identities-and-attributes

https://www.gov.uk/view-right-to-work