Right to Work checks are changing on 1 October 2026 — what it means if you use subcontractors
From 1 October 2026, Right to Work obligations extend beyond traditional employees for the first time. If your business engages subcontractors, self-employed individuals or outsourced labour, here’s what you need to know and what you need to do before the deadline.
- What’s changing
- What has not changed
- Every subcontractor?
- Real-life examples
- Statutory excuse
- Your contracts
- What documents count
- Every 90 days?
- What to do
- What we can and cannot do
What’s changing
For years, Right to Work checks have been something you did when you took someone onto the payroll. From 1 October 2026 that changes.
Section 48 of the Border Security, Asylum and Immigration Act 2025 widens the definition of “employer” for the purposes of the illegal working regime. It does not change employment law generally, but it does mean the duty to carry out Right to Work checks now reaches into working arrangements that have always sat outside it.
The arrangements brought into scope include:
- individuals engaged under a worker’s contract
- individual subcontractors
- certain workers sourced through online matching platforms and labour supply arrangements
It can reach you even if the worker isn’t yours
The change most likely to catch people out is that this is no longer only about the people on your payroll. Labour arriving through an agency, an intermediary, a subcontracting chain or an online platform can still bring obligations with it, because the legislation looks at how the work is actually arranged rather than at job titles. Nor does it have to be a written contract — verbal and implied arrangements can count too.
If someone is doing work for your business and you are not putting them through your payroll, that no longer automatically means Right to Work is somebody else’s problem.
What has not changed, and why this matters
There has been a lot of alarming commentary about these reforms, some of it based on the original consultation rather than the final rules. It’s worth being clear about what the Home Office did not do.
There is no blanket liability across the whole supply chain
Responsibility is determined by the statutory framework and by the actual contractual relationships between the parties. The starting point remains that responsibility sits with the business that has the direct contractual relationship with the individual.
Agency workers are not a separate legal category
Some agency labour will fall within the new provisions depending on how it is contracted, but “agency worker” is not a standalone trigger.
You do not have to use a Digital Verification Service Provider
The existing Home Office checking routes — manual checks, the online check and eligible digital verification — all still establish a statutory excuse. A DVSP is one option, not a requirement.
Civil penalties are not going up
They remain at up to £45,000 per illegal worker for a first breach and up to £60,000 for a repeat breach within three years.
Does this catch every subcontractor?
No — and this is the point most likely to be misunderstood.
“Contractor” is too broad a word to answer the question. A genuinely independent business supplying a service through its own limited company — a plumber, an electrician, a freelance designer trading as a limited company — will generally sit outside the extended regime, because you are contracting with a company, not engaging an individual.
The position is different where you engage an individual directly, where the arrangement looks like a worker’s contract, or where the contractual chain is layered enough that it is not obvious who holds the direct relationship with the person actually on site. Where the responsible employer cannot be identified, or where the prescribed compliance requirements have not been met, responsibility can extend to another business in the arrangement.
The real work here is mapping your arrangements, not rewriting your onboarding forms.
What that looks like in real life
| The arrangement | Do you check? | Why |
|---|---|---|
| A self-employed bricklayer. Works as himself, invoices as himself. | Yes | He’s a person. You contracted with him. |
| Smith Brickwork Ltd. They send three lads to site. | No | You contracted with a company. Smith Brickwork Ltd checks its own lads. |
| A plumber trading as J. Bloggs Plumbing Ltd. | No | Company again. |
| A driver off a gig app. | Depends | On who the contract is with — you or the app. |
The bit people are getting wrong
Lots of the press is saying you’re now responsible for everyone below you in the chain, all the way down. You’re not.
If Smith Brickwork Ltd hires a dodgy subbie, that’s Smith’s penalty, not yours. You contracted with Smith.
There’s one exception. If the Home Office turns up and can’t work out who the direct employer is — the paperwork’s a mess, nobody can show a contract, it’s all cash and handshakes — then they can look further up the chain. So the way you protect yourself is: have a proper written contract, and be able to produce it.
One more thing worth saying. Even where the penalty would not be yours, your customers may not see it that way. We are already seeing main contractors write checking obligations into their subcontracts and ask for evidence before anyone sets foot on site — one contractor we spoke to was given access to his client’s checking software and told to run his own subcontractors through it. Being able to answer that quickly may matter more commercially than the strict legal position does.
That’s the real message. Tidy contracts, not more checking.
Establishing a statutory excuse under the new rules
The checking methods are unchanged. What changes for more complex arrangements is what else you may need in place to rely on a statutory excuse. Depending on the arrangement, that can include:
- written contractual warranties on Right to Work compliance
- audit rights and evidence-sharing obligations
- a commitment to cooperate with Home Office investigations
- identity verification, confirming the person doing the work is the person who was checked
- controls around substitution, where someone else can be sent to do the job
Substitution clauses. Many subcontractor agreements let the contractor send someone else in their place. A right of substitution on paper does not make the issue go away: if a replacement turns up, that person may need checking before they start. A clause with no operational control behind it is a compliance risk.
Checking status is only half of it. You also need to be reasonably satisfied that the person who turns up is the person you checked. In practice that means whatever you already use to control access — signing-in systems, photo passes, biometric entry, or a digital identity service. For a small team that may be as simple as knowing your own people. On a large site with rotating labour, it will not be.
Start with your contracts
If you only do one thing before October, do this one.
Pull out your subcontractor and labour supply agreements and check that each one answers four questions:
- Who carries out the Right to Work check?
- Who keeps the evidence, and for how long?
- Can you ask to see it, and how quickly?
- What happens if the Home Office asks?
In a longer chain you may not be the one doing the checking, and that is fine. What you need is to be able to show that the right party did it, and that your contract required them to. An agreement that is silent on all four points is the thing to fix first — and it is quicker to fix now than to argue about afterwards.
What documents count
Where you do have to check someone, there are two routes. Which one applies depends on the person, not on your preference.
The online check — a share code
Anyone with an eVisa can only prove their right to work through the Home Office online service. They generate a nine-character share code, give it to you, and you enter it along with their date of birth. The code is valid for 90 days and can be used as many times as you need within that window.
This now covers most people with time-limited immigration status. Physical immigration documents are no longer issued, so if someone offers you a card instead of a share code, that is a flag worth pausing on.
The manual check — original documents
For people who can still prove status on paper, you need to see an original document from the Home Office’s published lists, in the presence of the holder, and keep a clear dated copy.
- List APeople with a permanent right to work, including British and Irish citizens. A passport is the usual one, and it can be expired. One check and you are done — no follow-up.
- List BPeople with a time-limited right to work. Your excuse lasts only as long as their permission, so you must diarise a follow-up check before it expires.
List A gives you a continuous statutory excuse. List B gives you a time-limited one. Miss the follow-up on a List B check and the excuse lapses, even though you did the original check properly.
Keeping the evidence
- Take a clear copy of the document, or save the online check profile as a PDF
- Record the date you carried out the check — an undated copy is worth very little
- Keep it for the duration of the engagement and for two years afterwards
- Diarise the follow-up date for anyone checked under List B
The full lists run to several pages and change from time to time, so we have linked the Home Office guide rather than reproducing them here. The employer’s checklist is a useful one-pager to keep with your onboarding file.
“Do I have to redo it every 90 days?”
No. This is the question we expect to be asked most, so it is worth being precise: the 90 days is the shelf life of the code, not of the check. There are three separate clocks, and almost everyone mixes them up.
| The clock | How long | What it actually governs |
|---|---|---|
| 1. The share code | 90 days | How long the link stays live. Miss it and he simply generates a new one. Nothing to do with his visa. |
| 2. Your check | Permanent, once done | Once you look up the code and save the result, you have your statutory excuse. It does not expire when the code does. |
| 3. His immigration permission | Until it expires | The only one that matters long term. This triggers a repeat check — not the calendar, not the code. |
So: no 90-day cycle, and no annual code. The check you did is the check, unless clock three applies.
Which one is he? The check result tells you
- “No time limit” — indefinite leave to remain or settled status. One and done. British and Irish citizens are the same, but prove it with a passport.
- A date on it — pre-settled status or a work visa. Do one follow-up check before that date, and put it in the calendar with a month’s warning.
New engagement, new check
Every engaging business does its own check and keeps its own record. If your SEO contractor also works for three other firms, all four of you check him separately — there is no shared register, and someone else’s check gives you no protection. He can hand the same code to all of you within its 90 days, but each of you must do your own lookup and keep your own dated record.
This is where businesses actually get caught. Not failing to check — forgetting the follow-up, and letting a good check quietly lapse.
What to do before 1 October
- Step 1Map how labour actually enters your business. Not just recruitment — procurement, operations and individual managers all engage people.
- Step 2Work out who holds the direct contractual relationship with each individual doing work for you.
- Step 3Review your subcontractor and supplier agreements. Do they say who carries out the checks, who keeps the evidence, and what happens if the Home Office asks to see it?
- Step 4Check your substitution and site access arrangements. Can you evidence that the person working is the person checked?
- Step 5Keep your records. Copies of checks, dated, retained for the required period.
- Step 6Brief the right people. This is no longer only an HR matter — whoever signs off subcontractors or outsourced services needs to understand it too.
An important note on what we can and cannot do for you
Please note that Business Help UK cannot carry out Right to Work checks on your behalf. These checks remain the responsibility of the business engaging the worker.
We can help you understand how the changes affect your arrangements, review where responsibility sits across your contracts, and make sure your record-keeping and processes stand up to scrutiny. But the check itself must be carried out by the engaging business.
With 1 October now days away, we’d encourage you to review your arrangements straight away. The mapping is the work. The paperwork follows from it.
If you engage subcontractors, self-employed individuals or outsourced labour and you are not certain where responsibility sits, we can work through it with you.
Get in touch, or see our payroll service.
Published September 2026. The expansion of the scheme is in the Border Security, Asylum and Immigration Act 2025 and the 1 October date is fixed. The detail of how the Home Office expects businesses to demonstrate compliance sits in guidance and a Code of Practice that were still in draft when this was written. The direction of travel is clear; some of the fine print may yet move.
This article is for general information and does not constitute legal advice. Where your arrangements are complex, we’d recommend taking specialist immigration advice.