Right to Work checks are changing on 1 October 2026 — what it means if you use subcontractors
From 1 October 2026, Right to Work obligations extend beyond traditional employees for the first time. If your business engages subcontractors, self-employed individuals or outsourced labour, here’s what you need to know and what you need to do before the deadline.
- What’s changing
- What has not changed
- Every subcontractor?
- Real-life examples
- Statutory excuse
- What documents count
- Every 90 days?
- What to do
- What we can and cannot do
What’s changing
For years, Right to Work checks have been something you did when you took someone onto the payroll. From 1 October 2026 that changes.
Section 48 of the Border Security, Asylum and Immigration Act 2025 widens the definition of “employer” for the purposes of the illegal working regime. It does not change employment law generally, but it does mean the duty to carry out Right to Work checks now reaches into working arrangements that have always sat outside it.
The arrangements brought into scope include:
- individuals engaged under a worker’s contract
- individual subcontractors
- certain workers sourced through online matching platforms and labour supply arrangements
If someone is doing work for your business and you are not putting them through your payroll, that no longer automatically means Right to Work is somebody else’s problem.
What has not changed, and why this matters
There has been a lot of alarming commentary about these reforms, some of it based on the original consultation rather than the final rules. It’s worth being clear about what the Home Office did not do.
There is no blanket liability across the whole supply chain
Responsibility is determined by the statutory framework and by the actual contractual relationships between the parties. The starting point remains that responsibility sits with the business that has the direct contractual relationship with the individual.
Agency workers are not a separate legal category
Some agency labour will fall within the new provisions depending on how it is contracted, but “agency worker” is not a standalone trigger.
You do not have to use a Digital Verification Service Provider
The existing Home Office checking routes — manual checks, the online check and eligible digital verification — all still establish a statutory excuse. A DVSP is one option, not a requirement.
Civil penalties are not going up
They remain at up to £45,000 per illegal worker for a first breach and up to £60,000 for a repeat breach within three years.
Does this catch every subcontractor?
No — and this is the point most likely to be misunderstood.
“Contractor” is too broad a word to answer the question. A genuinely independent business supplying a service through its own limited company — a plumber, an electrician, a freelance designer trading as a limited company — will generally sit outside the extended regime, because you are contracting with a company, not engaging an individual.
The position is different where you engage an individual directly, where the arrangement looks like a worker’s contract, or where the contractual chain is layered enough that it is not obvious who holds the direct relationship with the person actually on site. Where the responsible employer cannot be identified, or where the prescribed compliance requirements have not been met, responsibility can extend to another business in the arrangement.
The real work here is mapping your arrangements, not rewriting your onboarding forms.
What that looks like in real life
| The arrangement | Do you check? | Why |
|---|---|---|
| A self-employed bricklayer. Works as himself, invoices as himself. | Yes | He’s a person. You contracted with him. |
| Smith Brickwork Ltd. They send three lads to site. | No | You contracted with a company. Smith Brickwork Ltd checks its own lads. |
| A plumber trading as J. Bloggs Plumbing Ltd. | No | Company again. |
| A driver off a gig app. | Depends | On who the contract is with — you or the app. |
The bit people are getting wrong
Lots of the press is saying you’re now responsible for everyone below you in the chain, all the way down. You’re not.
If Smith Brickwork Ltd hires a dodgy subbie, that’s Smith’s penalty, not yours. You contracted with Smith.
There’s one exception. If the Home Office turns up and can’t work out who the direct employer is — the paperwork’s a mess, nobody can show a contract, it’s all cash and handshakes — then they can look further up the chain. So the way you protect yourself is: have a proper written contract, and be able to produce it.
That’s the real message. Tidy contracts, not more checking.
Establishing a statutory excuse under the new rules
The checking methods are unchanged. What changes for more complex arrangements is what else you may need in place to rely on a statutory excuse. Depending on the arrangement, that can include:
- written contractual warranties on Right to Work compliance
- audit rights and evidence-sharing obligations
- a commitment to cooperate with Home Office investigations
- identity verification, confirming the person doing the work is the person who was checked
- controls around substitution, where someone else can be sent to do the job
Substitution clauses. A clause that exists on paper but has no operational control behind it is a compliance risk.
What documents count
Where you do have to check someone, there are two routes. Which one applies depends on the person, not on your preference.
The online check — a share code
Anyone with an eVisa can only prove their right to work through the Home Office online service. They generate a nine-character share code, give it to you, and you enter it along with their date of birth. The code is valid for 90 days and can be used as many times as you need within that window.
This now covers most people with time-limited immigration status. Physical immigration documents are no longer issued, so if someone offers you a card instead of a share code, that is a flag worth pausing on.
The manual check — original documents
For people who can still prove status on paper, you need to see an original document from the Home Office’s published lists, in the presence of the holder, and keep a clear dated copy.
- List APeople with a permanent right to work, including British and Irish citizens. A passport is the usual one, and it can be expired. One check and you are done — no follow-up.
- List BPeople with a time-limited right to work. Your excuse lasts only as long as their permission, so you must diarise a follow-up check before it expires.
List A gives you a continuous statutory excuse. List B gives you a time-limited one. Miss the follow-up on a List B check and the excuse lapses, even though you did the original check properly.
Keeping the evidence
- Take a clear copy of the document, or save the online check profile as a PDF
- Record the date you carried out the check — an undated copy is worth very little
- Keep it for the duration of the engagement and for two years afterwards
- Diarise the follow-up date for anyone checked under List B
The full lists run to several pages and change from time to time, so we have linked the Home Office guide rather than reproducing them here. The employer’s checklist is a useful one-pager to keep with your onboarding file.
“Do I have to redo it every 90 days?”
No. And this is the question we expect to be asked most, so it is worth being precise.
The 90 days is the shelf life of the code, not of the check. Once you have used it, it has done its job. There are three separate clocks running, and almost everyone mixes them up.
| The clock | How long | What it actually governs |
|---|---|---|
| 1. The share code | 90 days | How long the link stays live, from the moment he generates it. If you do not look it up in time, the code dies and he makes a new one. Nothing to do with his visa. |
| 2. Your check | Permanent, once done | The moment you look up the code and save the result, you have your statutory excuse. It does not expire when the code does. |
| 3. His immigration permission | Until it expires | The only clock that matters long term. This is what triggers a repeat check — not the calendar, and not the code. |
So you do not go back every 90 days, and you do not ask for a fresh code annually. The check you did on the day you did it is the check, unless clock three applies.
Which one is he?
The online check result tells you.
- “No time limit” — indefinite leave to remain or settled status. You never check again. One and done. British and Irish citizens sit in the same category, though they prove it with a passport rather than a share code.
- A date on it — pre-settled status, a work visa, any time-limited permission. You do one follow-up check before that date. He generates a new code then, you check again, and you diarise the next one if there is one.
New engagement, new check
Every engaging business does its own check and keeps its own record. If your SEO contractor also works for three other firms, all four of you check him separately. There is no shared register, and someone else’s check gives you no protection whatsoever.
Within that 90-day window the same code can be used more than once. A subcontractor starting with several firms in the same month can hand the same code to all of them. Each firm still has to do its own lookup and keep its own dated record — but he does not need to generate a fresh code for each one.
What this means for your filing
Two piles, and only one of them needs watching.
- Done foreverBritish and Irish passports, and any “no time limit” result. File and forget.
- Diary dateAnything with an expiry. Put the date in a calendar with a month’s warning.
This is where businesses actually get caught. Not failing to check — forgetting the follow-up, and letting a good check quietly lapse.
What to do before 1 October
- Step 1Map how labour actually enters your business. Not just recruitment — procurement, operations and individual managers all engage people.
- Step 2Work out who holds the direct contractual relationship with each individual doing work for you.
- Step 3Review your subcontractor and supplier agreements. Do they say who carries out the checks, who keeps the evidence, and what happens if the Home Office asks to see it?
- Step 4Check your substitution and site access arrangements. Can you evidence that the person working is the person checked?
- Step 5Keep your records. Copies of checks, dated, retained for the required period.
- Step 6Brief the right people. This is no longer only an HR matter — whoever signs off subcontractors or outsourced services needs to understand it too.
An important note on what we can and cannot do for you
Please note that Business Help UK cannot carry out Right to Work checks on your behalf. These checks remain the responsibility of the business engaging the worker.
We can help you understand how the changes affect your arrangements, review where responsibility sits across your contracts, and make sure your record-keeping and processes stand up to scrutiny. But the check itself must be carried out by the engaging business.
With 1 October now days away, we’d encourage you to review your arrangements straight away. The mapping is the work. The paperwork follows from it.
If you engage subcontractors, self-employed individuals or outsourced labour and you are not certain where responsibility sits, we can work through it with you.
Get in touch, or see our payroll service.
Published September 2026.
This article is for general information and does not constitute legal advice. Where your arrangements are complex, we’d recommend taking specialist immigration advice.