Preventing illegal working and right to work checks: New rules from 1st October 2026

Section 48 of the Border Security, Asylum and Immigration Act 2025 comes into force on 1st October 2026, alongside a revised Code of Practice on preventing illegal working. Together, they mark one of the most significant changes to UK immigration compliance in years, extending illegal working civil penalty risk well beyond the traditional direct employer relationship - reaching into labour supply chains, subcontracting arrangements and online job-matching platforms.

In practice, this means agency workers, individual subcontractors, zero-hours staff, gig economy workers and platform-based labour will all fall within scope, regardless of how the engagement is labelled. Businesses that have only ever run right to work checks on direct employees will need to map their entire labour supply chain and reassess where their compliance obligations now sit.

Summary

• From 1 October 2026, the definition of "employer" for right to work purposes widens to include certain subcontracting arrangements, worker's contracts, individual sub-contractors and online matching services - not just direct employment relationships.
• Civil penalties for illegal working can reach up to £60,000 per worker, and businesses with complex labour supply chains, subcontractors or agency arrangements face the greatest exposure.
• Employers facing extended liability must meet new "prescribed requirements" - written contractual terms, substitution controls and identity verification - to establish a statutory excuse against penalty.
• Right to Work Digital Verification Service Providers (RtW DVSPs) must be registered.

What's changing on 1st October 2026?

Who counts as an "employer" under the new rules?

Section 48 of the Border Security, Asylum and Immigration Act 2025 inserts a new section 14A into the Immigration, Asylum and Nationality Act 2006. From 1st October 2026, references to an "employer" of an "individual" for right to work purposes will include a business that:

• employs someone under a contract of employment (a contract of service or apprenticeship)
• engages someone under a worker's contract
• engages an individual sub-contractor
• operates an online matching service and puts individual service providers in touch with clients or customers.

This goes well beyond the traditional direct employer, and organisations that don't consider themselves to be "employing" anyone in the conventional sense - because they rely on subcontractors, agency staff or an online platform to connect workers with clients - may still fall within scope.

The Code of Practice also introduces a set of new defined terms, including "individual sub-contractor" (someone providing work or services under a contract, where that work ultimately fulfils a separate third-party contract they aren't party to) and "online matching service" (a business that keeps a register of service providers and charges a fee when it matches them with clients). Businesses using complex supply chains should expect these definitions to require careful, case-by-case interpretation.

How to establish a statutory excuse

Where extended liability applies, an employer can still protect itself from a civil penalty by completing “prescribed requirements” to obtain a statutory excuse - but doing so now requires more than completing a standard right to work check. Depending on the arrangement, businesses may need to put in place the following arrangements:

• Written contractual terms with other employers or service providers in the supply chain, requiring them to carry out right to work checks, restricting further subcontracting without consent, and allowing audits and enforcement action.
• Substitution controls, where a contract allows a worker to be substituted by someone else, ensuring that any substitute has their right to work verified before starting.
• Identity verification systems, to confirm that the person actually doing the work is the person whose right to work was checked - this could include ID passes, biometric systems or facial verification.

The Code is not prescriptive about exactly which systems to use, but employers relying on another party's checks (such as a Right to Work Digital Verification Service Provider) must take reasonable steps to satisfy themselves that those checks are effective.

Registration requirements for digital verification providers

The Code also renames "Digital Verification Service" (DVS) providers as "Right to Work Digital Verification Service Providers" (RtW DVSPs). From 1st October 2026, it becomes mandatory for any RtW DVSP an employer uses to be registered on the Office for Digital Identities and Attributes (OFDIA) register, with confirmation that it's authorised to carry out right to work checks. Employers are not required to use a RtW DVSP if another appropriate checking method is available.

What are the penalties for illegal working?

The consequences for getting this wrong are significant. Civil penalties can reach up to £45,000 per illegal worker for a first breach, rising to £60,000 for repeat breaches within three years, and licensed sponsors risk having their sponsor licence revoked entirely. Where a business knew, or had reasonable grounds to suspect, that a worker lacked the right to work, the matter can escalate to criminal liability - carrying an unlimited fine and a prison sentence of up to five years. Immigration Officers also hold the power to issue a closure notice, shutting down business premises immediately for up to 48 hours. That closure can then be extended for up to 12 months through an illegal working compliance order granted by the Court.

What should employers be doing before 1st October 2026?

Here’s a list of actions employers could be taking now to ensure future compliance with these changes.

• Mapping labour supply chains, identifying where subcontractors, agency workers or online platforms are used, and assessing which arrangements could bring the business into scope of the wider "employer" definition.
• Reviewing and updating contracts with agencies, subcontractors and service providers to include the required written terms.
• Checking RtW DVSP registration for any digital verification providers used, to confirm they're on the OFDIA register and authorised to carry out right to work checks.
• Reviewing identity verification processes, particularly where substitution clauses exist in contracts.
• Training relevant teams - HR, procurement, contract management and operational managers - so they understand the wider scope of liability.
• Retaining evidence of compliance, since the Code expects businesses to be able to demonstrate the steps they've taken on request.

The bottom line for employers

Taken together, these changes represent the most significant expansion of UK illegal working liability since the Immigration Act 2016. The core message for businesses is simple: right to work compliance can no longer be treated as an HR-only, direct-employee exercise. Any organisation that engages labour through subcontractors, agencies, or platforms needs to trace those relationships now, tighten its contracts, and confirm its verification processes meet the new prescribed requirements - because from 1st October 2026, "we didn't employ them directly" will no longer be a defence.

This article is intended for informational purposes only and does not constitute legal advice. The information is accurate at the time of writing but may be subject to change. For advice specific to your situation, please consult a qualified professional.