Right to work checks are expanding to contractors: what changes on 1 October 2026

From 1 October 2026, right to work checks stop being an employees-only duty. Regulations laid in Parliament on 30 June extend the checks, and the civil penalties for skipping them, to businesses that engage agency staff, individual subcontractors, and gig economy workers. If any part of your workforce sits outside a standard employment contract, your current process has a gap, and you have three months to close it.

Here's what's changing, who's now in scope, and what to do before October.

What's changing

Until now, the legal duty to check someone's right to work has applied to employers taking on direct employees. Businesses using contractors, agency staff, or platform workers could rely on someone else in the chain doing the checking, and the civil penalty regime couldn't reach them if nobody did.

That's the gap the government is closing. Section 48 of the Border Security, Asylum and Immigration Act 2025 comes into force on 1 October 2026, extending the illegal working regime beyond contracts of employment. Alongside it, updated regulations and statutory codes of practice for employers were laid on 30 June 2026, setting out how the extended checks work in practice.

In his written statement to Parliament, the Minister for Border Security and Asylum, Alex Norris, said the reforms extend right to work checks to "companies who contract workers or individual sub-contractors to provide services under their company name, such as agency workers or workers in the gig economy".

Who's now in scope

From 1 October 2026, the duty to check covers businesses engaging:

• Agency workers supplied to work under your company's name.
• Individual subcontractors providing services under your company's name.
• Gig economy and platform workers, including individuals matched to work through online platforms.
• Casual, temporary, and zero-hours arrangements that sit outside a standard employment contract.

The common thread is that responsibility follows the work, not the contract type. If someone is providing services under your name, the government expects you, or someone in your chain who can prove it, to have verified their right to work.

The penalties, and why the chain matters

The civil penalty rates aren't changing, but who can be fined is. The maximum penalty for failing a Home Office Audit is £45,000 per illegal worker for a first breach, and £60,000 per worker for repeat breaches.

What's new is that liability can now move through the contractual chain. If the direct employer of an illegal worker can't be identified, or fails to comply, the business that engaged them can be penalised instead. For anyone running a flexible workforce at scale, that changes the risk calculation: a contractor's paperwork problem can now become your penalty.

For sponsor licence holders, the stakes stack higher still. Illegal working penalties are one of the compliance failures the Home Office weighs when reviewing a licence, and revocations are already running at record levels. A missed check on a contractor could put your sponsored workforce at risk too.

If you want a quick health check on your current process, our Right to Work Check Checklist covers what a compliant check looks like step by step.

Digital checks must use registered providers

The same package tightens the rules on digital identity verification. From October, if you choose to run digital right to work checks, they must be carried out through a government-registered digital verification service provider (DVSP).

If you currently use a digital identity provider for onboarding, check whether they're registered, or plan to be, before October. Powers in the Data Use and Access Act 2025 will also broaden digital document verification over time, so digital checking isn't going away. It just has to run through approved rails.

What to do before 1 October

None of this requires panic, but it does require a plan. Four things worth doing this quarter:

1. Map your flexible workforce. List everyone doing work under your name who isn't a direct employee: agency staff, contractors, platform workers, casual staff. That's your newly in-scope population.
2. Decide who checks, and put it in writing. Where an agency or intermediary sits in the chain, agree contractually who runs the check and who holds the evidence. Liability can travel, so "we assumed the agency did it" won't hold.
3. Extend your existing process. The check itself is the same one you run for employees: manual document check, Home Office online check, or digital check through a registered provider. The change is who it applies to.
4. Keep records like you'd show them tomorrow. A compliant check only protects you if you can evidence it. Store the evidence for every worker in scope, with dates.

Enforcement starts in October 2026, in line with the common commencement date for businesses. The government has signalled that illegal working is a priority, and the recent record on sponsor licence revocations suggests the follow-through will be real.

Where Borderless fits

Borderless Immigration runs right to work checks, compliance tracking, and sponsor licence management in one platform, so every worker's status is verified, recorded, and in date without the spreadsheet. If you're working out what the October changes mean for your organisation, book a demo and we'll walk you through it.

There's just too much at stake.

Sources: Written ministerial statement HCWS159, 30 June 2026; Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026; Immigration (Restrictions on Employment and Residential Accommodation) (Prescribed Requirements and Codes of Practice) (Amendment) Regulations 2026.