Right to work checks from 1 October 2026: what HR teams need to know

Right to work checks from 1 October 2026: what HR teams need to know in summary:

• From 1 October 2026, right to work checks extend beyond employees to workers, individual subcontractors and people found through online matching platforms.
• You could be liable for illegal working further down your supply chain unless the right contract terms and identity controls are in place.
• Digital verification providers must be on the OfDIA register, and authorised for right to work checks, to give you a statutory excuse.
• Existing staff don’t need re-checking, but any follow-up check from 1 October must follow the new rules.

---

If you look after right to work checks, you’ve probably got a routine that works.

Maybe it’s a folder of scanned passports with a spreadsheet of share codes and follow-up dates alongside it. It has served you well since the last big shake-up in 2022. But from Thursday 1 October 2026, the rules change again, and for some organisations they change a lot.

The biggest shift is who you need to check. Section 48 of the Border Security, Asylum and Immigration Act 2025 comes into force on that date, alongside a revised Home Office Code of Practice. Together, they widen the duty to prevent illegal working and push some of the liability up supply chains. It’s one of several employment law changes landing in 2026, so this guide sticks to what’s new, what hasn’t moved and what to do next.

What are the new right to work rules from October 2026?

Quick answer: From 1 October 2026, UK right to work checks cover more than employees. Workers, individual subcontractors and people engaged through online matching platforms are now in scope. Businesses can also be liable for illegal working in their supply chain. Civil penalties reach £60,000 per worker for repeat breaches, and digital check providers must be on the OfDIA register.

Who needs a right to work check from 1 October 2026?

Until now, the Right to Work Scheme only covered people on a contract of employment. From 1 October, the duty to prevent illegal working reaches much further. The Act brings these groups into scope for the first time:

• Workers on a worker’s contract. They aren’t employees, but they provide the work personally.
• Individual subcontractors, including people further down a contracting chain.
• People found through online matching services, which covers a lot of gig and platform work.

Genuinely self-employed people, who are in business on their own account, stay out of scope. What matters is how the arrangement works in practice, not what the contract calls it.

The Home Office uses the example of a self-employed rider on a food delivery platform. If that rider regularly sends a friend to do deliveries instead, the platform may be treated as employing both of them. So if someone is labelled a “freelancer” but works like one of your team, treat them as in scope until you’ve checked.

Do you need to re-check your existing staff?

No. The new rules don’t require retrospective checks on people who already work for you. For the newly covered groups, penalty exposure applies to engagements that start on or after 1 October 2026. Follow-up checks are where it catches up with you, though. Any repeat check carried out from 1 October must follow the new Code, so anyone with time-limited permission still needs your attention.

Can you be liable for a contractor’s or agency’s checks?

Yes, in some cases, which means your suppliers’ checks are now partly your problem.

If a business you subcontract to engages someone without the right to work, liability could travel back up the chain to you. To protect yourself, the revised draft Code expects specific contract terms to be in place before work starts. These include a duty to carry out right to work checks and a ban on unauthorised subcontracting. You’ll also need audit rights and a commitment to co-operate with any Home Office investigation, plus a way to verify the identity of whoever actually turns up.

Paperwork alone won’t cover you, as the Home Office expects these controls to work in practice. For example, lawyers at Howes Percival suggest mapping every type of arrangement across your workforce first. They warn this will be the hardest part for many businesses. Once you know who’s who, you can review supplier and agency contracts against the new rules.

What are the penalties for illegal working in 2026?

The civil penalty is up to £45,000 per illegal worker for a first breach. That rises to £60,000 per worker for repeat breaches within three years. These amounts aren’t new on 1 October, as they went up in February 2024. If you’re working from older guidance, you may still see a figure of £20,000, which is well out of date. What is new is the number of people and arrangements the penalties can now apply to.

Criminal liability sits on top of this. If you know, or have reasonable cause to believe, that someone is working illegally, you could face prosecution. The maximum penalty is an unlimited fine and up to five years in prison. Licensed sponsors can also have their licence suspended or revoked. Then there’s the reputational damage, which is much harder to put a number on.

Is a right to work check at onboarding still enough?

Not always, particularly where you use subcontractors, platforms or contracts that allow substitution. Right to work used to be something you checked before day one as part of onboarding and then filed away. The revised draft Code, published on 30 June 2026, expects you to be confident that the person you checked is the person doing the work. In practice, that might mean ID passes, facial verification, attendance systems or periodic identity checks. As the team at Farrer & Co put it, compliance should not be treated as a “one-off onboarding exercise”.

Some of these methods involve biometric or tracking data, so bring in whoever looks after GDPR and data protection before you choose one.

What’s changing for digital right to work checks?

If you use a digital verification provider, it’s worth a quick email to them this week. From 1 October, the provider must be listed on the Office for Digital Identities and Attributes (OfDIA) register. Its listing must also confirm that it’s authorised for right to work checks, because general identity certification isn’t enough. If your provider doesn’t meet both conditions, your checks won’t give you a statutory excuse. Many background screening firms subcontract this step, so ask exactly who carries out the check.

There’s some good news too. Registered providers will be able to check expired British and Irish passports, and Irish passport cards, up to six months past their expiry date. It’s also a good moment to tidy up any old process notes. Biometric residence permits have been replaced by eVisas. People with immigration status now prove their right to work online with a share code, not a physical card.

What hasn’t changed about right to work checks?

Plenty of the basics are exactly where they were, and the Home Office’s Employer’s guide to right to work checks is still the place to confirm the detail.

• Check before work starts. Without a check, you have no statutory excuse.
• Use a prescribed method. That’s a manual document check, a Home Office online check with a share code, or a registered digital provider.
• Keep clear records. Keep a copy of what you checked and the date you checked it, for as long as the person works for you and two years after.
• Book in follow-up checks. Anyone with time-limited permission needs a repeat check before it runs out.
• Treat everyone the same. Check every new starter in the same way, so nobody is singled out. There’s a separate Home Office code on avoiding unlawful discrimination while you do this.

How can HR prepare for the right to work changes?

Whether you’re reading this before or just after 1 October, here’s a list to work through with your team:

1. Map your workforce. List everyone who does work for you, from employees and agency staff to freelancers, subcontractors and platform workers. Mark who’s now in scope.
2. Review supplier contracts. Check for right to work terms, limits on subcontracting and substitution, audit rights and a way to verify identity.
3. Check your digital provider. Confirm they’re on the OfDIA register and authorised for right to work checks.
4. Track follow-up dates. Are repeat checks recorded somewhere reliable, or buried in a spreadsheet only one person understands?
5. Test your records. If the Home Office asked tomorrow, could you find proof of any check in five minutes?
6. Brief your managers. Anyone involved in recruitment and onboarding, or in hiring contractors, needs to know the new rules. Procurement should be in that conversation too.

How can HR software help with right to work compliance?

If your right to work records are spread across spreadsheets, inboxes, disconnected HR systems and shared drives, the new rules will make that harder to keep up. There are more people to check, more dates to track and more evidence to find at short notice. Keeping everything in one HR system means check dates, document copies and follow-up reminders live in the same place, rather than in five different files.

Cezanne’s People Management module includes dedicated features for managing visas and right to work, alongside document storage and automatic reminders you can tailor. It won’t decide whether a contractor is in scope, and it shouldn’t. What it can do is take the admin off your plate, so you have more time for the calls that need human judgement.

Frequently asked questions about right to work checks in 2026

When do the new right to work rules come into force?

On 1 October 2026. That’s when section 48 of the Border Security, Asylum and Immigration Act 2025 takes effect, alongside the Home Office’s revised Code of Practice on preventing illegal working. The updated Employer’s guide to right to work checks applies from the same date.

Do I need to carry out right to work checks on contractors?

It depends on the arrangement. From 1 October, people on worker’s contracts and individual subcontractors are in scope. Genuinely self-employed people running their own business are not. The label on the contract doesn’t decide it. How the arrangement works in practice does.

Do I need to re-check existing employees?

No. The new rules don’t require retrospective checks on people already working for you. However, any follow-up check carried out on or after 1 October must follow the new Code. Keep tracking expiry dates for anyone with time-limited permission to work.

What is the maximum fine for employing an illegal worker?

Up to £45,000 per worker for a first breach, and up to £60,000 per worker for repeat breaches within three years. If an employer knows, or has reasonable cause to believe, someone is working illegally, it can face prosecution. The maximum is an unlimited fine and five years in prison.

What is a statutory excuse?

It’s your defence against a civil penalty. If you carry out a prescribed right to work check correctly before work starts, and keep the right records, you won’t be liable for a civil penalty. That holds even if the person later turns out not to have the right to work.

What is the OfDIA register?

It’s the government’s register of certified digital verification services, run by the Office for Digital Identities and Attributes. From 1 October, any digital provider you use for right to work checks must be on it. Its listing must also show it’s authorised specifically for right to work checks.

Can someone still use a biometric residence permit to prove their right to work?

No. Biometric residence permits have been replaced by eVisas. People with immigration status now prove their right to work online by giving you a share code. You then check it using the Home Office’s online service.

What counts as an online matching service?

It’s a business that keeps a register of service providers and matches them with clients or customers online. It usually charges a fee or commission when a match is made. Many gig economy and marketplace platforms fall into this group.

How long should I keep right to work records?

Keep a copy of the documents you checked for as long as the person works for you, then for two years after the work ends. Record the date you made the check, too. Storing records securely in one place makes them much easier to find if the Home Office asks.

Do the changes affect organisations that don’t sponsor visa workers?

Yes. The changes apply to any business that engages labour in the UK, not just licensed sponsors. Sectors that rely on flexible or subcontracted labour are likely to feel the biggest impact. Think logistics, hospitality, construction, cleaning and facilities management.

So, where should you start?

The changes are significant, but they’re manageable if you take them one step at a time. Start by working out who’s now in scope. From there, check your supplier contracts and your digital provider. Then make sure your records would stand up to a Home Office visit.

If you’d like to see how Cezanne keeps right to work documents, dates and reminders in one place, book a demo with one of our team.

BIG NOTE! This guide is for general information only and isn’t legal advice. The Home Office Code and Employer’s guide were still in draft at the time of writing. For specific situations, speak to an immigration or employment law specialist.