You take on a courier through an app, a plasterer who invoices you as a sole trader, and an agency picker for the warehouse. None of the three triggers a right to work check today. From 1 October 2026 all three do, and the penalty for missing one runs to £60,000 per worker.
TL;DR: From 1 October 2026, right to work checks extend beyond employees to agency staff, individual subcontractors, gig workers and zero-hours staff. Civil penalties reach £45,000 per worker for a first breach and £60,000 for a repeat. Existing engagements need no retrospective check, but new ones from that date do.
What Changes for Employers on 1 October 2026?
Section 48 of the Border Security, Asylum and Immigration Act 2025 comes into force on 1 October 2026. It widens the illegal working rules so the duty to check, and the civil penalty for failing to, no longer stops at people on a contract of employment (Border Security, Asylum and Immigration Act 2025, s.48, 2025).
The date was fixed by a commencement order laid on 30 June 2026 (Commencement No. 4 Regulations 2026, 2026). Section 48 inserts new sections 14A and 15A into the Immigration, Asylum and Nationality Act 2006. The effect of section 14A is that every reference to "employment" in the penalty provisions now reads as "engagement" too.
That one word does most of the work. If you engage someone's personal labour, you are inside the regime, whatever the paperwork calls it.
Which Workers Are Now in Scope?
Three categories join. People under a worker's contract, meaning anyone who undertakes to perform work or services personally without being an employee. Individual subcontractors, where you have contracted to deliver a service and passed part of it to an individual. And online matching services that connect providers to customers for a fee.
In practice that pulls in agency workers, zero-hours and casual staff, self-employed subcontractors on your sites, and gig or platform workers. A record 1.24 million people were on zero-hours contracts as at March 2026 (Work Foundation analysis of ONS data, 2026).
For firms already filing CIS returns for subcontractors the overlap is immediate: the same person inside your CIS process is now inside your right to work process. What we see most often is businesses assuming the agency or platform has handled it. From 1 October that assumption carries a price.
Does This Catch Limited Company Contractors?
Not automatically. The test turns on whether an individual undertakes to perform the work personally, so a genuine business-to-business contract, where you buy an outcome from a company rather than one named person's labour, can still sit outside the regime (Morgan Lewis, 2026).
The qualifier matters. The Home Office looks at the working reality, not the wording. A one-person company whose sole director turns up, works to your instructions and cannot send anyone else looks like personal service however the invoice is headed. A substitution clause that has never once been used will not rescue it.
This is the same substance-over-form question that decides who carries the PAYE risk in a labour supply chain, and it tends to produce the same answer. If you already treat a contractor as inside IR35, the off-payroll working rules, assume they are inside these rules too.
Extended Liability Through the Labour Chain
Section 15A is the part most businesses miss. It creates exposure for a business that had no direct contract with the worker at all.
The Home Office pursues the direct engager first. Where that party cannot be identified, or has not met the requirements, liability can move up the chain to the business the work was ultimately done for. It also reaches online platforms, and cases where a contractor sends a substitute nobody checked.
So a main contractor can be penalised over a labourer engaged three links down, and a retailer over a cleaner supplied by a facilities firm that has since folded. The protection is contractual: written terms requiring checks, limits on further subcontracting, audit rights, and a way to confirm the worker on site is the one who was checked (Lewis Silkin, 2026).
Do You Need to Re-Check People You Already Engage?
No. There is no requirement to run retrospective checks on arrangements already running on 1 October 2026. The revised Code, still in draft at the time of writing, applies to engagements starting on or after that date and to any follow-up check falling due on or after it. Final Home Office guidance is expected before 1 October.
Follow-up checks are where this bites quietly. If you engage someone with time-limited permission to work, the repeat check diarised for November or March gets assessed under the new Code. Re-engaging a casual worker after a gap counts as a new engagement too.
The commencement order carries no transitional or saving provisions, so the cut-off is clean. One question clients always ask is whether to sweep the whole contractor base anyway. For most it is worth doing, because the exercise finds the people with no check on file at all.
What Are the Penalties for Getting This Wrong?
Up to £45,000 per illegal worker for a first breach, and up to £60,000 per worker for a repeat breach inside three years (GOV.UK illegal working penalties code of practice, 2026). Those levels have applied since February 2024, when they roughly tripled the previous £15,000 and £20,000 starting points.
Two reductions are available: £5,000 off for reporting the suspected illegal working yourself, and another £5,000 for cooperating with the investigation. Neither helps if there was no check on file.
These are not theoretical figures. Between January and June 2026 the Home Office penalised more than 1,200 businesses, with fines totalling over £74 million, after 7,270 illegal working visits and 4,756 arrests, with visits up 31% year on year (GOV.UK enforcement activity to the end of June 2026, 2026).
Criminal liability sits behind the civil penalty where an employer knows, or has reasonable cause to believe, someone has no right to work. For most businesses the civil penalty is the real exposure, and it is charged per worker, so one unchecked placement is not the ceiling.
Three Ways to Run a Compliant Check
Only three methods give you a statutory excuse. Anything else leaves you exposed even if the person is perfectly entitled to work.
A manual check means seeing original List A or List B documents, checking them with the person present in person or over live video, then keeping a dated copy. An online check uses the individual's share code through the employer service at gov.uk/view-right-to-work; share codes last 90 days and can be reused inside that window. For British and Irish citizens, a certified identity service provider can verify a passport digitally.
Looking at someone's status on their own phone does not count. Nor does a different GOV.UK page. The excuse comes from the employer-facing service and the record you keep of it, the same evidence-trail logic behind Companies House identity verification.
Your Checklist Before 1 October
Map the workforce first. List everyone who works for the business and is not on the payroll: agency placements, self-employed subcontractors, casual and zero-hours staff, platform workers, and anyone engaged through a one-person company.
Then close the gaps:
- Decide in writing which party runs the check for each engagement route
- Add check, no-further-subcontracting, audit and substitution clauses to agency and subcontractor contracts
- Confirm the person on site is the person who was checked
- Diarise every follow-up check for time-limited permissions
- Brief whoever onboards casual staff, where the record usually goes missing
When we reviewed a client's contractor file this summer, every employee had a check on record and none of the twelve subcontractors did. That is a normal starting position, and fixable inside a fortnight.
Frequently Asked Questions
Do I need to check a contractor who invoices through their own limited company?
Not if it is a genuine business-to-business arrangement where you are buying a service from the company. If the reality is that one named individual performs the work personally, takes your instructions and cannot substitute, treat it as in scope and check.
What if the agency says it has already checked the worker?
Get it in writing, with audit rights. Extended liability under section 15A can reach you where the direct engager cannot be identified or has not met the requirements, so a verbal assurance is not protection.
Can I run the check after someone starts work?
No. It must be completed before the work starts. A check run afterwards gives you no statutory excuse for the period already worked.
Do I have to check British citizens too?
Yes, and you should. Checking only the people you assume are foreign nationals invites a discrimination claim, and the Home Office runs a separate code of practice on avoiding unlawful discrimination while preventing illegal working. Check everyone in scope, the same way.
If you engage subcontractors, agency staff or casual workers and want a second pair of eyes before 1 October, get in touch. We can walk through your engagement routes, work out where the check sits in each one, and flag which contracts need rewording.