Right to work checks: what changes on 1 October 2026

TL;DR: From 1 October 2026, right to work checks stop being an employee-only obligation. Workers, casuals, individual subcontractors and people engaged through online platforms all come into scope. The checks themselves do not change at all. You will not need to go back over people you already engage, but anyone you take on from that date needs a proper check, and liability can reach up a labour supply chain to businesses that never engaged the person directly.

What is actually changing

The checks are not what changes: the three ways of checking someone’s right to work are staying exactly as they are, and so is the statutory excuse they give you (that is the defence against a civil penalty if it turns out someone did not have the right to work).

What is changing is the size of the group you have to run those checks on.

Until now, the duty has attached to employment. If you had a contract of employment with someone, you checked them. If you engaged a self-employed contractor, or took someone on for the odd shift through an agency, the obligation either sat somewhere else or did not clearly exist at all.

Section 48 of the Border Security, Asylum and Immigration Act 2025 changes that, and the new Home Office guidance takes effect on the same date.

The four arrangements now in scope

From 1 October 2026, a right to work check is required where someone is engaged:

• under a contract of employment, as now
• under a worker’s contract, which covers casuals and zero-hours arrangements where the individual performs the work personally
• as an individual subcontractor
• through an online matching service, meaning a platform that puts a service provider in front of a customer

The guidance treats all four as “employment” for right to work purposes.

Genuinely self-employed businesses trading with you as a business stay outside this. But it turns on the reality of the arrangement, not the label on the contract, which is the same problem employment status has always had. If the paperwork says independent contractor and the reality is one person on your rota doing the work personally, that arrangement is caught.

Is every casual on your books going to need a check? From the date they start with you, yes.

Nothing retrospective

This is the part that stops it being a scramble.

For worker contracts and subcontracting, a civil penalty can only be imposed where the engagement started on or after 1 October 2026. So there is no requirement to work back through the people you already engage.

That makes this an onboarding problem rather than a records problem, which is a much better problem to have. Fix the process once and everyone who comes through it afterwards is covered.

Liability travels up the chain

Where labour comes through an intermediary, and the business that directly engaged the person either cannot be identified or has not met the requirements in the Code, businesses further up the chain can be penalised instead. You can be liable for a person you have never engaged, never met and never paid.

Your protection here is contractual, so you need terms that oblige your supplier to carry out checks, restrict onward subcontracting, and give you audit rights. “Our agency says they do all that” is not a defence, and if I am honest it is the answer most procurement teams will give you if you ask them today.

So the work here is not really an HR job. It is a procurement one, and it needs someone to actually read the supplier agreements.

The person doing the work has to be the person you checked

A check at the start is not the whole obligation. The expectation is that the individual actually doing the work is the individual who was checked.

Substitution clauses are the obvious weak spot. If a contractor is entitled to send someone else, that substitute needs verifying before they start, not afterwards. In practice that means a pre-authorisation step, and somebody whose job it is to say no when a name turns up that nobody has checked.

Site access controls, passes, sign-in systems… none of that is new technology, but most of it was built to answer “is this person allowed on site” rather than “is this the person we checked”.

Two smaller changes worth knowing

Digital providers have to be registered. If you use a third-party company to verify identity digitally, from 1 October it has to be on the Home Office register of right to work digital verification service providers. Being certified under the old arrangement is not enough. Worth checking now rather than discovering it in October.

National Insurance number evidence can be digital. The acceptable document lists now recognise digital versions of official documents showing a person’s name and National Insurance number, so a screenshot from a personal device or an emailed confirmation can be used. That is a small and genuinely useful loosening.

What has not changed

The three routes, and this is where a lot of confusion sits, because the route is decided by the person’s status rather than by what suits you:

1. Home Office online check. For anyone whose immigration status is held digitally, which means eVisa holders, settled and pre-settled status, and frontier worker permit holders. They give you a share code, you enter it with their date of birth. Free, and for these people it is the only route that gives you a defence. Checking their physical document by hand gives you nothing at all, however carefully you do it.
2. Digital identity provider. For British and Irish citizens with a valid passport or Irish passport card, accepted up to six months past expiry. A registered provider verifies them digitally, and it has nothing to do with visas.
3. Manual document check. For everyone else, mainly British and Irish citizens without a passport.

Which brings me to something I get asked about constantly: do these checks have to be done in person?

No. Two of those three routes are remote by design and between them cover almost everyone. Even the manual route only requires the original document to be physically with you. The person can be on a video call while you check it. What you cannot do is work from a scan, a photo or a document held up to a webcam, and I suspect that is what people are being told when they hear “it has to be in person”.

One more thing that has not changed: you must not treat anyone less favourably because they have no passport or would rather not use a digital provider. A remote-only process that quietly makes life difficult for those people is a discrimination risk, not an efficiency.

What to do before 1 October

• Map your workforce by how people are actually engaged, not by what the contract calls them. Employees, workers, casuals, subcontractors, agency, platform.
• Extend your check process to every one of those categories rather than just new starters on a contract of employment.
• Review supplier and agency contracts for the check obligation, the subcontracting restriction and the audit right. This is the one with the longest lead time, so start here.
• Deal with substitution clauses. Decide who authorises a substitute and how they get checked first.
• Confirm any digital provider you use is on the Home Office register.
• Train whoever runs onboarding, and whoever books casual shifts at 6pm on a Friday, because that is where this will fail.

The civil penalty sits at £45,000 per breach for a first offence and £60,000 for repeat breaches, so the arithmetic on a handful of unchecked casual shifts is not comfortable.

1 October is a busy date: tribunal time limits change the same day, and the harassment duty follows on 30 October, so it is worth reading this alongside the rest of the Q4 changes. And if you sponsor workers as well as engaging them, how those visa costs are taxed is a separate thing worth checking.

Both the guidance and the Code are still in draft. The date and the scope are settled, some of the detail may shift before the final version, and I would not wait for it.

Working out which of your people are caught, and whether your supplier contracts protect you, is exactly the sort of thing kerbache hr picks up for growing businesses. If you want a second pair of eyes on it before October, get in touch.