Last week the Government confirmed a number of changes to the Right to Work (and Right to Rent) scheme in the UK. The changes are scheduled to come into force on 01 October 2026. The Right to Work scheme will face a significant expansion, and it is extremely important that UK businesses are fully aware of the changes to ensure that they don’t become liable for a civil penalty for illegal working of up to £60,000 per worker.

The new provisions are contained at section 48 of the Border Security, Asylum and Immigration Act 2025, and by virtue of Regulations made recently, it has been confirmed that section 48 will be implemented (and will amend existing Right to Work provisions under the Immigration, Asylum and Nationality Act 2006) on 01 October 2026.

What are the key changes?

Key changes include:

1. The current scheme applies to those in employment; from 01 October 2026, the scheme will also apply to ‘other working arrangements’, which will include:

• Those engaged under a worker’s contract (other than a contract of service or apprenticeship), which requires an individual to perform work or services
• Sub-contractors
• Those engaged via an online matching service, which includes providing details of an individual who is a service provider to potential clients or customers – the simple act of providing an individual’s details could form the basis of an illegal working civil penalty if the individual doesn’t have the right to work

Contracts can be express or implied and can be oral or in writing.

2. Liability is extended, which means:

• Organisations that employ individuals to provide work or services could face civil penalty liability. Likewise, those contracted to provide or arrange the provision of work or services could also face liability if they enter into a contract in relation to another person providing, or arranging, the work or services.
• Online matching services could also face liability if they provide details of a worker who will be a service provider. Even if an employee doesn’t have a contractual relationship with the worker (and doesn’t know that the worker is providing work or services), they can now face liability.

How can businesses prepare?

The Home Office has published a Draft code of practice on preventing illegal working, which has been made in light of the proposed changes. This makes it clear that the way in which organisations conduct Right to Work checks for workers, sub-contractors, and those engaged via an online matching service, will depend on whether the workers are directly engaged or non-directly engaged.

When a business has a direct relationship with a worker, just like under the current provisions, that employer is required to undertake a compliant Right to Work check.

If it can’t be identified who the employer is (who has the direct contractual relationship with the worker), a non-direct relationship may be established. This allows civil penalty liability to be imposed on another individual from the chain of work or services contracts. In these circumstances, an organisation will establish a statutory excuse against civil penalty liability where prescribed requirements have been met (in other words, the end client isn’t required to undertake a Right to Work check but must instead meet the Home Office’s prescribed requirements). The Home Office could then impose a civil penalty further up the supply chain, depending on the nature of the contractual arrangements and the extent to which each party has complied with prescribed requirements.

Prescribed requirements relate to:

1. Contractual terms and conditions – these must be in place before work/services commence and must contain key information set out by the Home Office. Amongst others, these terms require the employer or service provider to conduct a Right to Work check.

2. Substitution controls – if arrangements permit substitution, the employer will need to implement processes ensuring that a Right to Work check is carried out on the substitute.

3. Identity verification systems and processes – those in a chain of contracts, online matching services, or employers, in the case of substitution clauses, must maintain ‘proportionate systems and processes’ to ensure that the person undertaking work or services is the same individual who has undertaken a Right to Work check. Such a process could include workplace access passes, biometric or attendance management systems, facial verification technology (e.g. RtW DVSPs), verification against training records, qualifications or licences, or re-verification of identity at set intervals. The use of a RtW DVSP could certainly be the most straightforward approach here.

There will be no change to the civil penalty amount, which will remain at £45,000 per worker for the first breach, and up to £60,000 per worker for a repeat (within 3 years) breach.

Right to Work changes in practice

Before 01 October 2026

A construction company engages a self-employed bricklayer through a labour supplier. The construction company carries out Right to Work checks on its direct employees only. The self-employed bricklayer falls outside the traditional employer-employee relationship, so the company's Right to Work compliance obligations are limited.

From 01 October 2026

The same arrangement now falls within the expanded Right to Work scheme. The construction company will need to ensure its contract with the labour supplier contains the required Right to Work provisions, that any substitute workers are subject to Right to Work checks, and that there are proportionate systems in place to verify that the individual attending site is the same person whose Right to Work has been checked. This could include site access passes, biometric entry systems or digital identity verification. Failure to meet these requirements would place the business at risk within the contractual chain to civil penalty liability.

What should businesses do now?

These changes are significant, and UK businesses have less than 3 months to ensure compliance with the extended civil penalty provisions. Businesses should be auditing their workers, sub-contractors and supply chain contracts to ensure that the revised requirements can be met before 01 October 2026.