From 1 October 2026, significant changes have applied to UK Right to Work checks. Section 48 of the Border Security, Asylum and Immigration Act 2025 inserted a new section 14A into the Immigration, Asylum and Nationality Act 2006, which came into force on 1 October 2026, brought by the Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026 (S.I. 2026/683 (C. 57)), and expanded the rules beyond direct employees. Employers must now think carefully about workers on contracts, individual subcontractors, and people found through online matching services.
Liability can also extend beyond the direct employer, so a business may be treated as employing an individual without a direct contractual relationship, including through a chain of contracts. In practice, employers can now accept digital National Insurance number evidence, use recently expired British and Irish passports (up to six months old) for digital checks, and must use a registered Right to Work Digital Verification Service Provider (RtW DVSP) for digital checks. These changes do not apply to genuinely self-employed workers who run their own business and serve their own clients.
Introduction
The Right to Work check most UK employers were using is no longer enough. Since 1 October 2026, section 48 of the Border Security, Asylum and Immigration Act 2025 has brought a much wider group of people within the scheme. Companies that used to check their own payroll staff must now consider workers’ contracts, individual subcontractors, and platforms that connect workers to jobs. If the right-to-work check is not done properly, liability for paying a civil penalty for illegal work may extend beyond the employer with the direct contractual relationship with the worker.
This article examines the changes to RtW checks in 2026, with a comparative overview of the new rules and the rules in force before October. It does not cover visa eligibility, sponsor licence duties, criminal liability, or right to rent checks, as these issues are dealt with separately and require specific advice.
A statutory excuse is the defence that protects an employer from a civil penalty where a worker is later found to have no right to work. You establish it by carrying out a compliant check before work starts and keeping the prescribed evidence. Lose the excuse and the penalty applies even where you acted in good faith.
Key Takeaways
-
From 1 October 2026, UK employers must follow significantly expanded right to work check requirements.
-
Employers need to consider and check not just direct employees but also workers' contracts, subcontractors and online platforms.
-
A business can be liable even if it does not have a contractual relationship with the workers.
-
A British passport, Irish passport or Irish passport card can be used for a digital RtW check even if it is expired. However, the expiration date should not be more than 6 months before the date of the check.
-
Genuinely self-employed workers who run their own business and provide services to their own clients remain outside the scheme, but if they employ staff, then they become an employer and must check their employees.
New Changes to Right to Work Checks in 2026
The Border Security, Asylum and Immigration Act 2025 and the draft Employer’s Guide to Right to Work Checks (the 2026 Guide) and Employer’s Guide to Right to Work Checks 2025 Guide are taken into consideration to examine the changes mentioned below:
1. Right to Work Checks Cover More Types of Workers
Before 1 October 2026: The Right to Work check was required when someone worked under a direct contract of employment, service, or apprenticeship. If there was no direct contract of employment, the business was not required to carry out a check or establish a statutory excuse. This meant workers’ contracts, individual subcontractors, and people found through matching services or platforms remained outside the statutory scheme.
From 1 October 2026: Under the new rule, the Right to Work check covers several people engaged under a workers’ contract, a person engaging an individual sub-contractor and an online matching service under section 14A of the Immigration, Asylum and Nationality Act 2006, inserted by section 48(3) of the Border Security, Asylum and Immigration Act 2025.
2. Liability Can Extend Beyond the Direct Employer
Before 1 October 2026: Sections 15(1) to (3) and 25(b) of the Immigration, Asylum and Nationality Act 2006 placed civil penalty liability primarily on the direct employer. If a business involved someone without a direct contract of employment, service, or apprenticeship, it was not required to establish a statutory excuse for that person. If a business did not directly hire a worker, it couldn’t be fined over that worker’s Right to Work even if the work came through an agency, a middleman, or a subcontractor. Only the business that directly hired the person could be fined. And if no one in the chain had a direct employment relationship with that person, nobody needed to check their right to work.
From 1 October 2026: Under Section 48 of the Border Security, Asylum and Immigration Act 2025, which inserts a new section 15A into the Immigration, Asylum and Nationality Act 2006, a person may be treated as employing the individual who performs the work, even where there is no direct contractual relationship between them. This can also be applied where the work is provided through a chain of contracts. This means that even if the business has never contracted directly with the worker and does not know the worker is providing the work or services, it can still be fined if that worker does not have the right to work.
When does extended liability apply?
Extended liability applies in three situations:
-
A business is hired to deliver work or services to a third party and brings in another employer to provide workers for all or part of the job.
-
An online matching service connects a service provider with a client or customer, and the service provider then contracts directly with the client.
-
An employer hires someone for a job, but the contract lets that person send someone else to do the work instead.
Exception: where a staffing agency supplies workers only and does not undertake to deliver a finished job or service, the hiring business is not treated as the employer. The agency remains responsible for checking those workers.
Example 1: (Subcontracted services)
A construction company hires other firms to provide workers for activities such as laying foundations and bricklaying through a chain of contracts. Here, extended liability applies because the company depends on that chain to complete the project. As a result, it may be considered the employer of anyone working through the chain and could face a civil penalty if any of those workers are found to be working illegally.
Example 2: (Online Matching Service)
A homeowner uses an online matching service to find an individual electrician and then contracts with that electrician directly. The matching service connected the two, so it may be treated as employing the electrician and may face a civil penalty if that person has no Right to Work. The duty sits with the platform, not the homeowner. Where the homeowner contracts with an electrical firm rather than an individual, section 14A does not apply in the same way.
Example 3: (Substitution Arrangements)
An individual signs up to work with a food delivery platform as an independent contractor, and their agreement lets them send someone else to do deliveries for them. If they ask a friend to make the deliveries instead, the platform might also be considered the substitute’s employer. The platform could face a civil penalty if the substitute is found to be working illegally.
3. How do you protect yourself when you never contracted with the worker?
Where you have no direct relationship, the protection is contractual rather than procedural. In contracts with suppliers, subcontractors and agencies, consider requiring compliant Right to Work checks on everyone supplied, restricting further subcontracting without your prior written consent, requiring any permitted subcontractor to accept equivalent obligations, requiring a compliant check on any substitute before that substitute starts work, audit rights over check evidence, warranties and indemnities, and a right to suspend or terminate where illegal working is found. Existing commercial arrangements should be reviewed on the same basis as they come up for renewal.
4. Can Digital National Insurance Evidence be used for Checks?
Under Article 2 of the Immigration (Restrictions on Employment) Order 2007 (SI 2007/3290) along with List A and List B of the Schedule, if the official document showing a person’s name and permanent National Insurance Number (NINo) was needed as part of a manual Right to Work check, such document had to be original which meant an employer had to depend on original document while carrying out manual check. A photocopy, scan, or digital printout of this document could not be relied on.
The new change under the 2026 Guide is that the official document showing a person’s name and permanent National Insurance number may be accepted in digital form. However, it should be issued by, or on behalf of, a government agency. Some individuals receive a NINo as part of their immigration application, and it appears on their eVisa profile. In this case, you don’t need to apply separately to the Department for Work and Pensions to obtain one.
5. Is Registered DVSP Now Compulsory?
The 2025 Guide used the term Digital Verification Service (DVS) to cover the concept of Identity Service Provider (IDSP) and Identity Document Validation Technology (IDVT). This term was changed mainly to align with the UK digital identity framework and the Data (Use and Access) Act 2025. Registration was not made compulsory, so employers could choose any DVS provider without checking whether a regulator has registered it.
The 2026 Guide changes this term mainly to align with the UK digital identity framework and the Data (Use and Access) Act 2025. The term DVS changes to Right to Work Digital Verification Service Provider (RtW DVSP) in the new rule. This is not just a change of name, but it is beyond that. If an employer chooses to use a DVSP to conduct a prescribed digital Right to Work check, it must use a provider that is registered for Right to Work services. Under the Data (Use and Access) Act 2025, employers are required to use a provider that the Office for Digital Identities and Attributes (OfDIA) has registered if they choose the digital-provider route for a prescribed RtW check. Registration is mandatory if employers choose the digital provider route.
Documents needed
- A valid British passport,
- Irish passport, or
- Irish passport card
- Passport not to be expired more than 6 months before the date of the check.
Evidence to keep on file
- forename,
- middle name(s) if any,
- surname,
- date of birth,
- an image of the passport or passport card
- a photograph of the user,
- the date of the identity check,
- who checked the evidence,
- Confirmation that the DVS provider has a registered service
- Confirmation that the check is provided in accordance with the RtW supplementary code
- Link to DVS register entry
- Identity verified
Retain this evidence for the duration of employment and for two years afterwards. The guidance does not currently address retention for parties who are not the direct employer, which is an open point under the extended liability rules.
6. Can the Recently Expired British and Irish Passports be Used for Digital Checks?
Yes, Employers can use recently expired British and Irish Passports for digital checks. However, they should not be expired for more than six months before the check date.
Before 1 October 2026, an individual could not rely on expired British and Irish Passports or passport cards for proving their eligibility for the purpose of a digital Right to Work check. Under the 2025 Guide, if the candidate’s passport had expired by even one day, the employer had to use the manual Right to Work check and inspect the original document in the prescribed manner to obtain a statutory excuse.
From 1 October 2026, employers can run a digital check using Irish Passports or passport cards and British Passports even if they are expired. However, they should not have expired more than 6 months before the check date. This is mentioned in Regulation 2(2) (c) of the Immigration (Restrictions on Employment and Residential Accommodation) (Prescribed Requirements and Codes of Practice) (Amendment) Regulations 2026 (SI 2026/700) which amends article 2 of the Immigration (Restrictions on Employment) Order 2007. Similarly, employers must be careful about the 6-month window before relying on the digital check route; otherwise, that may ultimately result in the use of the manual check route.
7. Do the Non-Discrimination Rules Still Apply?
Employers were expected to check every prospective employee’s Right to Work, including British citizens, rather than only people who look or sound like migrants. Under the Code of Practice for Employers: Avoiding Unlawful Discrimination while Preventing Illegal Working, in force from 6 April 2022, employers were told not to make assumptions based on colour, nationality, ethnic or national origin, accent, surname, or length of residence in the UK. It strictly said to check British citizens as thoroughly as migrants.
The same principle of non-discrimination applies in the new rule. However, the draft Code of Practice for Employers: Avoiding Unlawful Discrimination while Preventing Illegal Working extends the protection not just to prospective workers but to all workers to cover the entire Right to Work Scheme. This change is added to align with changes in the Right to Work Scheme, where it covers workers’ contracts, individual sub-contractors and several other working arrangements.
8. No Separate Ukraine and Switzerland Sections
The 2026 Guide removes the separate provisions on Service provider from Switzerland and Annex D: Employment of Ukrainian nationals.
The 2025 Guide had a separate provision for Ukrainian Nationals in Annex D, which introduced bespoke temporary sanctuary visa schemes to support Ukrainian nationals and their family members in coming to the UK. It included details such as the Code 1A stamp in passports, the entry clearance vignette (a sticker used for travel), and what to do if someone needed to access their eVisa but didn’t have a valid Ukrainian passport to prove who they were.
Similarly, the service provider from Switzerland (SPS) was a special route which let individuals of any nationality, who were required by their employer (who had to be based in Switzerland) or Swiss nationals who were self-employed, to execute contracts to temporarily provide services for a party based in the UK and do short-term work without going through the usual full Right to Work check. An SPS visa was a hard copy document without an online checking function.
The section titled ‘Service providers from Switzerland’ in relation to EEA citizens is removed due to the closure of this route on 31 December 2025. Similarly, Annex D, Employment of Ukrainian nationals, is removed because Right to Work checks apply to all nationals as prescribed.
9. Changes in Supplementary Employment Rules
The changes in Supplementary Employment Rules are mentioned below:
a) Eligibility test for Skilled Workers
Old Rule: A Skilled Worker could undertake supplementary employment if the supplementary employment was in an occupation listed in Table 1, 2 or 3 of Appendix Skilled Occupations.
New Rule: A Skilled Worker can undertake supplementary employment if the supplementary employment is in:
- The same profession and at the same professional level as the job for which they are being sponsored.
- An occupation listed in Tables 1, 2 or 3 (RQF 6 occupations) of Appendix Skilled Occupations; or
- A role on the Immigration Salary List.
b) Rule depending on Visa Date
Old Rule: The same rule applied for all the Skilled Workers.
New Rule: Workers sponsored on or after 22 July 2025 use the new test above. Workers sponsored before that date can still use the older Tables 1a, 2aa or 3a (RQF 3–5 occupations), even after renewing their permission, provided their Skilled Worker status has been continuous.
c) Weekly Hours Cap
Old Rule: Supplementary employment could not exceed 20 hours per week, with no clarification on multiple employers.
New Rule: The 20-hour weekly limit now explicitly applies in total, across one or multiple employers combined.
d) Sponsored routes eligible for salary list-based supplementary employment
Old Rule: It included-
- Intra-Company routes in place before 11 April 2022
- Senior or Specialist Worker (but only if they qualified under a transitional arrangement,
- T2 Minister of Religion,
- International Sportsperson,
- Creative Worker,
- Government Authorised Exchange,
- International Agreement, and
- Religious Worker.
New Rule: It includes-
- The term “Intra-Company routes” is replaced by “Global Business Mobility: Senior or Specialist Worker” (applicants granted under the rules before 11 April 2022 who have had continuous permission in that route only),
- The other routes stay the same.
Conclusion
If you are an employer, you should now ensure that your processes reflect the rules applying from 1 October 2026. Everyone working for your business should be reviewed, not just employees with a direct contractual relationship, but also those with no direct relationship, like subcontractors, freelancers or platform workers. Check that your contracts, substitution clauses, and identity checks are strong enough to protect you if extended liability applies. Also, make sure your digital verification provider is registered with OfDIA, since using an unregistered one could mean losing your legal protection. Employers should also ensure that they are working from the applicable guidance and have made any necessary changes from 1 October 2026.
FAQ
Yes, from 1 October 2026, an expired British or Irish passport can be used for a digital right to work check, provided it expired no more than 6 months before the date of the check.
Yes, subcontractors and gig workers now need right to work checks, not just employees, after 1 October 2026. The scheme covers worker contracts, individual subcontractors and online matching services.
If you use a digital verification provider for a prescribed check, it must be registered with OfDIA. Using an unregistered provider means the check gives you no statutory excuse.
No. If someone genuinely runs their own business and works for their own clients, they are not included in the scheme. If that person employs staff of their own, they are an employer and must check those employees.
If checks were not updated in time, the employer could lose their statutory excuse and may face a civil penalty.
