TRW & Co · UK immigration
Right to Work Checks: Employer Obligations and Penalties
Right to work checks protect a UK business from illegal working penalties only if they are done the prescribed way, before work starts. Since 1 October 2026 the rules also cover workers, sub-contractors and online platforms, and can reach businesses higher up a contracting chain. This guide explains the methods, the new duties, the penalties and the steps to take now.
Key pointFrom 1 October 2026 a business that sub-contracts work it has promised a client can be treated as employing the person who actually does it, so its statutory excuse may depend on its contract terms and identity controls, not just on a document check.
At a glance
Three check methods
A statutory excuse needs a Home Office online check, a manual check of original documents, or a check through a registered right to work digital verification provider.
Wider scope since October
Section 48 of the Border Security, Asylum and Immigration Act 2025 took effect on 1 October 2026, extending the rules to workers, sub-contractors and online matching platforms.
Penalty starting points
The code of practice sets £45,000 per illegal worker for a first breach and £60,000 for a repeat breach within three years, with limited reductions.
No delegation to agencies
A check done by a recruitment agency or adviser gives the hiring business no excuse; only a registered digital verification provider can be relied on.
Keep records two years
Copies or online results, with the date of the check, must be kept for the whole engagement and for two years after it ends.
Swipe or scroll →
Right to work checks: the short answer
Right to work checks are the steps a UK business must take before someone starts work to confirm they are legally allowed to do that work. Done correctly and before work begins, the checks give the business a "statutory excuse" against an illegal working civil penalty. Done late, done by the wrong person or not recorded, they give no protection at all.
As of October 2026, the regime is wider than it has ever been. Since 1 October 2026 the illegal working rules no longer stop at employees: they also reach workers, individual sub-contractors and online matching platforms, and can attach liability to businesses further up a contracting chain. At the same time the penalty starting points, the move to eVisas and new rules on digital verification providers have changed how a compliant check looks in practice.
This guide explains the three check methods, the October 2026 extension, the penalty calculation and the mistakes we see most often, with a checklist at the end.
The legal framework: the 2006 Act, the 2025 Act and the code
The civil penalty and the statutory excuse sit in the Immigration, Asylum and Nationality Act 2006. Section 15 allows the Home Office to issue a civil penalty to an employer of someone who is not allowed to do the work, and regulations made under the Act prescribe the checks that establish the excuse. Knowingly employing an illegal worker, or having reasonable cause to believe a person lacks the right to work, is a separate criminal offence. GOV.UK states that it carries up to five years' imprisonment and an unlimited fine.
The biggest recent change came from section 48 of the Border Security, Asylum and Immigration Act 2025. It inserts new sections 14A and 15A into the 2006 Act. Section 14A says that references to employing someone include engaging an individual under a "worker's contract", engaging an "individual sub-contractor" and an online matching service providing a service provider's details to clients. Section 15A can treat a business that contracts to supply work or services as employing the individual who actually does the work, even with no direct contract and even where the business does not know who that person is.
The Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026 brought section 48 into force on 1 October 2026. The Home Office also published a revised Code of practice on preventing illegal working and an updated employer's guide to right to work checks, both effective from that date. The code explains the prescribed requirements and how penalties are calculated; the guide covers the documents and step-by-step mechanics.
Where the rules apply
The illegal working regime applies across the United Kingdom, so right to work checks are the same in England, Wales, Scotland and Northern Ireland. The related "right to rent" scheme for landlords is different: it operates in England only.
The three ways to carry out right to work checks
To obtain a statutory excuse, the business must complete one of three prescribed checks before the individual starts work. Which method is available depends mainly on the person's nationality and the form of their immigration permission.
| Method | Who it suits | What the business must do | Key limitation |
|---|---|---|---|
| Home Office online check (share code) | People with an eVisa or other digital immigration status | Use the share code and date of birth on the Home Office employer service, confirm the photo matches the person, keep the result | British and Irish citizens cannot obtain a share code; an eVisa holder can only prove their status this way |
| Manual document check | British and Irish citizens, and some others with acceptable original documents | See original documents from the prescribed lists, check them with the person present (in person or by video link), copy them in an unalterable format and record the check date | Biometric residence permits are no longer acceptable; the documents must be originals |
| Check using a registered RtW DVSP | British and Irish citizens holding a valid passport or passport card | Use a right to work digital verification service provider registered with the Office for Digital Identities and Attributes, and keep its output | From 1 October 2026 an unregistered provider gives no excuse; using a provider is optional |
| Employer Checking Service | People with an outstanding application, review or appeal, or status that cannot be shown digitally | Ask the Home Office to verify status and keep the Positive Verification Notice | Only gives an excuse while the notice remains valid; diarise its expiry |
Two points cause most errors. First, the code of practice states that an employer must not delegate the check to a third party such as a recruitment agency or professional adviser, other than a registered RtW DVSP. If the agency did the check, the hiring business has no excuse. Second, the check must happen before work starts. A check on the first afternoon of a shift is too late.
Follow-up checks
Where a person's permission is time-limited, the statutory excuse is also time-limited. The business must repeat the check before the permission expires to keep its protection. A diary system linked to visa expiry dates, rather than a once-a-year audit, is the only reliable way to do this at scale.
Records
The code requires copies of documents or online check results to be kept securely for the duration of employment and for two years after it ends, together with the date of the check. Data protection law still applies, so the records should be stored and destroyed under a written retention policy. Our data protection team often reviews these policies alongside HR.
What changed on 1 October 2026: gig, casual and sub-contracted work
The new section 14A captures three relationships in addition to employment. A "worker's contract" is any non-employment contract where the individual personally performs work or services and the engaging business is not their client or customer. The code notes this is broader than the familiar "limb (b) worker" test, so it is not enough to rely on an employment status analysis done for holiday pay or tax.
An "individual sub-contractor" is an individual who contracts to provide work or services that the engaging business has itself contracted to provide to a third party. An "online matching service" is a business that keeps a register of service providers, lets customers submit enquiries online to be matched, and charges a fee or commission for the match.
Liability up the chain
Section 15A is the provision that changes contracting practice. Where a business contracts to provide work or services and then sub-contracts all or part of it, it can be treated as employing the individual who personally does the work, wherever that contract sits in the chain. The Home Office's stated aim is still to pursue the direct employer first, but a business higher up that cannot show it met the prescribed requirements is exposed.
The code excludes end-users who buy work or services for their own benefit and are not under a contract to supply them onwards. A household booking a cleaner is not in scope; a facilities company supplying cleaning to a client building is.
The new prescribed requirements
For these extended relationships, the statutory excuse depends on more than a document check. Before work starts, a business in a contracting chain must have a written statement with the next party that requires prescribed right to work checks, bars further sub-contracting without prior written consent, permits audits, allows enforcement action such as suspension or termination, and requires co-operation with Home Office investigations.
Where a contract allows substitution, the business must check each substitute itself, must not leave substitute checks to the worker, and must stop anyone working as a substitute until their right to work is verified. All businesses with extended liability must also maintain proportionate identity verification, so that the person doing the work is the person who was checked. The code lists options such as access passes, facial verification through a registered provider, attendance systems and periodic re-verification.
The written statement is now part of the legal defence, not just good contracting. If your supply agreements, framework contracts or platform terms were signed before October 2026, assume they do not contain the prescribed terms until a lawyer has checked them. Our commercial contracts team can prepare a short-form variation that can be rolled out across a supplier base.
Civil penalties, warning notices and criminal liability
GOV.UK states that the civil penalty can be up to £60,000 for each illegal worker. The code sets the starting points: £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years. Before reaching a figure, the Home Office first asks whether the business has a statutory excuse. If it does, it receives a no action notice.
Without an excuse, the penalty can be reduced. The code allows a £5,000 reduction per worker where the business reported its suspicion to the Home Office and obtained a unique reference number before the Home Office identified the worker, and a further £5,000 for active co-operation. On a first breach, a business that also shows effective right to work practices can receive a warning notice instead of a penalty. That option is not available for a repeat breach.
A civil penalty notice gives 28 days to respond, and the notice explains how to object. The business's details may be published by Immigration Enforcement. For sponsors, an illegal working penalty can also trigger action against a sponsor licence, which is why we treat the two as one compliance system: see our guide to sponsor licence compliance.
A statutory excuse is all or nothing. A perfect check done by the wrong person, or a day late, is treated the same as no check at all.
A compliant process for right to work checks, step by step
- Map the workforce. List every route by which people do work for the business: employees, casual and zero-hours staff, agency workers, contractors, sub-contractors, substitutes and platform users. Mark which are now in scope of the 2006 Act.
- Choose the check method per group. Decide when to use online checks, manual checks or a registered RtW DVSP. Confirm any provider appears on the OFDIA register with a right to work note.
- Check before work starts. Build the check into onboarding so no shift, login or site pass is issued until the check is complete and recorded.
- Record and retain. Keep the online result, document copies or provider output with the date of the check, for the duration of the engagement plus two years.
- Update contracts. Insert the prescribed terms into supply chain, sub-contracting and platform agreements, plus substitution controls where substitution is allowed.
- Verify identity on the job. Use passes, attendance systems or facial verification so that the person working is the person checked.
- Diarise follow-up checks. Track time-limited permissions and Positive Verification Notices and recheck before expiry.
- Audit and respond. Run periodic internal audits and have a plan for a Home Office visit or information request, including who reports a suspected illegal worker.
On a business acquisition or outsourcing that is a "relevant transfer" under TUPE, the code gives the incoming employer 60 days from the transfer to carry out fresh right to work checks on transferring staff and secure its own statutory excuse. Our TUPE transfer guide explains the wider process.
An illustrative scenario
This scenario is illustrative only and does not describe any real client or matter.
A London logistics company holds a contract to deliver parcels for a retailer. It engages a regional delivery firm, which in turn uses self-employed couriers who may send a substitute driver. In November 2026, an Immigration Enforcement visit finds a substitute driver with no right to work.
The delivery firm is the direct engager, but it checked only the named couriers. Under section 15A, the logistics company may also be treated as employing the substitute because it contracted to provide the delivery services. Whether it has a statutory excuse depends on whether, before the work began, its contract with the delivery firm contained the prescribed terms, whether substitution controls existed and worked in practice, and whether it took reasonable steps to satisfy itself that identity verification was effective.
If its contract pre-dated the reforms and had never been updated, the logistics company may struggle to show an excuse. If it had varied the contract, audited the delivery firm and required app-based identity checks at each shift, it would be in a far stronger position. The retailer, as an end-user buying deliveries for itself, would generally fall outside the extended liability.
Risks and common mistakes
Relying on the recruitment agency's check
The code is clear that the employer cannot delegate the check to an agency or adviser and still obtain a statutory excuse; the only exception is a check carried out through a registered RtW DVSP under the code. Agencies remain responsible for checks on the people they employ, but a business engaging a candidate directly through an agency introduction must do its own check. Ask agencies for evidence of their own checks under the new contractual terms, but do not treat that evidence as your excuse.
Accepting a biometric residence permit or a screenshot
Physical biometric residence permits are no longer acceptable evidence. People with an eVisa can only prove their status through the Home Office online service using a share code, and the employer must complete the online check itself. Screenshots, photographs of documents or a PDF emailed by the candidate do not establish an excuse. Train hiring managers to ask for a share code and to stop the onboarding process if one is not provided.
Treating all self-employed contractors as out of scope
Before October 2026, many businesses assumed that genuinely self-employed contractors sat outside the regime. That assumption no longer holds. A worker's contract under section 14A is wider than the limb (b) worker test, and sub-contracted individuals delivering services you have promised to a client can create liability under section 15A. The analysis now turns on how the work flows through your contracts, not just on the label in the contract.
Ignoring substitution clauses
Substitution clauses are common in courier, cleaning, security and creative engagements because they support self-employed status. Under the code, a business that allows substitution only obtains an excuse if it checks every substitute itself before they work and keeps the person working matched to the person checked. If the clause exists on paper but is never policed, the Home Office can take that gap into account in deciding whether an excuse exists.
Discriminating in the name of compliance
GOV.UK warns that employers must not discriminate because of where a person comes from. Checking only candidates who seem foreign, or refusing anyone with time-limited permission, risks race discrimination claims under the Equality Act 2010. The safest approach is to check every person, in the same way, at the same stage of recruitment, and to keep that consistency documented.
Cross-border and group considerations
International groups often run hiring from a regional hub, for example in Dubai, Singapore or Dhaka. The UK rules do not care where the HR team sits: the check must meet UK requirements and be completed before work begins in the UK. Group-wide onboarding tools need a UK-specific path for share codes, DVSP checks and record retention.
Bangladeshi and other overseas nationals joining a UK entity will usually hold an eVisa, so the online check is the only route for them. For founders and families moving between the two jurisdictions, our UK–Bangladesh immigration team can coordinate the visa and the employer-side steps. Businesses that sponsor workers should also align right to work records with their sponsor duties; our business immigration lawyers handle both together.
What to do next: a checklist for right to work checks
- Confirm who in the business owns right to work checks and that they are not delegated to an agency.
- Re-map labour supply chains, platforms and sub-contracting against the October 2026 definitions.
- Vary supplier and platform contracts to include the prescribed written statement terms.
- Add substitution controls wherever contracts allow a substitute.
- Confirm any digital provider is a registered RtW DVSP; stop using any that are not.
- Check that no process still accepts biometric residence permits or screenshots.
- Set up automatic reminders for follow-up checks and Positive Verification Notice expiry.
- Write a retention and destruction policy for check records.
- Prepare an incident plan for reporting a suspected illegal worker and obtaining a reference number.
If you would like a review of your right to work checks, contracts or onboarding process, contact our London office at Holborn Gate, 330 High Holborn, London WC1V 7QH, by email at info@trw.co or on +880 1779 127165.
Frequently asked questions
01Do I need to do right to work checks on British citizens?
Yes. Every person must be checked before they start work, whatever their nationality, and checking only some candidates risks discrimination claims. British and Irish citizens cannot obtain a Home Office share code, so the check is either a manual check of an original passport or other acceptable document, carried out with the person present in person or by video link, or a digital check through a registered right to work digital verification service provider. Keep a copy of the document or the provider's output with the date of the check.
02Can a recruitment agency do the right to work check for us?
Not if you want a statutory excuse. The Home Office code of practice states that an employer cannot delegate the check to a third party such as a recruitment agency or professional adviser and still establish an excuse. The exception is a check carried out through a registered right to work digital verification service provider in line with the code. An agency must check the people it employs itself, and since October 2026 supply chain contracts must contain prescribed terms, but none of that replaces your own check.
03What changed for gig economy and sub-contracted workers in October 2026?
Section 48 of the Border Security, Asylum and Immigration Act 2025 came into force on 1 October 2026. It extends the illegal working rules in the Immigration, Asylum and Nationality Act 2006 to people engaged under a worker's contract, individual sub-contractors and online matching services. A business that contracts to supply work and sub-contracts it can be treated as employing the person who does the work. To obtain an excuse it must meet prescribed requirements, including written contract terms, substitution controls and identity verification.
04How much is the fine for employing an illegal worker?
GOV.UK states that the civil penalty can be up to £60,000 for each illegal worker. The Home Office code of practice sets a starting point of £45,000 per worker for a first breach and £60,000 for a repeat breach within three years. Reductions of £5,000 per worker are available for reporting a suspected illegal worker before the Home Office identifies them and for active co-operation, and a first breach can result in a warning notice where effective checking practices are also shown.
05How long must right to work check records be kept?
The code of practice requires copies of documents, online check results or provider outputs to be kept securely for the duration of the person's employment or engagement and for two years after it ends, together with a record of the date the check was made. After that period the records should be securely destroyed. Because the records contain personal data, the retention period and storage arrangements should be written into your data protection policies.
06Are biometric residence permits still accepted for right to work checks?
No. GOV.UK states that employers can no longer accept biometric residence cards or permits, and the employer's guide confirms that expired physical permits are not acceptable proof. People who have an eVisa can only prove their right to work through the Home Office online service, by giving the employer a share code. The employer must then complete the online check itself and keep the result.
Sources and official materials
- Border Security, Asylum and Immigration Act 2025, section 48 — Extension of the illegal working rules to other working arrangements
- Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026 — Brings section 48 into force on 1 October 2026
- Code of practice on preventing illegal working: Right to Work Scheme for employers — Prescribed requirements, statutory excuse and penalty calculation
- Right to work checks: an employer's guide — Home Office step-by-step guidance and acceptable documents
- Check a job applicant's right to work (GOV.UK) — Online, manual and IDVT check methods and record keeping
- Penalties for employing illegal workers (GOV.UK) — Civil penalty, criminal offence and objection process
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.