For most businesses, Right to Work has long been one of the more predictable parts of hiring. You collect the documents, you carry out the check, you keep the record, you move on. The framework had been broadly stable for years, and for most HR teams it felt more like a process than a live compliance risk.
That changed on 1 October 2026.
The Home Office's updated Code of Practice, implementing Section 48 of the Border Security, Asylum and Immigration Act 2025, is now in force. Commencement was fixed by SI 2026/683, made on 24 June 2026, so this is not a proposed reform or a soft deadline. It is a live legal duty with civil penalties attached. And for many businesses, the scope of who falls within the regime has expanded materially, overnight.
The complexity is not helped by the fact that the Home Office is still refining the guidance itself. A draft employer's guide was published in July 2026, revised again in September 2026 with further clarifications, and the final version has continued to evolve close to the deadline. Businesses have had to prepare against a moving target. That is worth acknowledging. It is also an argument for designing your compliance process around the statutory duty and the current guidance together, rather than waiting for a document that keeps changing.
Under the previous rules, Right to Work obligations broadly tracked employment. If you employed someone directly, you checked them. If they were provided through an agency, the agency typically held the responsibility. If they were a subcontractor, they often sat outside the regime altogether. That left large parts of the modern workforce untouched by the checks that Parliament originally intended to be universal.
The new regime closes those gaps. The scheme now covers people engaged under:
The one significant exclusion is the individual who is genuinely self-employed, operating in business on their own account and contracting directly with clients. That exclusion is narrower than it sounds, and it will not cover most contractor arrangements as they currently exist.
What matters, according to the September 2026 guidance, is the substance of the arrangement in practice, not the label on the contract. The Home Office has set out the factors it will weigh when deciding whether an arrangement is in scope. These include whether individuals are personally carrying out the work or a business is supplying a defined outcome, who actually engages or supplies the individuals, whether there is a chain of contracts and what role each party plays within it, and whether substitution of the worker is permitted. No single factor is decisive. The guidance has also now confirmed that work carried out entirely outside the UK falls outside the scheme.
For any business with a mixed workforce, the practical effect is significant. Construction, logistics, cleaning, hospitality, care, food delivery, warehousing, beauty services, maintenance and facilities management are the sectors most affected.
The piece most easily missed, and the one that carries the largest exposure, is extended liability.
Under the old rules, liability broadly tracked contract. If you had a direct contractual relationship with the individual, you carried the check. If you did not, someone else did. Under the new rules, that link is weaker. In some contractual chains, a business may now be treated as responsible for illegal working even where it is not the direct employer.
What is worth being clear about is that extended liability does not apply automatically. The Home Office guidance confirms three main scenarios where it is most likely to apply:
Equally important is what is NOT in scope. The guidance makes clear that an end-client does not automatically acquire extended liability simply because workers employed by another business carry out work on its premises. A retailer engaging a facilities management business to clean its premises remains outside the extended liability scope. Businesses purchasing goods or services from another supplier are not automatically brought into the regime. Where an employment business supplies workers, that employment business remains responsible for Right to Work compliance.
The question for every business is which of these scenarios it genuinely sits in. For those that do sit in a chain, labour supply or substitution arrangement, the prescribed contractual and operational controls now need to be in place.
Civil penalty levels remain severe. For a first breach, the penalty is £45,000 per illegal worker. For a repeat breach, it is £60,000 per worker. These have been in place since February 2024, when the rates tripled from £15,000 and £20,000.
What has changed is the enforcement intensity. According to Home Office data published on 27 August 2026, Q2 2026 saw 677 penalties issued to employers with a total value of £42.0 million, the highest-value quarter in the published series. The first half of 2026 reached 1,238 penalties worth £74.6 million. The whole of 2025 came to 2,438 penalties and £130.7 million.
Two honest caveats, both of which the Home Office states itself. The value is the gross amount issued, before any reduction on objection, appeal or early payment. And a single penalty can cover more than one worker, so the count of penalties understates the number of individuals involved.
One of the most important operational shifts has nothing to do with who is checked. It relates to how the checks are carried out.
For British and Irish citizens, employers can now use digital identity verification technology rather than inspecting a passport. The check must be run through an identity service provider that is registered with the Office for Digital Identities and Attributes (OFDIA) AND certified specifically for Right to Work. Registration on its own is not enough. Certification for a different purpose is not enough. A provider may be perfectly legitimate, may hold OFDIA registration, and may still not be certified for Right to Work, in which case the check it performs gives no statutory excuse.
The September 2026 guidance added one further requirement that is easy to miss. Where DVSP checks are bought through an intermediary rather than directly from the DVSP, the intermediary must now clearly disclose which registered DVSP is actually carrying out the check. Businesses using resellers or integrated platforms need to confirm this is in place.
For workers with an eVisa, the position is stricter. The only check that creates a statutory excuse is the Home Office online service using a share code.
Substitution clauses are common in contractor agreements and often used to support self-employment status. Under the new regime, they create a separate Right to Work risk.
Where a contract allows a worker to send a substitute, the employer may only establish a statutory excuse if there are processes to ensure that a prescribed Right to Work check is carried out on the substitute before that substitute starts work. The Home Office guidance recommends re-verification at least once per shift or 24-hour period to confirm that the person turning up to work is the person the check was carried out on. That can be done through workplace ID cards, periodic face-matching checks, or attendance management systems. For platform businesses, delivery operators and any model that relies on substitution at pace, this is operationally the hardest part of the new regime to meet.
For businesses that hold a sponsor licence, there is a further consequence. An illegal working civil penalty triggers a cooling-off period of twelve months from the date of payment before a sponsor licence application will be entertained. The financial penalty is often the smaller half of that commercial consequence.
Home Office research carried out between December 2023 and April 2024, covering 2,152 employers, found that 89 per cent were confident they were carrying out Right to Work checks correctly, and 80 per cent answered at least one compliance question incorrectly. Almost two thirds wrongly believed documents had to be rechecked every five years. Only 37 per cent said they used the Home Office digital service.
That gap between how compliant employers feel and how compliant they are matters here. The only thing that protects a business at a compliance visit is the file: the right check, on the right person, by the right method, at the right time, kept for the right period, and capable of being produced on the day.
Three practical steps worth taking this month, if you have not already:
One: Audit your workforce model. Identify not just employees, but workers, individual subcontractors, platform workers, substitutes and labour supplied through chains.
Two: Confirm your digital verification provider is OFDIA-registered AND certified for Right to Work. If you buy checks through an intermediary, confirm which registered DVSP is doing the work. Get it in writing.
Three: Review your supply chain contracts for Right to Work obligations, audit rights, substitution controls and Home Office cooperation clauses. Where these are missing or weak, you may struggle to establish a statutory excuse.
The regime is live. The enforcement data shows the Home Office is using it. The organisations that will find the next twelve months straightforward are those treating this as a cross-functional programme now, rather than waiting for the first penalty notice to arrive.