Right to work checks from 1 October 2026: casual, agency and contractor workers

Before 1 October 2026, the legal duty to check right to work sat with the employers of employees. In the words of the Home Office guide, “Modern working arrangements beyond traditional employer-employee relationships fell outside the previous legal framework.” From that date the duty also reaches people engaged under a worker’s contract, individual sub-contractors and online matching services, and it can reach a business that sits above a chain of contracts.

For a payroll or HR team the practical question is who gets paid without being an employee: the casual on a worker’s contract, the sole trader on a sub-contract, the agency and labour provider in between. This guide follows the Home Office documents dated 1 October 2026 and the legislation they rest on. We read the live GOV.UK and legislation.gov.uk pages on 14 October 2026, and the GOV.UK guide page still showed 1 October 2026 as its last update.

The quick answer

The law changed on 1 October 2026, when the Commencement No. 4 Regulations 2026 (SI 2026/683) brought section 48 of the Border Security, Asylum and Immigration Act 2025 into force. Section 48 writes a new section 14A into the Immigration, Asylum and Nationality Act 2006, so the 2006 Act’s word “employing” now covers engaging someone under a worker’s contract, engaging an individual sub-contractor, and an online matching service passing on an individual’s details.

The employer with the direct contract still carries out the check, before the work starts. A separate rule, section 15A, can make a business higher up a contract chain liable for a civil penalty unless it meets prescribed contract, substitution and identity requirements. For a civil penalty, the penalty code starts at £45,000 per worker for a first breach, and at £60,000 where the employer was found to have employed illegal workers in the previous three years. There is no general grace period, according to the Home Office. In a standard agency arrangement, the employment business remains responsible for the check, and the Home Office says the changes are not intended to make the hirer duplicate it routinely.

What section 48 changed

Section 14A(1) of the 2006 Act, inserted by section 48, says a reference in sections 15 to 24 to a person employing another includes a person engaging an individual under a worker’s contract, a person engaging an individual sub-contractor, and an “online matching service” providing an individual’s details to potential clients or customers. The statute defines each term:

A worker’s contract is a contract, other than a contract of service or apprenticeship, under which the individual undertakes to do or perform personally work or services, and the other party “is neither a client nor customer of any profession or business undertaking carried on by individual A”.
An individual sub-contractor is an individual who has a contract with a person who has in turn contracted with a third party to provide or arrange the work or services, where the individual has no such contract with the third party.
An online matching service keeps a register of service providers, provides an online service for enquiries from potential clients or customers, and charges a fee or commission for the matches.

Section 15A is the second half. Where a person is contracted to provide, or arrange, work or services and passes it down through another contract, section 15A(4) treats that person as employing the individual who personally does the work, including where the person has no contract with that individual or does not know that individual is providing the work or services. Section 15A(5) applies this whether the contract is the first or any other in the chain.

Commencement No. 4 Regulations (made 24 June 2026) bring in section 48 on “1st October 2026”. A companion instrument, SI 2026/700, was made the same day and came into force on 1 October 2026. It sets the prescribed requirements for the new arrangements in a new article 5B of the Immigration (Restrictions on Employment) Order 2007 and brings in the revised penalty code and discrimination code. The Home Office guide, the penalty code and the discrimination code are all dated 1 October 2026.

The guide also warns against borrowing employment-law labels. It says the definition of worker “is broader than the definition in s.230(3)(b) of the Employment Rights Act 1996”, and Annex C says an employment-law status assessment cannot “automatically be relied upon” to decide whether a check is needed. An IR35 determination is “a tax assessment” and “does not determine” right to work responsibilities.

Which arrangements are in scope

The guide gives worked examples. The ones closest to a shift-based payroll are below.

Arrangement	Guide example	Who carries the right to work duty
Receptionist at a hotel company, permanent, set shifts, on payroll	Example 1	The hotel, as direct employer
Individual registered with an employment business that supplies temporary workers to bars and restaurants, engaged on a contract for services	Example 2	The employment business
Individual who logs into a delivery platform app, accepts requests and is paid per delivery	Example 3	The platform
Cleaner matched to a homeowner by an online matching service	Example 4	The matching service
Company contracted to build homes that relies on a chain of contracts for its workers	Example 7	The company “may be treated as the employer” of individuals who personally do the work through the chain, and needs the prescribed requirements to establish a statutory excuse
Logistics company that outsources the running of warehouses to a third party	Example 10	The logistics company. Extended liability does not apply to the retailer buying the service for its own operations

The guide also gives examples that fall outside. Two are outside the scheme altogether: a self-employed plumber who advertises to the public and has several customers (Example 5), and a designer working through a personal service company that contracts with the client (Example 6). Four are cases where extended liability does not reach the business at the top, and responsibility stays with the direct employer: a retailer buying cleaning from a facilities company (Example 11), a manufacturer using agency temps inside its own operations (Example 12), a food producer using agency temps to make goods (Example 13) and a food ordering platform that does not engage the delivery staff (Example 14).

Annex C closes off the shortcut. There is no blanket exclusion for contractors, freelancers, consultants or personal service companies. Providing workers “is not, by itself, determinative”. And the guide says “the contractual description or label adopted by the parties involved will not, by itself, determine what responsibilities may arise under the Scheme.” It lists the questions to ask: who engages, supplies or arranges the individuals, who is contractually responsible for the work, whether substitution is allowed, and how the arrangement works in practice. “No single factor is determinative.”

Casual and zero-hours workers

The guide, the penalty code and the discrimination code do not contain the words “casual” or “zero hours”. We searched all three on 14 October 2026. So none of the three documents says a casual or zero-hours arrangement is in or out. What decides it is the contract.

A casual who is on a contract of employment is an employee, and the duty to check before they start is the established one. A casual engaged under a worker’s contract falls within section 14A(1)(a), if the section 14A(3) definition is met on the facts. The guide says a civil penalty for a worker’s contract, an individual sub-contractor or an online matching service engagement “may only be imposed where the employment commenced on or after 1 October 2026”.

For people who work in short assignments, Annex C answers the repeat-check question directly. The expansion “does not change when right to work checks must be carried out”. Where a worker “continues to be engaged by the same employer”, a fresh check is not required before each assignment, provided the employer holds a valid statutory excuse and carries out any follow-up check before the worker’s permission expires.

Agencies and labour providers

For the standard agency model, the Home Office’s position is stated in Annex C. Where an employment business engages agency workers directly and supplies them into a hirer’s own operations, “the employment business, as the employer with the direct contractual relationship with the worker, is responsible for conducting the right to work check”. The guide adds that “in a standard agency supply arrangement, the changes are not intended to require routine duplication of these checks by the hirer”. Examples 12 and 13 say the same.

Two limits matter to a hirer. First, the guide lets an employer delegate the act of checking to people “acting under the employer’s control and direction” and accountable to it, including agency workers, but the employer stays liable if the check is not carried out as prescribed. Second, the guide says that “except for a prescribed check carried out using a registered RtW DVSP, an employer cannot establish a statutory excuse by relying on a check carried out independently by an external third party, such as a recruitment agency or professional adviser.” In plain terms, if you are the employer, a recruiter’s screening of your candidates is not your statutory excuse. A digital check through a registered right to work digital verification service provider (RtW DVSP) is the exception, and the guide allows buying that service through a screening or onboarding provider if it names the registered DVSP it used.

The standard-supply comfort does not cover a business that is itself contracted to deliver work to a third party and uses a labour provider to do it. That is the Example 7 and Example 10 pattern, and it is the subject of the next section. Our recruitment agencies page covers the agency view, and our care and hospitality pages cover those two sectors.

Contract chains and extended liability

Extended liability applies in three situations, as the guide describes them: a person under contract to provide work or services to a third party that hands all or part of it to another employer, an online matching service whose service provider contracts with the client, and an employer whose contract lets an individual substitute someone else to do the work. It “does not apply to every business that purchases work or services from another business”, nor to a customer buying services for its own internal operations.

The employer with the direct contractual relationship remains responsible for the check. The guide says extended liability does not “automatically transfer” that duty. The Home Office “will ordinarily seek to identify the person responsible for the relevant contractual arrangements”, and in Annex C it “would not normally expect to issue a civil penalty notice to more than one employer in a contractual chain in respect of the same illegal worker”. But where the Home Office cannot identify the direct employer, and the prescribed requirements have not been met, liability “may extend beyond that direct employer to another person upstream”. The guide lists situations where that can happen: a worker who cannot say who employs them, several intermediaries, missing records, or substitution that leaves the worker unconnected to an employer. Extended liability “is not limited to a particular tier of contracting”.

To establish a statutory excuse against extended liability, the person must meet three prescribed requirements before the work starts and be able to evidence them. The legal source is article 5B of the 2007 Order, inserted by SI 2026/700.

The written statement

Before the work or service starts, there must be a written statement setting out terms for the contract with the next employer or service provider in the chain:

a requirement to carry out prescribed right to work checks on any individual employed to do the work;
a bar on further subcontracting without prior written consent, with equivalent right to work obligations in any permitted subcontract;
permission to audit compliance;
enforcement provisions, such as suspension or termination of the contract, where illegal working is found and no statutory excuse exists, plus equivalent provisions in the contract with the individual; and
a duty to cooperate with any Home Office investigation, including details of the chain and of each business in it.

A business may rely on assurances from others in the chain that checks have been done “provided that they have taken reasonable steps to satisfy themselves that those assurances are reliable”. Annex C is firm about the paperwork. There is no prescribed form of words, but “it is not sufficient simply to rely on equivalent wording contained elsewhere within existing contractual documentation”, and existing vendor onboarding and due diligence “cannot replace this requirement”. The guide also says the person “should not rely on contractual terms alone”: the arrangements must operate in practice.

Substitution controls

Where a contract lets a worker send a substitute, the guide says the employer establishes a statutory excuse only if, before the work starts, it has processes to make sure a prescribed check is done on any substitute, that the check is not delegated to the individuals doing the work, that nobody substitutes before being verified, that the contract has enforcement provisions, and that the worker and their registered substitute are the individuals whose right to work was checked. Where the contract forbids substitution but it happens anyway, the Home Office “will consider whether a prescribed right to work check has been carried out on the worker that was directly employed”.

Identity verification

There must be “proportionate systems and processes” to make sure the person doing the work is the person whose right to work was checked. The guide’s examples are identity cards or workplace passes, facial recognition through a registered DVSP, biometric or attendance systems, checks against training records or licences, and re-verification at set intervals. On that last one, “the Home Office recommends” re-verification “at least once in any 24-hour period or shift of work”, scaled to risk. A business can rely on another party’s identity systems or a third-party provider if it takes reasonable steps to confirm they work.

Start dates

The guide says the prescribed requirements for extended liability apply “where the relevant contractual arrangements were entered into on or after 1 October 2026”. Annex C repeats the point: the measures “are not intended to be retrospective”, and a pre-1 October arrangement “is therefore not brought within scope solely because work or services continue afterwards”. It also says a renewal, extension or variation should not be assumed to be either inside or outside scope: look at whether the change amounts to entering a new contractual arrangement on or after 1 October 2026.

What did not change

The check itself is the same. To establish a statutory excuse, the guide says an employer must do one of three checks before the worker starts: a manual document-based check, a Home Office online check, or a check using an RtW DVSP. The employer cannot dictate the method, and should give “reasonable opportunity” to prove right to work. Using a DVSP is optional (“not mandatory”), but if an employer chooses it, the provider must be registered on the Office for Digital Identities and Attributes register, and the employer, not the DVSP, remains responsible for the check meeting the requirements. The guide adds that where facial recognition technology is used to complete the identity-matching element digitally, a registered RtW DVSP must carry it out.

For workers with time-limited permission, the employer must re-check on or before the date permission ends. Someone with settled status, or status under the EU Settlement Scheme, needs no follow-up check. Copies are kept securely “for the duration of the worker’s employment and for two years afterwards”, then securely destroyed.

The anti-discrimination duty also carries over. The guide tells employers to be “consistent in how they conduct right to work checks on all workers, including British citizens”, and not to check only those they think are more likely to be migrants. If a discrimination complaint is upheld, the Tribunal “will normally order the payment of compensation, for which there is no upper limit”. Our reading is that any new checking added for the October rules should use the same process for everyone engaged on the same terms.

Penalties and enforcement

In the Home Office penalty code (stage 3, page 32), a first breach starts at £45,000 per worker. A repeat breach, meaning one within three years of an earlier finding, starts at £60,000 per worker. The code lists mitigating factors. Reporting a suspected illegal worker to the Home Office and getting a Unique Reference Number before the Home Office identifies them reduces the penalty by £5,000 per worker, and so does active co-operation with the investigation. The guide summarises the ceiling as “a civil penalty of up to £60,000 per illegal worker”.

The guide lists other sanctions: in serious cases a criminal conviction with up to five years’ prison and an unlimited fine, closure of the business and a compliance order, disqualification as a director, and loss of the ability to sponsor migrants. A criminal offence under section 21 of the 2006 Act arises if an employer knows, or has reasonable cause to believe, they are employing an illegal worker, and an employer who knows has no statutory excuse “regardless of whether they have conducted right to work checks”. On a grace period, Annex C says: “No. The requirements apply from 1 October 2026 and there is no general grace period.” Enforcement stays “intelligence-led”.

What the Home Office documents do not settle

Some questions a payroll team will ask are not answered by the documents we read.

In the three documents we found no rule for trial shifts, no sector exemption or separate start date for hospitality or care, and no text on zero-hours contracts as such. On the criminal side, section 15A(7) lists sections 15, 16, 17, 23 and 24 as those where the extended meaning of employing applies. Section 21, the offence of knowingly employing an illegal worker, is not on that list, and the guide does not say what follows from that. We take no view.

The documents also use two start-date tests and do not reconcile them. The guide and the penalty code say a civil penalty for a worker’s contract, sub-contractor or matching-service engagement may only be imposed “where the employment commenced on or after 1 October 2026”, and the code says this applies to liability under both section 15 and section 15A. For extended liability, the guide ties the prescribed requirements to arrangements “entered into on or after 1 October 2026”, and Annex C says the relevant date is when the arrangement was entered into, “not when the work starts or continues”. If a worker’s contract was signed before 1 October but the person first works after it, the formulations point in different directions. Our reading, not the Home Office’s, is that the cautious course is to complete the check before the first shift.

The Home Office also says it “cannot approve individual contractual clauses or business-specific compliance frameworks” and cannot give legal or HR advice on specific cases. The guide itself suggests businesses may “obtain their own independent legal or HR advice where necessary”.

A working checklist for payroll and HR teams

This list is ours. Each step rests on the sections above, but the sequence and the record-keeping suggestions are our reading, not Home Office instructions.

List every way people reach your workplace or work for you: employees, workers, sole-trader sub-contractors, agency supply, platform or matching-service sourcing, and any service you buy that a third party delivers with its own labour.
For each arrangement, record both the date the contract was entered into and the date the individual started. The guide uses each in different places.
Name the direct employer for each person. Where it is you, make sure the check is done before the work starts and the record is kept for the duration of engagement and two years after.
Where you are contracted to deliver work to someone else and use another business to fulfil it, work out whether extended liability applies. If it does, have the written statement in place before the work starts and keep the evidence the guide lists: the agreements, audit records, assurances and compliance reviews.
Where a contract lets someone substitute another person, decide whether to keep the clause. If you keep it, build the substitution controls and the identity checks around it before the first substitution.
Diary follow-up checks for anyone with time-limited permission, on or before the expiry date.
For borderline arrangements, take legal advice. The Home Office will not approve your reading of them.

The guide ties the statutory excuse to the check being made before the individual commences. Our reading is that the control therefore belongs in onboarding, ahead of the first shift and the first payslip, rather than in the payroll run. For the pay side of shift workforces, see our guide for employers, and for how the same casual arrangements are treated for holiday pay, zero-hours contract holiday pay.

Frequently asked questions

When did the right to work changes start?

On 1 October 2026. Section 48 of the Border Security, Asylum and Immigration Act 2025 came into force then under SI 2026/683, and SI 2026/700, the revised penalty code and the revised discrimination code took effect the same day.

Do casual and zero-hours workers now need a right to work check?

If they are on a contract of employment, they already did. If they are engaged under a worker’s contract, they are in scope from 1 October 2026 for engagements that began on or after that date. The Home Office documents do not use the words “casual” or “zero hours”, so the contract terms decide, not the label.

Do I need to recheck everyone I already engage?

The guide says the measures “are not intended to be retrospective”. For worker’s contracts, sub-contractors and matching services, a civil penalty may only be imposed where the engagement commenced on or after 1 October 2026. The guide also says employers may choose to review continuing arrangements as part of wider measures. Where the two start-date tests in the guide point different ways, see the section above.

Can an agency do the right to work check for me?

In a standard agency supply arrangement the agency is the employer and does the check, and the hirer is not expected to duplicate it. If you are the employer, you cannot rely on a check carried out independently by a recruitment agency or adviser, except a prescribed check by a registered RtW DVSP.

Are self-employed contractors in scope?

It depends on the arrangement. The guide says an individual running an independent business who contracts directly with clients is outside the scheme, but “there is no blanket exclusion” for contractors, freelancers, consultants or personal service company arrangements. The substance of the arrangement decides.

What is the penalty?

According to the Home Office penalty code, the starting point is £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years, reduced by £5,000 per worker for each of two mitigating factors. The guide summarises the ceiling as up to £60,000 per illegal worker. Criminal penalties of up to five years in prison and an unlimited fine apply in serious cases.

Is there a grace period?

No. Annex C says “there is no general grace period”.

Will the Home Office approve my contract wording?

No. It says it cannot approve individual contractual clauses or business-specific compliance frameworks, and there is no prescribed form of words for the written statement.