New Right to Work Checks for Gig Economy and Construction Workers: What UK Employers Must Do Now

Key Takeaways

• The extended right to work rules have been in force since 1 October 2026. Section 48 of the Border Security, Asylum and Immigration Act 2025 was brought into force on that date by SI 2026/683, and the prescribed requirements sit in SI 2026/700. The Home Office published the final Employer's guide and both codes of practice on 1 October 2026, so no part of the package is draft any more.
• Three new kinds of engagement now need a right to work check before work starts. They are individuals on a worker's contract, individual sub-contractors (such as couriers who sign up to a delivery app) and service providers found through an online matching service. The employment business, the platform or the matching service is the one that must check.
• A genuinely independent business is not in scope. The guide does not apply to individuals running an independent business, in their own name or through their own company, who contract directly with clients. A self-employed plumber with their own customers needs no check, but the contract label decides nothing: the Home Office looks at how the arrangement works in practice.
• You can be fined for a worker you never engaged. Under the new section 15A, a main contractor, a business that passes contracted work to suppliers, an online matching service or anyone whose contract allows substitution can be treated as the employer. The only protection is the prescribed requirements: a written statement of contract terms, substitution controls and identity verification. A warranty clause is not enough.
• The civil penalty is £45,000 per illegal worker for a first breach and £60,000 for a repeat breach. A repeat breach means another breach within three years. Each figure can fall by £5,000 per worker for reporting and by £5,000 for co-operation, and knowingly employing an illegal worker remains a crime carrying up to five years in prison.
• There is no grace period. The Home Office says the requirements apply from 1 October 2026 with no general grace period, so every new engagement needs a prescribed check, or for supply chains a written statement, before the work begins.
• Arrangements made before 1 October 2026 are not caught just because the work continues. The date that counts is when the contractual arrangement was entered into. A renewal, extension or variation can create a new arrangement depending on its legal effect, and the date limits only the civil penalty for the new categories, not liability for someone who was really an employee all along.
• You can delegate the check, but not the liability. A check carried out independently by a recruitment agency or adviser gives you no statutory excuse. The one exception is a prescribed check by a registered right to work digital verification service provider (RtW DVSP).
• The final guide confirms the 11 September 2026 draft and adds three things. It clarifies how TUPE applies, explains how to sign up for Home Office updates and adds an Annex C of questions and answers. The scope test, the independent business carve-out and the prescribed requirements are unchanged.
• WorkPermitCloud maps your engagements and fixes your contracts. Our Right to Work Check service tells you which arrangements are in scope, drafts the prescribed supply chain terms and sets up compliant checks for every new engagement from today.

Introduction

Since 1 October 2026, the duty to prevent illegal working no longer stops at the payroll. Section 48 of the Border Security, Asylum and Immigration Act 2025 is in force. A business that engages people on a worker's contract, uses individual sub-contractors or runs an online matching service must now check that those people have the right to work in the UK before they start. A business further up a supply chain can also be fined for an illegal worker it never met.

The Home Office published the final Employer's guide to right to work checks at 09:30 UK time on 1 October 2026, together with the final codes of practice on preventing illegal working and on avoiding discrimination. The Act, the regulations, both codes and the guide are all in force. Nothing in this post is a proposal.

This post sets out what an engager must do now: who must check, who sits outside the rules, how supply chain liability works, what the penalties are, and what to do about new contracts and the arrangements you already have. For the classification question in more depth, see our guide on whether you need a right to work check for a self-employed contractor. For the full checking process, see our right to work checks guidance.

We first published this post on 7 July 2026, before the Home Office had issued any guidance. That version said every self-employed contractor was now in scope. That was wrong. The final guide excludes people genuinely running their own business, and this update corrects it.

What Changed on 1 October 2026

Two changes took effect together. Section 48 inserted a new section 14A into the Immigration, Asylum and Nationality Act 2006, so that "employing" someone now includes engaging them under a worker's contract, engaging them as an individual sub-contractor, or matching them with customers through an online matching service. It also inserted a new section 15A, which lets civil penalty liability travel up a chain of contracts to a business with no direct contract with the worker.

Neither change alters how a check is carried out. The three check methods, the document lists and the follow-up rules carry on as before. What changed is who must check, and who pays if nobody does.

One rule protects anyone who checked correctly before today. A right to work check, or compliance with the supply chain requirements, is judged against the code in force when it was carried out. The penalty amount is set by the code in force on the date of the breach.

What the Final Guidance Confirmed or Changed

The final guide stays very close to the draft republished on 11 September 2026. The Home Office's own summary of changes lists three updates made after further stakeholder feedback: a clarification on TUPE transfers, a note on how to sign up for updates, and a new Annex C of questions and answers. We also checked every passage of the draft that our September guidance relied on, including the carve-out, the substance test, the commencement rule, delegation and the three prescribed requirements. Each appears in the final text word for word, and the guide keeps the same fourteen worked examples.

The new material matters most where it answers questions employers were asking. The points below are the ones that change what an engager does.

Who Is Now in Scope, and Who Is Not

The test is substance, not labels. The guide says consideration should be given to how an arrangement operates in practice, and that the label the parties use "will not, by itself" decide what responsibilities arise. It lists eight factors and says no single one is determinative:

• whether individuals personally carry out the work or services
• who engages, supplies or arranges the individuals doing the work
• who is contractually responsible for the work, and who is responsible for the people doing it
• whether the arrangement is mainly the supply of individuals, or the purchase of a defined service or outcome from an independent business
• whether there is a chain of contracts and, if so, what role each business plays in it
• who chooses, approves or replaces the individuals doing the work
• whether substitution is permitted, expected or controlled
• what the contracts say, and how the arrangement works in practice

The table below applies that test to the arrangements the Home Office uses as worked examples.

The Independent Business Carve-Out

This is the part of the rules our July version left out. The final guide says it "does not apply to individuals who are operating an independent business either in their own name or through their own company and who contract directly with clients or customers to provide goods or services". That includes services provided directly to the public and typical business to business contracts where the arrangement is the purchase of a service rather than the employment of an individual.

The guide gives two examples. A self-employed plumber who advertises to the public, works for many customers and is called out to fix a tap needs no check. A graphic designer engaged on a project through their own personal service company, which contracts and invoices in its own name, needs no check by the client company.

The carve-out has limits. People who find work through an intermediary, platform or matching service, and who are not running an independent business in their own right, may still be in scope. Annex C adds that there is no blanket exclusion for anyone described as a contractor, freelancer or consultant, or for anyone working through a personal service company. Where an engagement sits on the line, the safe course is a check, applied to everyone in that engagement type, British citizens included, as the code of practice on avoiding discrimination requires.

Extended Liability: When You Pay for Someone Else's Worker

Section 15A is the change with the longest reach. It applies in three situations: where you are under a contract to provide work or services to a third party and use another employer's workers to deliver it; where an online matching service matches a service provider with a customer and the provider contracts with that customer; and where your contract with an individual allows them to send a substitute. In each case you may be treated as employing whoever actually does the work, even if you have no contract with them.

It does not apply to every business that buys services. A client, customer or end user buying work or services for its own internal operations is outside it. The question is whether you consume the work yourself or pass it on to a third party under a contract of your own.

The direct employer still carries the duty to check, and extended liability does not transfer it. The Home Office says it will ordinarily look for the person responsible for the arrangements rather than treat everyone in a chain as liable. Where the direct employer cannot be identified, for example because the worker cannot say who employs them, there are several intermediaries, records are missing or substitution hides who did the work, liability may move up the chain to a business that has not met the prescribed requirements.

The Three Prescribed Requirements

A business facing extended liability gets a statutory excuse only by meeting the requirements in article 5B of the Immigration (Restrictions on Employment) Order 2007, inserted by SI 2026/700. They must be in place before the work starts.

Three points from the final guide shape how you meet these. You may rely on a supplier's assurance that checks have been done, and on another party's identity verification, if you have taken reasonable steps to satisfy yourself they are reliable. A general warranty that a supplier complies with immigration law is not one of the requirements, and the guide says you should not rely on contractual terms alone. There is no prescribed audit frequency or minimum evidence pack: the right level depends on the risk and the size of the chain.

The Penalties: What Employers Risk

The penalties did not change on 1 October 2026. What changed is who they can reach. The figures below come from the code of practice on preventing illegal working in force from that date and the final Employer's guide.

A civil penalty is charged per worker, so a gap across a team of riders or a labour gang multiplies quickly. If you receive a Civil Penalty Notice, you have 28 days to respond and you must object to the Home Office before you can appeal to a court (penalties for employing illegal workers). Our illegal working and civil penalties guidance explains the full process, and our post on employing illegal delivery drivers shows how each sanction applies across a delivery chain.

Enforcement Is Already at Record Levels

During 2025 the Home Office carried out 12,831 illegal working visits and made 9,008 arrests, and issued 2,438 civil penalties worth over £130 million. Construction arrests rose from 165 in 2024 to 588 in 2025, an increase of about 256%. Arrests in warehousing, distribution and delivery rose from 349 to 1,106, about 217%. These are provisional figures from the Home Office's illegal working and enforcement activity data, and they were recorded before the new categories came into force. For where the numbers have been heading, see our post on immigration raids and £74 million in fines.

What Counts as a Compliant Right to Work Check?

A statutory excuse comes only from a prescribed check completed before work starts. There are three methods, and the one you use depends on the person's nationality and status, not your preference.

• Manual document check. See the original acceptable documents in the person's presence, check they are genuine and belong to them, and keep a clear dated copy.
• Home Office online check. The person gives you a 9-character share code beginning with W, valid for 90 calendar days. Codes beginning with R or S are for other services and cannot be accepted. Enter the code and their date of birth at check a job applicant's right to work, record your business name in full, and keep the profile page.
• Check through a registered RtW DVSP. A provider registered on the Office for Digital Identities and Attributes register can check British and Irish passports, including those up to six months past expiry. Any facial recognition must also come from a registered RtW DVSP.

Keep copies for the length of the engagement and two years after it ends, and carry out a follow-up check before any time-limited permission expires. A check done for another purpose, such as an operating licence, does not give you a statutory excuse. Our free Right to Work Check tool walks you through which method applies, and our post on the UK digital ID card and right to work checks covers where digital checking is heading.

Sector Spotlight: Construction, Delivery and Gig Platforms

The law is arrangement-based, not sector-based. The same tests apply to every business. These are the sectors where the arrangements most often fall inside the new rules.

Construction

The Home Office's own example is a construction company that wins a contract to build homes and uses a chain of contracts to supply workers for foundations and bricklaying. That company may be treated as the employer of anyone working through the chain, and its statutory excuse depends on the prescribed requirements. A labour-only subcontractor engaged personally is likely to be in scope. A genuinely independent trade business that prices and staffs its own package of work is closer to the carve-out. In our view a CIS registration does not settle the question, for the same reason the Home Office gives about IR35: it is a tax status, not a right to work test.

Food Delivery, Couriers and Parcel Services

A rider who signs up to a delivery app, logs in when they choose and is paid per delivery is an individual sub-contractor, and the platform must check them. If the platform's terms allow substitution, extended liability makes the platform responsible for the substitute too, so account sharing is now the platform's problem as well as the rider's. A platform that only provides ordering technology to a takeaway which uses its own delivery staff is not liable for those staff; the takeaway is, as their employer.

Warehousing, Hospitality and Beauty

A logistics company contracted to run warehousing for a retailer, which outsources the operation to another company, is within extended liability. The retailer is not, because it buys the service for its own use. A hospitality business using temporary staff from an employment business leaves the check with the employment business. In beauty, a self-employed stylist renting a chair and running their own client base sits close to the carve-out, while someone engaged to work set shifts personally for the salon is likely to be on a worker's contract. That last point is our reading of the guide, not a Home Office example.

What Engagers Must Do Now

The question is no longer how to prepare. It is what each engagement needs today. The steps below are for whoever owns commercial and contractual risk. The onboarding workflow, records and training side is covered on our sister site, WPC HR.

New Engagements and Contracts from 1 October 2026

• Before anyone starts, decide which category the engagement falls into using the eight factors, and record your reasoning.
• For anyone you engage on a worker's contract, as an individual sub-contractor or through your matching service, complete a prescribed check before work starts.
• Where you pass contracted work on to suppliers, produce the written statement before the work begins and make sure the supplier contract carries all five prescribed terms.
• If a contract allows substitution, put substitution controls in place first. You check the substitute; the worker cannot do it for you.
• Set up identity verification at the point of work, re-verifying at least once per shift or 24-hour period where the risk calls for it.
• Do not treat a check carried out independently by an agency or adviser as your own. Use your own staff under your control, or a registered RtW DVSP.
• Apply the same checks to everyone in an engagement type, including British citizens.

Arrangements Already in Place

• You do not need a retrospective checking exercise to avoid a civil penalty for engagements in the new categories that began before 1 October 2026.
• Record the date each existing arrangement was entered into. If the question is ever raised, that date is your evidence.
• Before any renewal, extension or variation, ask whether it creates a new arrangement. If it does, check or meet the prescribed requirements before it takes effect.
• Review whether any "self-employed" engagement is really employment. Liability for employees has applied since 29 February 2008 and the new date does not help.
• Keep running follow-up checks for existing staff on time-limited permission.
• The Home Office says organisations may choose to review continuing arrangements. We recommend starting with substitution contracts and long labour chains, where the risk is highest.

When a Supplier, Contractor or Platform Changes

If workers engaged on a contract for services move to you after a change of contractor, TUPE does not apply to them, and you must check before they start for you. For employees who do transfer under TUPE, the Home Office advises a fresh check within 60 calendar days of the transfer. There is no grace period for any later follow-up check.

Common Mistakes to Avoid

• Treating every self-employed person as in scope, or every one as out of scope. The answer depends on how the arrangement works.
• Relying on the contract label, an IR35 determination or an employment status review to decide whether to check.
• Assuming a supplier warranty protects you. Only the prescribed requirements give a statutory excuse against extended liability.
• Accepting an agency's or adviser's check as your own statutory excuse.
• Waiting for a settling-in period. There is no grace period.
• Re-papering an existing contract without asking whether it creates a new arrangement.
• Checking only the people you assume are migrants.
• Carrying out a check but keeping no dated record, or missing a follow-up check. Our post on right to work check mistakes behind £67 million in London fines shows how often this goes wrong.

How Can WorkPermitCloud Help?

Most of the risk under the new rules sits in the classification and in the contracts, not in the check itself. Our Right to Work Check service maps every way people work for you against the Scheme as it now operates, tells you which arrangements are in scope and which fall inside the carve-out, and sets up compliant checks for new engagements. Where you pass work down a supply chain, we draft the written statement and the five prescribed terms, and build the audit and identity verification process behind them.

Start with our free HR Compliance Audit to see where your records stand. For a full review, our Home Office compliance audit tests your arrangements before an enforcement visit does, and if a Civil Penalty Notice has already arrived, our civil penalty service handles the objection and any appeal.

Conclusion

The extension of right to work checks to the gig economy and flexible labour is now law, with final guidance and no grace period. Platforms, employment businesses, online matching services and main contractors carry duties they did not carry on 30 September 2026, and a business can now be fined for a worker it never engaged.

The rules are narrower than many businesses were told. A genuinely independent business contracting with you directly is outside them, and arrangements made before 1 October 2026 are not caught just because they continue. Get the classification right, put the prescribed terms into every new supply contract, and check every new engagement before work starts. WorkPermitCloud can help you do all three.

Glossary