More people need a check
Checks no longer stop at employees. People on worker contracts, individual sub-contractors and people found through online matching platforms must now be checked before they start.
New rules in force from 1 October 2026
Prove the right to work of every worker in your supply chain.
A contractor can now be fined up to £60,000 for each illegal worker anywhere down its chain of contracts, including people it never hired. NC5 checks every worker, verifies them at your gate each shift and keeps the evidence the Home Office asks for.
- No app to download
- Workers onboard from an SMS in under 5 minutes
- Gate scanner works offline
NC5 ScannerOnline
LocationRiverside, Block C
ACCESS GRANTED
Right to work and identity verified
Sam Taylor
Supplied by Example Groundworks Ltd
- Right to work
- Verified
- Check type
- Home Office share code
- Next follow-up
- 14 Mar 2027
- Scan logged
- 07:42 · in geofence
Go
Offline: 24h pass
Stop
Illustration. Names and companies are examples.
The law, in plain English
Three changes that put contractors on the hook
Section 48 of the Border Security, Asylum and Immigration Act 2025 came into force on 1 October 2026. It changes who counts as an employer for right to work purposes, and how far up a supply chain the fines can reach.
Liability runs up the chain
If you're contracted to deliver work and other companies supply the people, you can be treated as the employer of every individual doing it. That applies even with no contract between you, and even if you didn't know they were there.
A contract clause isn't enough
To defend yourself you need three things in place before work starts: right to work terms in your subcontracts, controls on substitutes, and a way to verify that the person on site is the person who was checked.
£45,000
per illegal worker, first breach
£60,000
per illegal worker, repeat breach within three years
5 years
maximum prison sentence for knowingly employing an illegal worker
Civil penalty starting points from the Home Office code of practice on preventing illegal working. See the full breakdown and sources.
Extended liability
Who pays when a labour supplier gets it wrong?
The Home Office's own first example is a construction company that wins a housebuilding contract and brings in foundations and bricklaying crews through a chain of subcontractors. It can be treated as the employer of every person doing that work.
ClientCommissions the project
You, the main contractorNow treated as the employer
SubcontractorGroundworks package
Labour supplierProvides the crew
Worker on your siteNo right to work
Since 1 October 2026, the fine for that worker can land on you, as well as on the labour supplier who employed them. You have no contract with the worker and may never have met them. Your defence is to show the right checks and controls were in place before the work started.
What the Home Office asks for, and where NC5 fits
Built for the three things you now have to prove
The Home Office says contract terms alone won't protect you. You need to show your arrangements work in practice. That's the part NC5 does.
The requirement
Right to work terms in your subcontracts
Suppliers must run prescribed checks, can't subcontract further without consent, and must let you audit them.
How NC5 helps
Your contracts set the rules. NC5 shows they're being followed. Suppliers run their checks in the same system, so you can see which company supplied each worker, when they were checked and their status today. Audit evidence is an export, not a chase.
The requirement
Controls on substitutes
Nobody works as a stand-in until their own right to work has been checked, and the check is never left to the worker.
How NC5 helps
No check, no entry. Every person needs their own completed check and their own card to get through the gate. A stand-in with no record has no card, and someone using another person's card fails the photo check.
The requirement
Identity verification on site
A proportionate way to confirm the person doing the work is the person who was checked. The Home Office recommends doing it at least once every 24 hours or shift.
How NC5 helps
Each worker carries a signed QR card. The scanner shows their photo and status, so your gate team can confirm the face matches. Every scan is logged with the time, site and location, giving you a record of who worked where, and when.
NC5 doesn't write your contracts. Take legal advice on the wording of your subcontract terms. NC5 gives you the evidence that they work.
How it works
From invite to gate in three steps
Workers do the onboarding themselves on their phones. You get a record of every check and every scan.
Invite
Add workers one at a time or upload a roster of up to 500. Each gets a secure SMS link. There's no app to install and no password to remember.
Verify
Workers photograph their ID and take a liveness selfie. Share codes are checked with the Home Office online service. Mismatches go to a person to review, and the verified document always overrides typed details.
Scan
Workers show their QR card at the gate. Green means go, red means stop. If the signal drops, amber means a provisional 24-hour pass that syncs when you're back online.
Then NC5 keeps watching. When someone's permission to work is time-limited, you and the worker get reminders at 90, 30, 7 and 0 days, and their status changes automatically if it lapses. Follow-up checks happen on time, not after an inspection.
Who it's for
One system for the boardroom, the office and the gate
Directors and commercial managers
See your whole supply chain
The risk now sits with you. NC5 gives you one view of every supplier's checks, and the evidence that you took reasonable steps if the Home Office asks.
HR teams and labour suppliers
Clear people without paperwork
Workers verify themselves from a text message in under five minutes. Bulk-import hundreds at once, and reuse a worker's earlier verification instead of paying twice.
Site managers and security
Keep the gate moving
Scan, check the photo, done. The scanner keeps working without signal and issues a 24-hour provisional pass, so a dead spot never stops a shift.
Where the new rules bite hardest
If you deliver work with other companies' people, this is you
Construction
Main contractors delivering projects through subcontractors and labour-only trades. Individual sub-contractors now need their own check before they start.
Facilities and security
Contractors delivering cleaning, guarding or maintenance contracts with subcontracted staff across many sites.
Logistics and warehousing
Providers who owe a client a warehousing or distribution contract and outsource running it to another company.
Events and live production
Contractors delivering builds, crewing and stewarding for clients with staff drawn from several suppliers.
Platforms and gig work
Online matching services and delivery platforms, including where riders or workers can send a substitute in their place.
Major projects
Multi-tier programmes where thousands of workers arrive through dozens of suppliers and every tier needs a record.
Buying a service for your own business? If you only buy a service for your own operations, such as a retailer hiring a cleaning company for its stores, the new supply chain rules generally don't make you liable. The company employing the workers stays responsible, and needs to get its checks right.
What's in the platform
Everything between the invite and the inspection
Right to work checks
Share codes checked with the Home Office online service. British and Irish passports verified digitally by a registered RtW DVSP.
Identity verification
Document check plus a liveness selfie through Veriff, a RtW DVSP on the OfDIA register, so the person holding the phone is the person on the ID.
QR compliance card
A cryptographically signed card on each worker's phone. One scan shows their photo and status.
Offline gate scanning
No signal? The scanner validates the card's signature and issues a 24-hour provisional pass, then syncs when you reconnect.
Supply chain view
Main contractor, supplier, worker. See which suppliers are compliant and which ones put you at risk.
Expiry monitoring
Reminders at 90, 30, 7 and 0 days, with statuses that change automatically when permission runs out.
Tamper-evident audit trail
Every invite, check, scan and override is hashed and time-stamped, ready to show an inspector.
Access by role
Admin, supplier, checker, read-only auditor and worker roles. Gate staff see a photo and a status, never ID documents.
Compliance
Digital checks through a registered RtW DVSP
The Home Office employer's guide of 1 October 2026 says that if a right to work check is done digitally, it must be done by a right to work digital verification service provider (RtW DVSP) registered on the Office for Digital Identities and Attributes (OfDIA) register. NC5 is not a DVSP itself. The identity check inside NC5 is carried out by one, and every check record names it, as the guide requires of any platform that procures the service.
Veriff UK Identity Verification Service
Operated by Veriff OÜ. Carries out the document and liveness check for every worker on NC5.
- Supplementary codes
- Right to Work, Right to Rent
- Roles certified
- Identity, Component
- Identity profiles for right to work
- Medium (M1A, M1B)
- Trust framework version
- 0.4 (gamma)
- Conformity assessment body
- Kantara Initiative
- Certificate of conformity
- Issued 14 January 2026, expires 14 January 2029
Register entry as shown on 16 October 2026. The register is the authority: check the live entry before you rely on it.
Share codes go to the Home Office
Workers who are not British or Irish citizens prove their right to work with a Home Office share code. NC5 checks it with the Home Office online right to work checking service and keeps the result as evidence.
Your check record names the service
The guide says a platform that procures a RtW DVSP's service must say which certified and registered service carried out the check. NC5's compliance report does: Veriff for identity, the Home Office online service for the share code.
You stay responsible for the check
Using a RtW DVSP does not move the statutory excuse. The employer, not the DVSP, remains responsible for the check being done as prescribed. NC5 gives you the evidence to show it was.
Anyone who does not hold a British or Irish passport, or who does not want a digital identity check, must be offered a manual document check and must not be treated less favourably.
Pricing
Priced around your sites and your workforce
What you pay depends on how many sites you run and how many workers you check. Tell us about your supply chain and we'll put a quote together.
Useful to include
- Number of sites or contracts
- Roughly how many workers you check each year
- How many suppliers sit below you in the chain
- How you check right to work today
FAQ
Common questions
Does the 1 October 2026 change apply to my business?
Probably, if you engage people who aren't employees (casual workers or individual sub-contractors), run an online platform that matches workers with customers, or are contracted to deliver work that other companies' staff carry out. If you only buy a service for your own business, the company employing the workers generally stays responsible. Our guide walks through the tests.
Do we have to re-check everyone already working for us?
Not because of this change alone. Fines for the newly covered groups apply where the engagement started on or after 1 October 2026, and the supply chain requirements apply to contracts entered into from that date. Employees were already covered, and follow-up checks are still due when someone's permission to work expires.
Does NC5 give me a statutory excuse?
A statutory excuse is your defence against a civil penalty. Used correctly, NC5 runs the checks and keeps the evidence you need to establish one. You stay responsible for following the Home Office process, and for supply chain liability you also need the right terms in your contracts. NC5 records the checks. It doesn't write your contracts.
Is a driving licence proof of right to work?
No. A driving licence proves identity only. British and Irish citizens normally use a passport. Most other people prove their right to work with a Home Office share code.
Do workers need to download an app?
No. Workers open a secure link from an SMS in their phone's browser. Gate staff can add the scanner to their home screen like an app.
What happens if there's no signal on site?
The scanner works offline. It checks the cryptographic signature inside the QR card and issues an amber 24-hour provisional pass. Cards stay valid offline for 72 hours, and scans sync automatically when the connection comes back.
Who can see a worker's ID documents?
Only the automated checks and authorised admins reviewing a flagged case. Gate staff see a profile photo and a status, never the documents. Evidence is stored encrypted, and workers can request a copy of the data held about them.
Is NC5 a registered digital verification service provider?
No, and it doesn't need to be. The digital identity check inside NC5 is carried out by Veriff UK Identity Verification Service, a right to work digital verification service provider (RtW DVSP) on the OfDIA register, certified against the Right to Work supplementary code. The Home Office guide allows a platform to procure that service as long as it names the registered service doing the check, which NC5 does in every compliance report. See the credentials.
Talk to us
Questions about the new rules, a demo for your team, or a quote for your sites. Email us and we'll get back to you.
hello@nc5.uk
Already a customer? Log in
Worker? Get your QR card