Right to work checks now reach your supply chain: what changed on 1 October 2026

Why this matters now

The Border Security, Asylum and Immigration Act 2025 received Royal Assent on 2 December 2025, but its right to work changes didn't take effect then. They needed commencement regulations. Those regulations (SI 2026/683) brought section 48 into force on 1 October 2026, and the Home Office published its final employer's guide the same day.

Until now, right to work checks were mainly about your own employees. From 1 October the rules follow the work instead: who carries it out, under what arrangement, and who sits above them in the chain of contracts.

Who now needs a right to work check

The Act adds three groups to the illegal working rules. Each one is treated as employed, and the business engaging them as the employer.

• People on a worker's contract. Anyone who agrees to do work personally for a business that isn't their client or customer. This catches many casual, zero-hours and "self-employed" arrangements that are really personal service.
• Individual sub-contractors. An individual you contract with to do work you've agreed to provide to someone else. In construction this means labour-only trades engaged directly by a contractor.
• People found through online matching services. Platforms that keep a register of service providers, match them with customers online and take a fee or commission.

Labels don't decide it. The Home Office looks at how an arrangement works in practice, starting with whether the individual does the work personally. Someone genuinely running their own business and contracting directly with their own customers is generally outside the rules.

Extended liability: how fines travel up the chain

This is the bigger change. Where you're contracted to provide work or services and you contract with another business to provide some or all of it, the Act says you are to be treated as employing any individual who personally does that work. Three details make it bite:

• It applies even if you have no contract with the worker.
• It applies even if you don't know the worker is there.
• It applies whether your contract is the first in the chain or any later one.

The same idea covers online matching services whose providers take on work through the platform, and employers whose contracts let a worker send a substitute.

Based on example 7 in the Home Office employer's guide, 1 October 2026.

The direct employer stays responsible for running the check. Extended liability doesn't move that duty. It adds a second party who can be fined if nobody can show the right controls were in place. The Home Office says it will normally look for the person responsible for the contractual arrangements, rather than fining everyone in the chain. Where it can't identify the direct employer and the prescribed requirements haven't been met, liability can move further up.

Who isn't caught

Extended liability is about passing work down a chain. The guide gives examples of arrangements that are not in scope:

• Buying a service for your own operations. A retailer hiring a facilities company to clean its stores isn't caught by extended liability. The facilities company, as the cleaners' employer, is responsible.
• Agency workers inside your own business. A manufacturer taking temporary production staff from an employment business isn't caught. The employment business remains the employer.
• Supplying goods. A food producer selling sandwiches to a retailer isn't providing work or services to it.
• Pure technology platforms. An ordering app used by a takeaway that employs its own delivery staff isn't engaging those staff.

If you're the company in the middle, such as the facilities company, the employment business or the subcontractor, the duty to check still sits with you.

Penalties

Penalties are per worker, so they add up quickly: ten illegal workers on a first breach is a starting point of £450,000 before any reductions. A penalty can also be published on GOV.UK, and it can affect a sponsor licence, other licences and access to credit.

How to protect yourself: the three prescribed requirements

If extended liability applies to you, you can still establish a statutory excuse, which is your defence against the fine. You must meet the prescribed requirements before the work starts and be able to prove it if asked.

1. Right to work terms in your contracts

You need a written statement of terms in each contract with the business supplying the work. It must require them to:

• carry out prescribed right to work checks on everyone doing the work;
• not subcontract further without your written consent, and pass the same obligations down to anyone they do use;
• let you audit their right to work checks;
• accept enforcement, such as suspension or termination, if illegal working is found without a statutory excuse;
• cooperate with any Home Office investigation, including details of every business in the chain.

You can rely on a supplier's assurances that checks were done, but only if you've taken reasonable steps to make sure those assurances are reliable.

2. Controls on substitutes

Where a contract lets a worker send someone in their place, every substitute must have their own right to work check before they start. The check can't be left to the worker, and you need to be sure the person working is the person who was checked.

3. Identity verification on site

You need proportionate systems to confirm that the person doing the work is the person whose right to work was checked. The guide's examples include ID cards or workplace passes, facial recognition, attendance systems and checks against training records. It recommends re-verifying identity at least once in every 24-hour period or shift.

What about people already working for you?

• New groups: fines for workers, individual sub-contractors and platform matches apply where the engagement started on or after 1 October 2026.
• Extended liability: the prescribed requirements apply to contractual arrangements entered into on or after 1 October 2026.
• Employees: unchanged. They have been covered since 2008.
• Follow-up checks are still required when someone's time-limited permission to work runs out, whenever they started.

So you don't need to re-check everyone overnight. But every new engagement, every new subcontract and every follow-up check from now on falls under the new rules.

A checklist for main contractors

1. Map your chains. List the contracts you deliver using other businesses' people, and who sits at each tier.
2. Update your subcontract terms before new contracts start: checks, consent to subcontract, audit rights, enforcement and cooperation. Take legal advice on the wording.
3. Decide how you'll verify suppliers' checks. Assurances only count if you've taken reasonable steps to rely on them.
4. Verify identity at the gate, every shift. Make sure the person on site is the person who was checked.
5. Control substitutes. No check, no entry, with no exceptions for stand-ins.
6. Keep records of who worked, where, when and for which supplier. Keep right to work evidence for the length of the engagement plus two years.
7. Diary the follow-up checks for anyone whose permission to work is time-limited.

Where NC5 fits

NC5 is built for this. Suppliers invite their workers, who verify their identity and right to work from their phones. Each cleared worker carries a signed QR card that your gate team scans every shift, with the worker's photo on screen. Every check and every scan is logged with time, site and supplier, so you can show who worked where, when, and whose check covered them.

Where a check is done digitally, the guide says it must be carried out by a right to work digital verification service provider (RtW DVSP) registered on the OfDIA register. NC5 is not a DVSP. The identity check inside NC5 is carried out by Veriff UK Identity Verification Service, which is on that register and certified against the Right to Work supplementary code, and every NC5 check record names it. See the credentials.

What NC5 doesn't do is write your contracts. Your subcontract terms set the rules. NC5 gives you the evidence that they work in practice, which is the part the Home Office says contracts alone can't provide.

Sources

• Border Security, Asylum and Immigration Act 2025, section 48 (legislation.gov.uk)
• The Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026, SI 2026/683 (legislation.gov.uk)
• Home Office: Right to work checks, an employer's guide (version of 1 October 2026, GOV.UK)
• Home Office: Code of practice on preventing illegal working, Right to Work Scheme for employers (GOV.UK, PDF)
• Border Security, Asylum and Immigration Act receives Royal Assent (GOV.UK news)

This guide is general information based on the legislation and Home Office guidance in force on 1 October 2026. It isn't legal advice. Get advice on your own contracts and working arrangements.