From 1 October 2026, section 48 of the Border Security, Asylum and Immigration Act 2025 (BSAI 2025) comes into force. It amends the Immigration, Asylum and Nationality Act 2006 (IANA 2006) in two ways:
- Widens who counts as an "employer" — right to work checks will now apply to more types of working arrangement, not just traditional employment.
- Extends who can be liable for a penalty — in some cases, a business can be liable for illegal working even where they have not directly engaged the worker
The new rules will apply to anyone engaged on or after 1 October 2026 or to workers who have a time-limited excuse which needs a follow-up check before expiry and that expiry falls on or after 1 October 2026,
The government have updated their guidance to employers on right to work checks which can be found here. This was last updated on the 11 September and is still in draft form but in this article, we’ll take you through the key points.
Expanded definition of "employer"
Section 48 BSAI 2025 inserts a new section 14A into the IANA 2006. This expands the definition of 'employer' to include anyone engaging an individual:
- Under a worker's contract
- As an individual sub-contractor
- Through an online matching service
If you engage people in any of these ways from 1 October you will have the same duty to carry out a prescribed right to work check as you would for a directly employed worker — and the same liability if you get it wrong: a penalty of up to £60,000 per illegal worker.
Let’s take a closer look at who falls within these categories.
Worker — In these situations, you’ve engaged the individual to carry out work personally and they are not genuinely running their own business.
For example, a pub engages casual bar staff to cover shifts over a bank holiday weekend because regular employees have called in sick. The pub will be the workers' employer for Right to Work Scheme purposes and will be responsible for carrying out right to work checks before any work is undertaken.
Subcontractor – This is where you've agreed to carry out work or provide services for a third party, and you've engaged an individual to personally do some of that work for them.
For example, you have a contract with a developer to construct a housing block. You engage B, a groundworker who doesn’t operate his own business, to carry out the groundworks needed as part of the construction project. You would be B’s employer for the purposes of the Right to Work Scheme and would therefore be responsible for carrying out the right to work checks before B starts the work.
Online matching service — This covers situations where you put individuals providing services in touch with potential clients or customers.
For example, an online matching service matches cleaners to customers. A homeowner uses the online service to find a cleaner. The online matching service is the cleaner’s employer for the purposes of the Right to Work Scheme and is therefore responsible carrying out right to work checks.
Who is not covered by this?
Someone genuinely operating an independent business providing goods or services — in their own name or through their own company — will generally be out of scope.
However, the label given to an arrangement is not the deciding factor. What matters is the nature of the arrangement in practice, including how the work is arranged, supplied, and performed.
Extended liability
Section 48 BSAI 2025 inserts a new section 15A into the IANA 2006, extending potential liability for illegal working to businesses that don't have a direct relationship with the worker, in three situations:
- Chain contracting — your business agrees to provide work or services to a third party, and you contract with another party who employs worker(s) to carry out all or part of that work.
- Online matching — an online matching service matches a service provider with a client/customer, and the service provider then contracts directly with that client/customer.
- Substitution — you engage an individual to provide work or services, and the contract allows that individual to send someone else (a substitute) to do the work instead.
Important: if illegal working is uncovered, the Home Office will first go to the organisation who engaged the worker, but where they cannot be identified or found, they will look beyond them to others who may be liable under the extended liability rules.
Examples of situations where extended liability could arise
Chain contracting –this iswhere your business is contractually responsible for delivering work or services to a third party, and you contract with another employer who engages individuals to carry out all or part of that work. If one of these workers is found to be working illegally, you can be liable for the penalty for this even though you never contracted with them directly. This liability can apply through all layers of the contracting chain, not just the first layer.
For example, aproperty developer wins a contract to build a cinema and engages subcontractors for bricklaying and electrical works. If a worker further down that chain is working illegally, the developer can be held liable.
The key test is- are you delivering work or services to someone else, and using another business's workers to do it? If yes, you're in scope of the extended liability rules. If you're simply the end-user buying a service or product for your own internal use, you're not.
For example, you engage company A to provide cleaning services for your company offices. You are simply purchasing services from them and if it is subsequently discovered that one of the cleaners engaged by company A is working illegally, you would not be liable for this under the extended liability rules.
However, if your business wins a contract to provide facilities management services to a large office block and you subcontract the cleaning services element to company A, if one of the cleaners they engage is found to be working illegally, you could be liable for the illegal working penalties under the extended liability rules.
Online matching - this covers situations where an online matching service matches a worker providing a service with a client, and the worker then enters into a direct contract with that client.
For example, you operate an online matching service matching electrical services businesses with potential customers. A homeowner needs electrical work carried out at their property and uses your service to find an electrician. They then enter into a contract directly with the electrical services business to carry out the work. This arrangement falls within the extended liability provisions, meaning that if the worker they send out to carry out the work is an illegal worker, you could be liable for the penalty.
How to establish a statutory excuse in chain contracting and online matching situations
Where you don’t have a direct contractual relationship with the worker but the extended liability rules for chain contracting or online matching services apply, you can still avoid a penalty by establishing a statutory excuse. To do so you need to show that, before the work started, you complied with the following requirements and you can provide evidence of this.
Before work started, you put in place a written contract with the business supplying the workers that required them to:
- Carry out prescribed right to work checks on anyone performing the work
- Get your written consent before further subcontracting, and pass the same right to work obligations down the chain in any permitted arrangements
- Allow you to audit their compliance
- Cooperate with any Home Office investigation relating to illegal working — including providing details of the contractual chain and the names, company types, registered addresses or principal place of business, and company registration numbers of everyone involved, plus any other information the Home Office considers relevant
- Additionally, the contract must give you the ability to take enforcement action (including but not limited to suspension or termination of the contract) if illegal working is found and no statutory excuse has been established.
The guidance sets out examples of evidence which could help establish a statutory excuse including:
- Details of contractual arrangements, and copies of agreements or terms and conditions
- Audit records – it is important that this is not just a term in the contract, the Home Office will expect to see that you have actively audited compliance.
- Assurance information received from employers or service providers that right to work checks have been carried out. However, the guidance warns that you can only rely on these assurances if you've taken reasonable steps to satisfy yourself that they are reliable and the requirements are actually being met.
- Records of compliance reviews
- Information showing how concerns were identified and acted upon
This list is not exhaustive. The guidance explains that what is needed will also depend on the nature of the contractual arrangements, the risk of illegal working or non-compliance arising from those arrangements, and the size and complexity of the contractual chain.
What about agency workers?
The guidance provides the following example of where agency workers fit within the new framework.
A manufacturing company experiences a sudden increase in demand and uses an agency to bring in some temporary agency workers to increase production. The company is engaging the agency workers for use within its own business operations and is not responsible for providing the work or services onwards to a third party as part of a contractual chain. The extended liability provisions therefore do not apply to the manufacturing company in this situation. Responsibility for carrying out the right to work checks and liability for payment of a civil penalty in the event of illegal working, remains with the agency as the employer of the workers while they are on this assignment.
However, if you are using agency workers to deliver a service you are delivering to a third party, this is likely to come within chain contracting extended liability.
For example, you’ve contracted to provide facilities management services to a client and you use an agency to supply the workers who will actually do the work. In this situation, you are not the end-user of the agency workers’ services. Instead, they are the means by which you’re meeting your obligations to a third party and this is the type of situation covered by chain contracting extended liability. In this scenario, the obligation to carry out the right to work checks would still lie with the agency, but you could be liable under extended liability rules. If in any doubt, treat the agency as part of a contracting chain and make sure you have the contractual provisions and practices in place to establish a statutory excuse.
Substitution – this is a third situation where extended liability may apply and it covers situations where you have a direct contract with individual A to carry out work, but the agreement permits A to send a substitute to carry out the work instead.
For example, you enter into a contract with Helen to develop a new website for your business. The contract has a substitution clause allowing Helen to arrange for someone else to carry out the work. Helen arranges for Josh to do the work. Although the business has no direct contract with Josh, if he is found to be working illegally, your business may be liable under the extended liability provisions.
What do I need to do to establish a statutory excuse in cases of substitution?
You can establish a statutory excuse in these situations if, before work starts, you’ve implemented processes to ensure that:
- A prescribed right to work check is carried out on any substitute
- Responsibility for the check is not delegated to individuals carrying out the work, including where the contract describes that individual as running their own business
- No individual may carry out work as a substitute before their right to work has been verified
- Contractual provisions are in place between you and worker (which may include, but is not limited to, suspension or termination of the contract) to deal with situations where either party knows, or has reasonable cause to believe, a substitute is working illegally
- For the duration of the engagement, you ensure the worker and their registered substitute are the same individuals whose right to work has been checked e.g. through identity verification systems.
If illegal working is identified, you must give the Home Office whatever information it asks for to help decide whether a statutory excuse applies. The Home Office will look not only at what processes were implemented, but whether they were actually followed in practice.
Evidence which could support this statutory excuse includes:
- Details of contractual arrangements, or copies of agreements/terms relating to substitution
- Records of right to work checks undertaken on substitutes
- Records demonstrating that substitutions were authorised in accordance with your processes
- Records identifying who carried out the work and for what period
- Evidence of identity verification measures you used to confirm the individual carrying out the work was the same person whose right to work was checked
- Records of any audits or compliance activity which you undertook
- Evidence that appropriate action was taken where substitution occurred outside agreed processes, or where illegal working was identified or suspected.
What if a substitute was used without my knowledge and against the terms of our agreement?
Where substitution is not permitted under the contract, but the worker sends a substitute anyway, the Home Office will assess you based on whether you carried out a right to work check on the worker you engaged directly.
Identity verification
Employers and online matching services must have systems in place to ensure the individual carrying out the work is the same individual on whom a right to work check was conducted. These systems should be proportionate to the nature of the work, the level of risk, and the contractual arrangements.
Examples given in the guidance include:
- Issuing identity cards or workplace passes
- Facial recognition technology, including use of registered Right to Work Digital Verification Service Providers (such as TrustID -a Citation Group company)
- Biometric or attendance management systems
- Checks against training records, qualifications, or licences relating to the role
- Re-verification of identity at set intervals (Home Office recommends at least once per 24-hour period or shift of work)
Re-verification
Re-verification gives ongoing assurance that the person doing the work is still the person who was checked. The guidance states the frequency should be proportionate to the nature of the work and the risk of substitution or impersonation.
The Code lists examples of systems that can achieve this, such as:
- ID cards or workplace passes checked on entry
- Facial recognition technology (via a registered Right to Work DVSP)
- Biometric or attendance/clock-in systems
- Checks against training records, qualifications, or licences tied to the role
A business can meet these requirements using its own systems, or by relying on checks carried out by someone else in the chain (another contractor, or a third-party provider like a registered RtW DVSP). However, if they rely on someone else's system, they must take reasonable steps to satisfy themselves that it actually works properly and meets the requirements.
