Discover the importance of Annaizu Compliance Management in today's business landscape and how a Home Office compliance management platform can help your business streamline its compliance efforts, reduce risks, and stay ahead of regulations.
From 1 October 2026, the UK’s Right to Work Scheme is set to extend beyond conventional employees. The Home Office published a new draft employer guide on 16 July 2026 to explain how checks will apply to a wider range of working arrangements, including worker contracts, individual subcontractors and qualifying online matching services.
The change matters to far more than HR teams. Recruitment agencies, delivery and service platforms, labour suppliers, hospitality groups, care providers, construction businesses and organisations with layered supply chains may all need to revisit who is checked, who performs the check and what evidence is retained.
The guidance is still a draft at the time of writing. Employers should prepare for the planned 1 October 2026 start date while checking the latest Home Office employer guidance for any final amendments.
Key points for employers
- The draft is intended to take effect on 1 October 2026.
- The scheme’s scope expands to include worker contracts, individual subcontractors and certain online matching services, as well as employees.
- The direct contractual employer remains responsible for carrying out the prescribed Right to Work check.
- Extended liability can reach other parties in certain contractual chains, online matching arrangements and substitution models.
- Digital checks must use an appropriately registered provider. If an employer chooses the digital verification route, the provider must appear on the Office for Digital Identities and Attributes register and be permitted to provide Right to Work checks.
- Evidence must be retained securely for the engagement and for two years afterwards, with follow-up checks where permission to work is time limited.
Why the 1 October 2026 Right to Work changes matter
Right to work checks give an employer a statutory excuse against a civil penalty if a person is later found to be working illegally, provided the prescribed check was completed correctly and at the right time. Until now, the statutory scheme has centred mainly on traditional employment relationships.
Section 48 of the Border Security, Asylum and Immigration Act 2025 broadens the definition of “employer” for this scheme. Under the draft guidance, civil penalty liability for the newly covered arrangements can apply where the engagement begins on or after 1 October 2026.
This is not simply a change of terminology. Businesses may need to map working relationships that sit outside payroll, update contracts, control substitution and make sure identity verification continues after the initial check.
Who will fall within the wider scheme?
The draft guidance identifies four principal routes through which an individual may be engaged to carry out work or services:
- A contract of employment: the familiar employee relationship.
- A worker’s contract: an individual agrees to perform work or services personally in circumstances where the other party is not simply a client or customer of the individual’s own business.
- An individual subcontractor arrangement: an individual performs work under a contract linked to another person’s contract to supply those services to a third party.
- An online matching service: a business keeps a register of service providers, matches them with potential customers through an online service and charges a fee or commission for the match.
Examples of working arrangements in scope
Hotel employee: a receptionist works fixed shifts, is paid through the hotel’s payroll and serves hotel guests. The hotel is responsible for the check.
Agency worker: an employment business engages an individual under a contract for services and supplies them to bars or restaurants for short assignments. For the purposes of the scheme, the employment business is responsible.
Delivery subcontractor: an individual signs up to a delivery platform, selects jobs through an app and is paid for completed deliveries. The platform may be treated as the employer for Right to Work purposes under the draft rules.
Online matching service: a service matches a cleaner with a homeowner and charges for making the match. The operator of the matching service may be responsible for the check.
The label used in a contract will not settle the issue on its own. Employers should examine how the arrangement works in practice, including who provides the work, whether personal service is expected, how payment flows and whether substitution is allowed.
What extended liability means
The draft introduces a separate extended-liability framework for some non-direct contractual relationships. It can apply in a chain of contracts used to deliver work or services, in certain online matching arrangements, and where a worker may substitute another person to perform the work.
Extended liability does not automatically transfer the check from the direct contractual employer to another organisation in the chain. The direct employer remains responsible for carrying out the prescribed check and establishing its own statutory excuse.
However, where the extended-liability provisions apply, another person in the chain may also need to demonstrate that prescribed controls were in place before work began. Risk becomes particularly important when the direct employer cannot be identified, records are unavailable, several intermediaries are involved or the individual doing the work is not clearly linked to the party that engaged them.
Three controls for an extended-liability statutory excuse
Where an organisation is not in a direct contractual relationship with the worker but falls within the extended-liability provisions, the draft sets out three areas that should operate before work starts:
- Written contractual terms. The agreement should require prescribed checks, control further subcontracting, allow compliance audits, support enforcement where illegal working is identified and require cooperation with a Home Office investigation.
- Substitution controls. Any substitute must complete a prescribed check before performing work. Responsibility cannot simply be passed to the worker, and records should show who was authorised to perform each assignment.
- Identity verification. Organisations should have reasonable and proportionate systems to confirm that the person doing the work is the person whose Right to Work was checked. Depending on the model, this could involve workplace passes, attendance controls, facial matching or periodic identity checks.
Contract wording alone is unlikely to be enough. The Home Office may look at whether the controls operated effectively in practice and whether audit records, assurances, compliance reviews and follow-up action support the organisation’s position.
Who is not automatically brought into scope?
The wider definition does not mean every self-employed person or business-to-business supplier must receive a Right to Work check from each customer. The draft gives examples of arrangements that are generally outside the scheme.
- A genuinely self-employed tradesperson who advertises to the public, serves multiple customers and operates an independent business.
- A freelancer who contracts through their own personal service company and invoices a client company in a business-to-business arrangement.
- A business that buys services for its own operations but does not engage the individuals who perform the work.
The distinction is fact-specific. Businesses should not rely only on labels such as “freelancer”, “supplier” or “platform”; they should review the real contractual and operational relationship.
The three ways to complete a Right to Work check
The draft retains three prescribed routes. The correct route depends on the individual’s status and the evidence they hold.
1. Manual document check
The employer obtains original acceptable documents, checks that they are genuine and belong to the person, makes the required copies and records the date of the check. The check must be completed before work begins.
2. Home Office online check
Where an individual has an eVisa or other eligible digital status, they provide a share code and date of birth. The employer must use the Home Office online service, review the profile itself, confirm that the photograph matches the person and retain the profile output. A share code, screenshot or informal printout on its own is not a compliant check.
3. Check using a registered Right to Work DVSP
An employer may use a Right to Work digital verification service provider for permitted digital checks. Under the new draft, if the employer chooses this route, the provider must be registered by the Office for Digital Identities and Attributes and authorised to provide Right to Work services.
Using a provider does not remove the employer’s responsibilities. The employer must choose an eligible provider, obtain the required output, confirm that the biographical details and photograph relate to the person presenting for work, and retain the required evidence.
Record keeping and follow-up checks
For manual, online and provider-assisted routes, the evidence should be clear, dated and stored securely for the duration of employment or engagement and for two years afterwards. It should then be securely destroyed.
Where the check confirms a time-limited right to work, the employer must complete a follow-up check on or before the permission expires if the person will continue working. A continuous right to work will not usually require a repeat check, but the evidence of the original check still needs to be retained.
Other changes in the draft guide
- Acceptable National Insurance evidence may include an official digital document issued by or on behalf of a government agency.
- Terminology has been updated to reflect the wider set of working arrangements and the new “Right to Work DVSP” name.
- Digital verification content formerly in Annex C has been updated and moved into the main checking section.
- The separate annex for Ukrainian nationals has been removed because prescribed Right to Work checks apply to all nationalities.
- EEA citizen content has been consolidated, and the section on service providers from Switzerland has been removed following closure of that route.
How an employer can lose its statutory excuse
A process can fail even when some evidence has been collected. Common risks include completing the check after work begins, selecting a method that is not valid for the individual’s evidence, relying on a share code without accessing the Home Office profile, keeping only a screenshot, failing to match the person to the photograph, or missing a required follow-up check.
The consequences can be serious. The draft guide states that a civil penalty can reach up to £60,000 per illegal worker. Serious cases may also result in criminal prosecution, an unlimited fine, imprisonment, business closure or director disqualification.
How employers should prepare before October
- Map every way individuals perform work for the organisation, not only people on payroll.
- Identify the direct contractual employer and any parties that may face extended liability.
- Review agency, subcontracting, platform and matching-service agreements.
- Add written Right to Work obligations, audit rights and controls over further subcontracting where relevant.
- Make sure substitutes cannot begin work until their identity and Right to Work have been checked.
- Confirm that any digital provider appears on the OfDIA register and is permitted to conduct Right to Work checks.
- Standardise what evidence is saved, where it is stored and who can retrieve it for an audit.
- Track expiry dates and schedule follow-up checks for time-limited permission.
- Train hiring managers and operational teams to apply the same fair process to every worker, regardless of nationality.
- Recheck the final Home Office guidance before 1 October 2026.
How Annaizu can support a more controlled process
Annaizu helps employers bring Right to Work checks into a clearer onboarding and compliance workflow. Centralised status tracking, evidence management and expiry-date visibility can make it easier to show who was checked, when the check happened and whether follow-up action is due.
Right to Work and criminal-record screening remain separate obligations. Where a role also requires an eligible criminal-record check, employers can manage DBS checks as a distinct part of the same wider hiring process without confusing the purpose or evidence for each check.
For organisations using agencies, contractors or platform-based labour, the immediate priority is visibility: understand the contractual chain, assign responsibility and keep an audit trail that reflects what happens in practice.
FAQs
Do the new rules apply to every self-employed freelancer?
No. A genuinely independent business serving its own customers may remain outside the scheme. The outcome depends on the actual working and contractual relationship, not the label used.
Can an employer rely on a worker’s share code or screenshot?
No. The employer must access the Home Office online checking service, review the result, confirm that it relates to the person and retain the prescribed evidence.
Does using a digital provider transfer responsibility away from the employer?
No. The provider performs defined verification steps, but the employer must select a registered Right to Work DVSP, check the output relates to the person and keep the required record.
Final takeaway
The October 2026 draft changes move Right to Work compliance closer to the way the modern labour market actually operates. Employees remain in scope, but businesses must also consider worker contracts, individual subcontractors, online matching services, substitution and contractual chains.
The strongest preparation is practical: map the workforce, define responsibility, update contractual controls, verify identity, retain reliable evidence and schedule follow-up checks. Because the guide is still a draft, employers should also confirm the final Home Office wording before the planned implementation date.
.svg)