UK right to work checks: what changes in October 2026

From 1st October 2026, Section 48 of the Border Security, Asylum and Immigration Act 2025 comes into force. This means employers need to carry out right to work checks for a wider group of workers.

The government has released guidance for employers and those who may have responsibilities under the Scheme. It sets out how to carry out right to work checks and reduce your risk of a civil penalty, and what happens if an employee is found to be working illegally. This is known as 'establishing a statutory excuse' against a civil penalty.

What are the penalties?

They're steep! If you can’t establish a statutory excuse, there's a civil penalty of up to £60,000 for each illegal worker.

In serious cases, you could also face criminal prosecution, an unlimited fine, up to five years’ imprisonment, business closure, director disqualification, sponsor licence action and reputational damage.

As a UK employer, what do I need to do?

As with many legal changes, you need to be able to show you’re compliant. While this blog outlines the proper steps you should take, capturing and keeping proper records is key to making sure you're doing things the right way.

BrightHR document storage and advice services can help you to keep clear, easy to find records of checks, due diligence, contractual arrangements and audits. So you can stay on top of your record-keeping responsibilities.

Before 1st October 2026, businesses that use flexible labour models, outsourced service chains, platforms or substitution clauses should review who carries out the work, who completes the check and what evidence they keep.

1. Review which employees, workers, subcontractors, platform workers and substitutes may fall within the expanded scheme

2. Map contractual chains you use to deliver work or services to third parties

3. Update supplier and service-provider contracts with right to work obligations, audit rights, subcontracting controls and enforcement provisions

4. Create a process that stops substitutes from starting work until you’ve completed the prescribed check

5. Check that any digital verification provider is registered and authorised for right to work checks

6. Train recruitment, HR, procurement and operational teams on the new scope and evidence requirements

7. Audit record retention, follow-up reminders and identity controls

8. Apply checks consistently and provide non-digital alternatives where appropriate

Your expanded UK right to work responsibilities

Businesses need to look at how work arrangements work in practice. Genuine business-to-business services and independent businesses may still sit outside the scheme, depending on the facts. It’s not just about someone’s contract title or job spec.

Audit your workforce and labour supply arrangements

From 1st October 2026, the scheme will cover more people who carry out work or provide services. This includes:

• Individual subcontractors

• Gig economy and platform workers

• Substitutes who carry out work in place of the person originally engaged

• Service providers matched with customers through some online services

Understand extended liability

If the Home Office can’t identify the direct employer, a business further up the supply chain could be liable for a civil penalty.

This could affect labour supply chains involving subcontractors, substitute worker arrangements and matching or platform-based arrangements.

You’ll need to show that you had appropriate arrangements in place before work began and that they worked in practice.

Areas to check:

• Contracts: Make sure your terms require prescribed checks, control further subcontracting, allow audits and enforcement action, and support Home Office investigations.

• Substitution controls: It’s the employer’s responsibility to check every substitute before starting work

• Identity checks: Use proportionate systems to confirm that the person doing the work is the person you checked.

Three checking routes prescribed, use at least one

Using technology or a third party doesn’t remove your responsibility as an employer. You still need to prove you’ve followed the prescribed process.

• Manual document check: Obtain the required original documents, check them carefully in the holder’s presence, copy them clearly and record the date of the check. 

• Home Office online check: Use the worker’s right to work share code and date of birth. This is the required route for eVisa holders. 

• Digital identity check: Use a registered Right to Work Digital Verification Service Provider where the person and document are eligible for this route. 

Identity and impersonation checks

• You must be satisfied that the person completing the work is the person whose right to work you checked.

• Take reasonable and proportionate steps to confirm that the person presenting evidence is the person who will actually carry out the work.

• Controls can include workplace passes, attendance systems, checks against training records or facial recognition through a registered provider. 

• For contractual chains and substitution arrangements, the Home Office recommends ongoing identity assurance. Your approach should be proportionate to the work, the risk and your business model.

Follow-up checks

Check workers with time-limited permission before their permission expires if they’ll continue working for you. You don’t have to use the same method you used for the original check.

• You don’t need to repeat the check if the initial check confirms settled status, EUSS status or another continuous right to work.

• If a worker has an outstanding in-time application or can’t evidence their status because of a technical issue, you may need to use the Employer Checking Service.

• A Positive Verification Notice normally gives you a six-month statutory excuse. After that, you may need to carry out another check.

Update your document and record-keeping processes

• You can’t accept expired biometric residence permits for a manual check. Use the Home Office online service instead.

• You may be able to accept some official evidence in digital form if it shows the person’s name and permanent National Insurance number, and you pair it with the required supporting document.

• Store copies of checks securely for the duration of employment and for two years afterwards, then destroy them securely.

• Include the profile page showing the photograph and the date of the check in your online check evidence. 

Show you avoid discrimination 

• Right to work checks should be carried out consistently for all prospective workers, including British citizens.

• Don’t make assumptions based on nationality, race, accent, surname or perceived immigration status.

• Offer a reasonable alternative where a person cannot or does not want to use a digital route. 

How BrightHR can help

BrightHR clients get access to a 24/7 advice line for HR and employment law advice, from experienced, UK-based experts.

We also offer access to BRAINBOX+, an AI-enabled HR and employment law advice service, for instant answers verified by experts.