Right to work checks: what changes for gig, agency and subcontracted workers
From 1 October 2026, the duty reaches beyond employees. If you engage people under a worker's contract, as individual subcontractors, or through an online matching service, a civil penalty can now follow. Here is what the check is, who it covers and what a statutory excuse actually requires.
The definition of employer just got wider
Section 48 of the Border Security, Asylum and Immigration Act 2025 expands who counts as an employer for right to work purposes. It now includes engaging an individual under a worker's contract, engaging an individual subcontractor, and engaging someone through an online matching service.
The Home Office draft guidance is specific about the cut-off: for these arrangements, a civil penalty may only be imposed where the engagement commenced on or after 1 October 2026. Work that started before that date is not caught retrospectively.
For anyone running couriers, cleaners, site labour or agency staff, this is the change that matters. The population you never ran checks on is now the population you have to check, and you have to be able to show it later.
Can you prove, today, who was checked and when?
A statutory excuse is an evidence problem, not a policy problem. RevoHR keeps the document, the date and the expiry on each person's profile, warns you before a time-limited permission lapses, and gives you an export in the format an auditor asks for. Staffing firms run several client workforces from one interface, with each client's records kept separate.
30 minutes, with a person.
Three lawful ways to check
Home Office online check
The person gives you a share code, you enter it with their date of birth on the employer checking service, and you keep the response. This is the only route for most people who hold a digital immigration status rather than a physical document.
Manual document check
You see the original document, check it in the person's presence, and keep a clear copy with the date you made the check. The copy on its own proves nothing if you cannot show you saw the original.
Digital identity verification through an IDSP
A certified identity service provider verifies a British or Irish passport using Identity Document Validation Technology. The provider must be certified under the UK Digital Identity and Attributes Trust Framework — an uncertified one gives you no defence.
Whichever route you use, the check has to be completed before the person starts. A check done on day two does not give you a statutory excuse for day one. The official starting point is the GOV.UK guidance on checking a job applicant's right to work.
What it costs to get it wrong
Penalties were tripled in February 2024. The starting point is up to £45,000 per illegal worker for a first breach, and up to £60,000 per illegal worker for a repeat breach, before any reductions are applied. A breach counts as repeat if you were found employing illegal workers within the previous three years.
Those are per-worker figures, which is what makes this different from most compliance risks. One missed check on a site of forty people is one penalty. A systematic gap across that site is forty. The Home Office code of practice sets out how the amount is calculated and what reduces it.
The part that fails months later: follow-up checks and records
Where someone's permission to work is time-limited, you have to check again before it expires. Nothing prompts you. The person keeps turning up, the rota keeps filling, and the excuse quietly lapses on a date nobody diarised.
Records must be kept securely for the duration of the engagement and for two years after it ends, then destroyed securely. Two years after someone left is precisely when nobody can find the file, which is why this belongs on a record that outlives the person who ran the check.
Right to work checks: common questions
- Who does the duty cover from 1 October 2026?
- Section 48 of the Border Security, Asylum and Immigration Act 2025 expands the definition of employer to include engaging someone under a worker's contract, as an individual subcontractor, or through an online matching service. A civil penalty may only be imposed where that engagement commenced on or after 1 October 2026.
- What are the three lawful ways to check?
- A Home Office online check using the person's share code, a manual check of original documents in their presence, or digital verification through an identity service provider certified under the UK Digital Identity and Attributes Trust Framework.
- How much is the civil penalty?
- Up to £45,000 per illegal worker for a first breach and up to £60,000 per illegal worker for a repeat breach, before reductions. A breach is treated as repeat if you were found employing illegal workers within the previous three years.
- How long must records be kept?
- Securely for the duration of the engagement and for two years after it ends, after which they must be securely destroyed.