Right to Work Checks from October 2026: Contractors, Gig Work and Sponsor Duties

Calling someone a contractor no longer answers the Right to Work question. From 1 October 2026, the checking regime extends beyond traditional employment to further working arrangements. Small businesses need to review how they engage people; sponsored workers need to check whether the particular work is permitted.

The starting point is the Home Office Employer’s guide to right to work checks, dated 1 October 2026. Its introduction explains the changes made by section 48 of the Border Security, Asylum and Immigration Act 2025. The guide distinguishes direct checking duties from extended liability through contractual arrangements.

Which arrangements are now covered?

The guide brings the following into scope alongside contracts of employment:

Worker’s contracts: arrangements meeting the scheme’s definition for personal work or services.
Individual subcontractors: including individuals engaged through delivery platforms.
Online matching services: platforms providing details of individual service providers to potential clients or customers.

Assess the actual arrangement, rather than assuming that a self-employed label or tax assessment settles the question. Annex C specifically warns that an IR35 determination does not determine Right to Work checking responsibilities.

The direct employer or engager generally carries out the prescribed check before work begins. A platform’s role matters: the guide distinguishes engaging an individual directly from matching a separate service provider with a customer.

Are the changes retrospective?

No. The guide’s introduction and Annex C distinguish two dates:

For newly covered worker’s contracts, individual subcontractors and online matching arrangements, civil penalties apply where the relevant employment commenced on or after 1 October 2026.
For extended liability, the prescribed requirements apply to relevant contractual arrangements entered into on or after that date. Continuing work under an older arrangement does not alone bring it into scope.

This does not remove duties that already applied to conventional employees. Record when each engagement and relevant contract began, and seek advice where arrangements are renewed or changed rather than assuming an old supplier relationship answers the question.

Liability can extend up the contracting chain

Section 3 of the Home Office guide covers arrangements where a business contracts to provide work or services and subcontracts delivery, certain online matching arrangements, and substitution arrangements. Depending on the facts, another party in the chain may face civil liability even without directly engaging the individual.

That does not make every customer or every business in a chain automatically liable. Annex C says the Home Office normally attributes liability to the direct employer; where that employer cannot be identified, it may pursue another organisation in the chain if the prescribed requirements have not been met. Extended liability is not limited to the first contracting tier.

NHS Employers’ guidance, reviewed on 5 October 2026, reinforces the distinction: in standard agency supply, the agency remains responsible for checking its workers. Review relevant contracting arrangements without assuming the hirer must duplicate every agency check.

The three prescribed requirements

For arrangements within extended liability, section 3 sets out three requirements for establishing a statutory excuse, the defence against a civil penalty:

Contractual terms and a written statement. Before work starts, the statement must set out required terms: prescribed checks, consent before further subcontracting with equivalent obligations passed down, audit rights, enforcement provisions and cooperation with Home Office investigations. A general assurance that a supplier follows the law is insufficient.
Substitution controls. Where substitution is permitted, a substitute must have a prescribed check before doing the work. Responsibility cannot simply be delegated to the individual worker, even if described as running their own business. Contracts must provide for action where the employer or worker knows, or has reasonable cause to believe, that a substitute is working illegally; controls must also keep the worker and substitute linked to the identities checked throughout the engagement.
Identity verification. Maintain proportionate systems to ensure the person doing the work is the individual whose right to work was checked. An upstream business may rely on another party’s systems after taking reasonable steps to satisfy itself that they work effectively.

Keep evidence that the arrangements operate in practice: written statements, contracts, assurance records, reviews and action on concerns. The guide does not prescribe a single audit frequency for every business.

Penalties: £45,000 and £60,000 per worker

The Home Office’s published penalty levels are up to £45,000 per illegal worker for a first breach and £60,000 for repeat breaches. These are existing penalty levels applied within the expanded scheme, rather than a new charge for every missing document.

GOV.UK’s penalties guidance explains that correct prescribed checks can provide a defence against a civil penalty. Knowing employment of someone without permission, or having reasonable cause to believe they lack permission, raises separate criminal issues.

Digital checks: choose the correct route

Digital identity services are sometimes described as certified identity service providers, or IDSPs. The October guide uses registered Right to Work digital verification service provider (RtW DVSP) terminology and sets out certification and registration requirements. Check the provider’s registered service and the documents it can handle; buying onboarding software alone does not establish a statutory excuse.

For an eVisa holder, the guide requires the Home Office online Right to Work service using a share code. Check the work restrictions as well as identity, and retain the prescribed evidence. Employers remain responsible for completing the required steps even where technology supports the process. Use the current GOV.UK employer guidance when choosing a checking method.

What this means for Skilled Worker secondary work

A successful identity check does not itself authorise a second job. GOV.UK’s Skilled Worker additional-work guidance permits up to 20 hours a week in qualifying additional work while the worker continues their sponsored job. Eligibility depends on the occupation and, for some medium-skilled work, immigration history. Work for your own business also counts towards the limit, including business administration.

Annex B of the October employer guide says supplementary employment must be outside the contracted hours of sponsored employment, and the 20-hour limit applies across one or multiple additional employers. The second engager should obtain evidence of the main sponsored job and working hours, rather than relying only on a share code. Do not assume any delivery or gig role qualifies simply because it offers fewer than 20 hours.

For work beyond that limit, GOV.UK says a visa update and sponsorship for both jobs are needed. For a move to a new main employer, read our changing jobs guide.

Frequently asked questions

What should a small employer do first?

List new engagements and subcontracting arrangements, identify the direct checker, and assess extended liability separately. Update contracts and substitution processes before work begins. Sponsors should also reconcile these checks with their sponsor compliance duties.

Does a sponsor licence replace a Right to Work check?

No. NHS Employers confirms sponsors already have checking duties for sponsored workers, including those who are not direct employees. A licence and a worker’s permission answer different questions; check that each person can do the work offered.

This article is general information, not legal advice. Use the current Home Office guidance and seek regulated advice about complex contracting arrangements or restrictions on a worker’s permission.