Right to work checks and commercial contracts: what changed on 1 October 2026?

Right to work checks have traditionally been treated as a matter for an employer’s HR or onboarding team. Since 1 October 2026, some businesses need to consider them earlier, when they agree how work or services will be delivered through a contractual chain.

The Border Security, Asylum and Immigration Act 2025 expanded the Right to Work Scheme. It covers additional working arrangements, including some worker and subcontractor arrangements and online matching services. The Act also introduced “extended liability”, which can make a business higher up a contractual chain liable for a civil penalty if someone working illegally is identified.

The change does not make every business that buys services responsible for checking every person involved. The effect depends on the contractual arrangements and how they operate in practice.

When could extended liability apply?

The Home Office’s final guidance identifies three broad types of arrangement where extended liability may arise:

• Subcontracted services. A business contracts to deliver work or services to a client, then uses other businesses to carry out some or all of that work. A construction company that subcontracts parts of a building project is one example.
• Online matching services. A platform connects a customer with a service provider, and the provider contracts with the customer to carry out the work.
• Substitution. A contract allows an individual to arrange for someone else to do the work in their place, as may happen with a delivery platform.

In those situations, a business may be treated as employing an individual who personally carries out the work, even if there is no direct contract between them. The direct employer or service provider remains responsible for its own right to work checks. Extended liability may create additional responsibility for another organisation where the statutory conditions are met.

Buying a service is different from supplying it onwards

A business is not automatically caught simply because it purchases services for its own operations. For example, a retailer buying cleaning services for its stores is not, on that basis alone, supplying those services onwards to another client.

But the distinction can be fact-sensitive. The guidance says businesses should consider whether the arrangement is for a defined service or outcome, what role each party has in the contractual chain, and who selects or replaces the people doing the work. The label used in a contract is not decisive; the arrangement’s substance and operation matter.

What is needed for a statutory excuse?

A business within the extended liability rules may establish a statutory excuse against a civil penalty by meeting the prescribed requirements before the work begins and keeping evidence that its arrangements operate effectively. For subcontracted services and online matching arrangements, a written statement must be in place before the work starts. The required contractual terms cover right to work checks, limits on further subcontracting, audit rights, appropriate enforcement measures where illegal working is identified, and cooperation with Home Office investigations.

Where substitution is permitted, the business must have processes to check each substitute before they start work, prevent the worker from carrying out the check themselves, address suspected illegal working, and keep the worker’s and substitute’s identities linked to the checks. Proportionate identity verification systems are also required.

The Home Office guidance cautions that contractual wording alone may not be enough. Businesses should be able to show that their compliance processes work in practice. It does not prescribe a single audit frequency or a universal evidence package; what is appropriate will depend on the arrangement and its risks.

What about contracts already in place?

The new extended liability requirements are not retrospective. An arrangement entered into before 1 October 2026 does not come within the new rules solely because the work continues after that date. A renewal, extension or variation may require closer analysis: its legal effect will determine whether it amounts to a new arrangement caught by the rules.

The potential cost of getting it wrong

A business that is liable for employing someone without the right to work and has not established a statutory excuse may face a civil penalty. The maximum is up to £45,000 per worker for a first breach and up to £60,000 for a repeat breach. The Home Office says it would not normally expect to issue more than one civil penalty in a contractual chain for the same worker, and that extended liability does not make
every party in the chain automatically liable.

Practical steps for businesses

Businesses should map how work is delivered under new contracts made from 1 October 2026. That includes identifying subcontracting chains, online matching arrangements and contracts that permit substitution. Where the rules may apply, review the contract terms, put suitable checks and identity verification in place, agree how compliance evidence will be obtained and retained, and make sure the relevant teams understand the process.

A review should consider the precise terms and the way the arrangement works day to day. This is particularly important when renewing or changing a contract, because the legal effect of the change may affect whether the new requirements apply.

KTS Legal advises businesses on commercial contracts and business immigration matters. If your organisation is entering into a new service or subcontracting arrangement, our team can assist with reviewing the contractual and compliance implications.