From 1 October 2026, immigration compliance obligations will extend beyond traditional employment relationships to cover a wider range of working arrangements.

Published: 22 September 2026
Authors: Hannah O'Brien & Rory Stone

Background: What is changing?

The UK’s right to work regime is set for a significant expansion. From 1 October 2026, immigration compliance obligations will extend beyond traditional employment relationships to cover a wider range of working arrangements, including certain personal service arrangements, subcontracting models and online matching services.

The changes are introduced by section 48 of the Border Security, Asylum and Immigration Act 2025, which amends the Immigration, Asylum and Nationality Act 2006 and expands the circumstances in which civil penalty liability may arise.

Arrangements in scope

Historically, right to work obligations have focused on employees working under traditional contracts of employment. The new regime broadens that approach by treating certain non-employment working arrangements as employment for illegal working purposes.

In practice, the following arrangements are likely to be most relevant.

Direct employees are already within scope under the existing regime. Organisations must continue to complete compliant right to work checks before employing an individual under a contract of employment.

Personal service arrangements may also be caught where an individual undertakes to perform work or services personally, unless they are genuinely operating an independent business and providing services to a client or customer.

Subcontracting chains will require closer scrutiny. Where labour is supplied through a contractual chain, liability may extend beyond the organisation that directly engages the individual carrying out the work.

Online matching services may be brought within scope where they introduce or match service providers with potential clients or customers. This is likely to be particularly relevant to businesses operating platform-based labour models.

The practical effect is that immigration compliance will no longer be solely an HR issue. Procurement, legal, operations and commercial teams may all need to understand where right to work obligations can arise.

Practical examples

Subcontracting

Company A contracts with a local authority to provide highway maintenance services and subcontracts part of the work to Company B. Company B supplies workers to perform the maintenance work, one of whom is later found not to have the right to work in the UK.

Company B may be liable as the party directly engaging or supplying the worker. Company A may also face extended liability, although it may be able to rely on a statutory excuse if it had appropriate contractual controls and compliance measures in place before the work began.

Online matching

Company A operates an online matching service that connects businesses needing plumbing services with service providers. Through the service, Company B agrees to provide plumbing services and sends Plumber C to carry out the work. Plumber C is later found not to have permission to work in the UK.

Company B may be liable as the service provider. Depending on how the platform operates, Company A may also be exposed if it is treated as an online matching service involved in supplying the details of the individual service provider to potential clients or customers.

Substitution

Company A contracts with Worker A, an IT consultant, to provide software development services. The contract allows Worker A to appoint a substitute. Worker A sends Worker B to perform the work, and Worker B is later found not to have permission to work in the UK.

Company A may be exposed to liability even though it did not contract directly with Worker B. To mitigate that risk, Company A would need robust substitution controls requiring right to work checks before any substitute starts work.

Internal business services

The extended liability provisions are not designed to capture every commercial relationship. The focus is on arrangements where an individual is personally providing work or services through labour-supply, subcontracting, online matching services or substitution arrangements.

By contrast, where a business purchases services for its own internal operations and there is no labour-supply chain involved, the new regime is unlikely to apply. Examples may include engaging external accountants, instructing solicitors, purchasing software services, or contracting with a cleaning company to clean the business’s own offices. In these cases, the business is receiving a service for its own internal purposes rather than supplying labour onwards to a third party.

Businesses should nevertheless assess arrangements carefully. The distinction will depend on the contractual structure and, in particular, whether individuals are being supplied to perform work or services within the scope of the legislation.

Statutory excuse: What businesses need to show

A compliant right to work check can establish a “statutory excuse”, protecting a business from a civil penalty where an individual is later found not to have permission to work.

The draft guidance also introduces additional prescribed requirements aimed at protecting businesses from extended liability in contractual chains, substitution arrangements and online matching services. These requirements are likely to require both appropriate contractual wording and practical compliance controls.

Contractual controls. Contracts should require relevant parties to carry out compliant right to work checks, prevent unauthorised subcontracting and flow down equivalent obligations through any permitted subcontracting chain.

Substitution controls. Where substitution is permitted, businesses should ensure that substitutes are checked before work starts and that responsibility for those checks is not left to the original worker.

Identity assurance. Businesses should have processes to confirm that the person performing the work is the same individual whose right to work has been verified.

In short, contractual wording alone is unlikely to be sufficient. Businesses will need to show that the relevant controls are implemented and followed in practice.

Non-compliance risks

The consequences of non-compliance remain significant.

Where an individual is found to be working unlawfully under an arrangement covered by the expanded regime, a business may face a civil penalty of up to £60,000 per worker. Other enforcement action may also follow, including:

• criminal prosecution
• closure of business premises
• revocation of a sponsor licence.

The key change is that liability may arise even without a direct contractual relationship with the individual. Organisations should therefore consider not only who they employ, but also how labour is supplied across their wider business and supply chain.

Preparing for the new regime

Businesses should use the lead-in period before 1 October 2026 to assess where the expanded regime may affect their workforce, supplier and online matching arrangements.

Key preparatory steps include:

Map labour engagement models. Identify how labour is sourced across the organisation, including contractors, consultants, subcontractors, casual workers and online matching arrangements.

Update policies and procedures. Existing right to work policies may not address the new categories of working arrangement or the extended liability provisions.

Train relevant teams. HR, recruitment, procurement, legal, compliance and commercial teams should understand when checks are required and how liability may arise.

Review contracts. Supplier, subcontractor and consultancy agreements should be checked to ensure they contain appropriate right to work obligations, subcontracting controls and audit rights.

Check digital verification arrangements. Businesses using digital identity verification should confirm that their provider is registered on the relevant register and authorised to conduct right to work checks when the new regime takes effect.

Key takeaway

The reforms mark a clear shift in the UK’s approach to illegal working compliance. Businesses should not wait until October 2026 to assess their exposure. Mapping labour supply routes, updating contracts, strengthening verification processes and training relevant teams now will put organisations in the best position to reduce risk and establish a statutory excuse where needed.

Publication note: This article reflects the draft guidance currently available and should be checked against the final Home Office guidance once published.