This is the second in our series of articles on the changes to the civil penalty regime which will come into effect from the 1st of October 2026.
The first article gave a general introduction to the changes and explained why they are taking place. In this article we will break down what is meant by direct engagement under the new rules, who it applies to, who it does not apply to, and how businesses can stay compliant (and avoid a civil penalty for illegal working).
What is the current position?
Currently right to work checks must be carried out on employees before employment begins. Sponsors must also carry out right to work checks on anyone they are sponsoring (regardless of their employment status). Where permission to work is time limited (for example, a visa has an expiry date), right to work checks must be repeated when that permission is due to expire.
Although there is technically no legal requirement to conduct a check, an employer can be subject to significant penalties if an employee is found to be working illegally. These penalties include a civil penalty of up to £60,000 per illegal worker, criminal sanctions, revocation of sponsor licences, loss of other licenses, disqualification of directorships, and reputational damage.
By conducting a right to work check in accordance with the applicable Home Office guidance, a statutory ‘excuse’ (i.e. a defence) is obtained by the employer against a penalty for illegal working.
What is changing and who will the new rules apply to?
It was the Immigration, Asylum and Nationality Act 2006 that first created the concept of civil penalties for illegal working. The Border Security, Asylum and Immigration Act 2025 will begin to come into force on the 1st of October 2o26 and will expand the definition of ‘employer’ when it comes to who right to work checks must be conducted by.
From October 1st, as well as employees and those who are sponsored, right to work checks will also need to be conducted on:
- workers (for example someone engaged under a contract to perform work or services personally),
- individual sub-contractors (those engaged by one party to provide work or services to another), and
- individuals provided via online matching services (engagement via a platform and personally providing work to a third party).
The draft guidance for employers on right to work checks provides some helpful working examples of the new provisions in practice:
Example 3 from the guide explains that if an individual signs up to work through a delivery platform, logs into an app whenever they want to work, accepts delivery requests, and is paid for each delivery completed, the delivery platform is considered as the individual’s “employer” for direct right to work checking purposes, and is responsible for conducting a right to work check on the individual before work begins. Failure to do so may see the delivery platform liable for payment of a civil penalty if the individual is found to be working illegally.
Example 4 from the guide states that if a homeowner would like someone to clean their house, and uses an online matching service in order to find a cleaner, the online matching service will be the “employer”, is responsible for conducting a right to work check on the cleaner before work begins, and may be liable for payment of a civil penalty if the individual is found to be working illegally.
The effect of this change is that more people who are directly engaged by, or via, businesses will come within scope of the civil penalty regime, and businesses will now have to conduct right to work checks on wider groups. For some businesses this will mean having to do right to work checks for the first time.
Who do the new changes not apply to?
These extended responsibilities will not apply to genuinely self-employed individuals, business to business contracts for the supply of services, and end user clients. Employment businesses will remain responsible for conducting checks on agency workers engaged by them, and responsibility for the check is not being passed to the end user client.
However, relying on the label given to a particular working relationship can be risky. The Home Office may go beyond the label attached to the working relationship and find that an individual is, in practice and in reality, an employee or worker, regardless of how the relationship is formally defined. As a result, if that individual is working illegally, and no right to work check has been carried out, then the employer will have no statutory ‘excuse’ to rely on, and will likely be liable for a civil penalty (as well as any other applicable penalties as outlined above). Essentially, a label alone will not necessarily protect an employer; the working relationship must be genuinely reflective of the label attached to it.
When do the changes take effect?
These changes will apply to anyone “employed” on or after the 1st of October 2026. There is likely to be a grey area in relation to existing irregular workers who have had a pause in assignments. The cautious approach would be to treat a new assignment initiated on or after the 1st of October as falling within the new rules.
How to do a compliant right to work check on directly engaged workers
There are three ways to conduct a compliance check:
1. The first is a manual check, which involves the business physically reviewing an individual’s original identity documents (from a defined list as set out in Home Office guidance), to confirm they are permitted to work in the UK.
2. The second is an online check, which is carried out via an online service provided by the UK Home Office, which allows employers to verify an individual’s legal status and permission to work in the UK. An online check can only be carried out on those with eVisas or those falling under the EU Settlement Scheme.
3. The third type of check is a digital check, which uses certified Identity Service Providers to verify digital identity remotely. This is only available for British and Irish citizens holding valid passports or ID card (although from the 1st of October 2026 passports that expired within the last 6 months may be accepted). Also, from October 1st this year businesses must only use registered digital providers.
In all of the above cases, an “imposter check” must be carried out by the business. This involves the business confirming that the person presenting themselves for work is the same individual shown in the manual, online, or digital identity check. From the 1st of October the imposter check may be carried out by a registered digital identity service provider via the use of facial recognition software, but the business will always retain ultimate responsibility for the check.
In all cases, evidence that a check was correctly carried out before work began must be retained for the duration of the individual’s engagement and for 2 years after it has ended.
Businesses must also check that the individual is permitted to carry out the work in question. For example, international students who have permission to work, will be limited to 10 or 20 hours of work per week during term time, and additional evidence of their term and vacation dates must also be retained.
This is only a very brief overview of the process of conducting checks. Businesses should read the guidance in full to understand how fully compliant right to work checks must be carried out.
What should businesses do now?
Businesses should conduct an audit of their work arrangements and identify which individuals may come into the scope of the extended provisions for direct engagement. They should ensure processes are put in place to conduct right to work checks on these extended groups in advance of the 1st of October 2026 implementation date.
Companies should also ensure that staff are trained on the new requirements and on how to conduct compliant right to work checks, particularly where this is new territory for the business concerned. Depending on a business’ operations, this could include training wider groups than just HR, people, recruitment and engagement teams and include contract and commercial team members.
Businesses should also update their document retention policies and guidelines (and related data protection processes, policies, and procedures) to make sure they reflect the new requirements.
For any further support or queries, please contact our business immigration team. And in our next article we will discuss the other principle change coming into effect from the 1st of October this year – extended liability under non-direct contractual arrangements.
Alex Christen
Partner
Business Immigration, Employment, Employment Investigations, Equality & Diversity, International
Alex is a Partner in our Employment and Immigration team. Alex leads the business immigration team, successfully supporting companies and individuals with immigration issues, including understandin... Read More
Rebecca is a Trainee Solicitor in our Employment & Immigration team at Capital. Rebecca holds a degree in Law (LLB) from Cardiff University.... Read More
