This is the third in our series of articles on the changes to the civil penalty regime which will come into effect in the UK from the 1st of October 2026. In this article we discuss what is meant by extended liability under the new rules, when it will apply, when it won’t, and how businesses can protect themselves from liability.
Our earlier articles have provided an in-depth introduction to the new regime and explained how direct engagement is being defined and applied within them.
What is the new rule?
Extended liability is a new concept under the Border Security, Asylum and Immigration Act 2025 which will create a supply chain of liability for illegal working. The introduction of extended liability creates a fundamental shift in risk distribution. This is because, under the new rule, any of the following could occur:
- Liability can arise without a direct contractual relationship.
- Multiple businesses may be liable for the same illegal worker.
- Liability may extend throughout the supply chain.
What is extended liability and when does it apply?
The new extended liability principle is being introduced to combat compliance blind spots existing primarily in gig platforms, subcontracting chains, and agency arrangements.
Extended liability will apply in a various situations, such as:
- Company A has a contract to provide work or services to Company B. Company A enters into a separate contract (or series of contracts) with Company C to help it deliver the contract to Company A.
- An online matching service matches a corporate service provider with a client or customer, to provide work or services, and the service provider enters into a contract with the client or customer.
- An employer employs or engages an individual to provide work or services, and the contract permits that individual to substitute their work or services to be carried out by another individual in their place.
The draft guidance for employers on right to work checks provides some helpful working examples of extended liability in practice:
Example 7 from the guide – a property developer wins a contract to build new homes and engages other businesses through a chain of contracts to provide workers to complete certain elements of the project, such as laying foundations or bricklaying. In this scenario, the property developer is contractually responsible for delivering the work to a third party (the end client) and relies upon a chain of contracts for workers and services in order to fulfil the original contract. This will fall within the scope of extended liability. The property developer may be treated as the employer of any individuals within the contractual chain and therefore be liable for payment of a civil penalty if any of the workers are found to be working illegally. To establish a statutory excuse (and avoid a penalty for illegal working), the property developer must comply with the prescribed requirements discussed later in this article.
Example 8 from the guide – a homeowner needs electrical work carried out at their property and uses an online matching service to find an electrician. In this instance, the online matching service has matched the homeowner with a service provider (the electrical services business) and a contract for the work has been entered into between the homeowner and the service provider. This would fall within the scope of the extended liability provisions. The online matching service may be treated as the employer of any individual carrying out the work for the service provider and therefore be liable for payment of a civil penalty if that worker is found to be working illegally. As above, to establish a statutory excuse, the online matching service would need to comply with the prescribed requirements.
Example 9 from the guide – an individual signs up to work through a food delivery platform and is described by the platform as an independent contractor (self-employed), is paid by the platform for each delivery completed, and is permitted to substitute their work or services. The agreement itself is between the food delivery platform and the original individual, but the individual on occasion arranges for a friend to do the deliveries in their place. Under the extended liability principle, the food delivery platform may be treated as the employer of the original individual and any substitute who undertakes deliveries on behalf of the original individual. The platform may therefore be liable for payment of a civil penalty if the original or substituted individual are found to be working illegally. Again, to establish a statutory excuse, the food delivery platform must follow the prescribed requirements.
How can businesses protect themselves and get a statutory excuse?
Businesses can protect themselves against liability from illegal working penalties if they obtain a statutory excuse by following the prescribed requirements. These are a) written statements, b) substitution controls, and c) ID verification systems.
Note that this is not the same as obtaining a statutory excuse under the direct engagement provisions (see our earlier article on how to obtain a statutory excuse for direct engagement for advice in this area).
Written statements
The written statement requirement dictates that such a statement must be included in the relevant contract between the business and either the third party (usually a subcontracting company) or a corporate service provider.
For written statements to provide protection from liability, the following elements must be included:
- The requirement on the company to carry out right to work checks on their own workers.
- Not to subcontract without prior written consent and to do right to work checks.
- Permit audits on compliance with right to work checks.
- Enable suspension/termination of contract if illegal working occurs, and any other enforcement action that is appropriate.
- Require cooperation with Home Office investigations by providing information on the purpose and make-up of the chain of contracts where the work or services are provided, details of all third-party companies involved and any other information the Home Office thinks relevant.
Acceptable evidence, that a business has put appropriate written statements in place, includes evidence of contracts, agreements, terms and conditions, audit records and compliance reviews of right to work practices, and evidence of how issues were identified and acted on.
The guidance also states that business can rely on assurances from the relevant companies that they are performing compliant right to work checks “provided that they have taken reasonable steps to satisfy themselves that those assurances are reliable and that the prescribed requirements are being met”.
In practice, businesses should not rely on assurances alone and any assurances should be obtained in writing.
Businesses should also consider developing an evidence pack that demonstrates they have taken these steps, and implement a process of continual review to ensure the prescribed requirements remain met.
Substitution controls
The second prescribed requirement, that businesses should put in place “substitution controls”, will apply where a business has a contract with an individual (including employment contracts or worker contracts) and that contract allows the individual to send a substitute to carry out the work in their place. The new requirements mean businesses must put in place control measures to ensure substitutes have a right to work in the UK.
This involves implementing the following:
- Requiring that compliant right to work checks are carried out on any substitute.
- Identifying who will do the check (ensuring the check is not done by the individual providing the work or services).
- Ensuring work does not start until the check is done and a right to work is established.
- Terms allowing the contracted to be suspended/terminated for illegal working, or where a substitute has failed to comply with a request to undertake a check.
- Conducting ID checks on the worker and their substitute to ensure they are the same person whose right to work has been checked.
The guidance does not require substitution controls to be in writing, but clear written evidence (for example, terms in contracts around right to work checks being required on substitutes) is recommended. Acceptable evidence that substitution controls have been met also includes the business having appropriately worded contracts, agreements, terms and conditions, as well as records of checks on substitutes confirming that they are authorised to work, reports of ID measures taken, and audit records.
ID verification systems
The third prescribed requirement involves the business being assured that the person carrying out the work is the same person whose right to work was checked by a relevant third-party company.
Acceptable evidence of an ID verification system includes use of ID cards or workplace passes, facial recognition technology, checks against qualifications or licenses, and re-verification at a minimum of 24-hour intervals between shifts.
This is perhaps one of the requirements that will require greater in-depth planning and consideration.
When will these changes come into effect?
The guidance and code not strictly clear on this point but generic references are made to the new rules applying to employment or engagement on or after the 1st of October 2026.
One interpretation is that the extended liability provisions will apply to existing contracts where individuals under those contracts start carrying out the work or services from October 1st.
The cautious, and likely most sensible, approach is therefore to treat the changes as applying to existing contracts, and take necessary steps to update those contracts, either by putting new agreements in place or agreeing addendums to the original commercial agreement.
How will the Home Office enforce these rules?
The Home Office will seek to find a direct engagement in the first instance. Where the direct engager/employer cannot be easily identified, or if complex contractual structures are in place, the Home Office will look further into the supply chain and may extend liability elsewhere within it.
Essentially, this change means that businesses could be liable for illegal working in supply chains even if the illegal worker is not their direct recruit.
When does it not apply?
The extended liability provisions will not apply to the following:
- Where a service is being purchased by a business for their own internal operations or use. For example, where there is a traditional business-to-business contract, and there is no onward provision or agreement around the supply of work or services, the end user business is not caught by the extended liability regime. The business who employs the workers must of course conduct right to work checks under the direct engagement provisions.
- Purchasing labour for a business’ own use, as opposed to a contract for work or services. However, businesses are advised to take caution with this exception. Where a business receives agency workers for their own operations, the agency must verify the workers’ right to work under the direct engagement provisions. But where a business uses agency workers to fulfil a contract for a third party, the business may be caught by the new extended liability regime.
- Supply of goods. The new provisions apply to the supply of work or services.
What should businesses do now?
Businesses should conduct an audit of their work arrangements and identify which contractual arrangements and structures may come into scope of the extended liability provisions. They should also ensure that resources and processes are capable of efficiently conducting right to work checks, where necessary, in advance of the 1st of October 2026 implementation date.
As discussed in article two of our series on Civil Penalty Regime updates, training and educating staff on compliance with these new principles is of paramount importance.
To help with this, we are running a free webinar on the changes to the illegal working system on the 24th of February – sign up here to secure your spot today.
Businesses should also consider implementing the prescribed requirements where applicable, as soon as possible, in order to obtain a statutory excuse against any civil enforcement penalty.
For any queries, please contact our business immigration team today who will be more than happy to discuss your individual requirements.
And in our next article we will discuss the importance of compliance and provide more detail on how to prepare for the upcoming changes.
Alex Christen
Partner
Business Immigration, Employment, Employment Investigations, Equality & Diversity, International
Alex is a Partner in our Employment and Immigration team. Alex leads the business immigration team, successfully supporting companies and individuals with immigration issues, including understandin... Read More
Rebecca is a Trainee Solicitor in our Employment & Immigration team at Capital. Rebecca holds a degree in Law (LLB) from Cardiff University.... Read More
