As we set out in our July 2026 insight, more working arrangements have fallen within the UK right to work check regime since 1 October 2026 (contained in the Home Office Code of Practice). In direct engagement scenarios, employers now need to check the right to work of not only employees, but also workers and independent contractors.

The extended liability rules also mean that organisations upstream in a supply chain may be exposed to liability for a breach of the regime in relation to subcontractors and substitutes if they have not taken certain steps. This insight explains the changes and the practical steps employers should consider.

Which working arrangements are now in scope?

In direct engagement scenarios, from 1 October 2026 the new definition of “employer” means that organisations now need to ensure that workers, including those engaged under bank or zero-hours arrangements, and individual subcontractors have the right to work in the UK.

The new definition of “employer” also includes organisations that operate as an online matching service. The Home Office defines this as: “a person who, in the course of a business: (a) keeps a register of service providers for the purpose of matching them with potential clients or customers, (b) provides an online service by which potential clients or customers can submit enquiries for the purpose of being matched with suitable service providers, and (c) charges a fee or commission in return for making such matches”.

These organisations must ensure that individuals registered with them as service providers have the right to work in the UK.

Employers should ensure that they:

• have completed the correct checks for in-scope individuals before work begins;
• retain the evidence needed to establish a statutory excuse as a defence against liability for a breach of the regime;
• update workforce documentation to ensure that the right to work requirement is clearly signposted as a term of engagement; and
• include the right to suspend or terminate an engagement in the absence of the right to work.

New “extended liability” rules

Organisations entering into subcontracting arrangements should be aware that they may be caught by the new extended liability regime. It can apply in the following circumstances:

• Subcontracting supply chains: where work or services are subcontracted, liability for right to work checks is not limited to a single tier. It can move up every level of the supply chain where the Home Office is unable to identify an employer of a worker in the first instance.
• Online matching: where an online matching service matches a service provider with a customer to provide work or services, and the provider enters into a contract with the customer.
• Substitution: where an employer employs an individual to provide work or services and the contract allows them to send a substitute in their place.

The extended liability provisions are intended to establish responsibility where the direct employer (under the extended definition for right to work check purposes) of a worker, subcontractor or online matching service provider cannot be identified and/or the “prescribed requirements” have not been met.

The prescribed requirements include:

• A written statement: this should be in place before the work starts and require the supplier or provider to:
• carry out prescribed right to work checks on each relevant individual;
• obtain written consent before further subcontracting and flow equivalent obligations down the chain;
• permit audits and provide supporting records;
• allow suspension or termination where illegal working is identified or suspected; and
• cooperate with a Home Office investigation and provide information about the contractual chain.
• Identity verification systems: these must be maintained by the employer to ensure that the individual carrying out the work is the same individual whose right to work has been checked.
• Substitution controls: these must ensure that no substitute should be allowed to start in the place of an individual worker before the employer has completed a prescribed right to work check and verified their identity (as responsibility for the check must not be delegated to the original worker or substitute).

When the extended liability rules do not apply

The extended liability rules do not apply to the following arrangements.

End users, clients and customers

The rules do not apply to end users, clients and customers that “buy in” services for their own requirements and are not part of a supply chain of contracts to provide those services onwards to a third party.

For example, a business (A) contracts with a facilities management company (B) to provide cleaning services at its premises. B is responsible for ensuring that the cleaners it employs to carry out the work for A have the right to work. B will be liable for any civil penalty if it fails to do so without a statutory excuse. The extended liability provisions do not apply to A as B’s client and the end user of the cleaning services.

If B then subcontracted the cleaning services it provides to A to another company (C), C would be responsible for ensuring that the cleaners it employs to carry out the work for A have the right to work. C will be liable for any civil penalty if it fails to do so without a statutory excuse.

The extended liability provisions would apply to B as the company that subcontracted the work to C. However, they would still not apply to A, because A is not part of the subcontracting supply chain.

Genuinely self-employed individuals

Genuinely self-employed individuals are outside the regime where they:

• operate a business on their own account;
• trade in their own name or through their own personal service company; and
• contract directly with clients or customers to provide work or services.

The key question is whether individuals are genuinely self-employed. Organisations may wish to take a cautious approach and ensure that the prescribed requirements are met in all their direct contracts with individuals, regardless of the label applied to the arrangement.

Operators of “frameworks” that are outside the scope of the definition of an online matching service

The extended liability rules do not apply to operators of “frameworks” that fall outside the definition of an online matching service set out above.

For example, a business (A) needs to find a provider of cleaning services for its premises. It has access to a framework (run by B) of approved facilities management companies that businesses can call off from. B does not run the framework as an online matching service and therefore does not fall within the extended definition of “employer” for right to work purposes.

A selects a company (C) from the framework and decides to contract with C directly to provide the cleaning services. C is responsible for ensuring that the cleaners it employs to carry out the work for A have the right to work. C will be liable for any civil penalty if it fails to do so without a statutory excuse.

The extended liability provisions do not apply to:

1. A, as C’s client and the end user of the cleaning services; or
2. B, as the framework operator.

Immediate next steps

• Audit your workforce and contracts. Identify everyone who provides work or services, including bank workers, those under zero-hours direct engagements, individual contractors and those who provide services indirectly, such as subcontractors, platform workers and substitutes.
• Apply a “no check, no start” rule to all working arrangements in scope. Make sure the correct prescribed check is completed before work starts, with follow-up checks where permission to work is time limited. Keep a clear record of the check.
• Review substitution rights. Substitution clauses are common in contractor arrangements in order to demonstrate genuine self-employment. If substitution is needed, we recommend that documentation makes clear that advance notice and approval are required from the end user before a substitute starts work. Organisations should also maintain an approved-substitute register and record who actually performed each shift or task.
• Build identity checks into operations. Consider linking onboarding with site access, photo passes, shift allocation, timesheets or platform records so that the person doing the work is the person who was checked.
• Review and update your insourcing and outsourcing contracts and service level agreements. Any subcontracting arrangements where work or services commence on or after 1 October 2026 will need to include the prescribed written statement terms.
• Use indemnities carefully. Warranties and indemnities can allocate commercial risk, but they do not replace the prescribed controls needed for the statutory excuse. Consider which potential losses the indemnity covers and how it interacts with the wider limitation of liability clause.
• Strengthen monitoring, audit and assurance. Contractual terms alone will not suffice. Retain contracts, right to work records, approved-substitute registers, audit results, identity and access records, and evidence of action taken when concerns arose. Ensure that the organisation is clear about who has responsibility for right to work check queries.

Key takeaway

The duty to prevent illegal working can be expensive. Employers may face civil penalties of up to £45,000 per illegal worker for an initial breach, rising to £60,000 per illegal worker for repeat breaches of the regime.

How Capsticks can help

If you would like advice on the extended rules, a review of your existing compliance framework and documentation, support with any specific issues affecting your organisation, or training for managers and HR teams, please contact Partners Jonathan Lewis or Nicola Green about employment queries, or Partner Mary Mundy about commercial queries.