Right to Work Checks for Gig Economy, Agency and Zero-Hours Workers

Since 1 October 2026, right to work checks are no longer only about employees. Businesses must now check people engaged under a worker's contract, individual subcontractors and people found through online platforms, and liability for a missed check can travel up a chain of contracts.

The change comes from section 48 of the Border Security, Asylum and Immigration Act 2025, with the detail in the Home Office's code of practice on preventing illegal working, in force from 1 October 2026.

This page explains who is now covered, what businesses higher up a supply chain must do, and how the penalties work. It replaces our earlier guide written before the start date.

The Extended Scheme at a Glance

Arrangement	Who must check	Covered from
Employees	The employer	Already covered (employment from 29 February 2008)
Workers on a worker's contract, including many zero-hours and casual staff	The business engaging them	Engagements starting on or after 1 October 2026
Individual subcontractors	The business they contract with	Engagements starting on or after 1 October 2026
People matched through an online platform	The online matching service	Engagements starting on or after 1 October 2026
Chains of contracts and substitution clauses	Upstream businesses, through the prescribed requirements	1 October 2026

Who Is Now Covered

The code defines an "employer" for right to work purposes as anyone who engages an individual under a contract of employment, under a worker's contract, as an individual subcontractor, or as an online matching service passing on details of a service provider.

That definition is wider than employment law's. A delivery rider engaged through an app, a casual bar worker on a worker's contract and a self-employed labourer working under a main contractor can all now be in scope.

Who Is Not

People genuinely in business on their own account, trading in their own name and contracting directly with clients or customers, are outside the scheme. Ordinary business-to-business contracts for a service are outside it too.

The code adds a warning. Someone who gets work through an intermediary or platform and is not running an independent business is in scope, whatever their contract calls them. Our guide to contractor misclassification explains how status is tested.

Existing Arrangements

For workers, subcontractors and platform matches, a civil penalty can only be imposed where the engagement started on or after 1 October 2026. There is no duty to go back and check people engaged before that date.

That is not a reason to ignore them. Follow-up checks for people with time-limited permission still fall due, and many businesses are choosing to bring their whole casual workforce onto one checking process.

Liability Up the Chain

The bigger change is extended liability. Where a business contracts to provide work to a client and then subcontracts it, uses a platform, or allows substitution, it can be treated as employing whoever actually does the work.

The Home Office will look first for the business with the direct contract. If it cannot find one, or if the prescribed requirements were not met, the penalty can be imposed on a business further up the chain.

End users are protected. The rules do not apply to a business that simply buys a service for itself and is not passing the work on to a third party.

The Prescribed Requirements

An upstream business gets a statutory excuse only if it meets three requirements in full and can evidence them.

1. Contract Terms in Writing

Before the work starts, the contract with the supplier or service provider must require them to:

• carry out prescribed right to work checks on anyone they use for the work;
• not subcontract further without written consent, and pass the same obligations down;
• allow you to audit their checks;
• let you take action, such as suspension or termination, if illegal working is found;
• co-operate with any Home Office investigation, including details of the chain of contracts.

2. Substitution Controls

If a contract lets a worker send a substitute, the engaging business must have processes in place before work starts. Every substitute needs a prescribed check before they do any work, and the check cannot be left to the worker who is sending them.

The business must also be able to act if a substitute is found to be working illegally, and keep confirming that the person turning up is the person who was checked.

3. Identity Verification

Businesses in a chain, platforms and those allowing substitution must have proportionate systems to confirm that the person doing the work is the person checked. The code suggests ID cards or access passes, facial verification through a registered digital verification provider, biometric or attendance systems, and checks against licences or training records.

Where re-verification is used, the code says it should happen at sensible points, such as the start of a shift or a new assignment, and no less than once in any 24-hour period of activity.

How Checks Are Done

The three ways to check stay the same: a manual check of original documents from the prescribed lists, a Home Office online check using a share code, or a digital check through a registered right to work digital verification service provider.

Checks must be done before work starts, and repeated before permission expires for anyone with time-limited leave. Our right to work check procedure guide covers each method step by step.

Penalties

The civil penalty starting point is £45,000 per illegal worker for a first breach, and £60,000 per worker where the business has been found employing illegal workers within the previous three years. The GOV.UK penalties page sets out the wider sanctions.

The code allows reductions of £5,000 per worker for reporting the worker to the Home Office and for active co-operation. For a first breach, a business with effective checking practices and both mitigations can receive a warning notice instead of a penalty.

Penalties are not the only risk. Knowingly employing an illegal worker is a criminal offence, and sponsor licence holders can lose their licence.

What Businesses Should Do Now

1. Map every way people are engaged: employees, casual workers, subcontractors, agencies, platforms and substitutes.
2. Bring workers and individual subcontractors engaged since 1 October 2026 into your checking process.
3. Review supply contracts and add the prescribed terms before new work starts.
4. Check any substitution clause and put substitute checks in place, or remove the clause.
5. Choose identity verification measures that fit the work, and record them.
6. Keep copies of checks and evidence of the prescribed requirements, ready for an audit or investigation.
7. Train the people who onboard workers and manage subcontractors.

Common Errors to Avoid

• Relying on the label. Calling someone self-employed does not take them out of scope if they are not running their own business.
• Leaving checks to subcontractors without contract terms. Without the written terms and the right to audit, you have no statutory excuse.
• Letting substitutes start on trust. A substitute who works before being checked is a breach.
• Checking once and never again. Identity must be re-verified, and time-limited permission needs follow-up checks.
• Assuming agency staff are the end user's problem. The agency that employs them must check; the end user should still confirm it does.

How the Extension Fits With Other Changes

Casual and low-hours work is under scrutiny from several directions. Guaranteed hours and shift notice for zero-hours workers are planned for 2027, covered in our zero-hours contracts guide, and the Fair Work Agency now enforces several pay and holiday rules for the same workforce.

Right to Work Policy and Procedure Writers

We write right to work procedures, subcontractor contract terms and substitution controls that meet the 2026 code, sized to how your business actually engages people. They sit alongside our pre-employment checks policies and our wider HR policies and procedures service, priced from £65 per document.

If your supply chain uses subcontractors or platforms, our policy review service can check your contracts and procedures against the prescribed requirements. Get a quote to start.