Prevention of Illegal Working — Key Changes Taking Effect 1 October 2026

Background

Section 48 of the Border Security, Asylum and Immigration Act 2025 introduces the most significant expansion of the United Kingdom's illegal working regime since its inception. The changes came into force on 1 October 2026, alongside a revised Code of Practice on Preventing Illegal Working.

The reforms respond to changes in the labour market, including the growth of flexible and platform-based work, and are intended to ensure that the framework for preventing illegal working remains effective across modern workforce structures.

Expanded Scope of the Right to Work Scheme

Before 1 October 2026, the duty to carry out right to work checks and the associated civil penalty regime applied primarily to direct employment relationships, that is, employees and apprentices. Now, that duty extends to the following categories of working arrangement:

• Workers under a worker's contract – covering many casual, zero-hours and temporary arrangements;
• Individual subcontractors – where an individual personally provides services under a subcontracting arrangement; and
• Online matching services (gig/platform work) – where a platform provides the details of a service provider to clients or customers.

The new regime does not apply to genuinely self-employed individuals who provide services directly to clients through their own independent businesses.

Extended Liability Through Supply Chains

One of the most significant aspects of the reforms is the introduction of "extended liability". This means that a business may face a civil penalty for illegal working even where it does not directly engage the worker in question. Extended liability may apply in three key scenarios:

1. Subcontracting chains – where a person is contracted to provide work or services to a third party and enters into a contract with another employer to provide workers to fulfil that contract;
2. Online matching services with corporate service providers – where a platform connects clients with corporate service providers who themselves employ workers; and
3. Contracts with individual subcontractors or service providers that permit substitution.

Liability can apply at any point in a chain of contracts, meaning multiple businesses may be jointly liable for the same instance of illegal working.

Statutory Excuse and Prescribed Contractual Requirements

For direct employment relationships, the existing statutory excuse framework remains in place. For the new categories of arrangement caught by the extended liability provisions, a separate statutory excuse is available. To establish a statutory excuse against extended liability, a business must satisfy all of the prescribed requirements before work begins. These requirements fall into three categories:

1. Contractual terms and conditions: Certain prescribed terms must be incorporated into the contract with the down-chain employer or service provider;
2. Substitution controls: Where contracts permit substitution, prescribed processes must be in place before work commences to ensure that, among other things, a compliant right to work check is carried out on any substitute;
3. Identity verification: Proportionate systems and processes must be in place to ensure that the individual who turns up to carry out the work is the same individual on whom a right to work check was conducted.

Not only must the appropriate contractual terms be in place, but a business must also be able to show that the stated arrangements are operating effectively in practice. Businesses should keep clear, comprehensive records, including contracts, audit records, assurance information, compliance reviews and evidence of action taken where concerns arose.

It is important to note that the employer who has the direct contractual relationship with the worker remains responsible for carrying out a right to work check and establishing a statutory excuse.

The extended liability provisions do not automatically transfer that responsibility to another person in the contractual chain, nor do they make that person liable for another employer's failure to carry out a right to work check. Extended liability will primarily be applied where the employer in the direct contractual relationship with the illegal worker cannot be identified.

Digital Verification Service Providers

Since 1 October 2026, where an employer chooses to use a Right to Work Digital Verification Service Provider (“RtW DVSP”), it is now mandatory for that provider to be registered on the Office for Digital Identities and Attributes (“OFDIA”) register with a note confirming it is authorised to carry out right to work checks.

Civil Penalties and Enforcement

Civil penalties for illegal working remain significant:

• First breach: up to £45,000 per illegal worker (within a three-year period);
• Repeat breach: up to £60,000 per illegal worker (within three years).

In addition to financial penalties, licensed sponsors risk having their sponsor license revoked, and directors may face disqualification. Criminal liability may also arise where a business knew, or had reasonable cause to believe, that a worker did not have the right to work. In this situation, potential penalties include an unlimited fine and up to five years' imprisonment.

Implementation

The expanded civil penalty regime applies to engagements commencing on or after 1 October 2026. Working arrangements that started before that date are excluded from the new categories (though contracts of employment remain subject to the existing rules). The extended liability prescribed requirements apply to any engagement which starts on or after 1 October 2026, even where the contract was signed prior to that date.

Recommended Steps for Employers

In light of these changes, organisations should consider the following actions:

• Map their workforce to identify all categories of workers engaged (employees, workers, individual subcontractors, agency and platform workers) and determine who falls within the expanded scope;
• Review commercial contracts and supply chain arrangements to identify extended liability exposure and incorporate prescribed contractual requirements;
• Update onboarding processes to ensure compliant right to work checks are completed before work starts for all in-scope engagements;
• Verify DVSP registration if using digital verification services, ensuring the provider is OFDIA-registered; and
• Provide training to relevant personnel, including procurement and contract management teams, as compliance will no longer be solely an HR function.