If you run a business, you already know that it is illegal to employ someone who does not have the right to work in the UK, and that getting the checks wrong can be expensive. What changes from 1 October 2026 is who this applies to. Until now, the right to work regime has focused mainly on direct employees. From that date, the scheme and its associated civil penalties are expected to widen to cover businesses that engage contractors, agency workers, casual staff and outsourced service providers — even where there is no direct employment relationship at all.
This matters to a wide range of owner-managed businesses: those who use self-employed contractors on building sites or in the trades, those who bring in agency staff for seasonal or casual work, those who use platforms to match freelancers with clients, and those who outsource whole functions such as cleaning, security or logistics to another company. The detail is still being finalised through Home Office guidance and a code of practice, so this article sets out the direction of travel rather than the last word — but the direction is clear enough that owners should start preparing now.
Who is likely to be caught by the wider scope
It is worth being concrete about who this touches, because “contractors and agency workers” can sound abstract until you map it onto an actual business. A builder who takes on self-employed tradespeople for a project. A hospitality business that uses agency staff to cover shifts during busy periods. A retailer that brings in casual staff over Christmas through a staffing platform. A firm that outsources its cleaning, security or IT support to another company rather than employing those people directly. A business that uses an online platform to match freelancers with short-term work. In each of these cases, under the wider scope expected from 1 October 2026, the business benefiting from the labour may need to satisfy itself — and be able to show — that the individual doing the work has the right to do so, regardless of who technically employs them or which link in the chain arranged the work.
Why the exposure sits with you, not just your recruitment agency
The change that will catch most business owners off guard is the extension of liability through labour supply chains. Historically, if you used an agency to supply staff, the agency carried much of the compliance burden for those workers. Under the revised arrangements, a business can face exposure even where it has no direct contract with the individual actually doing the work — for example, where a contractor uses a sub-contractor, or where a labour supplier further down the chain has not carried out proper checks.
The practical effect is that you cannot simply assume someone else in the chain has this covered. If your business benefits from the labour — whether that person is on your payroll, supplied by an agency, engaged as a self-employed contractor, or working for a company you outsource a service to — the safest position is to know that a compliant check has been done and to be able to show it.
What the process is expected to look like
The core discipline does not change, even as the scope widens. The check has to happen before work starts — not after someone has already begun, and not as a box-ticking exercise once you have decided you want to keep them on. There are two routes, depending on the individual’s immigration status.
- Home Office online check. Where someone holds a digital status — an eVisa or similar — they generate a share code through their UKVI account (these codes typically begin with the letter W for right to work purposes and are time-limited, usually valid for around 90 days) and give it to you along with their date of birth. You then use the Home Office’s employer-facing online service to check that code. This is now the primary route for anyone with a digital immigration status, and it produces its own record.
- Manual document check. For those who still hold physical documents — a British or Irish passport, for example — the check has to be done properly: original documents, checked in the presence of the holder (or via an approved video method with an authorised identity service provider), confirming the photograph matches the person and the document is genuine and unexpired, and copying it correctly.
Whichever route applies, keep a dated copy of what you checked and how you checked it. This record is what gives you the statutory excuse — the legal protection that stands between your business and liability if it later turns out someone did not, in fact, have the right to work. Without that dated record, the excuse is not available to you even if the check genuinely happened.
If you outsource whole functions to another company — a cleaning contractor, a security firm, a payroll bureau — it is tempting to assume that company’s own employment practices are its own business. Under the revised rules, that assumption may no longer hold. Where the wider scheme applies to services provided under your name or on your premises, it is worth asking your suppliers directly what checks they carry out and whether they can evidence them, rather than discovering the gap only if something goes wrong.
Time-limited permission means the job is not done at the start
Where someone’s right to work is time-limited — a visa with an expiry date, for example — a single check at the outset is not enough. You need a follow-up check before that permission runs out, and a record of when the next check is due. For a business used to a set-and-forget approach to onboarding, this is the part most likely to slip. It works best as a standing item on a calendar or a checklist, not something left to memory.
What a civil penalty means for a small company
A civil penalty for employing someone without the right to work is a serious matter for any business, and disproportionately so for a small one — quite apart from the financial exposure, there is the reputational damage, the management time lost to an investigation, and in more serious cases the risk of criminal liability for those responsible. We are deliberately not quoting a penalty figure here, because the levels are set by the Home Office and are subject to change; you should check the current published guidance rather than rely on a number repeated secondhand. What is worth understanding now is the principle: get the check right, keep the record, and you have a statutory excuse; get it wrong, or skip it because “the agency handles that”, and the exposure is yours.
The sensible operational fix
None of this needs to become a compliance department. For most owner-managed businesses, three simple things do the job.
- One named owner of the process. Someone in the business — often the owner, sometimes an office manager — who is responsible for knowing which checks are needed, when, and for whom, across employees, contractors, agency staff and outsourced arrangements.
- A simple checklist. Before work starts: who is engaging this person or company, what category of check applies, has it been done, has it been recorded. Nothing elaborate — a spreadsheet or a paper file is entirely adequate for most small businesses.
- A records file. Dated copies of every check, kept together and kept for as long as the guidance requires, plus a note of any follow-up check dates for time-limited permission.
This is not a new discipline so much as an extension of one you may already have for direct employees. The change from 1 October 2026 is really about widening the circle of who it applies to — and making sure the same rigour is applied consistently, whoever is actually supplying the labour.
Where to go from here
This is a moving area. The Home Office guidance and code of practice were still being finalised at the time of writing, and the precise scope of what counts as an “engaging business” and the exact penalty levels are set out in that guidance rather than in this article. Before 1 October 2026, it is worth checking the final published Home Office guidance and taking employment advice specific to how your business engages contractors, agency workers, casual staff and outsourced services — particularly if any part of your workforce sits outside a straightforward direct employment arrangement.
This sits alongside the wider planning we help business owners with — succession, ownership structure, and what happens to the business if something happens to you — but it is worth flagging on its own because the compliance deadline is fixed and the exposure, until you have a process in place, is real.