Right to work checks from 1 October 2026: what the change adds to a sponsor’s file
The right to work scheme now reaches beyond employees. For a sponsor that matters twice: the sponsor’s own file has to show the check for every worker it employs or sponsors, and a sponsor that engages people through worker’s contracts, sub-contractors or contract chains has new exposure to a civil penalty of up to £60,000 for each illegal worker. This is what the primary documents say and what they add to the Appendix D file.
In short
- Section 48 of the Border Security, Asylum and Immigration Act 2025 came into force on 1 October 2026 (S.I. 2026/683, regulation 2). It adds sections 14A and 15A to the Immigration, Asylum and Nationality Act 2006. The prescribed requirements behind the checks and the extended-liability excuse are set by S.I. 2026/700, in force the same day; the guide and the code explain them.
- A person who engages someone under a worker’s contract or as an individual sub-contractor, or runs an online matching service, is now an “employer” for the civil penalty scheme. Liability can also reach a person up a contract chain (extended liability).
- The penalty starting point is £45,000 per worker for a first breach and £60,000 for a repeat breach within three years (Code of practice, Stage 3). Part 3 C7.30 adds that a civil penalty is likely to cost a sponsor its licence.
- There is no general grace period (guide, Annex C). A sponsor still has to check and retain evidence for every worker it sponsors, whether or not the arrangement is within the scheme (Appendix D 1.1; guide, Annex B).
Where extended liability applies the excuse is different: contract terms set out in a written statement, substitution controls where the contract allows substitution, and identity verification, in place before the work starts and kept up for as long as it runs.
1. Who is in scope now
The change is in the Border Security, Asylum and Immigration Act 2025, section 48. It was brought into force by one short commencement regulation:
2 Section 48 (extension of prohibition on employment to other working arrangements) of the Border Security, Asylum and Immigration Act 2025 comes into force on 1st October 2026.
The section inserts section 14A into the Immigration, Asylum and Nationality Act 2006. Its first subsection reads:
In sections 15 to 24, a reference to a person employing another person includes a reference to— (a) a person (“person A”) engaging an individual (“individual A”) under a worker’s contract, (b) a person (“person B”) engaging an individual sub-contractor (“individual B”), and (c) an online matching service (“person C”) providing the details of an individual who is a service provider (“individual C”) to potential clients or customers.
The employer’s guide, which came into force on the same day, defines the three new terms in the Act’s words. A worker’s contract is one under which an individual undertakes to perform work or services personally for another person, where that person is neither a client nor a customer of a profession or business undertaking carried on by the individual. An individual sub-contractor is one who has contracted to provide work or services where the other person has contracted with a third party to provide them, but the individual has not. An online matching service keeps a register of service providers, provides an online enquiry service for matching, and charges a fee or commission for the matches. The guide gives an example of each: a temporary-staff business (Example 2), a delivery platform (Example 3) and a cleaner matched to a homeowner (Example 4).
The start dates
In relation to employment under a worker’s contract, as an individual sub-contractor or in the case of an online matching service providing the details of a service provider to clients or customers, a civil penalty may only be imposed where the employment commenced on or after 1 October 2026.
Employment under a contract of employment is unchanged: the guide keeps the 29 February 2008 start date for that case. Extended liability has its own date. The prescribed requirements for the contractual arrangements apply from 1 October 2026, and a person seeking a statutory excuse must comply with them “where the relevant contractual arrangements were entered into on or after 1 October 2026”. Annex C of the guide says a pre-1 October 2026 arrangement “is therefore not brought within scope solely because work or services continue afterwards”.
Extended liability
Section 15A is the part with reach up a contract chain. Its subsection (4) treats a person as employing anyone who personally provides the work, even without a contract with that person:
For the purposes of section 15, and where this would not otherwise be the case, A is to be treated as employing any individual (“B”) who personally provides the work or services (or any part of the work or services), including where— (a) A is not in a contractual relationship with B, or (b) A does not know that B is providing the work or services (or part of the work or services).
It applies where a person employs an individual to provide work or services, or is contracted to provide or arrange work or services and enters into a contract under which someone else is to provide it (s.15A(1)). It is not limited to the first contract in a chain (s.15A(5)). Section 15A(6) says it “does not affect the liability of any other employer under section 15”.
What is outside
The guide is as specific about what the change does not do. A business buying a service for its own use is not caught merely by buying it (Example 11, cleaning for a supermarket). An agency supplying workers into a hirer’s own operations stays the employer of those workers, and in that standard arrangement the extended liability provisions do not apply to the hirer or the agency (Example 12). Annex C adds that in a standard agency supply arrangement “the changes are not intended to require routine duplication of these checks by the hirer”. Work performed wholly overseas is outside, solely because the engaging organisation is in the UK. And the guide says the label does not decide it: “The contractual description or label adopted by the parties involved will not, by itself, determine what responsibilities may arise under the Scheme.”
2. The statutory excuse and the digital-identity requirement
For a direct employer the excuse works as before: the prescribed check, done before the work starts, and a follow-up check before time-limited permission runs out. The guide lists the three checks:
In order to establish a statutory excuse, employers must do one of the following checks before the worker commences employment: 1. a manual document-based right to work check. 2. a Home Office online right to work check. 3. a right to work check using a Right to Work digital verification service provider (RtW DVSP).
Two points matter for the file. First, the online check is the one Appendix D 1.1 tells a sponsor to use in most cases. The employer must use the employer-facing share code service: the guide says “it is not sufficient to simply view the details provided to the individual on the migrant-facing service”. A share code is valid for 90 calendar days from issue; that is the window for using the code, and the follow-up check is set by the worker’s permission end date, not by the code. Second, a check done for another purpose gives no excuse: the guide says right to work checks carried out as part of an application for an operating licence or other regulatory approval “do not establish a statutory excuse under the Scheme”.
The digital identity route
Whilst it is not mandatory to conduct right to work checks digitally in this way, if an employer chooses to do so, it is mandatory that the DVSP is registered on the Office for Digital Identities Attributes (OfDIA) register, and that they are able to provide right to work checks
Where an employer uses a RtW DVSP, the employer (and not the RtW DVSP) remains responsible for ensuring that the check is carried out in accordance with the prescribed requirements. Where those requirements have not been met, the employer will not establish a statutory excuse and may be liable for a civil penalty if the worker is found to be working without the required permission.
The Code of practice lists the circumstances in which an employer has no excuse. Two concern this route: “they have used the services of an unregistered DVSP or a non-Right to Work DVSP”, and use of a RtW DVSP “where it is reasonably apparent that the output of the check sent to them is incorrect or does not contain the required information”. A screening or onboarding agency may supply the service, but it must make clear which registered provider performed it. For a sponsor the practical consequence is a line in the file: which provider, its registration, and the output of the check.
Extended liability has a different excuse
A person who is liable only through section 15A cannot rely on a check of the worker. The guide sets three requirements, all before the work commences:
Any person seeking to establish a statutory excuse against liability for payment of a civil penalty must comply with the prescribed requirements relevant to the contractual arrangements before the work commences and be able to provide evidence of that compliance if requested. 1. Contractual terms and conditions (written statement). 2. Substitution controls. 3. Identity verification.
The written statement must set out terms to be included in the contract with the employer or service provider: to carry out the prescribed checks, not to subcontract further without prior written consent and to replicate the same obligations in any permitted subcontracting, to allow audits, to allow enforcement action where illegal working is found, and to co-operate with a Home Office investigation. Annex C says existing vendor onboarding “cannot replace this requirement but may form part of the wider evidence of compliance”. The guide also says the Home Office “cannot approve individual contractual clauses or business-specific compliance frameworks”.
3. The penalty and extended liability
If an employer is found to be employing someone illegally and they have not carried out the prescribed checks, they may face sanctions including: a civil penalty of up to £60,000 per illegal worker. … not being able to sponsor migrants.
The Code of practice sets the amounts. The Home Office starts from a figure that depends on whether there has been a breach in the previous three years:
| First breach within the last three years | Repeat breach (within 3 years) | |
|---|---|---|
| Employers | £45,000 (per worker) | £60,000 (per worker) |
For a first breach, reporting the suspected illegal worker and receiving a Unique Reference Number before the Home Office identifies the worker reduces the penalty by £5,000 per worker, and so does active co-operation. A first penalty paid within 21 days of the notice is reduced by 30 per cent (the Faster Payment Option), which cannot be paid in instalments. A first breach where the employer also shows “effective right to work practices, together with reporting and active co-operation” is reduced to a Warning Notice. A repeat breach gets the two £5,000 reductions but no Warning Notice. The Code lists what counts as effective practice:
The Home Office will consider that the employer has effective right to work practices in place if they provide evidence of their general compliance with their responsibility to prevent illegal working. This includes: having robust checking systems in place. consistent right to work checking processes. retention of records, and a history of compliance with the requirements.
Two lines in the Code decide who carries the burden of proof: “It is the employer’s responsibility to demonstrate that they have complied with the requirements to establish and, where necessary, retain their statutory excuse”, and an employer has no excuse if “they cannot provide evidence of having conducted the prescribed right to work checks or having complied with the prescribed requirements in relation to the contractual arrangements, where applicable, before the employment commenced”.
What it means for a licence
C7.30. If you sponsor or employ a worker who does not have the relevant immigration permission to work, and you have failed to carry out the appropriate right to work check, or could otherwise have been reasonably aware that the worker does not have the relevant permission to work, you may face the following penalties: if you are in breach of the statutory right to work scheme, we may issue you with a civil penalty of up to £60,000 for each illegal worker; if we issue you with a civil penalty, we are likely to revoke your licence and you will not be eligible for a new licence until at least 12 months have passed since you have paid the civil penalty in full (this period could be up to 5 years if you are issued with more than one civil penalty)
The same paragraph says that where the scheme does not apply, for example where the sponsor is not the worker’s direct employer, but it is sponsoring a worker without permission to work, “we are likely to revoke your licence”. It also lists prosecution for knowingly employing an illegal worker, with up to two years in prison and an unlimited fine. Part 3 v08/26 (valid from 28 August 2026) also looks ahead to the change:
From 1 October 2026, the responsibility to carry out right to work checks will also apply to organisations that engage individuals under a worker’s contract or individual sub-contractors, or operate an online matching service providing details of an individual who is a service provider to potential clients or customers.
4. What goes in the sponsor’s file
The Appendix D rule has not changed and it is wider than the statutory scheme. It covers workers the sponsor employs whether or not it sponsors them, and workers it sponsors whether or not it employs them:
You must retain evidence you have carried out right to work checks on: any worker you employ, whether or not you are sponsoring them; any worker you sponsor, whether or not you are their employer.
As a licensed sponsor, you also have a duty to carry out a right to work check on any worker you are sponsoring, regardless of the nature of the employment relationship between you and the sponsored worker.
What section 48 adds is on the statutory side. A sponsor that engages a worker under a worker’s contract, or a sub-contractor, now has a statutory excuse to establish for that person as well as the sponsor duty. A sponsor that sits in a contract chain or runs a platform has the extended liability requirements. The Appendix D text printed in version 08/26 still describes the statutory excuse by reference to the employer (“If you are the worker’s employer, you must carry out these checks both to comply with your sponsor duties and to establish a ‘statutory excuse’”). That is the version captured for this post; it predates 1 October 2026 and does not mention the new limbs.
In practice the file for each person can hold these items, with the source of each. The guide’s Annex C says there is no single minimum evidential package for every arrangement, so the contract-chain rows apply only where extended liability does:
| Item | What the source says | Source |
|---|---|---|
| The check itself | For an online check, a PDF or HTML copy of the profile page with the photograph and the date of the check. For a manual check, a clear copy of each document, in a format that cannot be manually altered. | Guide, online Step 3; manual “3. Copy” |
| The date of the check | A dated declaration on the copy, or a separate record. Simply writing a date on the copy is not enough, as it does not confirm the actual date. | Guide, manual “4. Record and retain” |
| The digital provider’s output | Name, date of birth, image of the document, photograph, date of the identity check, the registered provider’s name, and confirmation of registration. | Guide, RtW DVSP “Step 4: Retain” |
| The follow-up check | Re-check on or before the date permission ends. Not needed where the first check showed settled status, or pre-settled or settled status under the EU Settlement Scheme. | Guide, section 4 |
| Contract-chain evidence | The written statement, audit records, assurance received, records of compliance reviews, and how concerns were acted on. Substitution controls: checks on substitutes and records of who did the work. | Guide, section 3 |
| The record that you kept it | Retained and producible quickly on request. | Guide; Appendix D |
Two retention clocks
The employer’s guide and Appendix D measure retention from different events:
The copy should be retained for the duration of employment and for two years afterwards. The file/hard copy must then be securely destroyed.
Unless otherwise stated in this guidance, all documents relating to a worker you sponsor must be kept throughout the period that you sponsor them and until whichever is the earlier of either: one year after the date on which your sponsorship of the worker ended; the date on which a compliance officer has examined and approved them, if this is less than one year after your sponsorship of the worker ended.
A sponsor that is also the employer is subject to both. The guide’s period is measured from the end of employment and Appendix D’s from the end of sponsorship, so the two end dates can differ. The Appendix D post sets out the other records in that file.
5. What a compliance visit will ask
The caseworker guidance rates immigration status monitoring as the first of five areas, and an officer may ask to see the right to work evidence on the day or within the time allowed for producing documents. The compliance visit post has the five areas and the timescales. The change gives the officer new things to ask. The questions below follow from the texts quoted above and are not the guidance’s own list:
- For each worker the sponsor employs, sponsors, or engages: which check was done, on what date, by whom, and where is the copy?
- For anyone engaged under a worker’s contract or as a sub-contractor from 1 October 2026: was the check done before the work started?
- If a digital identity provider was used: which provider, is it on the OfDIA register, and is the output of the check in the file?
- For time-limited permission: when does it end, and when is the follow-up check due?
- If the sponsor is up a contract chain: is there a written statement for each arrangement entered into on or after 1 October 2026, and what audit or assurance records are held?
- If the sponsor runs a platform or allows substitution: how is the person doing the work tied to the person who was checked?
The guide warns that the Home Office will look at whether the requirements “operated effectively in practice”, so a contract clause on its own is not the whole answer.
How SponsorFlow handles the right to work side
The staff and checks register holds a right to work record for every worker, sponsored or not, which is the Appendix D 1.1 scope. For each person it records the check, the method, the date it was done, the end of their permission where there is one, and the date the follow-up check is due. With ID capture, the worker photographs their ID and takes a selfie; a liveness check and face matching add evidence, and the employer reviews it and records the decision. SponsorFlow is not a RtW DVSP: that capture is evidence for the file, and the statutory excuse still comes from the prescribed check (manual, Home Office online, or a registered provider). Share code checks are done on the Home Office service and recorded. It does not make the legal judgement about whether an arrangement is in scope of section 14A or 15A: that stays with the sponsor and its adviser.
Questions people ask
Is there a grace period after 1 October 2026?
No. The employer’s guide (Annex C, “Will there be a grace period following commencement?”) answers: “No. The requirements apply from 1 October 2026 and there is no general grace period.” It adds that enforcement will continue to be intelligence-led.
Does the change reach arrangements that began before 1 October 2026?
It depends on the limb. For employment under a worker’s contract, as an individual sub-contractor, or through an online matching service, a civil penalty may only be imposed where the employment commenced on or after 1 October 2026. For extended liability the code says that same employment-start condition applies, and the guide adds a second date, when the contractual arrangement was entered into: Annex C says an arrangement entered into before 1 October 2026 “is not brought within scope solely because the work or services continue on or after that date”. The guide adds that a variation, renewal or extension should not be assumed either to bring an arrangement within scope or to leave it outside.
Is every contractor or personal service company now in scope?
No, and not every one is out of scope either. The guide says it does not apply to individuals operating an independent business who contract directly with clients or customers (Example 5, a self-employed plumber; Example 6, a graphic designer working through a personal service company). Annex C answers “No. There is no blanket exclusion simply because a worker is described as a contractor, freelancer or consultant, or provides services through a PSC”. The starting point is the substance of the arrangement.
Must a sponsor use a digital identity provider?
No. The guide says it is not mandatory to conduct right to work checks digitally. If an employer chooses to use a right to work digital verification service provider (RtW DVSP), the provider must be registered on the Office for Digital Identities and Attributes (OfDIA) register and able to provide right to work checks. The employer, not the provider, remains responsible for the check meeting the prescribed requirements. The guide says a RtW DVSP can check holders of British or Irish passports (or Irish passport cards) that are current or up to six months past expiry, verify List A and List B documents where the issuing authority provides them in a digital format, and supply the facial recognition that confirms the worker is not an imposter. A worker’s own photograph of a document is not a digital document from the issuer. Anyone else is checked by the manual or the Home Office online route.
How long must the right to work evidence be kept?
The two documents measure from different events. The employer’s guide says copies should be retained for the duration of the worker’s employment and for two years afterwards, then securely destroyed. Appendix D (version 08/26, “How long you must retain documents”) says documents relating to a sponsored worker are kept throughout the sponsorship and until the earlier of one year after sponsorship ended and the date a compliance officer has examined and approved them, if that is less than one year. A sponsor who is also the employer is subject to both texts.
Does a sponsor still have to check a sponsored worker who is not its employee?
Yes. Part 3 C7.28 says the sponsor must carry out a right to work check on any worker it is sponsoring “regardless of the nature of the employment relationship”, or ensure the check is carried out if it is not directly employing or engaging the worker. Annex B of the employer’s guide says sponsor licence holders must check and retain evidence of a worker’s immigration status for any worker they sponsor, whether or not the arrangement falls within the scheme.
Sources
- Border Security, Asylum and Immigration Act 2025 (c. 31), section 48legislation.gov.uk, revised text; “S. 48 in force at 1.10.2026 by S.I. 2026/683, reg. 2”; retrieved 2 October 2026 · GOV.UK
- The Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026S.I. 2026/683 (C. 57), made 24 June 2026; retrieved 2 October 2026 · GOV.UK
- The Immigration (Restrictions on Employment and Residential Accommodation) (Prescribed Requirements and Codes of Practice) (Amendment) Regulations 2026S.I. 2026/700, made 24 June 2026, in force 1 October 2026 (the prescribed requirements for the checks, the RtW DVSP route and the extended-liability excuse); retrieved 2 October 2026 · GOV.UK
- Employer’s guide to right to work checks, 1 October 2026 (Home Office)Title and cover “1 October 2026”; GOV.UK page updated 1 October 2026; PDF, 83 pages; retrieved 2 October 2026 · GOV.UK
- Code of practice on preventing illegal working: Right to Work Scheme for employersTitle and cover “1 October 2026”; GOV.UK page updated 1 October 2026; PDF, 37 pages; retrieved 2 October 2026 · GOV.UK
- Workers and Temporary Workers: guidance for sponsors, Part 3: sponsor duties and complianceVersion 08/26, valid from 3 August 2026 · GOV.UK
- Workers and Temporary Workers: guidance for sponsors, Appendix D: keeping records for sponsorshipVersion 08/26, valid from 3 August 2026 · GOV.UK
SponsorFlow provides compliance software and record-keeping tools. It is not a law firm or an immigration adviser and does not give legal or immigration advice, which are regulated activities (Immigration and Asylum Act 1999, section 84). This page describes what the published Home Office guidance and the Immigration Rules say, with the paragraph for each point, so you can read the source yourself. Guidance versions and figures are those in force on the date shown; the Home Office changes them, so check the current version before you rely on any of it.
Sponsors: keep the file as you work.
Staff and checks register, right to work with ID capture, pay-run salary check, the 10 and 20 working-day reporting diary, Key Personnel and SMS users, five sponsor policies. £99 a month + VAT, 30 days free, no card.
Start your 30-day free trialImmigration law firms: check the role, build the pack.
Step 1 checks a role and its candidates against the published rules, with the quote and the paragraph for each finding. Step 2 builds the Appendix D evidence pack. Your solicitor decides and signs. By invitation.
How it works for firms