Until the end of September, right to work checks were something you did for your own employees. The labourer a subcontractor sent to your site, the self-employed fixer paid by the day, or the cover who turned up when someone was off sick were, as far as immigration law went, somebody else’s concern.
That changed on 1 October 2026. The rules on illegal working now reach people engaged as individual subcontractors and on worker’s contracts, and labour supplied through a chain of contracts, however many tiers deep. For construction, where most of the people on a site are not employed by the firm running it, this is the biggest change to right to work checks in years.
This article explains what changed, who is now in scope and who is not, what main contractors need in place, and what to do this month.
What changed
Section 48 of the Border Security, Asylum and Immigration Act 2025 extends the prohibition on illegal working beyond employment contracts. It came into force on 1 October 2026, and the Home Office published an updated employer’s guide to right to work checks (opens in a new tab) and code of practice on the same day.
In the guide’s words, employing someone now includes engaging an individual under a worker’s contract, engaging an individual sub-contractor, and providing a service provider’s details through an online matching service. A separate extended liability provision covers labour supply chains: where a business contracts to deliver work and brings in another business to supply the people who do it.
The change is not retrospective. A civil penalty for these new categories can only follow where the engagement started on or after 1 October 2026.
Who is now in scope, and who is not
The test is the substance of the arrangement, not whether somebody calls themselves self-employed.
In scope: individuals you engage personally to do the work, whether on a worker’s contract or as an individual subcontractor, and people who work on your project through a chain of contracts, including agency and labour-only arrangements.
Not in scope: genuinely independent businesses, trading in their own name or through their own company, that contract directly with their clients or customers. The Home Office guide gives the example of a self-employed plumber hired for a job, who does not need a check. A personal service company contracting directly with its client is also outside the new rules.
Many sites have both. The specialist firm you subcontract the electrics to may be out of scope as a business, while the individual labourers it brings onto your site are not.
Who carries out the check
The business with the direct contractual relationship with the worker remains responsible for the check. The prescribed methods have not changed: a manual check of original documents, the Home Office online checking service, or an identity service provider. The business must keep a clear copy of what it checked and record the date the check was made, then hold those records for as long as the person works for it and for two years afterwards.
The check has to be of the person who actually turns up. The guidance expects identity to be verified, so that the individual on site is the one who was cleared, and substitutes have to be checked before they start work, not afterwards.
What main contractors need in place
Extended liability means a main contractor can be treated as the employer of people working through its contracting chain. The Home Office’s own example is a construction company working through a chain of subcontracts. That does not move the duty to check onto the main contractor automatically. Liability passes up the chain mainly where the Home Office cannot identify the business that engaged the worker directly, and the main contractor has not met the prescribed requirements.
Those requirements are your protection, and they apply to contracts entered into on or after 1 October 2026. Before work starts, there should be written contract terms requiring the subcontractor to:
- carry out the prescribed right to work checks
- not subcontract further without your prior written consent, and pass the same obligations down to anyone it is permitted to subcontract to
- allow you to audit its compliance
- accept enforcement if it does not comply, such as suspension or termination of the contract
- co-operate with any Home Office investigation, including providing details of the contracting chain
The guidance is clear that terms on paper are not enough on their own. You need to be able to show that you follow them up: that you audit, that you act on what an audit finds, and that people arriving on site are checked against the people who were cleared.
What it costs to get wrong
The penalties are not new. They have applied to employees since February 2024, and what changed on 1 October is how many people they now reach. The civil penalty is up to £45,000 per worker for a first breach and up to £60,000 per worker for a repeat breach within three years.
In serious cases, where a business knows or has reasonable cause to believe that someone is working illegally, the offence carries up to five years in prison and an unlimited fine. The guidance also points to business closure, compliance orders and disqualification as a director.
What to do this month
- Map who is on your sites and how each person is engaged. Employee, worker, individual subcontractor, or someone supplied by another business. That map tells you whose check it is.
- Update your subcontract templates with the terms above before you sign the next one, because the protection only applies to contracts entered into from 1 October.
- Tie site access to the check. Sign-in records, site passes and attendance systems should let you show that the person on site is the person who was cleared.
- Decide how you handle substitutes, so the cover who arrives at short notice is checked before they start, not at the end of the week.
- Audit and keep the evidence. Ask your subcontractors to show you their checks on a sample of their people, and record that you did.
The safety connection
None of this is far from what a well-run site already does. Under CDM 2015 the principal contractor must ensure a suitable site induction is provided and take steps to keep unauthorised people off site, and both depend on knowing who is there. A person nobody can name has not been inducted, has not been briefed on the day’s hazards, and cannot be accounted for at the assembly point. The discipline the new rules demand is the same one a construction phase plan relies on.
How MAST Safety can help
Our HR team carries out right to work checks and keeps the records the way the Home Office expects to see them. On the Health & Safety side, our CDM consultants can review your site access and induction arrangements so the two work together.
Tell us how you engage your labour, and we will tell you where the gaps are.
