Right to work checks are coming for your commercial contracts: What businesses need to do before 1 October 2026

There are two key changes in respect of the application to employers in direct contractual relationships with workers, and indirect contractual arrangements with workers. To note, ‘workers’ under the new legislation has a different meaning to that as typically understood under employment law. For the purposes of the extended regime, the categories of individuals potentially falling within scope now include employees, individuals engaged under a worker’s contract, individual subcontractors and individuals engaged through online matching services.

With regards to direct contractual relationships, the new legislation extends the scope of liability and responsibility for ‘employers’. No longer does the term ‘employer’ simply mean a person who  employs an individual under a contract of employment. Rather, an ‘employer’ under the new legislation is extended in scope to include a person who also engages an individual: (i) under a worker’s contract; (ii) as an individual sub-contractor; or (iii) when operating as an online matching service, providing the details of an individual who is a service provider to potential customers (i.e., reflecting the amended definition of worker mentioned above).

Section 48 of the Border, Security, Asylum and Immigration Act 2025 inserts a new section 15A into the IANA 2006, under which civil penalty liability may extend beyond the employer who holds the direct contractual relationship with the worker (classified as ‘indirect contractual arrangements’ under the new legislation/Guidance). This is referred to as ‘extended liability’. The extended liability provisions mean that entities participating in a supply chain may be exposed to civil penalty liability, even where they do not have a direct contractual relationship with the individual concerned (i.e. who has been working illegally), unless they are able to establish a statutory excuse.

The extended liability provisions therefore have broad application, and apply where:

• A person is contracted to provide work or services to a third party and enters into a contract with another employer providing the workers who carry out that work via a supply chain. For example, a main contractor engaging specialist subcontractors on an oil field construction project.
• An online matching service matches a service provider with a customer, and the service provider enters into a contract with that customer.
• An individual is employed under a contract which permits substitution and work is carried out by a substitute in their place (such as under a consultancy agreement).

The extended liability provisions are not limited to a single tier of contracting, meaning that where illegal working is identified, it is not only the employer that directly engaged the individual who may face a penalty – liability may extend across multiple levels of a contractual supply chain to reach an employer/business that has no direct relationship with the illegal worker at all.

Not all arrangements are caught by the new legislation. The Guidance confirms that the following arrangements are not in scope:

• Genuinely self-employed individuals. Those individuals who are genuinely self-employed, operating in business on their own account, trading in their own name or as part of their own business, and contracting directly with their customers for work or services.
• End users, clients and customers. The extended liability provisions do not apply to persons who are end-users, clients or customers of a service provider, purchasing work or services for their own internal operations.

If you are uncertain whether your arrangements fall within scope, please reach out to the relevant contact at the end of this blog who can guide you through this process.

The Guidance sets out two contractual mechanisms through which a business/employer/service provider can establish a statutory excuse against extended liability, as set out below.

As a side note, the Guidance also sets out having proper identity verification systems and processes in place to ensure that the individual carrying out services is the same individual on whom the right to work check was carried out, as an additional mechanism to establish a statutory excuse against liability for a civil penalty. However, as contractual arrangements are the focus of this blog, we have not gone into further detail on this mechanism. For more information, please check out another of our blogs here.

1. Contractual terms and conditions (i.e., a written statement)

To establish a statutory excuse through contractual provisions, the Guidance makes clear that contracts in the relevant chain must include terms with the employer or service provider that:

• Require right to work checks to be carried out. The contract must require the employer or service provider to carry out prescribed right to work checks on any individual employed to perform the relevant work or services.
• Restrict further subcontracting. The contract must prohibit the employer or service provider from further subcontracting the work or services without the prior written consent of the person or online matching service at the top of the chain. Critically, any permitted subcontracting arrangements must replicate equivalent right to work obligations, which means the compliance obligations must flow down through every tier of the chain.
• Permit audits. The contract must permit the person or online matching service to conduct audits of the employer or service provider’s compliance with the newly (as well as existing) prescribed right to work checks.
• Enable enforcement action. This is an unusual and potentially onerous requirement. The contract must enable the person or online matching service to take enforcement action against the employer or service provider where illegal working is identified and a statutory excuse has not been established. This must include equivalent provisions in the direct contractual relationship between the employer or service provider and the individual carrying out the work (including contractual rights of suspension or termination of the contract).
• Require co-operation with Home Office investigations. Again, this provision is unusual and potentially onerous. The contract must require the employer or service provider to co-operate with any Home Office investigation relating to illegal working by providing relevant information in respect of the chain, details of each employer or service provider involved in the chain, and any other information which the Home Office may consider relevant to the investigation.

Importantly, a person or online matching service may, as part of meeting the above mentioned requirements, rely on assurances from an employer or service provider in the contractual chain that prescribed right to work checks have been carried out. However, this is only permissible and can only be relied on if reasonable steps have been taken to satisfy themselves that those assurances are reliable and that the prescribed requirements are crucially being met in practice. The Guidance makes clear that contracts cannot be simply updated in isolation. To effectively be in a position to rely on employer or service provider assurances, businesses must also have processes in place to actively monitor and verify compliance against these new contractual and legislative requirements.

2. Substitution controls

Where a contractual arrangement permits substitution (i.e., allows an individual to send someone else to carry out the work in their place), additional requirements apply. Substitution is commonplace in consulting and contractor arrangements, and under employment and tax law is often one of the key indicators of genuine worker or contractor arrangements. This change therefore has significant implications for contracts with self-employed individuals and personal service companies that contain substitution clauses.

Where a contractual arrangement between an employer and a worker permits substitution, for the employer to establish a statutory excuse, the Guidance sets out that the business must implement processes before the work or service commences ensuring that:

• a prescribed right to work check is carried out on any substitute;
• responsibility for the check is not delegated to the individuals carrying out the work or services, even where the contract describes that individual as operating in business on their own account;
• no individual may carry out work or services as a substitute before their right to work has been verified;
• contractual rights for the employer to suspend the provision of the substitute’s services and/or terminate the contract, where the employer or worker knows, or has reasonable cause to believe, that a substitute is working illegally; and
• for the duration of the engagement, that the worker and their registered substitute are the same individuals whose right to work has been checked (which must include verification by way of identity verification systems).

The contractual requirements are likely to give rise to significant negotiation points in commercial agreements. Audit rights, Home Office investigation co-operation obligations, restrictions on subcontracting and mandatory termination rights may conflict with existing procurement models and outsourcing arrangements. Businesses should therefore allow sufficient time to renegotiate existing contractual frameworks before 1 October 2026.

The first step is to identify which of your commercial arrangements fall within the scope of the extended liability provisions. If any do fall within scope, the next step would be to review your existing contracts against the five requirements set out above. And thirdly, if any contracts that fall within scope do not contain the relevant provisions, these contracts will need to be updated accordingly.

Many existing commercial contracts, even well-drafted ones, are unlikely to contain all of the above mentioned provisions, as provisions relating to Home Office co-operation and engagement with enforcement action are highly unusual.

In addition to updating your contracts, businesses must also put in place operational processes to ensure continued compliance with the new rules. For example, processes such as conducting audits where appropriate and processes to receive and verify assurances from employers and service providers in the chain (as well as maintaining records of compliance reviews and any concerns identified).

Businesses will also need to carry out such compliance checks in line with data protection laws.

Businesses implementing audit, verification and monitoring processes should also ensure they have an appropriate UK GDPR lawful basis for processing personal data, provide suitable privacy information to affected individuals, maintain appropriate retention periods for right to work documentation and carry out any necessary data protection impact assessments where monitoring activities are expanded.

If your business is not at the top of a contractual chain but somewhere in the middle, you will not only need to ensure that you comply with any contractual amendments imposed on the business, but also that all contracts with those ‘below’ the business in the chain replicate the equivalent obligations. The requirement to flow down right to work obligations through every tier of the chain is one of the most commercially significant aspects of the new regime.

Caroline Sheldon joined the Corporate, Commercial & Finance team in August 2022 as an associate and specialises in advising on commercial matters. She advises entrepreneurs, start-ups and established businesses across a variety of sectors, with a focus on those in the technology sector.

Ilda de Sousa is a partner in the immigration team at Kingsley Napley. Ilda has more than ten years of UK corporate immigration law experience, managing large company clients as well as handling complex matters for individuals, British nationality applications, appeals, judicial reviews and applications under European Law including Brexit related advice.