Right to work changes: what businesses need to know

Changes to the UK’s right to work regime came into force on 1 October 2026, widening the scope of checks beyond traditional employees and introducing extended liability across certain contractual arrangements.

For businesses engaging contractors, subcontractors or individuals through online matching platforms, the changes raise important questions about who is responsible for carrying out checks and how compliance is managed. With civil penalties of up to £60,000 per illegal worker, understanding these responsibilities matters.

In this Q&A, Alex Christen, Partner and Head of Business Immigration at Capital Law, explores what the changes mean for businesses and the practical steps they can take to protect their organisations.

About Alex Christen

Alex Christen is a Partner at Capital Law where she leads the Business Immigration team. She helps employers across the UK to ensure compliance with current immigration law and build more robust and efficient HR policies and processes.

Ensuring compliance with new laws on illegal working – a Q&A for fintech companies

On the 1st of October 2026 the Home Office radically changed its approach to tackling illegal working, placing a much bigger onus on businesses to prevent illegal working in both their own businesses and throughout their supply chain.

This Q&A tackles the main questions we have discussed with stakeholders across several industry sectors, and which are particularly applicable to fintech businesses:

What are the main changes to the right to work regime from the 1st of October 2026, and how do they differ from the previous requirements?

There are two main changes under the new regime:

First, the regime expands the categories of people whose right to work must be checked before they start work. Under the old regime, employers were required to carry out right to work checks on employees or anyone they sponsor before employment or work began. Now, businesses must carry out right to work checks on a much wider range of individuals including workers and individual subcontractors. This is known as direct engagement’.

Second, the new regime introduces a brand new concept of extended liability, where a business can be liable for illegal working even where it is not directly engaging or employing the illegal worker. This can happen in three ways:

• Where a business (Company A) has a contract for work or services with a third party (Company B) but it enters into a contract with another business (Company C) to help it fulfil its contract with Company B. This could happen when a company wins a contract to provide IT services to a client and then outsources some of the work or services to a subcontractor.
• Where an online matching service (Company A) matches a corporate service provider (Company C) with a client or customer to provide work or services, and Company C enters into a contract with the client or customer.
• Where a business (Company A) contracts with an individual, and the contract allows the individual to send a substitute to carry out the work or services in their place.

In these scenarios, if the individuals engaged by Company C or the substitute are illegal workers, liability for that illegal working can sit with Company A. Company A can protect itself against liability by complying with the ‘prescribed requirements’ (see question 8).

Some business arrangements are not in scope for extended liability, including simple business-to-business arrangements and contracts for the supply of goods.

These changes apply to arrangements that began on or after the 1st of October 2026. However, be aware that existing arrangements could still come within scope depending on the circumstances.

Why should businesses pay attention to these changes, even if they don’t sponsor overseas workers or believe their current recruitment processes are compliant?

The consequences of being held liable for illegal working are severe (see question 10 for more). However, there are ways to protect your business from liability. Even if your current recruitment processes were compliant under the old regime, they must be reviewed and updated to capture these new requirements and ensure you have the correct processes in place to avoid liability under the new regime.

Which businesses are affected, and do the same requirements apply to small organisations and larger employers?

All businesses are potentially affected depending on who they engage and how they do business. The same requirements apply no matter the size of the organisation, its turnover or number of employees, or the extent of its resources.

Beyond employees, which freelancers, consultants, contractors and other workers now require right to work checks?

The new regime requires businesses to carry out checks on these individuals:

• Employees (as per the old regime)
• Anyone they sponsor (as per the old regime)
• Workers (ie individuals who are contracted to provide work or services personally)
• Individual subcontractors (ie individuals who contract with a business to help them provide work or services to a third party, where the individual does not have a direct contractual relationship with the third party)
• Individuals being matched by an online matching service to provide services to customers or clients

The guidance states that the new regime does not apply to “individuals who are operating an independent business either in their own name or through their own company and who contract directly with clients or customers to provide goods or services.” This includes genuinely self-employed individuals.

However, the guidance also states “There is no blanket exclusion simply because a worker is described as a contractor, freelancer or consultant, or provides services through a PSC”. The Home Office can look beyond the label, and the contracts, and assess how the working relationship operates in practice. Businesses should do the same to see if any of their freelancers, consultants, contractors, or other workers could come within the above definitions.

How could a fintech business become liable for someone engaged through an outsourced IT provider, recruitment agency, or subcontractor?

The fintech business must assess if the direct engagement or new indirect engagement provisions apply.

For example, they should check that the individual does not come within the definition of an individual subcontractor, as per the guidance. If so, and the engagement began on or after the 1st of October 2026, they should conduct a right to work check on that individual before work begins.

They should also check if this arrangement is captured by the new indirect engagement provisions. For example, if the outsourced IT provider is helping them deliver work or services to one of their clients (and the contractual arrangements began on or after the 1st of October 2026), then the arrangement could be in scope and they should ensure they put in place all the prescribed requirements.

With recruitment agencies, if the agency is providing workers to help the fintech business with its own internal operations then the agency will be seen as the direct engager of the workers and is responsible for ensuring a compliant right to work check is done before work begins. However, if the agency is providing workers to the fintech business to help them deliver a contract for work or services to one of the fintech businesses clients, then the arrangement could be caught by the new indirect liability provisions. In that case if the contractual arrangement began on or after the 1st of October 2026, the fintech business must put in place the prescribed requirements and set up processes to ensure those requirements are being met, before the workers begin work.

How do the new rules affect online platforms that connect clients with service providers, and who is responsible for checking someone’s right to work?

The new rules can affect businesses in two ways:

• If the business operates as an online matching service and it is matching individual service providers to clients or customers, the business must carry out a right to work check on the individual.
• If the business operates as an online matching service and it is matching corporate service providers to clients or customers, they will be in scope under the new indirect engagement provisions. This means they should make sure the prescribed requirements (including contractual and ID verification controls) are in place and can be evidenced.

What does a compliant right to work check involve, including record keeping, repeat checks and ensuring everyone is treated fairly?

This will depend on the type of immigration permission an individual has. There are three ways to conduct a compliant check:

• A manual check, for example checking a British Citizen’s passport.
• An online check – this is used for people with eVisas or status under the EU Settlement Scheme.
• A digital check – this can be used for British or Irish passport or passcard holders.

Full details on how to conduct the check, what to look for, the evidence to retain, and for how long, are in the employer’s guide to right to work checks.

The check will tell you if the person has a limit on their immigration permission, ie an expiry date on a visa. That date should be diarised and carefully managed to ensure that a repeat check is done before the visa expires and that you are satisfied that the person has a continued right to work in the UK.

The Home Office has also released a code of practice that explains how to ensure everyone is treated fairly in this process – Avoiding discrimination while preventing illegal working: code of practice.

What contractual wording, substitution controls and identity verification processes should businesses put in place to protect themselves from liability?

If the indirect engagement provisions apply, and the contractual arrangement began on or after the 1st of October 2026, the business can protect itself by putting these requirements in place before the work or services begin:

• Contractual controls. As a minimum, the business must include written statements in the contract that:
  • requires the other party to carry out right to work checks on its staff
  • not to subcontract without written consent and to replicate right to work check requirements for the subcontractor
  • permit the business to conduct audits to ensure compliance
  • enable enforcement action (including suspension and termination of the contract) if illegal working is identified
  • require co-operation with any Home Office investigation

Having a written statement is not enough – the business must actively ensure the requirements are met and be able to evidence that they are met.

• Substitution controls. As a minimum, the business must include the following terms in its contract with the individual that:
  • require a right to work check to be done on the substitute before work starts
  • state responsibility for the check cannot be delegated to the individuals carrying out the work or services
  • confirm no work can start until the check is done and right to work has been verified
  • enable enforcement action (including suspension and termination of the contract) if illegal working is identified
  • enable checks to take place on the substitute to ensure they are the same person whose right to work was checked.

Again, the written terms are a minimum but the business must ensure the requirements are met and can be evidenced.

• ID verification controls. This includes putting in place measures to ensure the person carrying out the work is the same person whose right to work was checked. It could include use of ID cards through to facial recognition technology.

How should businesses review their existing workers, supplier contracts and subcontracting arrangements to meet the new requirements?

Businesses need to look at this in two parts.

Part One – direct engagement:

• Who does the business typically engage with on an individual basis?
• Do any of these individuals fall under the new categories where a right to work check is required?
• Who deals with their onboarding? Are they aware that a right to work check will need to be carried out going forward before work begins? Do they know how to do compliant checks?
• For existing individuals, when did their engagement start? If it was on or after the 1st of October 2026, was a right to work check done?
• What are your current policies and processes, and do they need updating to take these new rules into account?
• Are the right people in the business aware of these new requirements and who shares accountability and responsibility?

Part Two – indirect engagement:

• Assess all your contractual arrangements for the provision of work or services – are they in scope of the new regime?
• Do you have contracts with individuals that allow a right of substitution?
• If so, have you put in place the prescribed requirements? Specifically, have you put in place contractual controls, substitution controls and ID verification controls?
• Are you checking that these requirements are being met in practice? For example, are you auditing your supply chain?
• Who has ownership and responsibility for ensuring these requirements are met? Do they understand when arrangements will be in scope or out of scope?
• Do you need to update existing policies and procedures? Do staff need training?

What are the consequences of getting it wrong, and when could a breach lead to a civil penalty, criminal prosecution or the loss of a sponsor licence?

If the Home Office thinks your business should held be liable for illegal working, it will issue you with a civil penalty of up to £60,000 per illegal worker.

If your business holds a sponsor licence, being issued with a civil penalty could affect your licence and lead to compliance action by the Home Office, up to and including revocation of your sponsor licence, which would mean you would have to dismiss all your sponsored employees (and face a ‘cooling off’ period before you could reapply for your licence).

In extreme situations, where the Home Office considers that you have deliberately engaged illegal workers, or you should really have known that workers were illegal, there can be criminal sanctions including up to 5 years in prison and an unlimited fine.

In all cases there are a range of other sanctions that can be imposed including loss of directorships, removal of certain licences, seizure of earnings, and closure of a business.

What three actions should businesses prioritise now, and what should they do if they discover a missing check or a potential right to work issue?

Businesses should:

• Audit their existing arrangements – which arrangements are in scope, which are out of scope
• Ensure they are carrying out a right to work checks for the right people, and that they are meeting the prescribed requirements
• Train all applicable staff within the business who need to be aware of these changes. Right to work checks are no longer the domain of HR and have become a much wider responsibility incorporating your commercial, procurement, and contract teams.

If a right to work check is missing, a check should be done as soon as possible and the records retained. The check should not be backdated to before employment or work began. If illegal working is identified it should be reported to the Home Office in the correct way as soon as possible.

If the business self-reports the issue, the civil penalty can be discounted and if other criteria are met, the business may just receive a warning rather than a civil penalty. Sponsor licence holders must also report the illegal working as part of their sponsor compliance duties. It is always better to be proactive – if the Home Office raises the illegal working with you first, you will be in a much worse position.

Summary

The new rules are complicated, but it is important that businesses understand the new regime and take the correct protective and preventative measures to avoid liability for illegal working. At Capital Law we advise businesses across all sectors on how to properly prepare themselves for the new regime and avoid penalties for illegal working – if you need any support, please let us know.