UK Right to Work Checks
Every UK employer has to check that a new hire is legally allowed to work in the UK, before that person starts, not after. It’s a genuine legal requirement with real financial consequences for getting it wrong, and it applies regardless of whether the employer itself is UK-based or based overseas.
What’s changing matters even more than the existing rule. From 1 October 2026, the right to work checking duty stops being limited to direct employees. Under Section 48 of the Border Security, Asylum and Immigration Act 2025, it extends to agency workers, subcontractors, casual and zero-hours workers, and gig or platform workers, meaning businesses that have only ever checked their direct payroll staff now need to think about everyone they engage, however that engagement is structured.
This matters more for overseas companies than it might for an established UK employer, since overseas businesses entering the UK market are often the ones relying most heavily on contractors, agency staff, or an Employer of Record arrangement while they get established, exactly the kind of engagement this change brings into scope.
What a Right to Work Check Actually Is
A right to work check is the prescribed process an employer uses to confirm that someone is legally permitted to do the work in question in the UK. Done correctly, before the person starts, it gives the employer a statutory excuse against a civil penalty if that person later turns out not to have had the right to work, provided the check was genuinely carried out using an approved method.
The check itself typically involves either an online check using a share code the individual generates through the Home Office system, or, for British and Irish citizens, checking a passport or other accepted document. Since Brexit, EU, EEA, and Swiss passports or ID cards can no longer be used on their own to confirm right to work, EU nationals now go through the same online checking process as anyone else with immigration status to demonstrate.
What’s Changing from 1 October 2026
This is the part that catches most businesses out, because the change is genuinely structural, not a minor update to existing rules. Currently, the civil penalty regime attaches to employment under a contract of service, meaning direct employees. Section 48 of the Border Security, Asylum and Immigration Act 2025 extends that regime to a much wider set of working arrangements: agency workers, individual subcontractors, casual and zero-hours workers, and gig or platform-based workers, including people matched to work through online platforms or introducers.
The government’s stated aim is to close a gap that’s opened up as flexible and platform-based work has grown, since businesses using agency staff, contractors, or gig workers have historically sat outside the traditional employee-focused checking regime entirely. From 1 October 2026, that gap closes, and responsibility for the check generally sits with whichever party is directly engaging the worker.
A second, separate change matters just as much. A new extended liability regime means a business can face a civil penalty even where it doesn’t directly engage the worker at all, for example, where illegal working occurs further down a subcontracting chain the business itself commissioned. This is a genuine expansion of exposure, not just a wider definition of who needs checking.
Why It Matters for Overseas Companies
This change lands differently for an overseas company than it does for an established UK employer, and it’s worth being direct about why. Businesses expanding into the UK often rely more heavily on flexible arrangements in their early stages, using contractors before committing to a full UK entity, engaging agency staff to move quickly, or using an Employer of Record https://www.paulbeare.com/blog/how-can-my-overseas-company-employ-people-in-the-uk/Â precisely to avoid setting up formal UK employment infrastructure before they’re ready.
Every one of those arrangements is now squarely inside the expanded scope. A business that assumed contractors or agency workers sat outside its compliance obligations, because they weren’t direct employees, needs to revisit that assumption before 1 October 2026, not after. If you’re using an EOR, it’s worth confirming directly with that provider how they’re handling the expanded regime, since the responsibility for the check generally follows whoever is engaging the worker, and the details of who that is can get genuinely complicated in a multi-party arrangement.
How It Works in the UK
In practice, preparing for this change starts with mapping who actually does work for your business, not just who’s on payroll. That means listing employees, agency workers, individual subcontractors, casual or zero-hours staff, and anyone engaged through a platform or introducer, then working out which of those engagements now fall within the expanded scope.
From there, the check itself follows the same prescribed methods as for direct employees: an online check using a Home Office share code, or an accepted document check where applicable. What changes isn’t the mechanics of the check, it’s who you now need to be running it on, and, in some cases, confirming that a third party in your supply chain, such as an agency or platform, is running it correctly on your behalf.
Evidence of every check needs to be retained securely throughout the engagement and for two years afterward, the same retention standard that’s applied to direct employees for years, now extended to this wider group.
Common Mistakes International Businesses Make
The most likely mistake, given how recent this change is, is simply not knowing about it yet. Because the expansion applies from October 2026 and reframes engagements many businesses never thought of as falling under right to work rules at all, contractors and platform workers being the clearest example, it’s easy for a business focused on its UK entity’s direct employees to miss that its contractor and agency relationships now carry the same compliance duty.
A second mistake is assuming an EOR or staffing agency automatically handles this without confirming it directly. Responsibility under the new regime generally follows whoever is engaging the worker, which in a multi-party arrangement isn’t always obvious, and assuming it’s someone else’s job is exactly the kind of gap the extended liability regime is designed to close.
A third mistake is treating this as a UK-domestic HR issue rather than something that needs input from whoever manages contractor and supply chain relationships too. Because the expanded scope reaches subcontracting chains, this is genuinely a cross-functional compliance issue, not one HR can handle in isolation.
How Paul Beare Helps With This
Through our HR and employment services https://www.paulbeare.com/hr-employment-services/, we build compliant right to work checking into UK hiring and onboarding from the outset, for direct employees and for the wider range of engagements now coming into scope under the October 2026 changes.
If you’re still deciding between forming a UK entity, using an Employer of Record, or engaging UK contractors, our guide on how overseas companies can employ staff in the UK https://www.paulbeare.com/blog/how-can-my-overseas-company-employ-people-in-the-uk/Â covers that decision, and it’s worth revisiting that choice now with this expanded compliance duty specifically in mind.
Questions & Answers
What's changing with UK right to work checks in October 2026?
From 1 October 2026, the checking duty extends beyond direct employees to agency workers, individual subcontractors, casual and zero-hours workers, and gig or platform-based workers, under Section 48 of the Border Security, Asylum and Immigration Act 2025.
What are the penalties for not carrying out a right to work check?
Civil penalties can reach £45,000 per worker for a first breach and £60,000 for a repeat breach. A new extended liability regime also allows penalties even where a business doesn’t directly engage the worker, including further down a subcontracting chain.
Do I need to check contractors and agency workers, not just employees?
From 1 October 2026, yes, in most cases. This is the core of the change: engagements that previously sat outside the checking regime, contractors, agency staff, and gig or platform workers, are now generally in scope.
If I use an Employer of Record, do I still need to worry about this?
It depends on the arrangement, and it’s worth confirming directly with your EOR provider. Responsibility generally follows whoever is engaging the worker, which can be genuinely unclear in a multi-party setup, so don’t assume it’s automatically covered.
The right to work compliance landscape is changing more than it has in years, and overseas companies using flexible UK engagement models are squarely in scope. If you’d like your UK hiring and onboarding reviewed against the new requirements, speak to our HR and employment services team.
