The Right to Work changes introduced on 1 October 2026 have changed the scope of the UK’s illegal working regime.
Right to Work responsibilities now extend beyond traditional contracts of employment to specified wider working arrangements. New extended liability provisions also mean that, in certain contractual arrangements, civil penalty liability can extend beyond the organisation with the direct contractual relationship with the worker.
Alongside this, the Home Office has updated requirements around digital verification, identity assurance and acceptable evidence.
For HR, recruitment and compliance teams, this makes October’s changes a useful point to ask a practical question:
Does your current recruitment and workforce process reflect the latest Right to Work guidance?
What changed to Right to Work checks on 1 October 2026?
The most significant change is the expansion of the Right to Work Scheme to a wider range of working arrangements.
Previously, the employer guidance principally applied where an organisation employed staff under a contract of employment, service or apprenticeship.
From 1 October 2026, the definition used within the Right to Work Scheme is broader. The Home Office guidance covers individuals engaged:
- under a contract of employment;
- under a worker’s contract;
- as an individual subcontractor; and
- through an online matching service where the service provides details of an individual service provider to potential clients or customers.
For employment under a worker’s contract, as an individual subcontractor or through the relevant online matching service arrangements, civil penalty liability applies where the employment began on or after 1 October 2026.
This is particularly important for organisations whose workforce models extend beyond conventional permanent and temporary employees.
Extended liability has also been introduced
Another major development is the introduction of extended liability.
The Home Office will first seek to identify the employer that has the direct contractual relationship with a worker. That employer remains responsible for conducting the prescribed Right to Work check.
However, under the new extended liability provisions, liability for a civil penalty can extend beyond that direct employer in certain contractual arrangements.
The Home Office identifies three broad circumstances in which this may apply:
- A person is contracted to provide work or services to a third party and enters into a contract with another employer whose workers carry out some or all of that work or those services.
- An online matching service matches a service provider with a client or customer and the service provider enters into a contract with that client or customer.
- An employer engages an individual to provide work or services and the contract permits that individual to substitute another person to carry out the work or services in their place.
This distinction matters.
Extended liability does not mean every customer or organisation purchasing services automatically becomes responsible for Right to Work checks throughout another company’s workforce.
Home Office guidance specifically states that extended liability does not apply to every business purchasing work or services from another business. Nor does it apply simply because a client, customer or end-user purchases work or services for its own internal operations.
Whether an arrangement is in scope depends on the specific contractual arrangements and how they operate in practice.
New requirements apply where digital verification services are used
Digital Right to Work checks remain optional where an appropriate alternative checking route is available.
However, where an employer chooses to use a digital verification service to conduct the digital identity verification element of a Right to Work check, the provider must now be a Right to Work Digital Verification Service Provider (RtW DVSP) registered on the Office for Digital Identities and Attributes register and permitted to provide Right to Work services.
This replaces the previous terminology around Identity Service Providers and IDVT within the Right to Work guidance.
The employer still retains responsibilities within the prescribed process. Using technology or a third-party provider does not transfer the employer’s responsibility for establishing a statutory excuse.
Greater emphasis on confirming who is actually doing the work
Identity is another prominent theme in the updated guidance.
For all Right to Work checks, employers must be satisfied that the person whose Right to Work has been checked is the same individual who will carry out the work.
The guidance requires reasonable and proportionate steps to verify this at the time of the check.
Where facial recognition technology is used to complete this part of a check digitally, it must be provided through a registered RtW DVSP. Facial recognition is not mandatory. Employers can, where appropriate, verify identity in person instead.
For extended liability arrangements, identity controls become particularly relevant because organisations may need systems that provide ongoing assurance that the individual actually carrying out work is the person whose Right to Work was checked.
Digital National Insurance evidence
The acceptable document lists have also been updated.
Where an acceptable combination requires an official document showing a person’s name and permanent National Insurance number, the evidence may now include a digital version issued by or on behalf of a government agency.
This is an update to the form in which qualifying evidence may be provided. A National Insurance number alone is not evidence of a Right to Work.
What has not changed?
The October update is substantial, but many core principles of Right to Work checking remain familiar.
Employers still need to use a prescribed checking route and complete the required steps correctly if they want to establish a statutory excuse.
Depending on the individual’s circumstances, the prescribed routes include:
- a manual document-based Right to Work check;
- a Home Office online Right to Work check; or
- a check using a registered RtW DVSP where that route is available.
For individuals with an eVisa, employers use the Home Office online Right to Work checking service and the individual’s share code.
Employers must also continue to carry out required follow-up checks where an individual’s permission to work is time-limited.
The underlying principle therefore remains the same: the correct check needs to be completed, using the appropriate route, at the correct point in the employment or engagement process.
Who is affected by the October Right to Work changes?
The expanded scope means organisations should consider more than the people they describe internally as “employees”.
Potentially affected arrangements include:
- workers engaged under worker’s contracts;
- employment businesses supplying temporary workers;
- certain individual subcontractor arrangements;
- online platforms through which individuals obtain work;
- organisations operating within chains of contracts for the delivery of work or services;
- online matching services; and
- arrangements allowing a worker to provide a substitute.
The contractual label alone is not decisive.
The Home Office guidance specifically warns that describing somebody as “self-employed” does not determine whether they fall outside the scheme. Organisations need to consider the nature of the arrangement and how the work is arranged, supplied and performed in practice.
At the same time, genuinely independent businesses remain an important exception.
For example, the Home Office gives the example of a self-employed plumber who advertises directly to the public, works for multiple customers and is hired by a homeowner to repair a leaking tap. The guidance states that the homeowner is not required to conduct a Right to Work check because the plumber is operating an independent business.
Similarly, the guidance gives an example of a graphic designer engaged through their own personal service company for a project. Where the client contracts with that company in a genuine business-to-business services arrangement, the guidance states that the client company is not required to conduct the individual’s Right to Work check.
These distinctions are why organisations should review their actual workforce and contractual models rather than adopting a blanket approach to every contractor, supplier or service provider.
What does this look like in practice?
The Home Office guidance contains a number of examples showing how the expanded scheme can operate.
The following scenarios are closely based on those official examples.
Scenario 1: Temporary hospitality workers
An individual registers with an employment business that supplies temporary workers to hospitality businesses. They are engaged by the employment business under a contract for services and accept short-term assignments.
Under the updated guidance, the employment business is treated as the employer for the purposes of the Right to Work Scheme and is responsible for the prescribed Right to Work check.
Practical point: organisations should not assume that a worker falls outside Right to Work requirements simply because they are not engaged under a conventional permanent employment contract.
Scenario 2: A construction supply chain
The Home Office gives the example of a property developer that wins a contract to build new homes and uses other businesses through a chain of contracts to provide workers for elements of the project.
Because the developer is contractually responsible for delivering work to a third party and relies on a contractual chain to provide the workers and services needed to fulfil that contract, the arrangement falls within the extended liability provisions in the Home Office example.
The developer may therefore be treated as an employer for Right to Work Scheme purposes and needs to meet the prescribed requirements relating to those contractual arrangements if it is to establish a statutory excuse against extended liability.
Practical point: organisations delivering contracted services through other employers should understand the contractual chain rather than relying only on the direct employer’s position.
Scenario 3: An online matching service
The Home Office gives another example in which a homeowner uses an online matching service to find an electrical services business. The homeowner contracts directly with the electrical business, which sends one of its workers to complete the job.
The guidance explains that the online matching service may be treated as the employer of the individual carrying out the work for the service provider for the purposes of extended liability.
Practical point: online platforms and matching services need to understand whether their operating model brings them within the extended liability provisions.
Scenario 4: A genuinely independent contractor
A self-employed plumber advertises services to the public, works for multiple customers and is engaged directly by a homeowner.
In the Home Office example, the plumber is operating an independent business and is outside the scope of the Right to Work Scheme for that engagement.
Practical point: the October changes expanded the scheme, but they did not create a universal requirement to Right to Work check every self-employed person or every supplier.
Taken together, these examples show why contractual structure matters. Two arrangements may both be described internally as “contracting”, while producing different Right to Work responsibilities.
Three questions every employer should ask following the October changes
1. Do we know which parts of our workforce and contractual arrangements are now in scope?
Review more than your employee list.
Consider worker contracts, individual subcontractors, online platforms, substitution arrangements and any chains of contracts through which your organisation delivers work or services to another party.
Where the position is unclear, review the specific contractual arrangements and seek appropriate legal or HR advice.
2. Are we using the correct checking and identity verification process?
Different individuals can require different checking routes.
Check that recruiters and hiring managers understand when to use:
- a manual document-based check;
- the Home Office online service and a Right to Work share code;
- a registered RtW DVSP;
- the Employer Checking Service where applicable.
Where digital verification is used, confirm that the provider meets the current Right to Work registration requirements.
3. Could we demonstrate how our process works?
A compliant process needs evidence.
That may include records of prescribed checks, dates, Home Office online profiles, RtW DVSP outputs, follow-up checks and, for relevant extended liability arrangements, contractual provisions, assurance information, audit records and identity controls.
If different locations or recruitment teams follow different processes, this is also a useful point to test whether those processes remain consistent with current guidance.
Download our Right to Work Changes Checklist
The October changes are a useful point to review not only individual checks, but the wider process around them.
EBC Global’s Right to Work Changes Checklist is designed to help HR, recruitment and compliance teams benchmark their current approach following the October 2026 changes.
It can help structure a review of areas including checking routes, responsibilities, evidence, digital verification, follow-up activity and the wider controls around your Right to Work process.
Download our Right to Work Changes Checklist
The checklist is a practical review resource. It does not replace current Home Office guidance or constitute legal advice. Organisations should refer to the latest GOV.UK guidance and obtain professional advice where required.
Why reviewing your Right to Work process matters
Right to Work compliance is not simply a question of whether somebody was checked.
The Home Office statutory excuse depends on prescribed steps being followed correctly.
For employers managing hundreds or thousands of hires, that creates an operational challenge: the process needs to work consistently across recruiters, locations, hiring managers and worker types.
Several areas deserve particular attention.
Checking routes
Recruiters need to recognise which checking route applies to an individual.
For example, where somebody has an eVisa, the Home Office online Right to Work service is used to establish the statutory excuse. Digital verification through a RtW DVSP operates differently and is available in prescribed circumstances.
A single generic “digital Right to Work” workflow can therefore be misleading if it does not distinguish between the underlying routes.
Identity
The updated guidance reinforces the need to confirm that the person whose eligibility has been checked is the person who will actually carry out the work.
That deserves particular attention in remote onboarding, platform work and arrangements involving substitution.
Evidence and record keeping
For an online check, the employer should retain a secure PDF or HTML copy of the profile page showing the person’s Right to Work, including their photograph and the date of the check.
The Home Office guidance requires this evidence to be retained for the duration of employment and for two years afterwards, after which it should be securely destroyed.
Equivalent record requirements apply to other prescribed checking routes.
Follow-up checks
Where somebody has time-limited permission to work, the employer needs to complete a further check on or before that permission expires if it intends to continue employing them.
A process that completes the initial check correctly but has no reliable method for identifying required follow-up checks can therefore leave a compliance gap later.
Extended workforce assurance
For organisations within the extended liability provisions, the review becomes broader.
The Home Office guidance sets out prescribed requirements covering areas including contractual terms, substitution controls and identity verification.
For relevant contractual chains, the required written statement includes provisions requiring prescribed Right to Work checks, controls over further subcontracting, audit rights, enforcement provisions and co-operation with Home Office investigations.
This makes Right to Work a consideration not only for HR, but potentially for procurement, operations, legal and supplier management teams as well.
Common Right to Work process gaps employers should look for
Following the October changes, practical gaps may include:
- Internal guidance based on the previous scope of the scheme. Policies may still describe Right to Work exclusively in terms of direct employees.
- Worker categories being determined by labels alone. A person being described as a contractor or self-employed does not itself decide whether an arrangement is in scope.
- Incorrect digital checking routes. Home Office online checks and checks using a RtW DVSP are distinct processes.
- Using a digital identity provider without confirming its Right to Work registration. Where an employer chooses the digital verification route, the provider must meet the current RtW DVSP requirements.
- Incomplete identity verification. Obtaining evidence of eligibility is not enough if the employer has not satisfied itself that the evidence relates to the person carrying out the work.
- Missing evidence. Right to Work records need to demonstrate that the prescribed process was followed.
- No reliable follow-up process. Time-limited permission needs to trigger a further check where required.
- Different practices across sites or recruitment teams. Decentralised recruitment can make it harder to demonstrate a consistent checking process.
- Contractual arrangements that have not been reviewed for extended liability. Organisations delivering work through chains of contracts may need controls that previously sat outside the HR onboarding process.
- Substitution processes that do not match reality. Where substitution is permitted, prescribed checks and controls need to operate before a substitute begins work.
The purpose of a review is not to add unnecessary stages to every hire. It is to understand which requirements apply to which arrangements and make those requirements repeatable.
What should employers do now?
A practical review can be approached in seven stages.
- Read the current Home Office guidance
Start with the current Employer’s Guide to Right to Work Checks and the relevant codes of practice.
Internal policies should follow the official position rather than summaries written before the October changes.
- Map how people perform work for your organisation
Look beyond payroll.
Identify employees, worker contracts, individual subcontractors, platform arrangements, permitted substitutes and relevant contractual chains.
- Map your Right to Work checking routes
Document when your organisation uses manual checks, Home Office online checks, RtW DVSP services and the Employer Checking Service.
- Review policies, contracts and internal guidance
Check whether documents still use outdated terminology or assume that Right to Work responsibilities apply only to conventional employees.
Where extended liability may apply, review the relevant contractual requirements carefully.
- Test evidence and audit trails
Select a sample of completed checks.
Could somebody independent of the original recruiter understand:
- which route was used;
- when the check happened;
- what evidence was obtained;
- whether the person’s identity was verified;
- whether restrictions were identified; and
- whether a follow-up check is required?
For extended liability arrangements, consider whether the relevant contractual, assurance and identity evidence could also be produced.
- Brief recruiters, hiring managers and other relevant teams
The people operating the process need enough knowledge to recognise when a different route or escalation is required.
Depending on the organisation, that may now include procurement, supplier management and operational teams as well as HR.
- Establish a process for future guidance changes
Right to Work guidance changes regularly.
Assign ownership for monitoring Home Office updates and translating relevant changes into recruitment workflows, internal guidance and training.
Technology should support Right to Work compliance
For organisations managing large recruitment volumes, the challenge is often consistency.
Employment screening software can help structure that process by:
- creating standardised screening workflows;
- directing candidates and recruiters through appropriate stages;
- maintaining evidence and audit trails;
- supporting follow-up activity;
- providing visibility across recruitment teams and locations;
- integrating Right to Work with other pre-employment screening checks; and
- reducing repetitive administration.
Technology can also help organisations identify where a process has stopped, evidence is outstanding or further human review is needed.
But software does not replace the employer’s responsibilities.
The Home Office makes clear that technology can support online Right to Work checks, but responsibility remains with the employer for conducting the prescribed process and establishing a statutory excuse.
That distinction should guide any automation project.
The objective is not to remove human responsibility. It is to make the correct process easier to follow, evidence and manage consistently.
Related reading: Automating Identity Verification, Right to Work, and DBS submissions for faster hiring.
How EBC Global can help
EBC Global supports employers, recruiters and compliance teams managing Right to Work and wider pre-employment screening.
Through Employment Check Pro and EBC Global’s API solutions, organisations can bring Right to Work, identity verification and wider employment background checks into structured screening workflows, with greater visibility over candidate progress and screening records.
For organisations reviewing their processes following the October changes, EBC Global can also help teams look at how their current recruitment screening workflows operate in practice.
You can explore the platform through EBC Global’s free 12-day trial, or speak to the team about a recruitment screening review.
The practical takeaway
The 1 October 2026 changes widened the scope of the Right to Work Scheme and introduced new considerations for organisations using worker contracts, individual subcontractors, online matching services, substitution arrangements and certain contractual supply chains.
For employers, the sensible next step is to check that current policies, workflows and evidence reflect the latest Home Office guidance and the way people actually perform work for the organisation.
A good Right to Work process should answer three questions clearly:
Who needs to be checked? How should they be checked? Can we demonstrate that it was done correctly?
Start a free 12-day trial
Get started by choosing the level of screening your organisation needs here: EBC Global packages.
Official external sources
Home Office: Right to Work checks, employer’s guide
Draft Employer’s Guide to Right to Work Checks, 16 July 2026
Home Office: Code of Practice on Preventing Illegal Working
Home Office: Avoiding unlawful discrimination while preventing illegal working
FAQs
For Home Office online checks, the updated guidance says employers should securely retain the relevant profile evidence for the duration of employment and for two years afterwards, then securely destroy it.
Yes, where a worker has time-limited permission and the organisation intends to continue employing them after that permission expires. The required follow-up check must be completed on or before the relevant expiry date.
A Right to Work Digital Verification Service Provider is a provider registered under the digital verification framework and noted as providing Right to Work digital verification services. Where an employer chooses the relevant digital verification route, it must use an appropriately registered provider.
Not universally. The correct route depends on the individual’s circumstances. Prescribed routes include manual checks, Home Office online checks and, where available and appropriate, digital verification through a registered RtW DVSP.
No. Home Office guidance expressly says it does not apply to every business purchasing work or services or simply to a client, customer or end-user purchasing services for its own internal operations.
Extended liability allows civil penalty liability to extend beyond the employer with the direct contractual relationship with a worker in specified arrangements, including certain contractual chains, online matching arrangements and permitted substitution arrangements.
They can. The updated scheme includes individual subcontractors and workers under worker’s contracts, but genuinely independent businesses and typical business-to-business service arrangements can fall outside the scheme. The facts and operation of the arrangement matter rather than the label used.
The Right to Work Scheme was expanded to cover specified working arrangements beyond traditional employment, including worker’s contracts, individual subcontractors and certain online matching services. Extended liability provisions were also introduced for specified contractual arrangements. Digital verification and identity requirements were updated too. The full changes can be found in the guide.
