UK Right to Work: Which Supply-Chain Arrangements Are in Scope from October 1?

From 1 October 2026, UK businesses engaging people through some worker contracts, individual subcontracting and online matching arrangements face an expanded right-to-work regime. The change also creates extended liability for certain parties in contractual chains and substitution arrangements. It does not make every buyer of outsourced services responsible for checking every worker employed by a supplier. The difference turns on who engages the individual, who undertakes to deliver work or…

From 1 October 2026, UK businesses engaging people through some worker contracts, individual subcontracting and online matching arrangements face an expanded right-to-work regime. The change also creates extended liability for certain parties in contractual chains and substitution arrangements. It does not make every buyer of outsourced services responsible for checking every worker employed by a supplier. The difference turns on who engages the individual, who undertakes to deliver work or services to a third party, and how the arrangement operates in practice. Section 48 of the Border Security, Asylum and Immigration Act 2025 establishes the statutory categories; the Home Office’s final 1 October employer guide explains their application.

That distinction changes the procurement question. A business first needs to identify the party with the direct checking duty and any separate upstream exposure. If a prescribed digital check is appropriate, it then needs to identify the registered service actually performing that check. A general identity certificate, a vendor’s marketing claim or a component inside someone else’s workflow does not answer that question. Sources: Home Office final employer guide, 1 October 2026; [OfDIA’s 3 September explanation.]

The contract determines the liability boundary

The expanded definition of employer covers an individual engaged under a worker’s contract, an individual subcontractor in the circumstances specified by the Act, and specified online matching services. A separate provision addresses extended liability when a party contracted to provide work or services to a third party uses another employer to fulfil that obligation, when an online matching service meets the statutory conditions, or when permitted substitution means someone else carries out the work. Those routes should not be collapsed into a single claim that all contractors or agency users are newly liable. Sources: section 48 of the 2025 Act; [Home Office final employer guide, pp. 6, 42–49.]

The employer with the direct contractual relationship to the worker retains responsibility for the prescribed right-to-work check. Extended liability can create separate responsibilities for an upstream party in a qualifying arrangement; it does not automatically transfer the direct employer’s checking duty. The final guide is explicit that a client buying services for its own internal operations is outside the extended provisions in its examples. A retailer buying cleaning for its own shops, or warehousing for its own operations, is not treated like the company contracted to deliver those services that then subcontracts performance. The guide’s standard agency-worker example likewise leaves the check with the employment business. These examples are a way to test real arrangements, not blanket exemptions based on labels such as “service contract” or “self-employed”. Source: [Home Office final employer guide, pp. 42–49.]

The timing matters. The final guide says the new provisions are not retrospective simply because work continues after 1 October. For extended liability, the relevant date is when the contractual arrangement was entered into. Whether a renewal, extension or variation creates a new arrangement depends on its legal effect. Organisations should assess new arrangements from today and classify changes to older contracts rather than assume that every continuing supplier contract must be rebuilt overnight. Source: [Home Office final employer guide, pp. 13, 76, 79.]

An upstream statutory excuse needs operating evidence

For a party within the extended provisions, the final Code of Practice and employer guide set out prescribed requirements. The written terms must require the direct employer to carry out checks, control further subcontracting, allow audits, support enforcement where illegal working is identified, and enable cooperation with Home Office investigations. Those arrangements must operate in practice. Audit records, assurance material, details of contractual chains and evidence of action taken when concerns arose matter more than a standard clause filed away at signature. Sources: [Home Office final employer guide, pp. 49–52; final Code of Practice, 1 October 2026.]

Substitution creates a particularly concrete identity problem. Where a contract permits a worker to send a substitute, the substitute must receive a prescribed check before work begins. The relevant party must also be able to show that the person performing the work is the person whose right to work was checked. A successful document scan at enrolment cannot, on its own, show who attended a later shift. A procurement specification should therefore identify who records substitutions, who performs checks, what proof reaches the upstream party, and how exceptions are handled. The guide permits proportionate systems and reliance on another party’s systems where their effectiveness has been reasonably tested. Source: [Home Office final employer guide, pp. 52–54, 80.]

The employer remains accountable for its check, although an individual acting under its control and direction may conduct it. A check independently performed by an external recruitment agency or adviser does not establish the employer’s statutory excuse, except through the prescribed registered Right to Work digital verification service route. That is the operational difference between delegating a task within the employer’s controlled process and outsourcing the legal duty. Source: [Home Office final employer guide, pp. 19, 77–78.]

Market context: Check the service, not only the vendor

Employers are not required to use a digital verification service for every right-to-work check. The appropriate prescribed route depends on the person and their evidence; the Home Office online route is required for an eVisa holder where that route applies. When an employer chooses a digital verification service for an eligible check, however, the service used to perform it must be certified and registered against the UK digital verification services trust framework and the Right to Work supplementary code to support the statutory excuse. Sources: [Home Office final employer guide, pp. 19, 24, 30–35; OfDIA, 3 September 2026.]

The statutory register had 65 listed services at its 30 September update; 42 displayed the Right to Work supplementary code when its seven pages were checked for this article. That is a dated service count, not a count of vendors or a guarantee that every code-bearing component performs an entire employer check independently. GB Group PLC illustrates the distinction: its GBG Go and Identify entries displayed Right to Work, while IDscan Enterprise, ID3global and oZone FYQ2 did not. Experian’s Device Intelligence and Behavioural Biometrics entry displayed the code but is listed with a Component role. Procurement teams should examine the role and certificate of the service that actually returns the prescribed result. The complete dated roster below makes the service-level distinction visible; it is not a vendor ranking. [Source: statutory DVS register, updated 30 September 2026.]

An employer can obtain the registered RtW service through an intermediary. The final guide says that intermediary must identify the registered service doing the check and must not misrepresent its certification. This is why “our platform uses a certified component” is insufficient as a procurement answer, while “this named registered RtW service performed the prescribed check” can be tested against the official entry and check output. Source: [Home Office final employer guide, pp. 30, 77–78.]

Certification needs a date check. As of 8 October 2026 the register lists ID-Pal as expiring on 19 October 2026, Atlantic Data’s two listed apps on 20 October 2026 and two Experian entries on 29 November 2026. The MiVIP certification, which the 30 September register listed as expiring on 6 October 2026, was renewed and now runs to 6 October 2029; the register lists its provider as Mitek Systems inc., trading as Hooyu Ltd. Those are listed expiry dates, not evidence that the providers will fail to renew. A buyer relying on any of these services should check the live register and the exact certificate at procurement and again when the service is used. The 1.1 Right to Work supplementary code also has transition rules for older valid 0.4 certificates; it does not render them all invalid on 1 October. [Sources: statutory DVS register, updated 30 September 2026; OfDIA supplementary code 1.1, 1 September 2026.]

The following snapshot records the 42 services whose entries displayed Right to Work on 30 September. It records certificate dates, not service performance or the configuration of any employer integration. The live register is authoritative for a later decision.

Procurement implications: A four-question decision test

1. Who is directly engaging the worker? Record that party and the prescribed checking route. For agency labour, examine who actually holds the direct contract; do not assume the hirer must duplicate the employment business’s check. 2. Does another party undertake to provide the work or services onwards? Trace each contractual obligation and any subcontracting or substitution. Apply the final guide’s own-use buyer and service-delivery examples to the facts, including the date the arrangement was entered into. 3. What operating evidence supports the statutory excuse? Keep the required written terms, audit and assurance records, substitute checks, and evidence that the person doing the work is the person who was checked. 4. If a digital provider route is chosen, which registered service did the check? Match the exact service, Right to Work supplementary code, role, current certificate and returned output. Recheck the register because its entries and validity dates can change.

These questions are an editorial decision aid, not a substitute for applying the Act and final Home Office documents to a specific contract. The strongest counter-read to an expansive supply-chain interpretation is in the government’s own examples: buying a service for internal use does not itself create extended liability. The change condition is equally concrete: a buyer that also undertakes to deliver that work onwards, or operates an online matching or substitution arrangement within the statutory terms, may face a different result. Sources: section 48 of the 2025 Act; [Home Office final employer guide, pp. 42–54, 79–81.]

Sources

• gov.uk — https://www.gov.uk/government/publications/right-to-work-checks-employers-guide
• enablingdigitalidentity.blog.gov.uk — https://enablingdigitalidentity.blog.gov.uk/2026/09/03/updating-the-supplementary-codes-for-right-to-work-and-right-to-rent-to-version-1-1/
• gov.uk — https://www.gov.uk/government/publications/illegal-working-penalties-codes-of-practice-for-employers
• access-dvs-register.service.gov.uk — https://www.access-dvs-register.service.gov.uk/register/all-services
• gov.uk — https://www.gov.uk/government/publications/supplementary-code-for-digital-right-to-work-checks-1-1/supplementary-code-for-digital-right-to-work-checks-1-1