From October, checking the subbies' right to work becomes your job too

The right to work check has always been an employees-only formality: new starter, day-one paperwork, copy of the passport in the file. If someone invoiced you rather than appearing on the payroll, the law left them to check themselves.

On 1 October 2026 that boundary goes. Section 48 of the Border Security, Asylum and Immigration Act 2025 comes into force on that date, and it rewrites who counts as an employer for illegal working purposes. Subcontractors, agency workers, gig workers and people engaged through online platforms come inside the scheme, and so do the civil penalties that go with it.

£45,000: Maximum penalty per worker, first breach
£60,000: Per worker for a repeat breach within three years

Those figures have been in place since 2024. What changes in October is how many of the people on your sites and in your supply chain they can attach to.

What actually changes

The commencement regulations were made in June, so the date is set rather than proposed, and the Home Office published a draft revised code of practice on 30 June setting out how the expanded scheme will be enforced.

Under it, you are treated as an employer not just of your employees but of anyone working under a "worker's contract" (someone providing work personally who is not genuinely in business serving you as their client), of individual subcontractors engaged to help fulfil a contract you hold with someone else, and, if you run an online platform matching tradespeople to customers for a fee, of the service providers on your register.

The phrase doing the heavy lifting is personally provides work or services. The scheme now follows the person, not the payroll.

Who is caught, and who is not

The distinction that matters most is buried in the code, and it is the one to get clear before October.

Buying services for your own benefit keeps you out of scope. A firm that brings in a plumber to fix its own kitchen is a customer, not an employer, and owes no check.

Passing work down a chain puts you in scope. A fit-out firm that wins a contract and subs the electrical work to a self-employed spark is engaging an individual subcontractor to fulfil a third-party contract. That is precisely the arrangement section 48 was written for. It is also the normal operating model of half the trades, facilities and construction firms in Cheshire.

Where the chain is longer, liability can travel. The Home Office says its first target remains whoever directly engaged the worker, but if that party cannot be identified, or cannot evidence its own compliance, others in the chain can be penalised. The code's answer is contractual: your agreements with subcontractors and agencies are expected to require right to work checks, forbid further subcontracting without your written consent, give you audit rights, and commit everyone to cooperating with a Home Office investigation. If your subcontract terms are a handshake and an email thread, that is the first thing to fix.

The check itself has not changed much

The mechanics are the ones employers already know. A manual check of original documents, the Home Office online check with a share code for anyone holding an eVisa, or a digital identity check for holders of valid British and Irish passports.

The digital route is where October tightens things. From the same date, a provider running digital right to work checks must be registered with the Office for Digital Identities and Attributes and specifically approved for right to work checking. Using a digital provider stays optional; using an unregistered one stops earning you any protection. If a checking app is already part of your onboarding, confirming its registration is a five-minute job worth doing before autumn.

The reward for checking properly is the same as it has always been: a statutory excuse. Do the prescribed check before the work starts, keep the evidence, and a worker who turns out to have no right to work costs you nothing. Skip it and the per-worker figures above apply, with no defence that you did not know the rules had changed.

The half nobody writes about

Every law firm in the country has published its summary of section 48. What those articles skip is that for a firm which has never checked anyone but employees, this is not a legal problem. It is a process problem, and the process does not currently exist.

The typical version we see is a site manager with a phone full of passport photos on WhatsApp. As evidence, that fails in every direction at once: nobody can find the right document two years later, nothing records when the check happened or who did it, leavers take the photos with them, and a folder of identity documents on a personal handset is its own data protection incident waiting to be written up.

A workable process is small, but it has to be deliberate:

01Map everyone who works for you without being on the payroll: subbies, agency staff, regular casuals, anyone with a substitution clause
02Decide where in onboarding the check happens, and name the person who runs it
03Decide where the evidence lives, so that any check can be produced on request years later
04Put the flow-down clauses into your subcontractor and agency terms before October
05Diary the repeat checks for anyone whose permission is time-limited

Verify a person, store the evidence, produce it on demand is a workflow we have built before: the anti-money-laundering checks inside the practice management platform we made for an accountancy firm do exactly this, with the record attached to the client rather than lost in someone's camera roll. The scale is different; the shape is identical. For most small firms the answer will not be new software at all, just a named owner, a proper store, and a process that runs the same way every time.

One honest caveat to end on. We can help you build the checking process; we cannot tell you what immigration law requires in a complicated chain, and this article is not legal advice. If your labour supply involves multiple layers, umbrella arrangements or platforms, the code itself expects you to take specialist advice, and you should. For the process half, we should talk before October rather than after.

We work with businesses across Knutsford, Alderley Edge, Wilmslow, Altrincham, Stockport and Warrington, and remotely for clients anywhere in the UK.