Direct answer: what should organisations do from 1 October 2026?
From 1 October 2026, the UK Right to Work Scheme covers more than conventional employees. A prescribed Right to Work check is required to establish a statutory excuse for workers engaged under a worker’s contract, individual subcontractors in the circumstances defined by the Home Office, and certain online matching arrangements. Organisations should first identify whether an engagement is in scope, then use the prescribed check, verify the person against the result, retain evidence, schedule follow-up checks where permission is time-limited, and assess extended-liability, substitution and supply-chain controls where relevant.
This does not mean every self-employed person, personal service company or overseas contractor automatically needs a UK Right to Work check. The contractual structure, who is directly engaging the individual, whether personal service is involved, the supply chain and where the work is performed can change the analysis.
Key takeaways
- The 1 October 2026 regime expressly covers employees, workers under a worker’s contract, individual subcontractors within the statutory definition, and certain online matching services.
- Identity or KYC is not a substitute for a prescribed Right to Work check. The prescribed routes are a manual document check, the Home Office online service, or an eligible Right to Work Digital Verification Service Provider (RtW DVSP).
- Where permission is time-limited, follow-up checks are needed to preserve the statutory excuse. Evidence generally must be retained for the duration of the engagement and for two years afterwards.
- Substitution and contractual chains need separate controls. Extended liability can arise even where the organisation is not the direct employer, but that does not mean every party should simply duplicate every check.
- For global contractor programmes, do not apply UK immigration checks merely because the client is UK-based. Determine whether the person is actually working in the UK and whether the arrangement falls within the UK scheme.
Check out our guide on UK Right to Work Rules for Contractors: October 2026 Changes
The 2026 UK Right to Work contractor checklist
1. Map the engagement
Ask: Is this engagement in scope?
Record the worker type, contracting party, work location, personal-service terms, any intermediary involved and the wider supply chain.
2. Assign responsibility
Ask: Who is responsible for the prescribed Right to Work check?
Identify the direct employer or engager, or the relevant online matching service where applicable. Separately assess whether extended liability could apply elsewhere in the contractual chain.
3. Choose the correct check
Ask: Which prescribed checking route applies?
Use the appropriate permitted method: a manual document check, a Home Office online Right to Work check, or an eligible Right to Work Digital Verification Service Provider (DVSP).
4. Verify the individual
Ask: Is the person presenting for work the person who was checked?
Match the individual against their photograph and biographical information, and confirm any restrictions on the work they are permitted to perform.
5. Retain the evidence
Ask: Could you prove later that the correct check was completed?
Securely retain dated copies or prescribed outputs from the check for the required retention period.
6. Monitor time-limited permission
Ask: Does the individual have a time-limited Right to Work?
Record expiry and follow-up dates, and complete any required follow-up check before the existing protection expires.
7. Control substitution
Ask: Could someone else perform the work?
Where substitution is permitted, make sure substitutes are appropriately checked before work begins and that effective identity and substitution controls are in place.
8. Review the supply chain
Ask: Could extended liability apply beyond the immediate engagement?
Review contractual chains, written statements, allocated responsibilities, supplier assurance processes and identity controls.
9. Govern the process
Ask: Are all relevant teams following the same process?
Align HR, Legal, Procurement, Compliance, Operations and supplier-management teams around one documented workflow.
The practical test: Your organisation should be able to show who was checked, how they were checked, who was responsible, what evidence was retained, when a follow-up is required and how substitutes or supply-chain risks are controlled.
What changed under the UK Right to Work rules from 1 October 2026?
The important change is the expansion of the illegal-working framework beyond the traditional contract-of-employment model. The Home Office checklist now states that prescribed checks are required, for the purpose of establishing a statutory excuse, for a worker employed under a contract of employment, a worker engaged under a worker’s contract, and a worker engaged as an individual subcontractor as defined in the guidance. The regime also addresses online matching services that provide details of individual service providers to potential clients or customers.
For HR and Legal teams, the practical consequence is that the label “contractor” no longer answers the Right to Work question. The organisation must understand the actual contractual chain and working arrangement.
Who is in scope and who is not automatically in scope?
The 2026 rules do not mean every contractor or supplier relationship should be treated in exactly the same way. Start with the nature of the engagement, who is providing the services and where the work is being performed.
Clearly in scope
Employees and apprentices
A prescribed Right to Work check should be completed before employment begins.
Workers under a worker’s contract
These engagements can fall within the rules where the individual provides personal service and meets the statutory definition of a worker. Examine the contractual terms and how the relationship operates in practice.
Can be in scope
Individual subcontractors
Do not assume that someone is outside the rules simply because they are described as a subcontractor. Assess whether the engagement meets the statutory definition applying to individual subcontractors.
Online matching services
Specific duties can apply where a service provides clients or customers with details of individual service providers in return for remuneration. The structure and function of the service matter.
Not automatically treated the same way
Genuine B2B suppliers and personal service companies (PSCs)
A company-to-company contract does not automatically create the same Right to Work obligations as a direct individual engagement. Examine who the contracting parties are, whether a genuinely independent business is supplying the services and who will actually perform the work.
Overseas contractors working for UK clients
Having a UK client does not, by itself, make an overseas contractor subject to UK Right to Work requirements. A key consideration is where the services are physically performed and whether UK immigration permission is relevant to that work.
Requires additional supply-chain scrutiny
Agency and subcontracting arrangements
Do not rely on the assumption that “someone else has already checked.” Identify who has direct responsibility for the prescribed check, then separately assess any extended-liability rules, contractual protections and assurance requirements across the supply chain.
Step 1: map the engagement before asking for documents
The fastest way to create a poor compliance process is to begin with passports. Begin with the engagement model instead. For every person or contractor population, record:
- the entity or person that holds the contract;
- whether the individual is expected to perform the services personally;
- whether the contractor trades through a company or other intermediary;
- where the work is physically performed;
- whether an agency, supplier or other service provider sits between the client and the individual;
- whether substitution is permitted;
- whether an online platform matches the individual with clients or customers;
- the planned start date, including whether the engagement starts on or after 1 October 2026.
This workforce map should determine which Right to Work workflow is triggered. It also prevents a common error: applying employee onboarding logic to every supplier while missing individual subcontractors or substitutes who may actually be relevant to the regime.
Step 2: distinguish identity/KYC from Right to Work
Identity verification answers “is this person who they claim to be?” A prescribed Right to Work check answers a different question: “does this person have permission to perform the work in question in the UK?” A platform may perform KYC, sanctions screening or bank-account verification without that process, by itself, establishing the statutory excuse available under the Right to Work Scheme.
The Home Office also expects employers to confirm that the person carrying out the work is the person on whom the Right to Work check was conducted. For extended-liability scenarios, proportionate identity-verification systems and processes should operate effectively in practice.
Step 3: choose the prescribed Right to Work check
The Home Office checklist identifies three prescribed routes. The appropriate route depends on the individual’s circumstances and evidence.
Employers should not force an individual to prove their Right to Work using one particular route where another prescribed method is available to them. The Home Office checklist also warns against discrimination based on the method an individual needs to use.
Step 4: verify the person and the permission
A compliant workflow is not simply “document uploaded = passed”. The checker needs to establish that the evidence belongs to the individual and that the individual is permitted to do the work offered, including any conditions or restrictions.
- Compare the photograph with the individual, using an allowed method.
- Check biographic details such as date of birth for consistency.
- Confirm that the result permits the work in question and note any restrictions.
- Record the date of the check before the individual starts the relevant work.
- Escalate unclear or exceptional cases rather than improvising an alternative process.
Step 5: retain evidence for an audit, not just onboarding
The statutory excuse depends on being able to show that the prescribed process was completed correctly. For online checks, the Home Office requires a secure PDF or HTML copy of the profile page, including the photograph and date of the check, to be kept for the duration of employment and for two years afterwards. The 2026 checklist sets equivalent retention expectations for RtW DVSP outputs and relevant manual evidence.
A scalable record should capture the individual, engagement, check route, check date, evidence/output, checker, permission type, restrictions, expiry or follow-up date, and any substitute or supply-chain relationship. Access should be limited appropriately because Right to Work records contain personal data.
Step 6: monitor time-limited permission and follow-up dates
Some evidence establishes a continuous statutory excuse; other evidence creates only a time-limited one. The Home Office checklist expressly identifies categories for which a follow-up check is required. The operational control is therefore an expiry workflow, not a calendar reminder sitting in one manager’s inbox.
- Record whether the statutory excuse is continuous or time-limited.
- Store the relevant expiry or follow-up date.
- Trigger reminders early enough for HR/Compliance to act.
- Complete the prescribed follow-up check before the existing protection expires where the engagement continues.
- Record the new evidence and update restrictions or conditions.
Step 7: treat substitution as an operational control
Substitution is especially important for contractor arrangements. The 2026 Home Office checklist says that, where the relevant contractual arrangement permits substitution, a statutory excuse against extended liability requires controls to be implemented before work or services commence. Any substitute should undergo the prescribed Right to Work check before starting, and the substitution controls should work in practice to prevent an imposter or unchecked substitute from doing the work.
That means the contract and workflow should answer: who can propose a substitute, who approves them, who performs the check, how identity is confirmed, and how the organisation records who actually delivered the services.
Step 8: review supply chains and extended liability
The 2026 framework introduces extended-liability screening for certain arrangements involving supplied workers, online matching and substitution. This is where Procurement becomes as important as HR.
Do not reduce the rule to “the end client must re-check everyone”. The Home Office framework instead requires organisations to determine whether extended liability applies and, where relevant, whether the prescribed contractual terms, operational arrangements, substitution controls and identity-verification systems needed for a statutory excuse are in place.
- Map the contractual chain from end client to the individual performing the work.
- State clearly which party performs prescribed Right to Work checks.
- Include the required written terms where the extended-liability framework calls for them.
- Require evidence/assurance that agreed processes operate in practice.
- Control further subcontracting and substitution.
- Document how the organisation verifies that the person delivering the service is the checked person.
- Escalate complex chains for specialist immigration/employment advice.
Common mistakes to avoid
- Assuming “self-employed” means outside the scheme without examining the statutory definition and contractual structure.
- Running KYC or identity verification and calling it a Right to Work check.
- Checking the named contractor but ignoring a substitute who actually performs the work.
- Assuming an agency or supplier automatically absorbs every Right to Work risk in a contractual chain.
- Collecting a share code or document without checking the person, permission and work restrictions.
- Failing to schedule follow-up checks for time-limited permission.
- Applying UK Right to Work checks indiscriminately to contractors who perform all services outside the UK.
- Keeping evidence indefinitely rather than following the applicable retention and secure-destruction rules.
- Using nationality, accent or appearance to decide who should be checked. The Home Office discrimination code requires a consistent, non-discriminatory process.
What about contractors who were already engaged before 1 October 2026?
The expanded Right to Work regime applies to relevant employment and engagements commencing on or after 1 October 2026. Organisations do not therefore need to treat every contractor already engaged before that date as though a new engagement automatically began on 1 October.
Existing arrangements should nevertheless be mapped carefully when they are renewed, replaced or materially changed, when a contractor moves onto a new assignment, or when a substitute begins performing the services. Where it is unclear whether a change creates a new engagement for the purposes of the rules, organisations should obtain specialist advice.
Where TFY fits
For organisations managing large or international contractor populations, the compliance problem is often less about knowing that a check exists and more about connecting the check to the correct person, contract, engagement, renewal, payment and audit record.
TFY (Transformify) provides contractor management and Contractor of Record workflows designed to centralise contractor onboarding, contracts, classification and compliance records, invoicing and payments. TFY states that its contractor platform supports 184+ countries and includes UK IR35 fee-payer support where applicable. Right to Work obligations remain fact-specific, so organisations should confirm the required UK immigration process for each engagement rather than treating any workforce platform as a substitute for the prescribed Home Office check.
Frequently asked questions
Do contractors need Right to Work checks in the UK from 1 October 2026?
Some contractor arrangements do. The 2026 Home Office checklist expressly includes workers under a worker’s contract and individual subcontractors within its definition. Whether a specific contractor is in scope depends on the legal and contractual structure, so “contractor” is not enough information by itself.
Does every self-employed person need a UK Right to Work check?
No. The regime should not be read as requiring the same check for every self-employed business or every B2B supplier. Organisations need to determine whether the individual and arrangement fall within the categories covered by the legislation and guidance.
Do overseas contractors working for a UK company need a UK Right to Work check?
Not merely because the client is based in the UK. UK Right to Work concerns permission to work in the UK. Where the individual performs services overseas, the location and engagement facts should be assessed rather than automatically applying the UK process.
Is KYC the same as a Right to Work check?
No. KYC/identity checks can establish identity and support fraud or financial-crime controls. A prescribed Right to Work check is the specific process used to establish the statutory excuse under the UK illegal-working framework.
What are the three prescribed Right to Work routes in 2026?
The Home Office checklist identifies a manual document-based check, the Home Office online Right to Work service, and a check using an eligible Right to Work Digital Verification Service Provider.
Can a company use a digital identity provider for Right to Work?
Yes, for eligible documents and where the prescribed requirements are met. The provider must be registered with the Office for Digital Identities and Attributes for Right to Work checks, and the employer still has specified checking and evidence-retention responsibilities.
How long should Right to Work evidence be kept?
The Home Office checklist requires relevant evidence to be retained securely for the duration of employment or engagement and for two years afterwards in the prescribed scenarios, after which it should be securely destroyed.
What happens when Right to Work is time-limited?
A follow-up check is required to maintain the statutory excuse where the individual has time-limited permission. Organisations should record the follow-up date and complete the appropriate prescribed check before the existing protection expires.
What happens if a contractor uses a substitute?
Where the relevant arrangement permits substitution, the 2026 extended-liability framework includes specific substitution controls. The substitute should undergo a prescribed Right to Work check before starting, and effective controls should ensure the checked person is the person performing the work.
Does the end client need to repeat an agency’s Right to Work checks?
Not automatically. Responsibility normally starts with the party directly employing or engaging the worker, while separate extended-liability provisions can affect other organisations in the chain. The contractual structure and the Home Office extended-liability rules should be reviewed rather than defaulting to duplicate checks.
Can a Right to Work platform guarantee compliance?
No software tool can make a fact-specific legal determination disappear. Technology can centralise records, reminders and workflows, but organisations still need to use the prescribed check and apply the Home Office rules to the actual engagement.
What should HR and Procurement do first?
Build a single map of employees, workers, individual subcontractors, agencies, suppliers, online matching arrangements and substitution rights. Then assign check responsibility, identify extended-liability scenarios, document evidence standards and implement follow-up controls.
