The UK Is Rewriting the Right To Work Rules for Contractors: What Every Company Must Fix Before 1 October 2026
From 1 October 2026, UK Right to Work rules will extend beyond traditional employees to cover significant parts of the external workforce, including workers, individual subcontractors and certain arrangements facilitated through online matching platforms. For companies relying on contractors, agencies and complex labour supply chains, identity verification is about to become a board-level compliance issue.
For years, the distinction appeared relatively straightforward.
Employees needed Right to Work checks. Independent contractors sat in a different box.
From 1 October 2026, that assumption becomes dangerous.
Changes introduced by the Border Security, Asylum and Immigration Act 2025 significantly broaden the UK's illegal-working regime. Businesses may need to verify people working under arrangements that historically fell outside the conventional employer-employee relationship.
And the change goes considerably further than asking someone to upload a passport.
Companies need to be able to demonstrate that the individual who was checked is entitled to perform the work — and, in relevant circumstances, that this is the same individual who is actually carrying it out.
For businesses with hundreds or thousands of contractors, the operational implications are substantial.
The short answer: what changes on 1 October 2026?
From 1 October, the UK's Right to Work regime will extend to certain engagements involving:
- workers who are not conventional employees;
- individual subcontractors;
- certain online matching services connecting individual service providers with customers or clients;
- subcontracting structures; and
- arrangements involving substitution.
Companies within scope will need appropriate Right to Work processes if they want to establish the statutory protection available when the prescribed checks have been conducted correctly.
The implications are particularly significant for businesses using:
independent contractors, contingent workers, staffing agencies, gig workers, consultants, labour suppliers, Contractor of Record arrangements and workforce platforms.
The Home Office guidance also introduces important concepts around supply-chain responsibility and verifying that the person performing the work is the person who was actually checked.
This is no longer simply an HR onboarding issue.
It touches Legal, Compliance, Procurement, Operations and Finance.
Five things companies need to know
1. Calling someone an “independent contractor” will not remove the compliance obligation.
The legal structure and reality of the engagement matter more than the title appearing on the contract.
2. Right to Work and identity verification are related but different checks.
Confirming that someone is who they claim to be does not, by itself, prove that they are legally entitled to perform the work in the UK.
3. Companies may need controls throughout the supply chain.
The legislation introduces circumstances in which liability can extend beyond the organisation holding the direct relationship with the person doing the work.
4. Substitution becomes a much bigger compliance issue.
If another individual can perform the services, companies need to know who that person actually is and whether the appropriate Right to Work requirements have been satisfied.
5. Evidence matters.
A checkbox saying “verified” is not the same thing as maintaining the evidence needed to demonstrate that the prescribed process took place.
Why the definition of “employer” suddenly matters
The traditional Right to Work regime focused primarily on employment.
The new legislation expands that framework.
For these purposes, the concept of employing an individual can now include engaging somebody under a worker's contract, engaging an individual subcontractor, and certain online matching arrangements involving individual service providers.
That does not mean every self-employed person in Britain suddenly becomes an employee.
Nor does it mean every contractor working remotely for a UK company anywhere in the world requires a UK Right to Work check.
A genuinely independent business providing services to clients may remain outside the relevant scope. A personal service company can also produce a different result from engaging an individual directly.
The critical issue is therefore how the engagement actually operates.
Companies need to understand:
- Who is contracted?
- Is an individual required to perform the services personally?
- Is there an intermediary company?
- Where is the work physically performed?
- Can the individual provide a substitute?
- Is another organisation supplying the worker?
- Is an online platform matching individuals with clients?
These questions can no longer be left until something goes wrong.
Identity verification is not enough
One of the easiest mistakes companies can make is to assume that existing KYC procedures solve the problem.
They do not necessarily do so.
A Know Your Customer check may establish identity.
A statutory Right to Work process establishes whether the person has the required immigration permission to perform the work in question.
The prescribed route may involve:
- a Home Office online Right to Work check;
- an appropriate manual document check; or
- a compliant Right to Work Digital Verification Service Provider.
Which method applies depends on the worker's circumstances and available evidence.
For many people with digital UK immigration status, the Home Office online system will be central to the process.
Companies therefore need a workflow capable of distinguishing between identity, immigration status and permission to perform the relevant work.
The overlooked risk: is the person you verified actually doing the work?
This may prove to be one of the most operationally important changes.
The Home Office's 2026 guidance places significant emphasis on controls designed to establish that the person carrying out the work is the same person whose Right to Work was checked.
That matters particularly in sectors where:
work is performed remotely;
workers can substitute other individuals;
platforms match large numbers of contractors with businesses;
multiple subcontractors sit between the client and the individual; or
onboarding takes place entirely online.
Depending on the risk and working model, appropriate measures can include identity cards, access systems, attendance tools, facial comparison technology or other proportionate methods of confirming identity.
For digital businesses, that changes the compliance question.
It is no longer simply:
“Did we verify this contractor when they joined?”
It increasingly becomes:
“Can we demonstrate who is actually delivering the services?”
The substitution clause has acquired a new risk
The right of substitution has traditionally featured prominently in discussions about independent-contractor status.
A genuine ability to provide a substitute can help demonstrate that an engagement is not one of personal employment.
But the new Right to Work regime creates another side to the equation.
If Worker A can send Worker B to perform the services, a company cannot safely assume that verifying Worker A resolves the issue.
Businesses should review their contractor agreements and operating procedures to determine:
- whether substitution is permitted;
- whether prior approval is required;
- who verifies the substitute;
- whether a Right to Work check is required;
- how the substitute's identity is recorded;
- how the business knows who actually performed the work.
A contract clause and an operational workflow now need to tell the same story.
Supply chains are also under scrutiny
The reforms are particularly important for organisations sourcing external talent through several layers.
Consider:
Client → Agency → Supplier → Individual contractor
Historically, each organisation might have assumed another party was responsible for immigration checks.
That is becoming an increasingly unsafe approach.
The legislation creates extended-liability mechanisms covering certain labour supply arrangements, online matching models and substitution.
Companies should therefore review supplier contracts and require appropriate parties to:
- conduct prescribed Right to Work checks;
- retain evidence;
- control subcontracting;
- flow equivalent compliance obligations down the supply chain;
- notify relevant parties of substitutions;
- cooperate with compliance audits;
- disclose material changes in a worker's Right to Work.
Compliance cannot live exclusively in procurement paperwork.
Companies also need evidence that the process works.
There is another 2026 contractor risk: umbrella companies
The October Right to Work changes are not the only development affecting Britain's external workforce.
Since 6 April 2026, new PAYE rules have changed the risk allocation in labour supply chains involving umbrella companies.
Where an umbrella company employs workers supplied through a recruitment agency, the agency contracting with the end client can become responsible for ensuring PAYE is operated correctly. Where there is no relevant agency, responsibility can fall on the end client.
If HMRC finds that the umbrella company has failed to account for PAYE correctly, recovery can move up the chain.
For CFOs and procurement teams, this is a significant change.
Choosing an umbrella company is no longer simply about rates, payroll processing and employee experience. Supplier diligence increasingly needs to include tax compliance and continuing monitoring.
What should companies do before 1 October?
The first step is not buying another verification tool.
It is mapping the workforce.
Companies should identify everyone providing services and determine:
Employee, worker, independent contractor, personal service company, agency worker, umbrella worker or supplier?
Then identify where services are physically performed and how each individual entered the workforce.
The second step is to map responsibility.
For every contractor population, ask:
Who performs the Right to Work check?
Who keeps the evidence?
Who knows when permission expires?
Who approves substitutes?
Who is liable if something goes wrong?
The third step is to review contracts.
Contractor, agency and supplier agreements should contain appropriate provisions dealing with Right to Work verification, evidence, subcontracting, substitution, audit rights and notification obligations.
The fourth step is automation.
A scalable contractor compliance process should be capable of recording:
- worker identity;
- country where services are performed;
- Right to Work requirement;
- verification method;
- verification date;
- work restrictions;
- immigration permission expiry;
- supporting evidence;
- follow-up check dates;
- substitute details;
- compliance history and audit trail.
Trying to administer this using spreadsheets and email attachments becomes increasingly risky as contractor numbers grow.
What happens if companies get it wrong?
The cost is not merely administrative.
The UK already operates significant civil penalties for illegal working, and the expanded framework brings a much broader set of workforce arrangements into the compliance perimeter.
But the bigger corporate risk is often cumulative.
An organisation with hundreds of contractors may have:
- missing evidence;
- inconsistent onboarding;
- expired immigration permissions;
- unapproved substitutes;
- disconnected agency records;
- no central audit trail.
One isolated problem may be manageable.
A systemic failure across a workforce can become a very different conversation with regulators, auditors, investors and customers.
How TFY helps companies prepare
The challenge for companies is straightforward: external workforce compliance increasingly requires several functions that were historically handled separately.
Identity.
Right to Work.
Contracting.
Contractor records.
Approvals.
Payments.
Audit evidence.
TFY brings those processes into one environment.
TFY has already implemented the required identity and compliance checks within its workforce onboarding workflows.
For each employee or contractor, the relevant verification evidence is automatically stored in the individual's digital employee or contractor file, creating a central audit trail rather than leaving compliance evidence scattered across inboxes, shared drives and spreadsheets.
Companies can therefore connect onboarding with the continuing worker record.
That includes the ability to maintain relevant identity and compliance information alongside contracts, documents and workforce data.
For businesses using TFY's Contractor Payroll and Contractor of Record services, this creates a particularly important advantage: compliance does not sit in a disconnected identity-checking product while contracts and contractor payments happen somewhere else.
The workflow can connect:
Onboarding → Identity & compliance checks → Contractor file → Contracts → Approvals → Contractor payroll → Audit trail
The result is not simply faster onboarding.
It is evidence.
And in the new regulatory environment, evidence is what matters
The real shift is bigger than Right to Work
The direction of travel in UK regulation is becoming increasingly clear.
External workers are no longer sitting comfortably outside the compliance infrastructure traditionally associated with employees.
Governments are looking more closely at labour supply chains, umbrella companies, worker status, immigration compliance and the identity of the person actually delivering services.
For companies, the old distinction between an HR system for employees and a spreadsheet for contractors is becoming difficult to defend.
The external workforce now needs infrastructure of its own.
Businesses that build it before the rules change will experience October as another compliance update.
Those that do not may discover just how fragmented their contractor workforce has become.
Frequently Asked Questions
Do independent contractors need Right to Work checks in the UK from October 2026?
Some will. From 1 October 2026, the Right to Work regime expands to cover certain worker contracts, individual subcontractors and other specified working arrangements. Whether a particular contractor falls within scope depends on the structure and reality of the engagement.
Do overseas contractors need a UK Right to Work check?
Not simply because their client is British. Where the work is physically performed and the legal structure of the engagement are important. UK immigration Right to Work rules should not automatically be applied to every contractor working abroad.
Is KYC the same as a Right to Work check?
No. Identity/KYC verification and a statutory UK Right to Work check perform different functions. A business should ensure that the correct prescribed Right to Work process is used where required.
Can companies outsource Right to Work checks?
Digital verification services can play a role in prescribed checks, but organisations should make sure the service and process comply with the applicable Home Office requirements. Outsourcing a process does not automatically remove every compliance responsibility.
How long should Right to Work evidence be retained?
Under the Home Office framework, relevant evidence generally needs to be retained securely for the duration of the engagement and for two years afterwards where required to maintain the statutory excuse.
What happens if a contractor's Right to Work expires?
Where the individual's permission is time-limited, the company needs an appropriate follow-up check before the existing statutory protection expires if the engagement is continuing.
What should companies do now?
Map the external workforce, identify which UK engagements fall within scope, review contractor and supplier agreements, implement Right to Work and identity workflows, introduce expiry monitoring and ensure that evidence is centrally retained.
1 October 2026 is close. The time to find the gaps in your contractor compliance process is before a regulator does.
