From October 1st 2026, Section 48 of the Border Security, Asylum and Immigration Act 2025 will broaden the illegal working regime beyond conventional employment. End-clients, Managed Service Providers (MSPs), Recruitment Processing Outsourcing (RPO) providers, recruitment agencies, umbrella companies, labour-supply intermediaries, consultancies and digital talent platforms are all affected.
For contractors, October’s changes mean more thorough Right to Work (RTW) checks: duplicated onboarding, being checked again every time you move umbrella, and — for limited company directors — closer scrutiny of substitution clauses, writes Ashley Olliver, a director at Parasol.
A shift in the key questions will occur too, reflecting RTW becoming a labour supply chain governance issue, not just an immigration compliance bolt-on — but unfortunately for ContractorUK readers, the answer to “My agency already checked me under RTW, surely you as my umbrella don’t need to too?” will be: “Yes, we do.”
Having spent more than 18 years working across contractor payroll and the recruitment supply chain, I’ve watched regulatory change reshape business practice many times over. This one is different in scale — not least the heft of the penalties for getting RTW wrong from October 2026.
What RTW changes from October 1st?
Two developments sit at the heart of the new framework.
- DEFINITIONS WIDEN: The statutory concept of employing someone expands to cover certain worker contracts, certain individual subcontractors, and online matching services. Put another way, RTW expands to three new groups in October: individuals on worker contracts, some subcontracting arrangements, and service provider-to-customer platforms.
- LIABILITY PERMEATES: Extended liability can reach businesses further up particular contractual chains where the prescribed safeguards have not been met. In other words, contractors familiar with April 2026’s Joint and Several Liability rules will recognise the same principle at work, as the organisation directly employing the worker will no longer be solely ‘on the hook.’
These two central tenets of the October RTW changes go some way to explaining one of the new key questions. From Q4 2026, no longer will you hear, “Has somebody completed a Right to Work check?” — rather, it’ll evolve into “Who carries the RTW obligation, what evidence protects each business, and can the RTW checking process withstand scrutiny?”
Under the RTW changes, what’s a worker’s contract?
A worker’s contract (as distinct from a contract of employment) is an arrangement under which:
- someone agrees to do the work personally
- that someone is not a customer of a business that they run.
A temporary staff recruitment agency may fall in direct scope of RTW from October, where it engages temporary workers under qualifying worker contracts, including where it operates PAYE.
[Editor’s Note: Workers engaged under a contract of employment have been within the regime since 2008.]
Under October’s RTW changes, who is an in-scope sub-contractor individual?
If you’re contracted to do work that your client has itself been contracted to provide to someone else, you’re an individual sub-contractor under RTW.
The technical version? An individual sub-contractor denotes an individual who has “entered into a contract with a person to provide work or services, in circumstances where that other person has entered into a contract with a third party to provide, or arrange for the provision of, the work or services but the individual has not.”
In draft RTW guidance from the Home Office, where I have extracted the slightly wordy ‘sub-contractor’ definition from, a rider is given as an example of a sub-contractor — whereby the rider signs up to a delivery platform and accepts jobs through an app. For RTW purposes, the platform is the employer.
Under RTW from October, what’s an online matching service?
An online matching service is a service that:
- keeps a register of service providers
- allows potential clients or customers to submit enquiries online
- charges a fee or commission for making a match.
These criteria are particularly relevant in 2026/27, as AI-driven matching tools, direct-sourcing platforms, skills marketplaces and open talent pools are becoming more deeply embedded in workforce acquisition.
So technology may make the match faster — but it does not remove the need to identify who carries the Right to Work obligation.
How does RTW affect contractors from October?
Contractors should expect more thorough and, in some cases, duplicated onboarding checks, as a result of RTW expanding to atypical workers from October 1st.
Historically, it has not been uncommon for RTW-related documentation to follow after an assignment has been agreed — and occasionally even after work has begun.
In my view, those days are coming to an end. End-clients, MSPs, agencies, umbrella companies and workforce providers — acting as contractors’ ‘employers’ under the new rules — will increasingly want confirmation that identity and Right to Work status have been verified before the individual starts work.
Therefore, some onboarding journeys from October 2026 may lengthen, particularly where evidence is incomplete or immigration permission is time-limited.
Contractors working through an umbrella company will be checked by the umbrella, regardless of what the recruitment agency has already collected. And if you move between umbrella companies, you will be checked every time you start with a new umbrella employer.
What about contractor limited companies under RTW?
If you work through your own limited company and your contract has a substitution clause, expect this IR35-savvy arrangement to attract more scrutiny.
The relevant RTW compliance obligations will depend on who directly engages the substitute-individual. And they’ll depend on whether any business higher in the service chain is exposed to extended liability.
That said, nobody can hand your own limited company responsibility for checking its own substitute.
For contractors facing the enlarged RTW system from October, whether you’re limited or umbrella, my advice is simple: treat Right to Work evidence with the same importance as you treat your CV, qualifications and professional certifications.
Have the evidence appropriate to your status ready. For example, an eligible passport or, where applicable, a Home Office share code, together with evidence of any name change. Being ‘project-ready,’ as many good IT contractors are, may no longer be enough; you’ll also need to be RTW compliance-ready.
What is extended liability across the labour supply chain?
Under 15A — a new section of the Border Security, Asylum and Immigration Act 2025 — the Home Office can issue a penalty to a business further up a contractual chain, where an employer is found to be employing someone illegally and has not carried out the prescribed RTW checks.
Section 15A is currently the most talked-about part of Right to Work checks updating in October 2026.
How much are RTW penalties from October?
The penalty can be issued at up to £45,000 per worker for a first breach of the October regime.
But the RTW penalty increases to £60,000 per worker for a repeat breach of the law.
When will RTW penalties apply?
This significant civil penalty applies in three situations:
- Where a business is under a contract to provide work or services to a third party and contracts another employer to supply the workers
- Where an online matching service matches a provider to a client
- Where a contract permits substitution.
Does extended liability catch every business in the chain?
No, and this is where we believe the detail matters. The provisions do not apply simply because a business is the ultimate purchaser of work or services. A business acting solely as an end-user, or client/customer, may sit outside extended liability where it is not contracted to provide those services onwards.
That does not mean every organisation in a labour supply arrangement is outside the enlarged RTW framework, nor does it remove the ‘direct’ employer’s obligations.
The bottom line? Buying work for your own usage keeps you out of October’s “RTW £60k penalty regime,” as it’s being called by some. Buying it to supply to someone else does not keep you out.
What’s potentially outside extended liability?
A straightforward labour-supply arrangement may fall outside the extended-liability provision, where the client is solely the end-user and the recruitment agency is itself the relevant direct employer.
That said, this conventional set-up does not remove the agency’s direct checking obligations.
The agency is not off the hook. Remember, the first of RTW’s two key changes — the definition of ‘employer’ widening — makes the recruitment agency the employer of those workers. So, instead, the agency actually faces being directly liable.
Why does your labour supply chain need a compliance review under RTW?
Because each additional layer in a modern labour supply chain — MSPs, RPO providers, agencies, umbrella companies, digital platforms — reduces visibility over what’s actually happening in practice. And under RTW’s extended liability rules, responsibility no longer sits with the direct employer alone.
The UK labour market is moving in the opposite direction to simplicity. Businesses are building flexible workforce programmes, direct-sourcing models, freelancer communities and open talent pools, increasingly supported by AI-powered sourcing and matching technology. These models can improve speed, reach and candidate experience, but they can also create more distance between the individual performing the work and the organisations relying on it.
Who sits in a typical labour supply chain?
Today’s workforce ecosystem can include:
- End-clients
- MSPs
- RPO providers
- Recruitment agencies
- Second-tier suppliers
- Statement of Work providers
- Consultancies
- Umbrella companies
- Employer of Record and PEO providers
- Digital talent marketplaces, freelancer platforms and open talent communities.
What’s in your chain post-October?
What matters is the reality of each relationship, not the label attached to it.
A genuine business-to-business engagement with an individual operating an independent business may fall outside the expanded direct-employer definitions. But the use of a personal service company is not conclusive. Calling somebody ‘self-employed’ is not enough either. The contractual terms and the reality of the arrangement will matter.
An agency acting solely as a genuine introducer will not necessarily become a second employer merely because it sourced the worker. Liability turns on the agency’s actual contractual role and conduct.
However, an online service that keeps a register, makes matches and charges for them is subject to a specific statutory definition. This distinction becomes increasingly important as conventional recruitment services converge with platform technology.
What does RTW from October 2026 mean for agencies, MSPs and umbrella companies?
For umbrellas, the core position is familiar: the umbrella company employs the worker and must establish its own statutory excuse. For recruitment agencies, the answer depends on how each worker population is engaged, and a single business may find itself in more than one RTW position at once.
For MSPs and end-clients, the immediate priority is to map the programme rather than assume that the RTW responsibility sits elsewhere. Both parties should understand which suppliers engage workers directly, which relationships involve onward provision of work or services, where substitution is permitted, and whether any digital platform is doing more than advertising opportunities.
Can you rely on a third party’s Right to Work check?
No. The government’s official but still draft code on preventing illegal working says an employer must not delegate responsibility for conducting right to work checks to a third party, and that where a check is performed by a third party, such as a recruitment agency, the employer does not establish a statutory excuse.
The only exception is a check carried out by a registered digital provider.
This is a big change that matters for umbrella companies. The umbrella is the employer, so the umbrella has to run the RTW check itself. An agency’s RTW file on the worker, no matter how complete, gives the umbrella no statutory excuse.
[Editor’s Note: The same applies in reverse, i.e. an agency relying on a copy of the umbrella’s RTW check for its own PAYE workers will have no statutory excuse — see p49, and p63-65, of the Home Office guidance for further details on establishing a statutory excuse against extended liability].
How will a statutory excuse against a civil penalty work for employers?
If an agency and umbrella each independently engage an individual contractor within one of the statutory definitions, each must establish its own statutory excuse.
Neither should assume that the other party’s check protects it.
As with April’s JSL rules, no single party can rely on someone else in the chain having already checked.
How does Right to Work affect Statement of Work, outsourced delivery and consultancy models?
The introduction of extended liability under the RTW regime also hits somewhere else: on Statement of Work (SoW) arrangements, outsourced delivery and consultancy models. In addition, it covers the construction subcontracting chains that the legislation was largely conceived for.
These structures deserve particular attention because one business may be contracted to deliver an outcome and then engage another employer or individual to provide the work. This is precisely the situation that section 15A has been drawn up to address.
The irony is that some agencies have moved engagements into SoW structures partly to sit outside the IR35 off-payroll rules and, since April 6th 2026, outside joint and several liability too. But from October, these are precisely the structures that bring extended liability in. Nobody should assume that a label such as ‘SoW’ determines the Right to Work outcome.
What does good RTW supply-chain assurance look like?
At the time of writing (September 1st 2026), the most important theme is not duplication for its own sake; it is assurance.
Businesses in scope of extended liability need to meet the prescribed requirements before work starts. In practical terms, this means stronger contractual protection, effective substitution controls and proportionate identity verification.
What must the down-chain contract include?
Firstly, the contract with the down-chain employer has to carry five terms:
- A requirement to run prescribed checks before anyone starts
- A bar on further subcontracting without written consent, with equivalent obligations replicated in anything permitted
- Audit rights
- Enforcement rights, including suspension or termination;
- A duty to co-operate with a Home Office investigation, including disclosing the make-up of the chain and the registered details of every business in it.
Assurance from further down the chain is permitted, provided the down-chain employer has satisfied itself that the requirements are actually being met. Keep in mind, the Home Office code on RTW returns repeatedly to how arrangements operate in practice. Therefore, getting the contract wording right is important, but won’t be enough on its own.
As for limited company contractors, where a contract allows substitution, five processes have to be in place before the work starts:
- A right to work check on any substitute
- No delegating the RTW check to the person doing the work, even where the contract describes them as being ‘in business on their own account’
- No substitute starting work before their right to work has been verified;
- Contractual provisions, such as suspension or termination, where there is reason to believe the substitute is working illegally
- Ongoing assurance that the worker and their registered substitute are the same people who were checked.
What does the Home Office say about identity verification?
According to the Home Office, a person under a contract to provide work or services, an online matching service or an employer in the case of a substitution clause must have proportionate systems and processes in place to ensure that the individual carrying out the work or services is the same individual on whom a right to work check has been conducted.
What does this mean in practice?
Translated? ‘Employers‘ (in the RTW-broadening sense) need reasonable systems in place for confirming that the person turning up is the person who was checked. Included but not limited to:
- Access passes
- Facial verification through a registered provider
- Biometric or attendance systems
- Re-verification at set intervals.
And from October, any digital identity provider handling RTW ID checks has to be registered on the Office for Digital Identities and Attributes register and specifically noted for RTW. General identity authorisation is not enough.
Where is the risk of getting RTW wrong likely to land?
The Home Office has said it will look for the direct employer first, and go upstream where it cannot identify one or where the prescribed requirements have not been met.
Therefore, businesses further up relevant contractual chains cannot rely on distance from the worker as a risk-management strategy. Their defence will depend on their own contracts, records, assurance activity and identity controls.
This is particularly important where AI-powered platforms or open talent pools make sourcing appear seamless. A frictionless candidate journey can still conceal fragmented ownership of compliance. End-clients, MSPs and agencies should understand whether the technology is simply supporting a human-led recruitment process or whether the service itself meets the statutory definition of an online matching service.
How should you prepare for RTW’s October 2026 changes?
Organisations affected by Right to Work checks expansion should use the period before October 2026 to:
- Map every layer of workforce engagement
- Identify who performs each RTW check
- Review supplier and platform contracts
- Test substitution controls
- Assess identity-verification technology
- Confirm how evidence will be retained and audited.
For end clients and MSPs, this means programme-level visibility.
For agencies, it means separating genuine introduction activity from arrangements in which the agency itself engages or supplies the worker.
For umbrella companies and other direct employers, it means establishing their own statutory excuse rather than relying on another party’s file.
And for technology providers, it means examining whether AI-powered matching, open talent pools and marketplace functionality bring the service within the specific online-matching rules.
The civil penalties remain substantial (up to £45,000 per worker for a first breach and £60,000 for a repeat breach), but the wider exposure for flouting RTW’s enlarged regime from October is operational and reputational too.
The takeaway
Right to Work is set to become a board-level supply-chain issue.
Compliance with right-to-work checks can no longer be safely assumed to be somebody else’s responsibility. The organisations best prepared for October 2026 will be those that combine clear contractual ownership with real oversight, auditable evidence and a compliance-first approach. For contractors, being prepared means the same thing on a personal scale: your Right to Work evidence is now as much a part of being assignment-ready as your CV.
Start the discussion
Working contractors, accountants and recruiters chime in on the issues raised in this article.
No comments yet — be the first to chip in.