Right to work checks for employers: what changed in October

From 1 October 2026, right to work checks no longer cover only employees. The Home Office has widened the Right to Work Scheme to include people on worker's contracts, individual sub-contractors and some online matching services. Care providers who directly employ their staff carry on much as before. Providers who use bank staff, self-employed carers, introductory agencies or subcontracted care packages now have new questions to answer. The civil penalty for getting it wrong is up to £60,000 per illegal worker.

What is a right to work check?

A right to work (RTW) check confirms that a person is allowed to do the work you're offering, before they start. Done correctly, it gives you a "statutory excuse": a legal defence against a civil penalty if that person later turns out to be working illegally.

The Home Office's employer's guide to right to work checks sets out three ways to do a check:

A manual document check. You see the original documents in the person's presence and keep a clear copy.
A Home Office online check. The person gives you a share code and you check their status online.
A digital identity check. You use a registered Right to Work digital verification service provider (an "RtW DVSP"), mainly for valid British and Irish passports. You stay responsible for the check, not the provider.

All three must be completed before work starts. If someone has time-limited permission to work, you need a follow-up check before that permission runs out.

What changed on 1 October 2026?

The Border Security, Asylum and Immigration Act 2025 amended the law so that "employing" someone now includes more working arrangements. The final employer's guide, published on 1 October 2026, says the scheme now applies where you engage someone:

Working arrangement	In scope before 1 October 2026?	In scope now?
Contract of employment (including apprenticeships)	Yes	Yes
Worker's contract	No	Yes
Individual sub-contractor	No	Yes
Online matching service connecting a service provider with clients	No	Yes
Independent business contracting directly with clients	No	No

The guide also introduces extended liability. In some contracting chains, an organisation can be treated as employing people it doesn't engage directly. That applies where an organisation is under contract to provide work or services to a third party and contracts another employer to supply the people who do it.

Three more details matter:

It isn't retrospective. The guide says the relevant date is when a contractual arrangement is entered into, not when the work starts. New arrangements from 1 October 2026 are in scope.
The label doesn't decide it. The scheme looks at how the arrangement works in practice, not what the contract calls it.
Digital providers must be registered. If you use an RtW DVSP, it must appear on the Office for Digital Identities and Attributes (OfDIA) register. An unregistered provider does not give you a statutory excuse.

Which care staff does this affect?

Most care workers on permanent contracts were already in scope, so nothing changes for them. The changes land on the more flexible arrangements that care providers rely on to cover rota gaps.

Arrangement in your service	What to check
Directly employed care workers	No change. Keep checking before day one and running follow-up checks on time.
Bank or casual staff	If they're on a worker's contract rather than an employment contract, they're now in scope for new arrangements. Check them the same way.
Self-employed carers you engage directly	Likely to be in scope as individual sub-contractors, unless they genuinely run their own independent business.
Agency staff supplied by an employment business	The guide says the agency stays responsible in a standard supply arrangement, and hirers aren't expected to repeat checks routinely.
Carers placed through an introductory agency or app	The online matching service may now be the "employer" for right to work purposes.
Care packages you subcontract to another provider	Extended liability may apply. You'll need the right contract terms in place before work starts.

The same logic applies to Ofsted-regulated settings. Children's homes and nurseries that use bank staff or sub-contractors should review those arrangements too.

What does extended liability mean for subcontracted care?

Where extended liability applies, the organisation further up the chain can only rely on a statutory excuse if it meets prescribed requirements. The guide groups these as contract terms, substitution controls and identity verification.

The contract terms must be set out in a written statement before the work or service begins. They must:

Require the other employer to carry out prescribed right to work checks on everyone doing the work.
Stop them subcontracting further without your written consent, and pass the same obligations down the chain.
Let you audit their right to work compliance.
Let you act, for example by suspending or ending the contract, if illegal working is found.
Require them to co-operate with any Home Office investigation.

You can rely on the other employer's assurances, but only if you've taken reasonable steps to check those assurances are reliable. Audit records, copies of agreements and compliance reviews all count as evidence.

Why does this matter so much in care?

Care runs on flexible staffing: bank shifts, last-minute cover and subcontracted packages. That flexibility is exactly what the new rules target.

The sanctions are serious. The Home Office guide lists:

a civil penalty of up to £60,000 per illegal worker
in serious cases, up to five years in prison and an unlimited fine
losing the ability to sponsor migrant workers
being named in the published list of non-compliant employers

For a care provider, losing a sponsor licence can affect staff who are already in post. And a right to work failure is a safer recruitment failure. CQC inspectors look at whether you've checked that staff are fit to work with the people you support, so you need to be able to show your checks.

How do you get ready? A five-step checklist

Map every way people work for you. List employees, bank staff, self-employed carers, agency workers and any subcontracted packages. Note when each arrangement started.
Check new arrangements from 1 October 2026. Anyone on a worker's contract or engaged as a sub-contractor since then needs a prescribed check before they work.
Review your contracts with subcontractors. If extended liability could apply, add the five written terms before any new work starts.
Confirm your digital provider is on the OfDIA register. Keep a record that you checked, and when.
Keep your evidence in one place. The guide says to keep check records for the length of the working relationship and for two years afterwards. A copy in someone's inbox won't help you during an investigation or a CQC visit.

Where does Lily fit in?

The hard part isn't knowing the rules. It's applying them for every applicant when you're short-staffed.

Lily builds the right to work check into the hiring process, so nobody has to remember to start it. Applicants can complete a digital identity check, share a Home Office share code, or upload their documents for a manual check if the other routes don't work for them. The evidence sits on each applicant's file next to their DBS, references and interview record, so you have a CQC-ready audit trail when someone asks to see it.

Lily supports your judgement; it doesn't replace it. Someone in your team still decides whether a check is complete and whether a person can start.

If you want to see how compliance runs alongside screening and interviews, take a look at how the Lily platform works, or read why CQC compliance starts at the application stage.

Frequently asked questions

Do I need to recheck staff I already employ?

No. The Home Office says the changes aren't retrospective. Existing employees don't need a new check because of 1 October 2026. Keep running follow-up checks for anyone with time-limited permission to work.

Do I need to check agency care workers myself?

Usually not. Where an agency supplies workers into your own service, the guide says the agency remains responsible for the check. Keep the agency's confirmation that checks were done.

Are bank staff on zero-hours contracts now covered?

Yes, if they're on a worker's contract agreed on or after 1 October 2026. Either way, check them before their first shift.

What is the penalty for not doing a right to work check?

Up to £60,000 per illegal worker as a civil penalty. In serious cases, where an employer knew or had reasonable cause to believe someone was working illegally, the offence carries up to five years in prison and an unlimited fine.

Can I use any digital ID provider for right to work checks?

No. A provider must be on the Office for Digital Identities and Attributes (OfDIA) register and able to provide right to work services. Checks through an unregistered provider don't give you a statutory excuse.

Does this apply to children's homes and nurseries?

Yes. The scheme applies to every UK employer, including Ofsted-regulated settings.

This article summarises Home Office guidance as at 7 October 2026. It isn't legal advice. Check the Home Office employer guidance collection for the latest version and take advice on complex contracting chains.