Extended UK right to work checks for staffing suppliers and platforms come into force this autumn

The Border Security, Asylum and Immigration Act 2025 has widened the scope of who is required to prevent illegal working under the Right To Work (RTW) scheme and of sanctions for non-compliance that go beyond traditional employment relationships to a wider range of working arrangements. 

Compliance duties have now extended to businesses that engage workers under service contracts, use individual sub-contractors or operate digital matching platforms, with the new regime taking effect on 1 October.

A draft RTW code of practice for employers, published by the Home Office in June, sets out details of the checks that parties are expected to carry out and explains how the new requirements apply to non-direct contractual arrangements and the extended liability regime.

Although less onerous than originally proposed, the new regime will still require review of existing processes and contractual arrangements, particularly for parties who do not hold the direct contractual relationship with the worker. 

Affected businesses

The changes affect all businesses that use, procure, supply and pay contingent workers, including agency workers, personal service company (PSC) contractors supplied via agencies, subcontractors under the Construction Industry Scheme, "umbrella" workers and certain gig workers. 

The impact will be particularly acute in sectors with high levels of flexible or subcontracted labour: logistics, delivery, warehousing, hospitality, construction, cleaning, security, facilities management and platform-based work. These are also the sectors the Home Office is most likely to compliance audit.

Many staffing suppliers already conduct RTW checks as a matter of caution, but without the benefit of a statutory defence as employer. The new requirements confirm who in a supply chain must conduct RTW works checks and introduce a new extended liability regime. Importantly, those who comply with the "prescribed requirements" will also benefit from a statutory defence if a worker is found to be working illegally. 

Employer definition

The legislation expands the definition of "employer" for RTW scheme purposes. It covers those in the UK who employ individuals under a contract or employment, service or apprenticeship; as well as those who engage individuals under a worker's contract to perform work or services personally, where the "employer" is not a client or customer of the individual's business.

It covers those who engage individual sub-contractors through an intermediary that has itself contracted with a third party to deliver those services but the individual has not. This captures a significant proportion of contingent workers supplied via agencies. It also extends to those who operate an online matching service. In the context of this code of practice, the definition of "employer’ is in relation to the RTW scheme only.

Individuals who are genuinely self-employed, operating in business on their own account, trading in their own name or as part of their own business, who contract directly with clients or customers for the provision of work or services, are not in scope of the RTW scheme. This includes services provided directly to members of the public or under traditional business-to-business contracts for the supply of services, where the arrangement is for the purchase of a service rather than the employment of an individual to carry out work or services.

Online platforms

An "online matching service" for RTW purposes is a business that keeps a register of service providers, provides an online matching service through which clients or customers can submit enquiries, and charges a fee or commission for making matches. Most gig-delivery and ride-hailing apps, freelancer and contractor marketplaces, and trades and tasking platforms are likely to fall within the definition. Job boards and directory or ratings platforms are probably not caught.

Where the definition is met, the platform is treated as "employing" any individual or service provider who personally provides the work that results from a match, and the platform is responsible for conducting the RTW check. This is so even where the platform has no direct contractual relationship with that individual.

Responsibility for checks

Where an end client has a direct contractual relationship with an individual worker, the end client is responsible for conducting RTW checks. 

In more complex supply chains, responsibility lies with whoever holds the contractual relationship with the worker, referred to in this update as the "engager". Other supply chain parties are not required to carry out their own or additional RTW checks, but may face a civil penalty under the new extended liability regime.

Extended liability

Extended liability applies where someone other than the end user directly employs or engages the worker or where an end user contracts with a person who is permitted to substitute their work with another individual.

Where a worker is engaged illegally, the Home Office will, in the first instance, seek to identify the engager. Where the engager cannot be identified, or where the prescribed requirements have not been met, liability for a civil penalty may be imposed on another person further up the chain.

A party not in a direct contractual relationship with the worker will establish a statutory excuse against extended liability by demonstrating that the "prescribed requirements" have been met in full. 

The draft code confirms that end users are not subject to extended liability requirements where they are clients or customers of a service or purchase work or services. It remains unclear whether this includes or excludes the procurement of staffing services and workers.

However, the draft code makes it clear that end users will be subject to the regime if they buy in workers and then supply them on to a third party as part of a chain of contracts. This is of particular relevance to consultancies and staff augmentation businesses that buy in external resource to supply to clients. 

Prescribed requirements

The statutory defence is built through the structure of contracts, processes and controls. Three categories of prescribed requirements must be satisfied.

Contractual terms

Every business in the chain, whether an agency, managed service provider (MSP), umbrella or platform, is expected to have in place a written statement with the next party in the chain before the worker commences work.

That statement must require the downstream service provider to conduct prescribed RTW checks; to refrain from further sub-contracting without prior written consent, replicating equivalent RTW obligations in any permitted sub-contracting; to permit audits of compliance; to enable enforcement action including suspension or termination where illegal working is identified; and to co-operate with any Home Office investigation by providing information about the chain of contracts and parties involved.

In practice, any party who is one step removed from the engager will need to require that RTW checks flow down through the contractual chain to the engager. An MSP sitting at the head of a supply chain that includes an agency and umbrella company, with the primary duty as the engager to carry out the RTW checks, needs to ensure that the prescribed contractual terms and conditions pass down the chain, via the agency, to the umbrella company.

Substitution controls

Where a contractual arrangement permits substitution, a statutory excuse is only established where the engager has implemented, before work commences, processes to ensure that a prescribed RTW check is carried out on any substitute and that the responsibility for checks is not delegated to the individual carrying out the work.

No substitute can work before their right to work is verified and contractual enforcement provisions are in place, where either party knows or has reasonable cause to believe a substitute is working illegally.

The engager must also ensure, through identity verification, that the worker and any registered substitute are the same individuals on whom checks were conducted. All supply chain parties are expected to ensure that substitution controls flow down through contractual obligations to the engager.

Identity verification

Proportionate systems must be maintained to ensure that the individual carrying out the work is the same individual on whom the RTW check was conducted. Acceptable approaches include identity cards or workplace access passes, facial verification technology, biometric or attendance management systems, verification against training records or licences, and re-verification at set intervals, no less than once in any 24-hour period of activity.

A party may rely on identity verification systems operated by another party in the chain or by a third-party provider, provided it has taken reasonable steps to satisfy itself that those systems are effective and the prescribed requirements are being met. This will involve a combination of contractual obligations and compliance audits.

Self-employed exemption

The draft code confirms that genuinely self-employed individuals contracting directly with clients, as clients or customers of their business, are not in scope of the RTW.

However, arrangements where individuals obtain work through an intermediary, agency, platform or similar arrangement are caught.

The IR35 interaction

An obvious tension arises where a contractor is engaged through a PSC and the engagement has been determined as falling outside IR35.

On a strict reading of the draft code, a contractor engaged directly by an end client via their own PSC, where the engagement is genuinely outside IR35, may be exempt from the RTW scheme. However, this analysis is heavily fact specific. Where a PSC contractor is sourced through an agency or intermediary, the arrangement falls within the RTW extended liability regime regardless of how it is characterised for tax purposes. The cautious approach is to ensure that parties in the chain have contracts in place requiring whoever holds the contractual relationship with the PSC to carry out RTW checks to the prescribed standard.

Checks and IR35 status risk

There is a legitimate concern that conducting RTW checks could be used by HMRC in an IR35 enquiry as evidence that the engager was treating the contractor as a worker rather than an independent business.

Businesses engaging PSC contractors determined as outside IR35 should: review each engagement on its facts and document any RTW checks as being driven solely by statutory compliance under immigration law. Further guidance from both the Home Office and HMRC is expected.

Civil penalties

The civil penalty levels are £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years.

Practical steps

With the 1 October deadline approaching, businesses across staffing supply chains face a range of practical considerations.

• Staffing supply chain reviews. The first priority is identifying who is the engager in respect of each supplied worker and reviewing contractual arrangements to ensure that they meet the prescribed requirements, keeping that assessment under review as circumstances change.
• Audits of RTW check processes. RTW check processes warrant review against the draft code.
• Supply chain contract updates. No standard form supply chain contract currently contains all five required terms for the written statement. Every tier of the chain requires contract updates before 1 October.
• Identity verification. The identity verification requirement is new under the regime. Technology solutions, including facial verification provided through RTW digital verification service providers (DVSP) can meet this requirement but need to be procured and operational in time.
• Addressing the IR35 tension. Where PSC contractors are engaged outside IR35, any RTW checks are best documented as being driven solely by statutory immigration compliance.
• Data protection. RTW checks involve collecting, copying and retaining sensitive personal data. Compliance with UK data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018, is required, including data processing agreements with any RTW DVSP or identity verification provider.
• Training and enforcement responses. Businesses will also benefit from identifying a designated owner for Home Office interactions, ensuring records can be retrieved quickly, and training those responsible for onboarding and compliance. Active co-operation with an investigation attracts a £5,000 reduction in the civil penalty per worker; delayed or incomplete responses will incur unnecessary costs.
• Building evidence of mitigation factors. Documented evidence of checking systems, processes and compliance history is important. The burden is on the business to prove compliance, making evidence retention is critical.

Osborne Clarke comment

The changes to the RTW scheme represent a fundamental reshaping of the UK right to work compliance landscape.

For staffing supply chains, extended liability means that RTW compliance is now clearly a chain-wide obligation. Unlike the previous regime, however, there is the benefit of a statutory defence if the requirements are followed.

For platforms, the scheme's commencement marks a watershed. The three-limbed definition of online matching service captures most gig-economy and staffing marketplace platforms.

The prescribed requirements framework will requires contractual updates across potentially large numbers of service provider relationships, and those updates take time. Staffing suppliers, MSPs, umbrellas, end user and platforms will want to review their supply chains to identify who holds the engagement, and to ensure that contractual, substitution and verification prescribed requirements are in place across their staffing supply chains. 

This Insight is intended as a general overview and does not constitute legal advice. Please contact us if you would like to discuss how these changes affect your specific arrangements.