Right-to-work reform extends liability along supply chains from 1 October

Significant changes to the right to work (RTW) framework come into force soon on 1 October, extending civil penalty liability to businesses that use contractors, agencies, platform worker and subcontractors, and not just to businesses with direct employees.

The current framework

All UK employers are currently required to prevent illegal working under the Immigration, Asylum and Nationality Act 2006 by carrying out prescribed RTW  checks before employment starts. If those checks are carried out correctly, the employer has a "statutory excuse" against the payment of a civil penalty. Without a statutory excuse, employing someone who is disqualified from working can lead to both civil and criminal sanctions.

Under the existing scheme, businesses using contractors, subcontractors, platforms, or independent "self-employed" workers are not generally treated as the employer for RTW purposes. Liability currently sits with the direct employer and does not extend up the contracting chain.

That is about to change.

The new Border Security, Asylum and Immigration Act 2025 amends the Immigration, Asylum and Nationality Act 2006 introducing two critical reforms.

Expanded definition of 'employer' 

The term "employer" will extend beyond the traditional contract of employment model. The expanded definition includes those who employ individuals under a contract of employment; engage individuals under a worker's contract; engage individual sub-contractors; and operate an online matching service connecting individual service providers with clients or customers.

Crucially, labels such as "self-employed" or "contractor" are not determinative. The Home Office will apply a substance-over-form test, looking at how the work is arranged, supplied, and performed in practice.

Extended liability 

Civil penalty liability can extend beyond the direct employer. The guidance sets out three scenarios where this arises.

First, in contracting chains, the scenario is where a business is under a contract to provide work or services to a third party and then contracts with another employer who provides workers to fulfil that contract. The example given is a property developer using subcontractors supplying bricklayers and labourers. The developer can be treated as the "employer" for RTW purposes and face penalties if those individuals are working illegally.

The second scenario involves online matching services. Here, a business operates an online matching service connecting service providers with clients or customers, and the service provider contracts directly with the client or customer. The example given is a home services app matching electricians with homeowners: the platform could be treated as the "employer" for RTW purposes.

The third involves substitution clauses, where a business employs or engages an individual to provide work or services and the contract allows that individual to substitute another person to do the work instead. The example given is a delivery platform allowing riders to send a friend to complete deliveries in their place: the platform can be treated as the "employer" of any substitute who personally performs the deliveries.

There is an important limitation: extended liability does not apply to every business that buys services or labour. It focuses on those who are contractually responsible for providing or arranging work or services onwards as part of a chain. A client or end user purchasing work or services for its own internal operations is generally not within the scope of extended liability, though it will likely still have direct RTW duties for its own employees.

Why this matters 

Employers face significantly higher financial exposure, with civil penalties of up to £60,000 per illegal worker and the potential for multiple penalties across a contractor, supply chain or platform workforce.

Liability can arise even where the business is not the direct employer, meaning that the risk no longer sits only with HR but also extends to procurement, operations and platform teams.

Operational and reputational consequences are also significant: removal of illegal workers from key operations such as warehousing, construction, logistics, facilities and delivery could disrupt the business, and publication on the Home Office list of non-compliant employers increases reputational damage and media and stakeholder scrutiny.

Directors also face personal exposure through potential disqualification and criminal liability in serious cases, as well as the possible loss or refusal of a sponsor licence.

Three prescribed requirements

Where extended liability applies, the Home Office will look up the contractual chain to assess whether the organisation has complied with three prescribed requirements. If those requirements have been met, the organisation should have a statutory excuse. If they have not been met, the organisation may share liability and face civil penalties, even if it did not directly engage the worker. To establish the statutory excuse, the organisation must show compliance before the work or services began and be able to evidence this in practice.

Contractual terms and written statements

Before work starts, employers should have a written statement with agencies, subcontractors, service providers, and platform users, The statement should require prescribed RTW checks on anyone personally performing the work; restrict further subcontracting without consent and require RTW obligations to be mirrored in permitted subcontracts; give audit rights and allow enforcement action such as suspension or termination if illegal working is identified; and require cooperation with any Home Office investigation.

These requirements are best built into master service agreements, framework agreements, and platform terms and conditions.

Substitution controls

Where the individual can send someone else to perform the work, employers must have processes in place before any substitute starts. 

Specifically, prescribed RTW check needs to be carried out on every substitute and checks performed by the employer or another appropriate employer in the chain. Workers must not self-police the check. No substitute should be allowed should start work until their RTW is verified, and records and identity controls must be maintained showing who actually carried out the work and when.

Where substitution is not permitted but occurs anyway, the Home Office will assess whether proper checks were carried out on the original worker, given the risk of "impersonation".

Identity verification

Businesses must operate proportionate systems and processes to confirm that the person actually doing the work or services is the same individual on whom the RTW check was carried out. This applies in contracting chains, online matching services, and substitution arrangements.

Acceptable identity controls include photo ID cards or site and warehouse access passes; platform or app log-ins tied to verified identities with periodic re-checks; biometric or attendance systems, or facial recognition through a registered RTW digital verification service provider; reverification at appropriate intervals; and checks against training records, qualifications, or licences required for the role. The Home Office recommends reverification at least once in every 24-hour period or shift where risk is higher.

Employers can rely on identity verification systems operated by another party in the contractual chain or by a third-party provider, including a registered RTW digital verification service provider (DVSP). However, employers must still take "reasonable steps" to satisfy themselves that the systems are effective and appropriate, and that the prescribed requirements are being met in practice.

The key message is that employers need both the "paper" trail of contracts and policies and the "practice" covering systems, audits, and records.

Practical steps 

The changes come into force soon on 1 October. As time is now short, employers have a range of actions to consider over the coming weeks.

• Map labour and service delivery models. Identify where contractors, agencies, platforms and substitution are relied on.
• Identify in-scope arrangements. Focus on contracts where services are delivered onwards and prioritise high-risk areas.
• Review and update contracts. Insert or strengthen RTW clauses covering prescribed contractual terms, audit rights, subcontracting controls, and Home Office cooperation; update substitution provisions, including RTW checks on substitutes and consequences for illegal working.
• Design or upgrade RTW and identity systems. Decide what identity verification tools are needed, such as ID cards, platform log-ins and DVSPs, and determine the frequency of checks.
• Train and align key stakeholders. Ensure that HR, procurement, operations, and platform teams understand the expanded definition of "employer", how extended liability works, and the three prescribed requirements.
• Establish governance, audit, and escalation routes. Embed RTW compliance into business-as-usual processes and ensure there are clear lines of accountability.

Osborne Clarke comment

The new extended liability and non-traditional "employer" definitions apply to work and arrangements commencing on or after 1 October. There is no retrospective effect. Existing duties and penalties for direct employees continue unchanged.

Robust RTW compliance is now a core governance and risk management issue, not just an HR process.