The final guidance preserves the principal elements of the expanded Right to Work Scheme.
Wider scope of the Right to Work Scheme: The Scheme now includes contracts of employment, worker’s contracts, individual subcontracting arrangements and certain online matching services.
Direct employer responsibility: The employer in the direct contractual relationship with the worker remains responsible for completing the prescribed right to work check.
Extended liability: Separate responsibilities may arise where work or services are delivered through specified contractual chains, online matching arrangements or permitted substitution.
Substance matters more than labels: Describing someone as self-employed, a consultant, contractor, freelancer or platform user does not determine whether the Scheme applies.
Own-use services: Extended liability does not apply merely because a client or end-user purchases services for its own internal operations.
Contractual controls: Where extended liability applies, prescribed terms must address right to work checks, further subcontracting, audits, enforcement and cooperation with a Home Office investigation.
Substitution: Where substitution is permitted, substitutes must be checked before beginning work and the checking responsibility must not be left to the individual providing the services.
Identity assurance: Businesses must have proportionate systems connecting the person whose right to work was checked with the person who actually carries out the work.
Evidence of operation: Contractual wording alone is insufficient. Businesses must be able to show that their arrangements operate effectively in practice.
Cross-functional ownership: HR, Procurement, Legal, Operations and Contract Management may all have responsibilities under the expanded Scheme.
Generally, no.
The final guidance confirms that employment under a worker’s contract, individual subcontracting arrangements and relevant online matching arrangements is within the civil penalty regime where the employment commences on or after 1 October 2026.
For extended liability, the prescribed requirements apply where the relevant contractual arrangement was entered into on or after 1 October 2026. A pre-existing arrangement is not brought within scope solely because work or services continue after that date.
This is an important clarification for businesses with longstanding supplier and service arrangements. There is no general requirement to treat every existing contract as though it had been entered into under the new regime.
However, businesses should still review continuing arrangements to identify:
Annex C confirms that the effect of renewing, extending or varying a pre-1 October contract depends on the legal and contractual effect of the change.
A document is not automatically outside the new regime simply because it is described as a “variation”. Equally, every minor amendment should not automatically be treated as creating a new contract.
The correct question is:
Does the change have the legal effect of entering into a new contractual arrangement on or after 1 October 2026?
That assessment may require advice on the particular agreement, amendment mechanism and commercial changes involved.
Not routinely in a standard agency supply arrangement.
Annex C confirms that where an employment business directly engages agency workers and supplies them to a hirer for use within the hirer’s own operations, the employment business remains responsible for the prescribed right to work checks.
The changes are not intended to require the hirer routinely to duplicate those checks in a standard agency supply arrangement.
This does not remove the commercial value of appropriate supplier terms, assurance and identity controls. It does, however, help distinguish between:
Businesses should therefore avoid adopting an indiscriminate “check everybody ourselves” policy. The correct approach is to identify which organisation has which legal responsibility.
No.
The final guidance confirms that the Home Office will ordinarily seek to identify the person responsible for the relevant contractual arrangements rather than treating every party in a chain as liable.
Annex C goes further. It states that the Home Office would not normally expect to issue a civil penalty to more than one employer in a contractual chain in respect of the same illegal worker.
Liability will ordinarily remain attributed to the direct employer. Where that employer cannot be identified, the Home Office may pursue another organisation in the chain if the prescribed requirements have not been met.
This is helpful, but it does not make compliance optional for upstream businesses.
Where an arrangement meets an extended-liability gateway, the relevant organisation should still establish its own statutory excuse by complying with the prescribed requirements before work begins.
Yes.
One of Annex C’s most important clarifications concerns the prescribed written statement.
Where extended liability applies, the organisation must be able to produce a written statement setting out the prescribed contractual terms. There is no mandatory form of words that must be copied verbatim, but it is not sufficient simply to point to equivalent language contained elsewhere in existing contractual documentation.
Existing vendor onboarding and due diligence may support the evidence of compliance, but they cannot replace the written statement.
The written statement must address the prescribed terms, including:
This means that a general warranty to comply with immigration law, even when supported by an indemnity, will not by itself establish the upstream party’s statutory excuse.
There is no prescribed universal audit frequency.
The Home Office has declined to specify how often agencies, contractors and labour providers must be audited.
Annex C states that the appropriate extent and frequency of due diligence or assurance activity will depend on factors including:
Similarly, there is no single minimum evidential package suitable for every arrangement. Relevant evidence may include contracts, audit records, supplier assurances, compliance reviews and records showing how concerns were identified and addressed.
The practical consequence is that organisations should adopt a documented, risk-based methodology rather than an arbitrary universal audit cycle.
Not necessarily.
The final guidance confirms that an upstream party does not necessarily have to meet or identity-verify every individual in a contractual chain.
A business may rely on systems operated by another party in the chain or by an external provider, provided it takes reasonable steps to satisfy itself that:
The final guidance recommends identity re-verification at least once in any 24-hour period or shift of work, but also recognises that another system may provide equivalent assurance.
The frequency should reflect the nature of the work and the risk of substitution or impersonation.
Biometric technology is not mandated. Businesses should avoid purchasing technology before understanding the particular identity risk, the existing controls and the proportionality of the proposed solution.
The final guidance confirms that, where an employer chooses to use a Right to Work Digital Verification Service Provider, the provider must be registered with the Office for Digital Identities and Attributes and able to provide Right to Work services.
The employer must obtain the provider’s output, check that the photograph and biographical information relate to the individual and retain the prescribed evidence. Use of a Digital Verification Service Provider remains optional.
The final checklist also confirms that the employer must retain evidence that the provider is registered, is conducting checks in accordance with the Supplementary Code for Digital Right to Work Checks and has verified the individual’s identity, together with a link to the provider’s register entry.
There is no blanket exemption for personal service companies.
The final guidance includes an example where a client purchases a defined project from a graphic designer’s personal service company. In that example, the client does not need to carry out a direct right to work check because it contracts with the company for services rather than directly engaging the individual.
Annex C nevertheless warns that there is no blanket exemption merely because somebody is described as a contractor, freelancer or consultant, or operates through a personal service company.
The contractual structure and practical operation must still be assessed.
The final guidance resolves a number of important issues, but it does not remove the need for judgement.
Annex C confirms that the answer depends on the legal effect of the change. It does not prescribe a universal test for determining when an amendment becomes a new contractual arrangement.
The final guidance says that the Home Office would not normally penalise more than one employer in the chain for the same illegal worker.
However, where the direct employer cannot be identified and several upstream organisations have failed to establish a statutory excuse, the guidance does not provide a detailed selection methodology.
There is no standard package of contractual warranties, evidence, audit records and operational testing that will be sufficient in every case.
Each business must justify its approach by reference to its contractual structure and risk.
The Home Office confirms that there is no single prescribed audit frequency.
Businesses must decide what is reasonable by reference to risk, scale and complexity, while retaining evidence of the rationale adopted.
The recommendation of re-verification at least once during a 24-hour period or shift is useful, but the guidance also permits equivalent assurance.
What is reasonable and proportionate will differ between, for example:
The final guidance does not convert proportionality into a sector-by-sector rulebook.
Businesses should avoid treating the final guidance as requiring universal checks or identical controls across every supplier relationship.
The priority actions are:
Identify direct employees, workers, individual subcontractors, agency labour, outsourced services, platforms and permitted substitution.
Establish which organisation directly contracts with each individual carrying out the work.
Determine whether services are being provided onwards, whether an online matching service is involved or whether substitution is permitted.
Identify relevant direct engagements commencing on or after 1 October 2026 and extended-liability contractual arrangements entered into on or after that date.
Ensure that a compliant written statement and prescribed contractual protections are in place where extended liability applies.
Determine the appropriate supplier assurance, auditing, identity verification and escalation controls for the particular model.
Keep contracts, written statements, audit records, assurances, identity records, compliance reviews and evidence of action taken when concerns arise.
Allocate clear responsibilities across HR, Recruitment, Procurement, Legal, Operations, Contract Management and sponsor licence key personnel.
The final guidance confirms the expanded scope of the Right to Work Scheme and the need for organisations to understand their wider labour and service arrangements.
The principal development is greater clarity.
The Home Office has confirmed that the regime is not generally retrospective, that routine duplication of agency checks is not intended, that extended liability is not automatic across a contractual chain and that it would not normally expect to penalise more than one employer for the same illegal worker.
At the same time, the final guidance strengthens the practical compliance message:
The written statement is mandatory where extended liability applies, contractual warranties alone are insufficient, and organisations must be able to demonstrate that reasonable and proportionate controls operated effectively in practice.
The organisations best placed to establish a statutory excuse will be those that can explain their contractual structure, identify the correct legal responsibilities and produce contemporaneous evidence showing that their controls were designed, implemented and monitored appropriately.
The Home Office has also provided a useful Right to Work checklist, which organisations should refer to and/or adopt as part of their checks.