Right to work checks for agency workers change on 1 October 2026

Right to work checks have, until now, been an employer's duty, owed on people employed under a contract of employment. A trust's HR team checks its own employees, and the locums and temporary theatre staff you supply sit outside that process because they were never your employees either. From 1 October 2026, right to work checks for agency workers become the responsibility of the business supplying them, and the civil penalty is issued against that business.

That liability lands on a population most employment businesses have never treated as employees, under contracts that were drafted when the duty sat with the client.

Section 48 and the three arrangements coming into scope

Section 48 of the Border Security, Asylum and Immigration Act 2025 amends the Immigration, Asylum and Nationality Act 2006 to extend the Right to Work Scheme beyond employees. Three arrangements come into scope: employment under a worker's contract, engagement as an individual sub-contractor, and use of an online matching service that passes a service provider's details to clients.

The legislation is enacted, though the guidance implementing it is still in draft. The Home Office's draft Employer's guide, dated 16 July 2026, states that it "will come into force on 1 October 2026". The guide in force today is the 26 June 2025 version, so confirm the final text before rewriting policy against it.

The draft sets the boundary for each of those three arrangements: "a civil penalty may only be imposed where the employment commenced on or after 1 October 2026". Engagements already running when that Thursday passes are outside it.

Example 2 in the draft guide is a staffing arrangement

Where an individual is registered with an employment business supplying temporary workers, the draft states that "the employment business is the individual's employer for the purposes of the Right to Work Scheme and is therefore responsible for the right to work check". The guide is framing status for the purposes of the Right to Work Scheme, which is a separate question from status for tax or employment law.

Section 15A extends liability further, to a contractor who subcontracts the workers fulfilling a contract, and to a contract permitting substitution where somebody else does the work. A provider engaging subcontracted clinicians is exposed even where it holds no contract with the individual on the shift.

The statutory excuse when the duty is yours

A statutory excuse is the defence against a civil penalty, and it exists only where one of three prescribed checks was completed before work began:

• a manual check of original documents, available for all nationalities
• a Home Office online check using a nine-character share code, valid for 90 calendar days
• a digital identity check through a certified provider, for British and Irish citizens holding a valid passport or Irish passport card

From 1 October the digital route carries a condition. The draft confirms an update "to mandate the use of right to work registered providers", with the terminology moving to right to work digital verification service provider. A check through an unregistered provider establishes no excuse, and the guide still requires you to satisfy yourself that the photograph and details returned match the person turning up for work.

Against extended liability under section 15A the excuse works differently. Section 3 of the draft sets out three routes: contractual terms recorded in a written statement, controls on substitution, and identity verification. The wording of your contract templates is therefore part of the excuse, and it needs reviewing before 1 October.

Follow-up checks land on the expiry date itself

A List A document gives a continuous excuse for the duration of the engagement. With List B Group 1, the excuse expires with the permission itself, and a List B Group 2 check gives six months.

The draft restates the follow-up rule in the same terms. An employer re-checking a worker with time-limited permission "must do this on, or before, the date their permission comes to an end". No follow-up is required where the initial check confirmed settled status or EU Settlement Scheme status.

The 28-day grace period covers one situation only. It applies where a prescribed check preceded employment and the worker has an in-time application, appeal or review outstanding, giving 28 calendar days from expiry to obtain a Positive Verification Notice. The guidance is explicit that "the 28 calendar days 'grace period' does not apply to checks conducted before employment commences". The two rules cover different moments: the grace period is available for an existing worker whose excuse expires during employment, and a new starter cannot be onboarded on the strength of a pending application. For an agency filling a Friday shift against a Wednesday application, that is the sentence that decides it.

Civil penalty levels, and the sliding scale that reduces them

Under the code of practice in force since 13 February 2024, the civil penalty starts at £45,000 per worker for a first breach and £60,000 for a repeat breach within three years. A draft code dated 30 June 2026 now sits alongside it on the same GOV.UK page, so the starting points after 1 October are not yet settled. The 16 July draft guide continues to state a penalty of "up to £60,000 per illegal worker".

The guide lists further sanctions, among them criminal conviction carrying up to five years' imprisonment, business closure and a court compliance order, director disqualification, and loss of the ability to sponsor migrants. For an agency supplying clinical staff through an NHS framework, losing the ability to sponsor migrants closes a recruitment route the business may be built on.

The sliding scale is where process quality turns into money. £5,000 per worker comes off for reporting a suspicion and holding a Unique Reference Number, and a further £5,000 for active co-operation. On a first breach, where the employer evidences reporting, co-operation and effective checking practices, the outcome is a warning notice instead of a financial penalty.

What has to be true about your right to work checks for agency workers before 1 October

Taking the draft guidance as it stands, five things need to hold.

Every engagement commencing on or after 1 October is checked before the first shift. A check run in week two of a placement does not establish the excuse; the penalty is already live.

Permission end dates sit in a system that watches them. The follow-up must land on or before the expiry date, so the date needs to sit somewhere that raises it ahead of time.

Your digital check provider is registered. If you run digital identity checks for British and Irish citizens, confirm the provider will hold right to work registered status from 1 October.

Expired biometric residence permits are handled on the right rule. An expired BRP is already not acceptable for a manual check. The 31 December 2026 date that circulates alongside it is about account access: an expired card can be used to sign in to an eVisa and generate a share code for 24 months from the expiry date printed on it, or until 31 December 2026, whichever comes first.

The national standard has not caught up yet. NHS Employers revised all six Employment Check Standards on 23 July 2026 and said the same day that they do "not yet include the extension of civil liability guidance", to be added "when legislation becomes active on 1 October 2026". An agency waiting for the refreshed standard will change its process after the liability has started.

Evidence an auditor asks for beyond the document

Evidencing effective checking practice means holding a record separate from the document itself: when the check was done, and what happened as the permission date approached. That is the record a first breach turns on.

Credentially runs right to work verification inside the role-specific onboarding workflow, and tracks permission expiry dates with automated re-checks so a follow-up date is raised before it passes. Workers who fall out of compliance are blocked from booking shifts, and every action writes to a logged activity trail. Compliance monitoring of that kind produces the effective-practice evidence as a by-product.

Doctor Care Anywhere onboarded 127 users and identified more than 450 expiring or expired documents in doing so, reaching 100 per cent compliance with non-compliant doctors blocked from booking shifts.

The date to work back from

Your last clean window closes when the first placement commencing on or after 1 October starts, and those engagements are already moving through your pipeline.

Confirm the final guide when the Home Office replaces the 16 July draft, because the extended-liability excuse routes are what your contract templates get drafted against. Then run everyone on your books through two questions: for each worker with time-limited permission, what is the date it ends, and which system raises it beforehand.

The pre-employment checks feature page covers the three prescribed check types and how expiry dates are tracked once a worker is on the books.