Right to work checks: bank and agency care staff

Your employed staff list has a right to work check against every name, done and dated. The bank list is patchier. There may be nothing at all against the carer who picked up two nights in August through a matching app.

On 1 October 2026, section 48 of the Border Security, Asylum and Immigration Act 2025 extends the right to work scheme beyond employment into other working arrangements. The job for a registered manager is to work out who on next month's rota sits inside the new scope.

What section 48 changes for care providers on 1 October

Commencement is fixed by SI 2026/683 (C. 57), regulation 2, made 24 June 2026:

"Section 48 (extension of prohibition on employment to other working arrangements) of the Border Security, Asylum and Immigration Act 2025 comes into force on 1st October 2026".

Section 48 inserts new sections 14A and 15A into the Immigration, Asylum and Nationality Act 2006. Section 14A brings three categories into scope: engagement under a worker's contract, engagement of an individual sub-contractor, and an online matching service providing a service provider's details to potential clients or customers.

Section 14A(3) defines a worker's contract as one other than a contract of service or apprenticeship, under which the individual undertakes to perform work or services personally, and where the engager is neither a client nor a customer of any profession or business undertaking carried on by that individual.

Section 14A(5) extends that to contracts which are express or implied, oral or in writing. On the face of the definition, a shift agreed by text message and worked in person can fall inside it. Genuine self-employment is carved out at 14A(4), where you are the client or customer of the individual's own business.

The third category lands on a group unlikely to be reading about it. An introductory agency that keeps a register of carers, runs an online matching enquiry service and charges a fee or commission for the match meets all three limbs of the online matching service definition. CQC confirms that agencies of this kind sit outside registration where they have no ongoing role in directing the care. So on 1 October a business with no CQC registration, and in most cases no history of running these checks at all, becomes responsible for them. The Home Office equality impact assessment of 30 June 2026 names the sector on that basis, observing that "in areas like care or hospitality, it is linked to the use of intermediaries".

Section 15A, the other insertion, can extend liability for a breach beyond the party that made it. Whether it reaches a particular provider turns on the contracts in place: a provider sub-contracting delivery of a local authority care contract sits in different territory from one taking agency staff onto its own rota. Put your own arrangements to your legal adviser.

What does not change for employed care staff and agency workers

Employed care staff are already inside the right to work scheme, and nothing about that check changes.

Agency care workers supplied by an employment business stay where they are. The Home Office draft employer's guide of 16 July 2026 states it plainly:

"The employment business is the individual's employer for the purposes of the Right to Work Scheme and is therefore responsible for the right to work check".

The checks a care provider still runs for itself when it takes agency staff onto a rota are covered in locum compliance checks.

The guide in force today is the 26 June 2025 version. The 16 July 2026 version quoted here is a draft, and the final text has not yet been published. Check the final text when it is published before relying on any of it for a specific arrangement.

The retrospection boundary and the £45,000 penalty per worker

The draft employer's guide draws a clear line:

"In relation to employment under a worker's contract, as an individual sub-contractor or in the case of an online matching service providing the details of a service provider to clients or customers, a civil penalty may only be imposed where the employment commenced on or after 1 October 2026".

There is no requirement to go back through the bank list and re-check everyone engaged before that date. A care provider holding a first-engagement date against every name can sort the two groups quickly. A care provider without those dates has a records problem to solve first.

The Home Office code of practice in force from 13 February 2024 sets the civil penalty at £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years. It applies per worker, so a branch that engaged four people under the same faulty process faces four separate penalties.

Digital right to work checks do not become mandatory

Nothing in section 48 requires a digital check. From the draft employer's guide:

"Whilst it is not mandatory to conduct right to work checks digitally in this way, if an employer chooses to do so, it is mandatory that the DVSP is registered on the Office for Digital Identities Attributes (OfDIA) register, and that they are able to provide right to work checks".

Three routes remain open: a manual document check, a Home Office online check, and a check through a right to work digital verification service provider, or RtW DVSP. Each one gives you the statutory excuse, meaning a defence against the civil penalty if the worker turns out not to have the right to work.

If you take that third route, the verification supplier has to appear on the DVS register operated by the Office for Digital Identities and Attributes, established under section 32 of the Data (Use and Access) Act 2025. Registration under section 33(4) is service-specific. The entry has to cover right to work checks specifically, so ask any supplier what its entry covers.

Responsibility does not move to the supplier:

"Where an employer uses a RtW DVSP, the employer (and not the RtW DVSP) remains responsible for ensuring that the check is carried out in accordance with the prescribed requirements".

That is the boundary a compliance system works inside. A compliance record holds each check against the named worker, and real-time monitoring shows which of those checks are still current. Credentially does not take on the statutory duty, and no supplier should suggest it can.

Bank and casual care staff: reading the statute on its face

Take this as a reading of the legislation rather than as guidance. The Home Office has published nothing addressed specifically to bank staff in adult social care, so what follows is what section 14A appears to cover on its face. Take your own advice on your arrangements.

The bank arrangements to look at are the ones that are not contracts of service. Where the individual works personally, and your organisation is not a client or customer of a business that individual runs, the arrangement falls within the 14A(3) definition as drafted. Because 14A(5) reaches implied and oral contracts, an unsigned arrangement is not outside it.

For the worker, the change is small and repetitive. Someone picking up shifts across three care providers in a month can expect to prove their right to work three separate times. It goes wrong when a passport is requested in a staff room ten minutes before a shift starts, by a senior who has never run one. The check belongs before the shift is offered.

Four things to sort on the rota before 1 October

List everyone who works shifts in your services and is not on a contract of employment, with the arrangement type and first-engagement date against each name.
Separate engagements that began before 1 October from anything starting on or after, because the civil penalty applies only to the latter.
Identify which suppliers are employment businesses and which are introductory agencies or matching platforms, then ask the second group about section 48.
Decide your route for new engagements: manual document check, Home Office online check, or an RtW DVSP.

What that record needs to hold is set out in building CQC evidence that passes inspection.

Who on your rota comes into scope on 1 October