Right to work checks have changed, what employers need to know
On 1 October 2026 the right to work scheme stopped being an employer-only problem. It now covers agency workers, gig workers, zero-hours staff and individual sub-contractors, and liability can travel up a supply chain to businesses that never engaged the worker directly. If your hiring model relies on flexible labour in any form, the rules you were working to in September are not the rules you must work to now.
Here's what moved, who it catches, and what to do about it.
Right to work, what actually changed on 1 October?
Three things, and they stack.
First, scope. Right to work checks used to attach to people on a contract of employment. The scheme now extends to workers' contracts, individual sub-contractors and anyone sourced through an online matching platform. The government's response to its consultation on preventing illegal working confirmed that gig and platform work is now firmly in scope.
Second, who counts as an employer. Until now the duty sat with whoever held the employment contract, so a business using contractors or gig workers could fairly say 'they're not our employees' and leave it there. That line no longer works. If you engage someone under any of the arrangements above, you are their employer for right to work purposes, whatever your contract calls them.
Third, and this is the big one: the fine can now reach businesses that never hired the worker. Say you outsource some work to a supplier. That supplier passes it to a sub-contractor, who brings in an individual to do it. That individual turns out to have no right to work in the UK. Before October, that was the sub-contractor's problem; the new rules mean this can now be your problem too. If the work came from you and ended up with that person, you can be treated as their employer, and the penalty is up to £60,000 for each worker found working illegally. In short: you can be fined for someone you've never met, engaged by a company you may never have dealt with, because the work started with you.
The way you check hasn't changed. There are still four routes:
A manual check, where you see the original document (a passport, birth certificate or similar) and keep a copy.
A certified Digital Verification Service, for people with a valid British or Irish passport, where the technology confirms the passport is genuine and you confirm the person in front of you matches it.
A share code, for anyone with an eVisa, which you enter on the Home Office online service to see their status and photo.
The Employer Checking Service, for the cases none of the above can handle, such as someone with an application still being decided.
And the rules around the check haven't changed either. It happens before the person starts. A check that the person is who the document says they are happens on day one. If their permission has an end date, you diarise a follow-up. And you keep the records for as long as they work for you plus two years.
Same process. Far more people in scope.
Why does this matter more if you run an RPO or MSP model?
Because flexible workforces are exactly where the chain gets long.
Picture a typical contingent workforce:
The client needs people
An MSP manages the programme
A handful of agencies supply the workers
An umbrella or payroll company pays them
Then there's the worker.
Before October, one of those parties held the employment contract, so one of them did the check and carried the risk. Everyone else could leave it to them.
Now the fine can land on any of them.
So every business in that chain needs to know not just that a check happened, but that it was done properly, and be able to prove it.
The questions clients are starting to ask us are simple ones:
Who is actually doing the check, and can they evidence it?
If an agency checked a worker six months ago, can the client see that record?
If a check gets missed, who does the contract say pays the fine?
Do we even know about everyone working for us through a platform or a sub-contractor?
If the answer to any of those is 'probably' or 'not sure', that's the gap.
We've seen this up close. In most contingent programmes we've taken over, the right to work records lived in the agencies' systems, not the client's. The client knew a check had been done because the agency said so. Nobody had ever asked to see it. That was fine when the agency carried the risk alone. It isn't now.
What should you do if you haven't caught up yet?
It's the same list you'd have had in September. You just have less time to get through it.
Map your flexible workforce: Not the headcount on your HR system, the full picture: agency, contract, zero-hours, platform-sourced, sub-contracted. Most organisations find people in that list they weren't tracking as 'workers' at all.
Work out who does the checks: For each category, name the party doing the check, how it's recorded and who can see the record. If it's a supplier, ask for evidence rather than assurance.
Read the contracts: Agency terms, MSP agreements and sub-contractor arrangements written before October probably say nothing useful about chain liability. They need to.
Audit the process, not just the policy: A compliant policy document with an inconsistent day-one imposter check behind it doesn't give you a statutory excuse.
Train the people doing the checks: Hiring managers, onboarding teams and anyone who signs off a contractor start need to know the scope has widened.
How Vermelo handles right to work checks for clients
Where we run RPO or embedded solution for a client, right to work sits inside the process we manage, with checks, records and follow-up dates held in one place the client can see. Where we run an MSP, the supplier panel works to one standard and one evidence trail, so the client isn't relying on five agencies' five different approaches.
If you'd like a second pair of eyes on how your flexible workforce is checked and who holds the risk, talk to us.
Note - This article is market commentary, not legal advice. Right to work obligations depend on your specific arrangements and the law as it applies to them; take advice from a qualified immigration or employment lawyer before changing your processes.
Sources:
Employer brand, answered
Because it does most of the deciding before you get a say. Candidates in insurance, insurtech and financial services are usually weighing you against two or three named competitors, not the whole market, and they've formed a view from reviews, LinkedIn and your careers page before the first call. A strong employer brand makes that comparison quicker to win. A weak one shows up as longer time to hire, more declined offers and a pipeline full of people who applied everywhere.
A look at two things: what a candidate can find out about you, and what happens to them once they apply. The first half covers review sites, careers pages, job adverts, social channels and how your people talk about work. The second covers where applications drop off, how long each stage takes, why candidates withdraw and what nearly put your recent hires off. You come out of it with a short list of specific fixes and a clear view of whether your problem is positioning, process or visibility.
Both, and it fails when it's only marketing. Marketing owns the visible layer: the careers page, the content, the tone. Recruitment and hiring managers own what candidates actually experience: response times, interview quality, how offers and rejections are handled. When the two don't match, candidates believe the experience. Whoever owns the project needs the authority to change the process, not just the copy.
Vermelo is a UK talent solutions specialist delivering RPO, Project RPO, MSP, embedded talent (RaaS), total talent and talent advisory & consultancy. Named Best Recruitment Process Outsourcing (RPO) Business at the Global Recruiter Awards 2025. Part of the GWV Talent Solutions Group which includes Gerrard White Consulting and FlarePeople.