Right to work checks now cover contractors: what a UK founder must do before work starts

If your developer works wholly outside the UK, these new rules do not apply to you. The Home Office says so in its own words: “The Scheme applies to work or services carried out in the UK. Work performed wholly overseas would not fall within scope, solely because the organisation engaging the individual is based in the UK.”

The position changes if any of the work is carried out in the UK. From 1 October 2026, the right to work check must be completed before the worker starts, and a first breach can result in a civil penalty of £45,000 per worker.

This article is not legal advice. The operative claims below are based on gov.uk or legislation.gov.uk, with the relevant source identified so you can check the position for yourself. The Home Office also makes clear that it “cannot provide legal or HR advice on individual or business-specific cases or approve an organisation’s interpretation or compliance approach.”

Last updated: 2026-10-04

Key facts

In this article

• Does this apply to your developer, or not?
• What actually changed on 1 October 2026?
• How does a compliant check work, and what makes it a statutory excuse?
• What happens when the liability runs through a contract chain?
• How does this compare to the US rules you may already follow?
• What should you do before the next contractor starts?
• Where RocketDevs fits
• Conclusion
• Frequently asked questions

Does this apply to your developer, or not?

Start with the territorial question because, for many founders, it ends the enquiry immediately. The Scheme covers work carried out in the UK. If a developer in Cape Town, Lagos or São Paulo never performs work in the UK, the Scheme does not apply to that arrangement. The fact that the developer is engaged by a UK company does not, by itself, bring the arrangement within scope.

The Home Office makes this clear in two places. In the scope section, it says the guidance is not intended to cover arrangements where “the work or services are not carried out in the UK” in the Employer's guide to right to work checks, p.15. Annex C makes the point even more directly under “Are checks required for overseas workers?” It states: “The Scheme applies to work or services carried out in the UK. Work performed wholly overseas would not fall within scope, solely because the organisation engaging the individual is based in the UK.”

Annex C was added to the guidance published on 1 October 2026, when the new rules came into force. That helps explain why much of the earlier coverage focuses on the expansion to contractors without addressing wholly overseas work. For example, Personnel Today's 25 September 2026 guide explains that the Scheme will extend beyond traditional employees to contractors, agency workers, sub-contractors and certain gig economy workers, but does not address work performed outside the UK. Howes Percival's briefing similarly focuses on the expanded liability. Lewis Silkin did address the territorial point in its 29 September 2026 analysis, stating that the Scheme does not apply where the work or services are carried out outside the UK.

The practical question is therefore not simply whether you call someone a “contractor”. You need to look at where the work happens and then examine the substance of the arrangement.

Three points in the table deserve particular attention.

A personal service company is not automatically a shield

The Home Office's Example 6 describes a graphic designer engaged through their own personal service company and concludes that the client company does not need to carry out a right to work check. That example should not be treated as a blanket exemption.

Annex C specifically says that using a personal service company does not, by itself, determine whether an arrangement falls within the Scheme. It also states that there is no blanket exclusion simply because someone is described as a contractor, freelancer or consultant, or provides services through a PSC. The starting point is the substance of the arrangement and how it operates in practice.

For a founder, the practical takeaway is simple: if a one-person company is providing an individual's personal services under an arrangement that looks like direct personal work, the company structure alone does not answer the question.

An IR35 determination does not settle the right to work question

Your IR35 determination is another separate issue. The Home Office states that “An IR35 determination is a tax assessment and does not determine right to work checking responsibilities under the scheme.”

The guidance also warns that its test should not be assumed to be identical to the definition of a worker under the Employment Rights Act 1996. In other words, an arrangement can raise different questions under tax, employment rights and right to work legislation.

That distinction matters if you already use IR35 processes for UK contractors. Getting the IR35 position right does not automatically mean you have discharged your right to work obligations. The same general problem appears in the US contractor-classification rules discussed in our guide to contractor classification for remote developers.

The label is not the test

Calling someone a “contractor”, “freelancer” or “consultant” does not decide whether the Scheme applies. The guidance says that the contractual description or label adopted by the parties will not, by itself, determine their responsibilities. Instead, the Scheme applies according to the objective features of the working arrangement.

The Home Office identifies eight factors to consider. These include whether the individual personally carries out the work, who engages or supplies them, who decides who performs the work, whether someone can be replaced, and whether substitution is permitted or controlled.

No single factor is determinative. The question is how the arrangement operates in practice.

What actually changed on 1 October 2026?

The duty is no longer limited to traditional employment. Section 48 of the Border Security, Asylum and Immigration Act 2025 widened the definition of “employer”, introduced liability that can reach up a chain of contracts, and came into force on 1 October 2026 with no general grace period.

The process for carrying out a right to work check did not fundamentally change. Who may be responsible for carrying out one did.

What section 48 changed

The statutory mechanics are set out in section 48 of the Border Security, Asylum and Immigration Act 2025, at the revision valid from 1 October 2026.

A new section 14A widens the meaning of “employer”. It extends the existing references to a person employing another person to cover someone who engages an individual under a worker's contract, engages an individual sub-contractor, or operates an online matching service that provides an individual service provider's details to potential clients or customers.

A new section 15A introduces extended liability. It can apply where a person engages an individual under a contract that permits substitution, contracts to provide work or services and then subcontracts that work, or operates an online matching service where the resulting match leads to a contract.

In these circumstances, the person can be treated as employing the individual who actually provides the work or services, even where there is no direct contract between them and the person does not know that individual is carrying out the work. The provision is not confined to the first link: it applies “regardless of whether that contract is the first or any other contract in a chain of contracts”.

In practical terms, the change is less about changing the check itself and more about expanding the circumstances in which a business can be responsible for making sure the check has happened.

The rules are not retrospective

The new rules do not simply apply to every existing contractor relationship from 1 October.

For employment under a worker's contract, engagement of an individual sub-contractor, or an online matching service, a civil penalty can only be imposed where the employment commenced on or after 1 October 2026.

For extended liability, the relevant contractual arrangements must have been entered into on or after 1 October 2026.

The Home Office is explicit about the date that matters: the relevant date is when the contractual arrangement is entered into, not when the work starts or continues. An arrangement entered into before 1 October 2026 is therefore not brought into scope merely because the work continues afterwards.

Renewals need particular attention

Renewing or changing an existing contractor agreement is where the position becomes less straightforward. The Home Office says that a change to an existing arrangement should not automatically be assumed either to bring it into scope or to leave its position unchanged simply because it is described as a variation, renewal or extension.

Instead, organisations should consider whether the change has the effect of creating a new contractual arrangement on or after 1 October 2026.

For founders, that means the next renewal or material change to a contractor agreement is a point at which the right to work position should be checked again. The fact that the original agreement predates 1 October does not, by itself, answer the question.

What are the penalties?

The headline £60,000 figure is the repeat-breach amount, not the starting penalty.

The Code of practice on preventing illegal working, pp.32-34, sets out the penalty levels:

The code is the seventh version of the instrument issued under section 19 of the Immigration, Asylum and Nationality Act 2006. It is particularly important if a penalty is challenged because the County Court, and the equivalent court in Scotland, is required to have regard to the code when determining an appeal against liability for a civil penalty.

There is no general grace period. The Home Office states that the requirements apply from 1 October 2026 and that enforcement activity will continue to be intelligence-led.

What does enforcement look like?

The Home Office's most recent anonymous national report records 561 penalties issued against 773 illegal workers, with a gross value of £32,615,000. The publication contains inconsistent date references between its title, body and URL, so the figure is more useful here than assigning it to a specific quarter.

At a wider level, the government's consultation response reports more than 2,400 civil penalties in 2025, with fines exceeding £130 million. It also reports more than 17,400 visits and more than 12,300 arrests between July 2024 and December 2025, representing increases of around 77% in visits and 83% in arrests compared with the previous period.

The government says that, for the first time, the expansion covers businesses hiring gig-economy and zero-hours workers in sectors including construction, food delivery, beauty salons, courier services and warehousing. Software is not specifically named in that list. That does not, however, exclude UK software contractors who fall within the statutory definition. A software contractor working personally in the UK can still be within scope.

How does a compliant check work, and what makes it a statutory excuse?

There are three prescribed routes for completing a right to work check. All must be completed before the worker starts, and all produce a record that must be kept for the duration of the engagement plus two years.

The statutory excuse is not the check itself. It is the evidence that the check was completed correctly, using the prescribed process, and at the right time.

The Home Office states that employers must complete one of three checks before the worker commences:

• A manual document-based right to work check.
• A Home Office online right to work check.
• A right to work check using a registered Right to Work digital verification service provider (RtW DVSP).

The terminology has also changed. The previous language around identity service providers and IDVT has been replaced by RtW DVSP, and digital checks using this route require the provider to be registered.

Which route should you use?

The employer cannot simply choose whichever route it prefers. All prospective workers should be asked to demonstrate their right to work, but employers cannot mandate the method by which an individual does so. The individual must have a reasonable opportunity to demonstrate their right to work by another permitted route.

There is one important exception. Someone who has been issued an eVisa can only evidence their right to work through the Home Office online service. Where an individual has an eVisa, the employer must use that service.

Can someone else carry out the check for you?

There is an important distinction between delegating a check and outsourcing it.

You can delegate the task to one of your own employees or another individual acting on your behalf, provided that person operates under your control and direction and remains accountable to you.

You generally cannot establish a statutory excuse simply because an external recruitment agency or professional adviser tells you that it carried out the check. The exception is a prescribed digital check carried out using a registered RtW DVSP.

The code of practice is explicit that an employer does not establish a statutory excuse by relying on an independently completed check by an external third party, such as a recruitment agency or professional adviser.

That means a recruiter saying “we've checked their right to work” is not enough on its own. The recruiter must either be acting as your properly controlled delegate or the check must have been completed through the prescribed registered DVSP route.

For a growing company, this is also a procurement issue. If a supplier says it handles right to work checks, ask who actually performs the check, under what authority, and whether any digital provider involved is registered.

What does a registered digital verification provider actually do?

Digital verification is optional, but if you choose this route, the DVSP must be registered on the Office for Digital Identities Attributes (OfDIA) register and must be able to provide right to work checks.

Using a provider does not transfer the legal responsibility to the provider. The Home Office states that the employer remains responsible for ensuring that the check is completed according to the prescribed requirements.

Digital verification is not a universal replacement for manual checks. Someone who does not have a valid passport, or who chooses not to use that route, must be given the appropriate alternative. Employers must not treat someone less favourably because they do not hold a valid passport.

Keep the process consistent

Right to work checking also creates a discrimination risk. A separate statutory code on avoiding discrimination in right to work checks came into force on the same date.

It is unlawful to discriminate against people on the basis of protected characteristics, including race, when carrying out right to work checks. If a discrimination claim succeeds, the Tribunal will normally order the payment of compensation, and there is no upper limit on that compensation.

The practical approach is consistency. Use the same process for everyone, including British citizens. Do not decide who needs to prove their right to work based on their name, accent, appearance or assumptions about their nationality.

Our guide to verifying a remote developer's identity covers the broader process-design considerations for applying identity checks consistently.

What destroys the statutory excuse?

Completing a check is not enough if the process itself was defective. The code of practice identifies circumstances in which an employer will not have a statutory excuse.

The safest way to think about the statutory excuse is therefore not “we saw their passport” or “the recruiter checked them.” It is: we completed the prescribed check, before the work started, using the correct route, established that the evidence belonged to the individual, recorded what we did, and retained that evidence for the required period.

What happens when the liability runs through a contract chain?

If you are contracted to deliver work to a client and use another company's people to deliver it, you can be treated as their employer for right to work purposes even if you have no direct contract with the individual and may not know who they are.

There is a way to establish a statutory excuse against this extended liability. But it requires three prescribed measures to be in place before the work starts, together with evidence that they are actually operating.

Who does extended liability catch?

The Home Office identifies three situations where the extended liability provisions can apply.

The important point is that the legislation can reach beyond the first contractual relationship. A person can be treated as employing someone who personally provides the work even where there is no direct contract with that person and the organisation does not know that they are doing the work.

Who is outside extended liability?

Extended liability is not intended to apply to every business that buys services from another business.

The Home Office specifically excludes a client, customer or end user purchasing work or services for its own internal operations.

For a software business, the distinction is therefore fairly sharp. If you buy development work for your own product, you are the end user. If you sell development work to your clients and use another supplier to deliver it, you can be part of the contractual chain.

That distinction matters because a software agency, dev shop or consultancy can have responsibilities that a company simply buying development services for its own internal product does not.

How do you establish a statutory excuse?

The Home Office sets out three prescribed requirements for someone seeking protection against extended liability.

All three must be addressed before the work commences, and you must be able to provide evidence of compliance if requested.

Your existing contract is not enough

The written statement is a particularly important requirement. The Home Office does not prescribe a particular set of words, but the organisation must produce a written statement containing the required terms.

It is not enough to point to equivalent wording somewhere else in an existing contract. The Home Office specifically says that existing vendor onboarding and due diligence processes cannot replace this requirement, although they can form part of the wider evidence showing compliance.

The statement needs to cover five areas:

The important point is that a contractual promise is not the same thing as compliance.

The Home Office says an organisation should be able to demonstrate that appropriate arrangements are operating effectively in practice and that it has taken reasonable and proportionate steps to satisfy itself that right to work requirements are being met.

There is no prescribed audit frequency and no single minimum evidence package that applies to every arrangement. The assessment is not limited to whether a warranty or contractual provision exists.

Substitution needs its own process

Substitution is one of the areas most likely to be overlooked because it can sit inside a standard contractor clause without anyone considering what the clause means operationally.

Where a contract permits substitution, the statutory excuse requires processes to be in place before work starts.

If substitution is prohibited by the contract but happens anyway, the Home Office instead considers whether the appropriate check was carried out on the worker who was actually engaged.

A contract that says nothing about substitution is not automatically treated as permitting it. The Home Office says that whether a right of substitution exists depends on the contractual arrangements in place.

Identity verification does not have to mean constant surveillance

The identity requirement is intended to be proportionate. You need systems and processes that provide reasonable assurance that the person actually doing the work is the same person whose right to work was checked.

Examples include:

Where re-verification at intervals is used, the Home Office recommends that it occurs at least once in any 24-hour period or shift of work.

An organisation can rely on another party's identity systems, provided it takes reasonable steps to satisfy itself that those systems are effective.

Importantly, an organisation further up the chain does not have to carry out a right to work check on every individual personally. The relevant checks and controls can operate through the contractual chain, provided the prescribed requirements are met.

Extended liability does not automatically make everyone liable

There is an important limitation here.

The Home Office says it would not normally expect to issue civil penalty notices to more than one employer in a contractual chain for the same illegal worker. Extended liability does not mean that every organisation in the chain automatically receives a penalty.

The direct employer remains the organisation normally associated with the liability. Where that employer cannot be identified, the Home Office may pursue another organisation in the chain where the prescribed requirements have not been met.

That makes the statutory excuse important for organisations sitting further up the chain. You are not automatically liable simply because you are somewhere in the contractual structure, but you need to be able to demonstrate that you met the prescribed requirements if the Home Office looks beyond the direct employer.

The Home Office did not give businesses a simple point-of-failure rule

The consultation shows that businesses wanted more certainty about how liability would be allocated within a chain.

Of 70 responses specifically addressing how liability should be determined by the point of failure, 34 disagreed with the proposed approach. Respondents often wanted the Home Office to clarify liability upfront. Twenty respondents agreed.

The final framework therefore gives businesses a set of prescribed requirements rather than a simple rule saying that one particular organisation will always be liable when something goes wrong further down the chain.

For a founder, the practical lesson is straightforward: if you are selling services to a client and using another business's people to deliver them, do not treat right to work as a problem belonging only to your supplier. Build the prescribed contractual terms, substitution controls and identity-verification process into the relationship before the work starts, and keep evidence that those controls are actually working.

How does this compare to the US rules you may already follow?

If you already run Form I-9 checks in the US, do not assume the same approach will work in the UK. The two systems look similar at a high level, but they place responsibility in different places.

In the US, the I-9 obligation generally sits with the employer, while independent contractors are treated differently from employees. The UK’s expanded rules can place responsibility on the organisation engaging the worker and, in some cases, further up a contract chain.

The timing is also different. Under 8 CFR 274a.2, US employers generally complete the document examination within three business days of the hire. The UK check must be completed before the worker starts.

The potential penalties are different too. The UK’s starting point for a first breach is £45,000 per worker, rising to £60,000 for a repeat breach. US penalties are substantially lower on a per-worker basis.

The US statutory framework, 8 U.S.C. 1324a, makes it unlawful to hire, recruit or refer for a fee an unauthorised worker while knowing that they are unauthorised, or to hire without complying with the required verification process. Good-faith compliance can establish an affirmative defence. USCIS states the obligation broadly: every US employer that recruits, refers for a fee or hires someone for employment in the US must complete Form I-9.

UK and US rules at a glance

The UK figures come from the Code of practice, p.32. The US figures come from 28 CFR 85.5. The Department of Justice confirmed on 15 July 2026 that the US penalty amounts would not increase for 2026 because there was no cost-of-living adjustment. No currency conversion is used here because the purpose is to compare the scale and structure of the penalties, not their value in another currency.

The US and UK put responsibility in different places

The US regulations expressly distinguish employees from independent contractors. They also state that, for independent contract labour or services, the employer is the independent contractor or contractor rather than the person or entity using that contract labour.

That is a major difference from the UK's expanded regime. The UK rules expressly bring certain worker contracts and individual subcontractors into scope. They can also extend responsibility further up a contract chain where the statutory conditions are met.

The knowledge requirement is an even sharper distinction.

Under US law, someone who uses a contract, subcontract or exchange to obtain an unauthorised worker's labour can be treated as having hired that worker where they know the person is unauthorised. Knowledge therefore plays a central role in this part of the US regime.

The UK's new section 15A does not use the same knowledge test. A party can be treated as employing someone further down the chain even where it does not know that the person is providing the work. Instead, the UK regime gives the organisation a route to protect itself through a statutory excuse. That protection depends on completing the prescribed checks and maintaining the required evidence.

So, if your compliance instinct is, “We did not know,” that is not a safe assumption under the new UK rules. The UK question becomes whether you took the prescribed steps to establish a statutory excuse.

Do not confuse right-to-work rules with worker classification

There is also a third question that sits outside both right-to-work regimes: how should the worker be classified for tax purposes?

In the US, the IRS looks at the degree of control and independence between the business and the worker. Its guidance considers factors covering behavioural control, financial control and the type of relationship.

The UK has its own tax classification rules under IR35. But the Home Office has made clear that an IR35 determination does not decide who has responsibility under the right-to-work Scheme.

These are therefore three separate tests:

• Right to work: does the person have permission to work, and who is responsible for checking it?
• Tax classification: is the person an employee or independent contractor for tax purposes?
• UK IR35: do the off-payroll working rules apply to the engagement?

One answer does not automatically determine another. A worker can be treated one way for tax purposes and still fall within the UK's right-to-work rules.

For a founder using US processes as a starting point, the practical lesson is simple: do not copy the I-9 workflow and assume it satisfies the UK Scheme. Check first whether the UK rules apply to the arrangement, identify who carries the responsibility, complete the prescribed check before work starts, and retain the evidence needed for the statutory excuse.

What should you do before the next contractor starts?

There are four practical steps to take. The first answers the question many founders will have after reading this article: does the Scheme apply to my developer at all?

1. Record the territorial answer

If your developers work wholly outside the UK, the Scheme does not apply to them. Write that conclusion down once and make it available to the people who handle sales, operations and contractor onboarding.

Your internal FAQ should include the relevant Annex C wording so your team can answer the question consistently when a client asks about UK right-to-work requirements. This is a small piece of documentation, but it prevents the same question from turning into a new compliance exercise every time.

2. Map every UK engagement by how it actually works

Do not classify engagements based only on labels such as “contractor”, “consultant” or “developer”. For each UK engagement, answer three questions:

• Is the individual personally performing work in the UK?
• Are we contracted to provide that work or service onwards to a client?
• Does the contract permit someone else to perform the work?

A yes to the first question can bring the worker within the Scheme and require a right-to-work check.

A yes to either of the other two questions can create extended liability further up the contract chain. That is where the additional contractual requirements, substitution controls and identity-verification measures become important.

3. Put renewals on your compliance calendar

Do not assume that an arrangement entered into before 1 October 2026 becomes subject to the new rules simply because the work continues after that date.

Instead, review what happens when an existing arrangement is renewed, extended or materially changed. The relevant question is whether the change creates a new contractual arrangement after 1 October 2026.

That makes your renewal calendar an important part of your compliance process. Flag UK contractor agreements before they reach renewal or material variation so you can review whether the new rules apply.

4. Decide your check route before you need it

Choose how your organisation will complete right-to-work checks before the next contractor arrives. Then factor the cost and administration into your hiring process.

The consultation responses show how widely the cost and time can vary. Digital verification was reported at between £0.72 and £41.36 per worker, with a median cost of £5 among 27 respondents. Among 90 respondents, reported completion times ranged from one minute to four weeks. Manual checks remained the most common approach, accounting for 46% of 104 responses.

The wide range is itself useful information. A check can be inexpensive and quick when you already have a defined process. It can become much more expensive and time-consuming when the route is decided separately for every hire.

Two things not to do

Do not ask the Home Office to approve your specific approach. The Home Office states that it cannot approve individual contractual clauses or business-specific compliance frameworks. Your process therefore needs to be built around the published legislation, guidance and statutory codes rather than an expectation that the Home Office will sign off your interpretation.

Do not assume your recruiter’s check automatically protects you. A third party completing a check does not necessarily give you a statutory excuse. The prescribed arrangements matter. In particular, the third party must either be a registered Right to Work digital verification service provider where that route applies, or be acting as your delegate under your control and direction.

The practical takeaway

If you are about to engage a developer who will work in the UK, start with the territorial question. Then establish how the engagement actually works, whether you are part of a contract chain, and whether substitution is possible.

From there, decide who will complete the check, which prescribed route they will use, how the evidence will be retained and what happens when the worker's permission expires.

If you are setting up a UK-entity engagement from scratch, the payment and paperwork side is covered in how to pay a developer in another country, while the broader hiring process is covered in how to hire offshore developers.

Where RocketDevs fits

Most RocketDevs clients will finish this article with a straightforward answer: their developers work wholly outside the UK, so the Scheme does not apply to those engagements. That is the useful conclusion, and it is better to state it clearly than to create a compliance problem simply to have something to sell.

RocketDevs does, however, run its own developer-vetting process. Each developer completes 6-8 hours of assessment, with the current cohort acceptance rate in the top 2%. Identity verification is also part of onboarding. Developers work remotely from their own countries with full EU timezone overlap, and new placements include a 14-day money-back trial, honoured 100% of the time.

That vetting process is not a substitute for a UK right-to-work check or a statutory excuse. If you engage a contractor to perform work in the UK, the responsibility to complete the prescribed check remains yours where the Scheme applies. The check must be completed before the worker starts, and you cannot create a statutory excuse simply by relying on an independent check carried out by another organisation unless the arrangement falls within one of the prescribed routes, such as a registered Right to Work digital verification service provider.

The Home Office cannot approve an organisation's individual compliance framework, and RocketDevs cannot do so either. Where an arrangement is genuinely marginal, take appropriate legal or HR advice. Where the developer works wholly outside the UK, start with the Annex C position set out earlier in this article.

The point is not to make every contractor engagement look like a UK compliance problem. It is to identify the engagements where the rules actually apply and make sure the right process is in place before work begins.

Conclusion

For a founder, the important question is not whether the UK's right-to-work rules have become more complicated. It is whether your way of hiring developers puts you inside them.

Start with geography. If your developer works wholly outside the UK, the new Scheme does not suddenly apply because your company, your client or your contract is UK-based. That is the first answer to establish, document and communicate internally.

If your developer does work in the UK, stop relying on labels. “Contractor”, “consultant”, “freelancer” or “developer through a company” does not tell you who carries the responsibility. Look at what the person actually does, who has contracted for the work, whether you are passing that work on to a client, and whether someone else can perform it.

That matters because the new rules can move responsibility beyond the person who directly engages the worker. If you sell development services to a client and use another business's people to deliver them, your supplier's compliance is no longer something you can simply leave in the supplier's inbox. If substitution is allowed, you also need to know who is actually turning up to do the work.

The good news is that this does not require founders to turn every international hire into a six-week compliance project. Build the decision into your hiring workflow.

Before the next contractor starts:

• Establish where the work will be performed.
• Map the engagement by how it actually operates, not what the contract calls it.
• Identify whether you have direct or extended responsibility.
• Have the prescribed checking process ready before the first day where the Scheme applies.
• Keep the evidence and review the position when contracts are renewed or materially changed.

And keep one distinction clear: developer vetting is not right-to-work compliance. You can have an excellent technical assessment, thorough identity verification and a trusted recruitment partner and still need to establish your own statutory excuse.

For founders building distributed teams, that distinction is ultimately useful rather than burdensome. It lets you separate the engagements that genuinely need attention from the ones that do not.

So don't start by asking, “How do I comply with every new UK rule?” Start by asking, “Does this rule actually reach this developer, under the way we are engaging them?” Once you can answer that question, the rest becomes a process rather than a panic.

Frequently asked questions

Do I need a right to work check for a contractor based overseas?

Not where the work is performed wholly outside the UK. The Home Office states that “The Scheme applies to work or services carried out in the UK. Work performed wholly overseas would not fall within scope, solely because the organisation engaging the individual is based in the UK.” If any part of the work is carried out in the UK, that answer changes.

What is the penalty for getting it wrong?

The starting point is £45,000 per worker for a first breach within three years and £60,000 per worker for a repeat breach, before the two £5,000 mitigations for reporting and co-operation. A first-breach employer with effective checking practices and both mitigations can receive a Warning Notice instead. No Warning Notice is available for a repeat breach. Serious cases can also carry criminal liability of up to five years' imprisonment and an unlimited fine.

Does a limited company contractor need a check?

There is no blanket exclusion. The guide's Example 6 says no check is required where a client contracts with a designer's own personal service company, but Annex C says a personal service company “does not, in itself, determine whether an arrangement falls within scope”. The starting point is the substance of the arrangement and how it operates in practice.

Treat the example as an illustration rather than a safe harbour. The fact that a contractor invoices through a limited company does not, by itself, settle the right-to-work question.

Can I do the check after they start?

No. The statutory excuse requires the prescribed check to be completed before the worker commences employment. For extended liability, the prescribed requirements must also be complied with before the work commences.

This is one of the clearest differences from the US regime, where Form I-9 is completed within three business days of the hire. Under the UK Scheme, “we'll sort the paperwork out after their first day” is not a safe compliance process.

Am I responsible for a contractor supplied by another company?

Potentially. If you are simply buying development work for your own business, you are generally the end user rather than part of an extended-liability chain. But if you have contracted to provide work or services to a client and use another business's people to fulfil that obligation, the extended-liability rules can apply further up the chain.

Where they do apply, do not rely only on a contractual promise that your supplier carries out right-to-work checks. You may need written contractual requirements, controls over further subcontracting, audit rights, enforcement provisions and a way to verify that the people actually performing the work are the people whose right to work was checked.

The key question is therefore not simply “Who hired this contractor?” It is “What role does our business play in the contract chain?”

James Hitch, COO at RocketDevs.LinkedIn

Sources

• Home Office, Employer's guide to right to work checks, 1 October 2026, 83 pages. Publication page: GOV.UK
• Home Office, Code of practice on preventing illegal working: Right to Work Scheme for employers, 1 October 2026
• Home Office, Avoiding discrimination while preventing illegal working: code of practice, 2026, in force 1 October 2026
• Border Security, Asylum and Immigration Act 2025, section 48, legislation.gov.uk, revision valid 1 October 2026
• UK Parliament Bills API, bill 3929, Royal Assent 2 December 2025
• Home Office, Extending the Right to Work Scheme, consultation outcome, 30 June 2026, and the government response
• Home Office, Illegal working civil penalties: anonymous UK report
• 8 U.S.C. 1324a, United States Code 2024 Edition, via GPO
• 8 CFR 274a.1 and 8 CFR 274a.2, eCFR
• 28 CFR 85.5, eCFR, and Civil Monetary Penalties Inflation Adjustments for 2026, 91 FR 43405
• USCIS I-9 Central
• IRS, Independent contractor (self-employed) or employee?, last updated 19 May 2026
• Rebecca Tester, Right-to-work checks: A quick guide to October's changes, Personnel Today, 25 September 2026
• Naomi Hanrahan-Soar, Tom McEvoy and Kathryn Denyer, What's changed in the updated Employer's guide to right to work checks?, Lewis Silkin, 29 September 2026
• Bilal Ehsan and Bineeta Joshi, Right to work checks are expanding from 1 October 2026, Howes Percival, 2 July 2026