From 1 October 2026 the illegal working regime stops being about employees. It reaches workers engaged under a worker's contract, individual sub-contractors and the online platforms that match them to work — and liability runs up the contractual chain. Penalty levels do not change. What changes is how many people in your supply chain you must now answer for, and how little time is left to map them, check them and document it.
On This Page
Two Duties, One Consequence
Two things, and they are separate. Every employer must carry out a prescribed right to work check before work starts, and keep the evidence — that is what buys the statutory excuse against a civil penalty. Sponsors carry a second, heavier set of duties owed to the Home Office in exchange for the licence. Failing the first costs money. Failing the second costs the licence, and with it every sponsored worker.
Most employers meet immigration compliance as a form-filling exercise: photocopy a passport, put it on file, move on. That understanding was never quite right, and from 1 October 2026 it is actively dangerous. The duty is defined by statute, the defence is defined by a Code of Practice, and both are about to reach a population of people most businesses have never checked at all.
This page sets out what the law requires of an ordinary employer today, what changes in October, what a breach costs, what a sponsor licence adds on top, and how a penalty is challenged. Figures and dates are given with their source, because in this area the difference between a starting point and a statutory maximum is £15,000 per worker.
Who You Must Check From October
Section 48 of the Border Security, Asylum and Immigration Act 2025 extends the prohibition on illegal working beyond the contract of employment. It was commenced by the Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026, made on 24 June 2026, which provides that section 48 comes into force on 1 October 2026. Until that date the older position holds: the civil penalty scheme bites on employees, and on nobody else.
Workers, Sub-Contractors and Platforms
The extended definition catches three arrangements. The first is engaging an individual under a worker's contract — the limb (b) worker, familiar from employment law and common in agency, hospitality and construction. The second is engaging an individual sub-contractor who provides services under their own name. The third is an online matching service that supplies the details of a service provider, which is how most gig platforms operate.
- List every individual who works for you outside a contract of employment: agency staff engaged directly, self-employed contractors, platform-sourced labour.
- Decide, for each, who is doing the check — you, the agency, or the platform — and record the answer in writing.
- Amend contracts and onboarding so a check is completed before the first engagement, not after the first invoice.
- Brief the people who actually onboard, because the duty is discharged at that desk and nowhere else.
Liability Up the Contract Chain
Section 48 inserts new sections 14A and 15A into the Immigration, Asylum and Nationality Act 2006, and section 15A creates liability that runs up a contractual chain. A business that never met the worker can be answerable for them. Substitution clauses — the standard device for keeping a contractor at arm's length — are expressly within scope, so the clause that protects you from employment status does not protect you here.
There is one piece of good news, and it is worth acting on. For the new categories a civil penalty may only be imposed where the engagement began on or after 1 October 2026. Arrangements already running are not retrospectively exposed. That makes the next few weeks the cheapest moment to fix the process, and every engagement started after commencement the expensive one.
How a Compliant Check Is Done
A right to work check only works if it is one of the three prescribed forms, done before work starts, and evidenced. Anything else — a look at a passport, a verbal assurance, a scanned document with no record of when it was seen — leaves you with no statutory excuse, however honest the intention. The operative guidance is the Home Office employer's guide to right to work checks of 26 June 2025.
The Three Prescribed Routes
- Manual document check. Original List A or List B documents, checked in the person's presence, copied in a format that cannot be altered, and dated.
- Home Office online check. The individual generates a share code; you use the employer portal and must satisfy yourself that the photograph shown is the person in front of you, in person or by video call.
- Digital identity verification. Available only for holders of valid British and Irish passports, and only through a certified provider. Everyone else needs one of the other two routes.
Records are kept for the duration of the employment and two years after it ends. The third route is the one most often misunderstood: because it is limited to British and Irish passport holders, a business cannot standardise on it, and must be careful that offering a slower route to everyone else does not become less favourable treatment.
eVisas and the Expired BRP Problem
Biometric residence permits stopped being issued on 31 October 2024 and expired on 31 December 2024. Holders now have an eVisa. The guidance is unambiguous that a manual check of an expired BRP establishes nothing: the individual can still use the document to access the online service, but the employer must run the online check to gain a statutory excuse.
A filed photocopy of an expired BRP looks like compliance, files like compliance and audits like compliance. It is not compliance. This is the single most common defect we see on a Home Office visit, because nothing about it feels wrong at the time — the document was genuine, the person was entitled to work, and the file looks complete. The excuse is still absent, and the penalty still follows.
Follow-up checks are needed only where permission is time-limited, and must be done on or before expiry. No repeat check is required for indefinite leave, or for EU Settlement Scheme settled or pre-settled status. Where an application or appeal is outstanding, the excuse continues for up to 28 days pending a Positive Verification Notice from the Employer Checking Service.
What a Breach Costs
The statutory maximum is £60,000 per illegal worker, set by the Immigration (Employment of Adults Subject to Immigration Control) (Maximum Penalty) (Amendment) Order 2024 and in force from 13 February 2024. The £45,000 figure that circulates widely is not a separate cap. It is the starting point for a first breach under the Code of practice on preventing illegal working, and the distinction matters when you are pricing exposure.
Where the Two Figures Come From
| Situation | Starting point per worker | Reductions available |
|---|---|---|
| First breach in three years | £45,000 | £5,000 for reporting, £5,000 for co-operation; warning notice possible |
| Repeat breach within three years | £60,000 | Same two reductions; no warning notice |
Mitigation and the Warning Notice
Two reductions of £5,000 each are available on a first breach: reporting suspected illegal working, and active co-operation with the investigation. Where both apply and the business also has effective right to work practices in place, the outcome can be a warning notice rather than a penalty at all. On a repeat breach the reductions survive but the warning notice does not, which is why a first penalty changes the arithmetic of every subsequent one.
£60,000 is the statutory maximum for any breach. £45,000 is a Code starting point for a first breach. Written as "the maximum for a first offence is £45,000", the sentence is wrong in a way that under-states exposure — and it is wrong in a great deal of employer-facing material. Price the risk at the ceiling, then argue the mitigation.
What a Sponsor Licence Adds
Holding a licence layers a second regime on top of the first. Sponsor duties are owed to the Home Office and are set out in the sponsor guidance, of which Part 3 governs duties and compliance. They are not discharged by good faith. They are discharged by records kept in the prescribed form and reports made within fixed windows, and a compliance visit tests exactly that.
- A sponsored worker's employment ends, or they are absent without authorisation for ten or more consecutive working days.
- Salary drops, or the role or work location changes.
- Changes to the organisation itself carry a longer window of twenty working days.
- A breach of conditions is reported as soon as reasonably practicable, not at the next convenient moment.
Suspension, Revocation and What Follows
Suspension is the investigative step: new certificates of sponsorship cannot be assigned, while existing sponsored workers are unaffected unless revocation follows. Revocation ends the licence, and sponsored workers face curtailment of their permission. The mandatory and discretionary grounds are set out in the annexes to Part 3, and in serious cases revocation can come without a suspension first.
The consequence people plan for least is the wait afterwards. Part 3 provides that a business whose licence is revoked cannot apply again until at least twelve months have passed from the date the Home Office notified the revocation — not from the breach, and not from the end of any challenge. A separate and longer period applies where a licence has been revoked more than once, and it can follow the individuals concerned between organisations as well as the entity.
Objecting to a Civil Penalty
A civil penalty is not a court order and it is not final on issue. The notice sets out an objection route to the Home Office, and an appeal to the county court after that. Both are time-limited and both turn on evidence you either created before the check or did not.
The Three Statutory Grounds
An objection runs on one of three grounds: that you are not liable at all, that you have a statutory excuse, or that the amount is too high. The second is the strongest and the least available after the event, because it depends entirely on a compliant check having been made and recorded before work began. The third is where mitigation is argued, and where a well-documented compliance system does real work even when a check has failed.
What the Evidence Has to Show
The Home Office assesses the file as it stood on the day the person started work. Reconstructed evidence, a check completed after a visit, or a document obtained once a problem emerged does not create an excuse retrospectively. This is the practical reason compliance is a process question rather than a legal one: the argument is won or lost by whoever set up onboarding, months before anybody thought about a penalty.
Enforcement as It Actually Runs
Home Office transparency data published on 7 August 2026 records 7,270 illegal working visits and 4,756 arrests in the first six months of 2026, up 31% and 20% respectively on the same period in 2025. Over that half-year, 1,238 businesses were issued a civil penalty, with a total value of £74.6 million. The department states that the figures are provisional and were taken from live operational systems on 7 July 2026, and they are transparency data rather than accredited official statistics.
The direction is what matters for planning. Visit volume is rising, penalties are being issued at scale rather than exceptionally, and the population subject to checks expands in October. A business that has never had a visit is not thereby a business with a defence.
Where a penalty has already landed, the route through it is set out in our guide to challenging an illegal working civil penalty. For the mechanics of the check itself, see our employer guide to right to work checks; for licence-specific risk, our analysis of sponsor licence compliance and enforcement. The wider policy background sits in our note on what the white paper means for employers and on which white paper measures are now in force.
Common questionsFrequently asked questions
Do I need to check self-employed contractors now?
Not until 1 October 2026. From that date, engaging an individual sub-contractor falls within the illegal working prohibition, and a penalty can follow. Penalties for the new categories apply only where the engagement began on or after commencement.
Is the maximum civil penalty £45,000 or £60,000?
£60,000 per worker is the statutory maximum for any breach. £45,000 is the Code of practice starting point for a first breach in three years, before mitigation. Treat £60,000 as your exposure ceiling.
Can I still accept an expired biometric residence permit?
Not as a manual check. Expired BRPs give no statutory excuse on their own. The holder can use the document to generate a share code, but you must complete the Home Office online check to be protected.
How long must I keep right to work records?
For the full duration of the employment and two years after it ends. Copies must be in a format that cannot be manually altered, and the date the check was made must be recorded.
How soon can we re-apply after a sponsor licence is revoked?
At least twelve months from the date the Home Office notified the revocation. A longer period applies where a licence has been revoked more than once, and it can attach to key personnel as well as to the organisation.
Does a compliant check protect me if the documents turn out to be forged?
Yes, provided the forgery was not reasonably apparent and the prescribed check was properly made and recorded. The statutory excuse protects the employer who followed the process, not the employer who suspected and continued.
Tell us how you engage people outside a contract of employment — agency, sub-contractor, platform. We'll tell you where the new liability lands, who carries it in your chain, and what has to change before the first of the month.
Get Expert Advice