Immigration compliance: the new labour supply chain risk

As Right to Work responsibilities now extend beyond conventional employment, businesses need greater visibility over how labour is supplied, subcontracted and ultimately delivered.

For most employers, Right to Work compliance has historically centred on their employees. An individual joins the workforce as an employee, their immigration status is checked before employment begins and the evidence is retained.

From 1 October 2026, that perimeter widens.

Changes introduced by the Border Security, Asylum and Immigration Act 2025 extend the statutory Right to Work Scheme beyond traditional employment relationships. The regime will cover individuals engaged under a worker’s contract, individual subcontractors and certain online matching services. In specified contractual arrangements, civil penalty liability can also extend beyond the organisation with the direct relationship with the worker.¹

Businesses will need to carry out more Right to Work checks and review how they obtain and oversee labour.

Businesses may obtain labour through employees, employment businesses, contractors, subcontractors, platforms and outsourced service providers. Information about those arrangements may be spread across HR, procurement, legal, operations and individual business units. Immigration compliance has not always followed the same organisational lines.

The October reforms bring those arrangements directly into the compliance framework. For some workforce models, preventing illegal working will depend on more than checking an individual at the point of hire. Businesses may also need to know how work reaches them, how contractual chains operate, whether further subcontracting is permitted and who is actually performing the work.

Right to Work compliance is, in part, becoming a labour supply chain issue.

Section A: The compliance perimeter is changing

The existing Right to Work Scheme is grounded in sections 15 to 25 of the Immigration, Asylum and Nationality Act 2006. Section 48 of the Border Security, Asylum and Immigration Act 2025 changes that framework by broadening who can be treated as an employer for these purposes. From 1 October, the definition includes engagement under a worker’s contract, engagement of an individual subcontractor and certain online matching services that provide details of individual service providers to potential clients or customers.¹

Where a business has a direct contractual relationship with an individual in one of these categories, the underlying principle remains familiar. A prescribed Right to Work check, carried out correctly before work starts, can establish a statutory excuse against civil penalty liability.

The legislation also introduces a further layer of responsibility.

A new section 15A creates what the Home Office describes as extended liability. It can apply where a person is contractually responsible for providing work or services to a third party and enters into another contract with an employer providing workers to fulfil that obligation. Extended liability can also arise in specified online matching arrangements and where a contract allows an individual to substitute another person to carry out the work.¹

Responsibility can therefore become relevant at more than one point in a labour supply chain.

Not every company using agency labour or outsourced services will suddenly become responsible for every worker supplied to it. Home Office guidance expressly states that extended liability does not apply to every purchaser of services and does not generally arise merely because a business purchases work or services for its own internal operations.¹

Exposure instead depends on the contractual structure and how the arrangement operates in practice.

Section B: Counting contractors will not tell businesses whether they are exposed

Businesses may begin their review by counting the people working for them outside employment.

That count might include contractors, agency workers and people working through outsourced services.

The numbers may be useful, but they do not establish where responsibility sits.

Home Office guidance directs organisations towards the structure of the arrangement: who engages or supplies the individuals, who is contractually responsible for the work, whether the arrangement concerns the supply of labour or delivery of a defined service, whether a contractual chain exists, who controls replacement workers and whether substitution is permitted. Contractual labels alone are not determinative.¹

Two businesses with apparently similar contingent workforces could therefore have very different exposure.

A retailer purchasing warehousing or cleaning services for its own operation does not automatically acquire extended liability for workers employed by the service provider. A different position may arise where a business has contracted to deliver services onwards to a third party and relies on another company, or a chain of companies, to provide the workers needed to fulfil that obligation. The Home Office uses construction and managed-service examples to illustrate the difference.¹

Contractor headcount alone cannot explain those arrangements.

Businesses also need to examine their labour delivery model.

Businesses need to know what they have promised to deliver, which organisations sit between that obligation and the individual carrying out the work and how responsibility runs through the contractual chain.

Section C: The real risk sits where visibility starts to deteriorate

Complex labour arrangements can look relatively straightforward when the commercial contract is first signed.

A business appoints a contractor. The contractor confirms that it complies with immigration law. Warranties and indemnities are included in the agreement. On paper, responsibility appears to have been allocated.

The arrangements used to deliver the work may be more complicated.

The contractor may use a labour provider, which may in turn subcontract part of the work. Workers may be replaced during the contract and different individuals may attend different locations. Local managers might deal with the workforce while procurement owns the supplier relationship. Systems for onboarding, site access and worker records may operate separately and hold different pieces of information.

As more intermediaries become involved, it can become harder to establish who employs the workers and who holds the relevant records.

The September 2026 Home Office guidance addresses circumstances in which the direct employer may be difficult to establish because multiple intermediaries are involved, records are unavailable or substitution means the individual performing the work cannot clearly be linked to a particular employer. Where the direct employer cannot be identified and the prescribed safeguards have not been met, liability may extend further upstream.¹

Information about each organisation in the supply chain can help establish where responsibility sits.

Knowing the identity of a tier-one supplier may not be enough where an arrangement falls within the extended liability provisions. Businesses may also need to establish whether that supplier is subcontracting the work, which other organisations are involved and whether the controls agreed in the contract operate in practice.

Section D: Supplier warranties are not the same as compliance controls

Contractual protection has a specific role under the new framework.

Where extended liability applies, an organisation seeking to establish a statutory excuse cannot rely on a general contractual statement that its supplier will comply with immigration law.

Home Office guidance identifies three components: contractual terms, substitution controls and identity verification.¹

For relevant contractual chains, written arrangements are expected to require prescribed Right to Work checks for individuals performing the work. Further subcontracting should be restricted without prior written consent, with equivalent obligations replicated where subcontracting is permitted. Audit rights and mechanisms for taking action if illegal working is identified also form part of the prescribed contractual framework.¹

Home Office guidance also makes clear that contractual terms alone are not enough. Organisations should be able to demonstrate that appropriate arrangements exist, operate effectively and have been subject to reasonable and proportionate assurance.¹

The business therefore needs to consider how it will monitor compliance with the contract.

Supplier agreements often provide that one party warrants compliance and indemnifies the other if something goes wrong. Those provisions may still have commercial value, but the statutory framework places greater weight on whether risk is actually being controlled.

The business needs to assess whether it can prevent unauthorised subcontracting, audit the arrangements, identify the people carrying out the work and show that agreed procedures were followed.

That assessment requires information about how the work is managed day to day.

An indemnity may determine which commercial party ultimately bears a financial loss. It does not, on its own, establish that the statutory requirements have been satisfied.

Section E: Substitution creates a different type of immigration risk

Where substitution is permitted, Right to Work compliance depends on how replacement workers are approved and checked.

Some platform, contractor and gig-economy models allow the individual who accepts work to send somebody else in their place. The person originally onboarded may therefore not be the person who eventually performs the service.

Under the new guidance, where a contractual arrangement permits substitution, prescribed processes are needed to ensure that a Right to Work check is carried out on the substitute and that the individuals doing the work are the same people whose status has been checked.¹

Checking the person originally onboarded does not establish the substitute’s Right to Work.

The business needs to be able to identify the person who actually performs the work.

The Home Office identifies possible controls including workplace passes, attendance systems, facial recognition technology, checks against training or licence records and periodic identity re-verification. The appropriate approach should be proportionate to the nature of the work, the risk of substitution or impersonation and the contractual model.¹

The systems used to allocate work and control access can therefore affect immigration compliance.

A weakness may sit in a platform login, site-access process, shift allocation system or replacement-worker procedure rather than within the immigration team itself.

A technically correct Right to Work check has limited protective value if the business cannot establish that the individual who was checked is the person who subsequently performs the work.

Section F: The scale of the change is difficult to measure, which is itself significant

The Home Office does not have a definitive measure of the number of working arrangements that will fall within the expanded regime.

Its impact assessment models low, central and high scenarios.

The low scenario assumes 2.5 million additional working arrangements, the high scenario 5 million and the central assumption 3.75 million. The department describes the figures as illustrative and expressly acknowledges significant uncertainty over the size of the affected population.²

Using assumptions about workforce churn, the central scenario generates approximately 3.8 million additional Right to Work checks in 2026/27. The low and high scenarios range from around 700,000 to 8.6 million checks. The assessment also recognises that some organisations already carry out checks voluntarily, so the modelled figures may overstate the amount of genuinely additional activity.²

The central estimated cost to business is £9.2 million in 2026/27 and £90 million in present-value terms over the ten-year appraisal period. The range is wide, reflecting uncertainty over both population size and workforce churn.²

The uncertainty behind those estimates also has practical relevance for businesses.

The assessment illustrates the difficulty of identifying the affected arrangements across a labour market where agency work, casual work, subcontracting, platform work and other non-standard models overlap.

Individual employers may encounter much the same problem within their own organisations.

Producing an employee headcount is usually straightforward. Producing an equally reliable picture of every person providing work through outsourced contracts, temporary labour arrangements, subcontractors and platforms can be considerably harder.

For businesses using several labour models, incomplete records of people outside the employee workforce can make potential exposure harder to identify.

Section G: The organisational blind spot sits between HR and procurement

The expanded Right to Work regime cuts across established corporate responsibilities.

HR normally manages employee onboarding and immigration processes.

Procurement manages supplier relationships.

Legal advises on the contracts.

Operations knows who is carrying out the work.

Security or facilities may control access to sites.

Technology teams may manage platform identities and account controls.

Compliance may test whether those systems are operating as intended.

No single function necessarily has sight of the whole workforce.

The October changes require businesses to consider whether they can identify the people performing work across their different labour models.

Where a business relies heavily on contingent or outsourced labour, immigration risk cannot always be managed through an employee compliance framework alone.

Businesses need to link information about those workers to the contracts through which their labour is supplied.

Businesses need to know where relevant supplier and worker records are held and how to bring them together when a compliance question arises. That does not necessarily require a single system for every record.

If an organisation cannot identify the contractual route through which an individual reached a workplace, assessing which Right to Work obligations apply becomes considerably more difficult.

Section H: Exposure will vary sharply between workforce models

The government has highlighted construction, food delivery, courier services, warehousing and similar sectors when explaining why the Scheme is being extended. It has also referred to casual workers, agency arrangements, gig work and self-employed models.³

The way each business obtains and manages labour also needs examination.

Two businesses operating in the same industry can organise labour in very different ways. One may employ almost its entire workforce directly while another relies on several layers of labour providers. One may prohibit substitution while another incorporates it into the operating model. One may outsource a defined service purely for internal use while another is itself contractually responsible for delivering that service onwards.

The review should examine the contractual arrangements and working practices of the business.

Exposure is likely to increase where businesses have:

• several tiers of subcontracting
• frequent worker replacement or substitution
• decentralised procurement
• high-volume temporary labour
• labour supplied across multiple locations
• limited visibility below tier-one suppliers
• contractual permission for further subcontracting
• weak alignment between supplier records and actual site or platform users.

None of those characteristics determines legal liability in itself. They do, however, indicate where the contractual and operational arrangements may warrant closer examination.

Section I: October should change what businesses ask their suppliers

A wholesale rewrite of Right to Work policies is unlikely to be the most useful first response to the reform.

Businesses first need to identify the workforce arrangements to which the expanded regime may apply.

Four questions provide a useful starting point.

Who is actually performing work?

Visibility may need to extend beyond payroll where labour is obtained through other models.

Through what contractual route did that person reach the organisation?

The answer helps establish whether the arrangement involves direct engagement, outsourced services, labour supply or a longer contractual chain.

Can somebody else perform the work in their place?

Where substitution forms part of the model, Right to Work checking and identity controls need to accommodate the way work is actually allocated and delivered.

What assurance exists beyond the contract?

Where relevant extended-liability arrangements exist, organisations need evidence that contractual requirements are operating in practice rather than treating the supplier warranty as the end of the compliance process.

Answering those questions will often require input from procurement and operations before HR or immigration specialists can properly assess the legal position.

Section J: A wider shift in workforce compliance

The Home Office presents the reform as a response to labour-market models that have developed outside the traditional employee relationship. Its impact assessment refers to growth in agency work, casual arrangements, gig-economy models and subcontracting as part of the rationale for intervention.²

The reform also affects how businesses manage responsibility for their wider workforce.

Businesses have spent years diversifying the way work is delivered. Employees now work alongside consultants, agency workers, outsourced teams, contractors and platform labour. Those models can provide commercial flexibility and access to skills, while also dispersing information and responsibility across organisational and contractual boundaries.

Immigration compliance is now extending further into those structures.

The maximum civil penalty for illegal working remains £60,000 per illegal worker, with criminal and regulatory consequences also possible in more serious cases.¹ The greater management challenge is knowing whether the business can see and control its labour model well enough to identify where its obligations arise.

From October, a strong Right to Work framework will depend on more than the quality of the policy held by HR. Businesses using more complex labour models will need to connect workforce information with supplier governance, contractual controls and worker identity.

Organisations using several tiers of labour suppliers or separate systems for different parts of their workforce will need to account for immigration compliance in the way they commission and manage that work.

Section K: Sources