Five weeks to sort it, and nobody can tell a builder in Basingstoke who counts as the employer
From 1 October 2026, right to work checks stop being about the people on your payroll and start being about anyone working in your name. The rulebook telling businesses how to do that is still sitting in draft.
Here's what's actually happening. Section 48 of the Border Security, Asylum and Immigration Act 2025 got Royal Assent on 2 December 2025 and has now been switched on for 1 October. It drags worker contracts, individual subcontractors and online matching platforms into the regime. Construction, food delivery, beauty salons, couriers and warehousing are named in the firing line. The draft Code of Practice was laid before Parliament on 30 June, the draft Employer's guide turned up on 16 July, and Lewis Silkin reckons the guide won't even be finished before the rules bite.
Get it wrong and it's £45,000 per worker for a first breach, £60,000 for a repeat. Knowingly employ someone with no right to work and you're looking at up to five years inside and an unlimited fine. Not a slap on the wrist.
What this really means if you're a small business
Liability now travels. If you subcontract a job, or a substitute turns up in someone else's place, the business at the top of the chain can carry the penalty for a person it never met, never hired and never signed anything with.
In practice that means mapping every type of labour you use, rewriting supplier contracts to demand checks, ban unapproved subcontracting and give you audit rights, putting identity verification in place so the bloke on site is the bloke you checked, and training your site managers and whoever books the work, not just HR. Immigration lawyers are already warning SMEs who use subcontractors that they're the ones in the firing line.
A FTSE company has a compliance team for this. Most British businesses have an owner, a laptop and a bookkeeper who comes in on Thursdays. Same rules, same fines, wildly different odds.
The bits nobody can pin down
Genuinely self-employed people running a business in their own right, contracting straight with their own clients, are out of scope. Get your work through a platform or an intermediary and you're in. And the label on the contract doesn't decide it, what you actually do does. So the sole trader who takes half his jobs direct and half through an app is sat right on the line, and the worked examples that would settle it aren't published.
Substitution is the sharp end. If your contract lets someone send a substitute, you're expected to have checked that substitute before they start, and you can't palm the checking off onto the worker. There's a bit of give if you've been defrauded despite decent controls, but that's the Home Office's judgement call after the event, not something you can plan a Tuesday morning around.
Asking businesses to comply by October using a rulebook still stamped "draft" is like handing someone an exam paper and promising the syllabus will follow. Publish the final guidance and the worked examples now, or move the date. Small firms can't audit a supply chain on vibes.
We'd like your views:
- Sole trader who subcontracts one job to a mate. In scope or not, and how sure are you?
- Who's "the employer" when there are four businesses sat between the client and the person doing the work?
- A substitute turns up on site at 7am and nobody's checked him. Who should pay the £45,000?
- Fair crackdown on exploitation, or the government quietly handing border control to small businesses? Pick a side.
- Can a business with no HR function realistically map its labour chain and rewrite its contracts by 1 October?
- Does chasing liability down the chain catch the operators who are genuinely exploiting people, or just the honest ones who kept a paper trail?
