Right to work checks for subcontractors: who checks whom?

A UK business must not assume that every person labelled a “subcontractor” is outside the right to work scheme—or that every company buying a service must personally check every worker in a supplier's workforce. The legal answer depends on the individual's contract and the supply-chain arrangement, not the label in a purchase order. The Home Office's final employer's guide, updated 1 October 2026, extends direct checking to people engaged under a worker's contract, individual subcontractors in the defined chain, and specified online matching services. It also introduces extended liability in certain contractual arrangements for work or services. Those are related but different questions.

Start by identifying who engages the individual and what they personally undertake to do. If your business directly employs or engages a person within the guidance's categories, carry out a prescribed check before the work starts if you want the statutory excuse against a civil penalty. If another business employs or engages the worker and supplies work or services to you, examine the extended-liability rules and prescribed contractual, substitution and identity controls. If you are simply the end customer of an independent business providing a service, you may not be in scope on that basis. Complex chains and contract variations need case-specific legal review, not a blanket checkbox.

This guide explains the routing decision for organisations in the UK. It does not replace the Home Office's current check instructions or legal advice on a particular contract.

Why the 1 October 2026 change matters

The Home Office's right to work checklist now lists direct employment, engagement under a worker's contract, an individual subcontractor, and operation of an online matching service among arrangements for prescribed checks. The definition of an individual subcontractor is narrower than ordinary construction or procurement language: it involves an individual contracted to provide work or services to someone who has contracted with a third party to provide or arrange that work or service, where the individual has not themselves contracted with that third party. A limited company, labour agency, client, principal contractor and individual tradesperson can occupy different positions in different chains. Map the actual relationships.

The employer's guide says civil penalties for the newly covered direct arrangements apply where employment commenced on or after 1 October 2026. It gives a separate commencement rule for extended liability, linked to contractual arrangements entered into on or after that date. A contract signed before 1 October does not become newly covered merely because work continues, but renewal, variation, a new assignment or a changed chain may alter the analysis. Record the contract dates and obtain advice rather than applying a universal “grandfathering” rule. Read the final employer guide, particularly its commencement and FAQ sections, before acting on a borderline arrangement.

The first decision: are you the direct engager?

Use the real contract and working facts. Ask:

1. Does your organisation employ the individual under a contract of employment or apprenticeship?
2. Does the person undertake to perform work or services personally under a worker's contract, in the guidance's sense, rather than operating a business of which your organisation is a client or customer?
3. Are you contracting with an individual subcontractor as defined by the Home Office, through a chain in which your organisation has undertaken to provide or arrange that person's work for someone else?
4. Are you operating an online matching service in the category described by the guide?

If the answer to one of these is yes, identify the organisation responsible for the prescribed check before the person starts. A worker's tax status, CIS deduction, self-employed invoice, trade card, CSCS card, site induction or supplier assurance badge does not itself establish a statutory right to work excuse. A construction firm that directly engages an individual for site work cannot outsource its own legal decision to an onboarding label.

The Home Office's accessible checklist sets out the three prescribed routes: an eligible manual document check, the Home Office online checking service, or a registered right to work digital verification service provider where applicable. The method depends on the individual's evidence. Give the person a reasonable opportunity to use an available prescribed route; do not discriminate or demand one method from everyone. For an eVisa holder, use the Home Office online service and the individual's share code and date of birth, then check the returned photograph and permission for the work offered. A worker showing a document that requires the Employer Checking Service should be routed there under the current guidance. A screenshot of a share code, a contractor's verbal assurance or a stored passport image alone is not the prescribed check.

Record who did the check, which prescribed method was used, the check date, the actual person matched, the result, any work restriction and the follow-up date where permission is time-limited. The Home Office checklist says copies/output must be held securely for the duration of employment and two years afterwards, then securely destroyed. Apply the detailed rule to the check route used and restrict access to immigration evidence. Do not create an indefinite “compliance archive”.

The second decision: do you receive people through another organisation?

Where another employer or service provider supplies individuals to fulfil your contract, ask whether the Home Office's extended-liability provisions apply to that contractual arrangement. The checklist's extended-liability screening asks about supplied workers, online matching, substitution and the underlying contracts. The final employer guide explains when an organisation in the chain can face a civil penalty even though it is not the immediate engager.

Extended liability does not mean that every upstream customer must duplicate the direct employer's check on every person. Instead, determine whether the statutory scheme requires a written statement with prescribed contractual terms, effective substitution controls, and identity-verification arrangements showing that the person actually doing the work is the one who was checked. The Home Office checklist says the prescribed written statement must be in place before work or services commence where relevant; arrangements must operate in practice, not just appear in a contract. For substitution, a permitted substitute must undergo a prescribed check before starting, with effective controls against an unchecked replacement or imposter. Where another party's systems are relied on, take reasonable steps to test that they work.

Build a contract-chain record: client, principal contractor, subcontractor, labour provider, direct engager and individual; service purchased; contract date and renewal; who can substitute; who performs prescribed checks; who verifies identity on arrival; and who can refuse access or stop work. Ask counsel to review it where the party's status or statutory-excuse route is uncertain.

Four practical scenarios

These are routing examples, not legal conclusions for every company with the same commercial label. A construction project may contain several different arrangements at once. Some individuals are direct workers; some are supplied through a labour company; others operate independent businesses. Assess the individual and the chain, not the project as a whole.

A workable pre-start process

1. Capture the right facts once

At procurement or onboarding, record the organisation buying the service, who contracts with whom, whether a named individual must perform the work personally, whether substitution is permitted, whether the worker has an independent client-facing business, and whether there is an intermediary. Keep the operative contract and amendments, not just a spreadsheet category. If these facts are unavailable, pause the compliance classification; a platform should not turn “subcontractor” into an automatic legal decision.

2. Assign a direct check owner

If your organisation is the direct engager within the scheme, name the person responsible for choosing and completing the current prescribed route before commencement. Check that the person in front of you matches the document or Home Office output, and that any restrictions permit the proposed work. Do not use an expired physical biometric residence permit as proof or rely on an informal video image of documents; use the current Home Office checklist for route-specific instructions.

3. Assign supply-chain controls separately

If your organisation faces extended liability rather than the direct-check duty for a supplied individual, document the statutory-excuse measures that apply. Agree prescribed written terms before work starts; make sure someone verifies that the actual person on site or delivering the service matches the checked person; establish how a substitute is notified, checked and accepted. Audit the arrangement. A contract clause with no operational process is weak evidence.

4. Record and act on time limits

Where permission is time-limited, schedule the correct follow-up check. Distinguish an immigration permission expiry from a project or site-pass expiry. The current Home Office guidance explains when a follow-up preserves the statutory excuse and how the Employer Checking Service works for certain pending applications. A person moving to another site within a continuing engagement does not automatically require an entirely new check, but a new engager, changed work or expired permission may change the position.

5. Test what happens at the gate

Ask a supervisor to show how they detect a different person arriving, a substitute being sent without approval, or a labour provider changing its workforce. Site access data, photo comparison and a contract's substitution rules should agree. If they do not, stop the individual start and resolve the identity or permission issue through the appropriate employer or provider. A routine visitor check is not, by itself, a right to work check.

Common mistakes to avoid

• “All subcontractors need our check.” The Home Office separates direct engagements, individual subcontractors in a defined chain, extended liability and customers of an independent business. First classify the arrangement.
• “CIS means self-employed, so no check.” Tax treatment does not replace the immigration scheme's contractual definitions.
• “The agency checked them, so we are safe.” Identify who is directly responsible and whether your business must satisfy extended-liability conditions. Obtain evidence that agreed systems operate.
• “We collected a passport, therefore we checked.” The prescribed process involves the eligible route, identity match, work restrictions, dated output/copy and retention.
• “Our old contract can never be in scope.” Renewal and variation may matter; review the actual legal effect.
• “A subcontractor can send anyone.” Substitution and identity verification are specific risk points in the 2026 guidance.
• “Right to work software makes the legal check.” A record system can help manage evidence; it cannot substitute for the prescribed method or the engager's statutory responsibility unless it actually provides a relevant regulated verification service.

Where Complys fits

Complys right to work compliance software is presented as a place to store and organise check evidence, dates and follow-up records alongside a worker record. It does not itself perform the right to work check, verify immigration status or identity, query Home Office share codes, act as a registered digital verification provider, or create the statutory excuse. Those steps remain with the responsible organisation and the prescribed Home Office route. If your business has a mixed workforce, first classify each engagement and complete the required check or supply-chain controls; then use a consistent record process so the evidence and renewal action can be found. Verify current implementation before publishing any more specific feature claim.

For the general method and acceptable evidence, link readers to the existing right to work checks for employers guide. Keep this page focused on subcontractor and supply-chain classification rather than duplicating the general check manual. For a wider onboarding process, use the contractor compliance checklist after confirming that exact route at integration.

Sources and writer-side QA

Terminal writer-side disposition: READY.