right to work extended liability written statement

Direct answer. Under the UK's right to work regime that began on 1 October 2026, an upstream business in a qualifying work or service chain, or an online matching service in the arrangements described by the Home Office, may need a written statement in place before work begins to establish a statutory excuse against *extended* civil-penalty liability. The statement must cover prescribed right to work checks by the direct employer or service provider, controls over further subcontracting, audit rights, enforcement and cooperation with a Home Office investigation. The statement alone is insufficient: the Home Office expects reasonable, proportionate evidence that the contractual requirements operate in practice. Not every purchase of contractor services is in scope, and the directly contracting employer retains responsibility for its own prescribed checks. Home Office final employer guide, sections 1 and 3.

This guide is for UK procurement, legal, HR and operations teams that buy or arrange work through another business, supply labour or run an online matching service. It is a process guide, not model contract wording or a substitute for legal advice on a particular chain.

First decide whether the arrangement is within the extended-liability provisions

The 2026 change extends the right to work scheme beyond conventional employment: direct engagements under a worker's contract, individual subcontractors and certain online matching services can carry a prescribed check duty. Extended liability is a further question. The final Home Office guide identifies circumstances in which a person contracted to provide work or services to a third party then contracts with another employer to provide or arrange workers; an online matching service connects a provider and a customer; or a direct employer permits substitution. The legal and practical relationships matter more than the labels the contracts use. A simple buyer receiving services for its own operations is not automatically an upstream party under this provision. The Home Office's examples expressly distinguish chain arrangements that may be in scope from customers buying services for their own use. Final guide, extended liability, pages 42–49.

Draw the chain before drafting a clause. Record who contracts with the end customer, who promises to provide the work, who contracts with and pays each individual, whether any tier can subcontract further, whether individuals may send substitutes, and who actually identifies the person arriving to do the work. If those facts are unclear, get the actual contracts and operational process; a generic supplier category will not answer the statutory question. Check the overview of the October 2026 change for the wider worker-scope context, then use the final Home Office guide to classify the chain.

The employer with the direct contractual relationship with an individual remains responsible for carrying out that individual's prescribed right to work check. Extended liability does not automatically transfer that check duty to every upstream business, nor does it make an upstream business automatically liable because its supplier failed. A separate upstream statutory excuse depends on the requirements that apply to that chain. The Home Office says it may look beyond the direct employer where that employer cannot be identified and the upstream prescribed requirements were not met. That is why the ownership map and evidence of how the arrangements work matter. Final guide, pages 48–50.

What the written statement needs to do

For the specified chain and matching-service arrangements, the final guide says a written statement must be in place before the work or service commences. It must set out terms and conditions to be included in the contract with the employer or service provider. In substance those terms must:

1. Require prescribed right to work checks for every individual employed to perform the relevant work or services.
2. Prevent further subcontracting without the upstream party's prior written consent, and require equivalent right to work obligations to pass through permitted lower tiers.
3. Allow the upstream party to audit the employer's or service provider's compliance with prescribed checks.
4. Allow enforcement action where illegal working is found and no statutory excuse has been established, with equivalent provisions in the direct employer–worker relationship. Suspension or termination may be among the available measures.
5. Require cooperation with a Home Office illegal-working investigation, including information about the purpose and make-up of the contract chain, the identity of involved businesses and other relevant information requested.

Those are statutory themes, not ready-made legal drafting. Ask legal counsel to fit them to the actual contracts, privacy arrangements, data access, subcontracting model and governing law. Keep evidence of the executed statement, the operative version of each agreement, its effective date and who approved it before work started. A clause signed weeks after mobilisation does not prove the pre-commencement requirement was met. Final guide, written-statement requirements, pages 50–52.

Why a supplier attestation is not enough

A statement that “our suppliers comply with immigration law” lacks the elements above. Equally, copying all five themes into a standard form and never checking whether the controls operate is weak evidence. The Home Office says reasonable, proportionate assurances from a supplier can be relied on, but the upstream business must take steps to satisfy itself that those assurances are reliable and the prescribed requirements are being met. Its guidance lists contracts, audits, assurances, compliance reviews and concern-response records as possible evidence. What is proportionate depends on the chain's nature, size, complexity and risk. Final guide, pages 50–52.

Turn the statement into a working control

Map and assign. Give each in-scope chain a named owner. That person should be able to produce the contract map, written statement and evidence of implementation. In a long chain, record each permitted tier and the person at that tier responsible for individual checks. If the direct employer changes, update the map and statement as needed.

Gate mobilisation. Put an executed statement, permitted-subcontractor approval and the agreed assurance method on the mobilisation checklist. An unapproved subcontractor or missing statement is a stop-and-escalate issue, not an item to close after people have started work. The Home Office's timing requirement is before the work or service commences.

Test the assurance, not just the answer. A supplier's signed confirmation may be part of the evidence. Define what could reasonably test it: a sample of dated check outputs where lawful and proportionate, a documented walkthrough of the check process, proof that lower-tier contracts carry equivalent requirements, or an audit finding and its closure. Set a review interval based on changing workforce, chain structure and risk, without inventing a universal legal frequency. Handle personal data with appropriate access and minimisation. Use the right to work record-keeping guide for prescribed evidence retention by the direct employer; do not assume every upstream party must copy every worker's passport or immigration record.

Track exceptions. Keep a log of late statements, unapproved subcontractors, missing assurance, unexplained identities or a supplier refusing an audit. Record the decision, interim control, accountable person and closure evidence. An audit right never exercised despite warning signs is less persuasive than an assurance process that identifies and resolves problems.

Reconcile the person doing the work. The final guide treats identity verification as a distinct prescribed element of an extended-liability excuse. An upstream party may use proportionate systems to ensure the person performing the work is the person whose right to work was checked, and may rely on another party's system after taking reasonable steps to assess its effectiveness. This is particularly important where workers rotate or substitutions are permitted. Do not equate a generic site badge or worker record with the prescribed identity and right to work checks. Final guide, pages 54–56.

Substitution needs a separate control

If a direct employer's agreement allows an individual to substitute another person, the written-statement chain control is not the whole answer. The final guide specifies processes to ensure a prescribed check is carried out on the substitute before they work, that the check is not delegated to the worker arranging the substitute, that contract remedies exist for illegal working or refusal to cooperate, and that the actual person providing the service continues to match the checked identity. It suggests evidence such as check records, authorisations, work-period logs, identity measures and action taken when the process was bypassed. If the contract forbids substitution but someone appears in place of the worker anyway, the Home Office considers the actual circumstances and the direct worker's check; investigate impersonation rather than assuming the clause solves it. Final guide, substitution controls, pages 52–54.

A useful operational example is a maintenance contractor permitted to send a substitute engineer. The supplier must not treat “the original engineer has a right to work file” as enough. Its approval process should name the substitute, ensure their prescribed check is completed before the job, identify who carried it out, and connect the actual site attendee to that checked record. The upstream business should understand and, where proportionate, test the supplier's process. Site-access and competence controls may add assurance, but they are not a replacement for the prescribed check.

An online matching service example

Imagine a platform that matches an individual service provider to a customer, and the provider then contracts with that customer. The platform may be within the extended-liability framework described by the final guide. It should map who makes the match, who contracts with whom, whether further subcontracting or substitution is possible, what checks the direct contracting party carries out, and how the platform obtains reliable assurance. A bare platform terms page that no one can tie to a particular engagement is weak evidence. The exact duty and statutory-excuse route depend on the factual arrangements and the final guidance's examples; this guide does not decide whether a particular platform is in scope. Final guide, examples and written statement, pages 44–52.

What should be in the evidence file?

For an in-scope upstream arrangement, a usable file may contain the dated chain map; executed written statement and linked contract versions; written consents to any further subcontracting; evidence of pass-through terms; named responsibility for checks; supplier assurances and the reason they were regarded as reliable; audit plans, findings and correction records; identity-control description; substitution approvals and exceptions; and records of action taken when a concern arose. The Home Office calls these examples, not an exhaustive statutory checklist. Keep evidence that matches the actual operating model, including changes over time. Where a Home Office investigation occurs, an organised file makes it easier to explain the chain and provide what is requested. Final guide, pages 51–55.

Avoid collecting more personal data than the assurance purpose requires. The direct employer's statutory check output and the upstream party's contract-assurance file are related but different records. Agree who keeps originals, who has lawful access, how a request is fulfilled, and how records are protected and disposed of. The ICO's employment information guidance is a starting point for privacy decisions; seek specialist advice for complex sharing arrangements.

Common errors

• Calling every client in a supplier chain an “employer” without analysing who is providing services onward and who directly engages the worker.
• Using a generic supplier code of conduct instead of the prescribed written statement and contract terms.
• Signing the statement after the engagement starts.
• Allowing an unapproved lower-tier subcontractor while the contract says prior written consent is required.
• Treating the upstream party as the one that must personally perform every direct employer check, or conversely assuming it has no assurance responsibility.
• Keeping a signed assurance statement without showing why it was reliable, what was tested and what happened when a gap appeared.
• Ignoring worker substitution or identity mismatch at the site or on the platform.
• Claiming that any software record, badge or digital identity result automatically gives a statutory excuse.

Where Complys fits

Complys Right to Work compliance software is presented as a record and follow-up layer for worker evidence. It is not the Home Office checking service or a registered RtW digital verification provider, and it does not decide whether an individual is legally allowed to work. For an extended-liability workflow, a buyer may evaluate how it will organise worker evidence, dates, supplier documents and outstanding actions alongside its contract and audit records. The legal owner must still classify the chain, obtain the correct written statement and ensure checks and assurance actually happen. Verify any specific Complys workflow against the deployed product before using it as an implementation promise.

Next step: map one real chain that will supply work this month, identify the direct employer and any substitution rights, then ask the contract owner to compare the executed statement and operating controls with the final Home Office guidance. If a record system would help organise the evidence, review the Complys money page on that limited basis.

Primary sources

• Home Office, final Employer's guide to right to work checks: 1 October 2026, especially section 3, examples 7–11 and pages 49–55 of the linked PDF.
• Home Office, Employers' right to work checklist, updated 1 October 2026.

Reviewed 4 October 2026. General information for the whole United Kingdom; obtain advice on a specific contractual arrangement. No article can replace the final Home Office guide or make a statutory-excuse decision for a reader.