What the 1 October 2026 illegal-working change means if you run a gang

What actually changes

Right-to-work checks have always applied to employees. Section 48 of the Border Security, Asylum and Immigration Act 2025 widens who counts as an employer, so the same duty now covers three more arrangements. The Home Office draft employer’s guide of 16 July 2026, which comes into force on 1 October 2026, sets them out.

• Worker’s contracts. Someone who agrees to do the work personally for you, and who is not running a business of which you are a client. A self-employed subbie on your books who turns up and does the work himself is the picture.
• Individual sub-contractors. In the guide’s words, “an individual who has entered into a contract with a person to provide work or services, in circumstances where that other person has entered into a contract with a third party to provide, or arrange for the provision of, the work or services but the individual has not.” That is a labour-only subbie on your package: the main contractor contracts with you, you contract with him, he has no contract up the chain.
• Online matching services. Platforms that match tradespeople with customers for a fee. Not you, unless you run one.

The government’s own announcement named the sectors it had in mind: construction, food delivery, beauty salons, courier services and warehousing. Construction is first on the list.

Who has to check whom

The duty falls on whoever engages the individual directly. If you take a sole trader on to your job, you check him. If you contract with another limited company and it brings its own gang, that company checks its people. The guide says the Home Office “will ordinarily seek to identify the person responsible for the relevant contractual arrangements” rather than treat every party in a chain as liable.

There is a sting for firms higher up. Where you are under contract to deliver work and you bring in another business to supply the labour, and you stay contractually responsible for that work, the guide’s extended-liability section (it cites section 15A) can treat you as the employer of the people that business supplies. If you are a subcontractor who sub-lets a package to a labour supplier, read that section twice.

One thing the new rules do not do: they do not make a main contractor responsible for checking your workers because you are on his site. Your workers are yours to check.

From when, and what about the people already on site

The new duties apply from 1 October 2026. The transitional rule matters: a civil penalty for a worker’s contract, an individual sub-contractor or an online matching service “may only be imposed where the employment commenced on or after 1 October 2026.” A subbie who started with you in September is not caught by the new scheme. One who starts on 1 October is.

That does not make September a good month to skip checks. The person who starts in September and comes back for a new job in November has commenced again. Check everyone you take on from now, and you will not have to work out who started when.

How a check is done

There are three routes and which one applies depends on the person’s nationality, what permission they hold and their preference. All three are free.

• The Home Office online check. The worker gets a share code from the government’s prove your right to work service and gives it to you with their date of birth. You enter both on the employer’s side and keep the result page. Anyone with an eVisa can only prove their right to work this way, and that is most non-UK nationals now.
• A manual document check. You see the original document in person (a British or Irish passport is the common case), check it is the person in front of you, and keep a copy with the date you checked it.
• An identity service provider. A registered digital verification service checks a British or Irish passport holder’s identity for you. Useful at volume; for a gang of ten, the first two routes are enough.

Two things a check is not. A photograph of a CSCS card is not a right-to-work check; a CSCS card says nothing about immigration status. And a copy of a passport sent over WhatsApp is not a manual check either. The guide requires the original, seen, with the person present or on a live video call while you hold the original.

The record, and how long to keep it

A check you cannot show is a check you did not do. What the guide calls the statutory excuse, your defence against a penalty, is established by doing the check before work starts and keeping the evidence.

• Keep the share-code result page or the document copy for as long as the person works for you and for two years after, then destroy it securely.
• Record the date you did the check, on the copy or in a separate record.
• Keep it in a form that cannot be quietly altered: a PDF, a printed copy, or a system that stamps it.
• If the person’s permission has an expiry date, diary a follow-up check before it expires. Miss it and the excuse lapses.

The thing most firms will be asked for first is simpler than any of that: a dated record of who worked on which site on which day. That is the record that turns “we checked everyone” into something an inspector can read.

What it costs to get wrong

The civil penalty is set by the Home Office code of practice of 13 February 2024: up to £45,000 per illegal worker for a first breach, and up to £60,000 per illegal worker where the firm has been found employing illegal workers in the previous three years. Reductions apply for reporting a suspicion yourself and for cooperating. The government’s announcement adds business closure, director disqualification and, for the criminal offence of knowingly employing someone with no right to work, up to five years in prison.

For a firm of thirty with six individuals engaged directly and none of them checked, the arithmetic is not complicated. The check takes minutes.

What to do this month

• List every individual you engage directly, meaning sole traders, labour-only subbies and day-rate lads, as distinct from the firms you subcontract packages to.
• For each one starting on or after 1 October, do the check before their first shift. Ask for a share code; if they are a British or Irish passport holder, see the passport.
• Write down the date. Keep the copy somewhere it cannot be edited.
• Put the expiry dates in a diary.
• Tell your ganger. He is the one at the gate at 6:45 when a new face turns up.

Where SHINDI fits, and where it does not

SHINDI does not carry out right-to-work checks. What it keeps is the dated attendance record: every worker on every site on every day, from the WhatsApp message they already send. When someone asks who was on your job on a given Tuesday, that is the answer, and it is the first thing you will be asked for. A card a worker photographs into SHINDI is stored as declared, not verified. It will never be presented to you as a right-to-work check, because it is not one.

About this guide

This guide reads the draft employer’s guide to right-to-work checks published on 16 July 2026, which comes into force on 1 October 2026 and supersedes the version of 26 June 2025, together with the government’s response to its consultation and the code of practice on penalties. It is written for trade subcontractors and it is not legal advice. If your arrangements are unusual, with umbrella companies, agencies or gangs supplied by another business, take advice on your own contracts. We will update this page when the final guide is published, and the date at the top will move.