Right to work checks for agencies, and what changes on 1 October 2026

7 minute read · Updated 2026-09-09

A civil penalty for illegal working is up to £45,000 for a first breach and £60,000 for a repeat, for each worker. It is not a fine you argue down with good intentions: either you did a prescribed check correctly before the work started, in which case you have a statutory excuse, or you did not, in which case you do not.

What changes on 1 October 2026

Section 48 of the Border Security, Asylum and Immigration Act 2025 widens the regime beyond conventional employment. From that date the duty reaches into labour supply chains and subcontracting, which is exactly what an agency is. Your organisation can face a penalty over a worker you do not employ directly.

If you supply labour, this is the single change in the year that most affects you. Read the employer's guide, which is free, and set your procedure before October rather than after.

How to do a check that counts

The online check

Most people now have a share code. You use the online checking service, enter the share code and their date of birth, and check that the photograph on the screen is the person in front of you, in person or on a live video call. Save the result as a PDF with the date on it. The service is free.

The manual check

Where there is no share code, it is the three steps in the guidance: obtain the original document, check it in the presence of the holder, and copy and date it. A British or Irish passport, current or expired, is the simplest acceptable document.

The rules that catch people out

• Before the first shift. A check done the following week gives no excuse for the days already worked.
• Check everybody, the same way. Checking only people whose names or accents sound foreign is race discrimination under the Equality Act 2010, and it is also how you miss the one that mattered.
• Diarise the expiry. Where permission is time limited you must repeat the check before it runs out. Forgetting is the same penalty as never checking.
• Write the date on the copy. An undated copy proves nothing about when you looked.
• Keep it for two years after the check or after the engagement ends, whichever is later. Then destroy it: keeping identity documents for longer than you need is its own problem under the UK GDPR.

What a good record looks like

One sheet per person: their name, what they were checked for, whether it was online or manual, the share code or the documents seen, the date, who carried it out, whether the photograph matched, the outcome, and any expiry date with the follow up diarised. If you cannot produce that sheet in thirty seconds, you do not have a procedure, you have a habit.

Before you rely on this

This is a guide, not legal advice, and it is free because the law behind it is free. Every source we used is linked in the text so you can read it yourself rather than take our word for it. Where a decision turns on your own circumstances, and two of them below do, pay a solicitor once. It is cheaper than the alternative.

We are a UK job board and we are building a recruitment arm of our own, so we are working through this list ourselves. If you spot something out of date, tell us and we will fix it and say when.