UK Extends Illegal Working Civil Penalties to Workers, Sub-contractors and Online Matching Services

Introduction and key takeaway

The UK is extending illegal working civil penalties to a far wider range of working relationships. Under the Border Security, Asylum and Immigration Act 2025, provisions were enacted to extend the civil penalty regime for illegal working so that it reaches beyond the traditional employer–employee relationship. The measure inserts a new provision into the Immigration, Asylum and Nationality Act 2006 so that references to “employing” are read as also catching parties who engage workers, who engage individual sub-contractors, and certain online matching services that provide service-provider details to clients.

The exact commencement date and detailed scope will be set by regulations made under the Act, and businesses should confirm the operative date and transitional arrangements against the published commencement regulations and current Home Office guidance before relying on any particular date.

For HR directors, procurement teams, labour suppliers and platform operators, this is a structural change in liability that demands attention. There are three practical takeaways. First, the civil penalty regime is being extended beyond your direct payroll into your contingent workforce and supply chain, so your risk map should be redrawn. Second, your statutory excuse, the defence that protects you from a penalty, depends on carrying out the Home Office-prescribed checks for each in-scope relationship, not just for employees. Third, contracts, onboarding workflows and platform terms of service should be reviewed and updated, because the change applies to engagements from the date the relevant provisions come into force.

Who is brought into scope?

Statutory text and effect

The mechanism is deliberately broad. The new provision operates so that references to “employing” a person in the relevant sections of the Immigration, Asylum and Nationality Act 2006 are to be read as including engaging a worker, engaging an individual sub-contractor, and the provision by an online matching service of service-provider details to a client. The effect is that the familiar section 15 civil penalty for “employing” an adult subject to immigration control can now bite in situations that were previously outside the regime.

Because the extension works by modifying the meaning of existing language rather than by creating a wholly new penalty, the enforcement architecture, penalty calculation and statutory-excuse concepts in the 2006 Act continue to apply, now across a much wider population of relationships.

Employee, worker, individual subcontractor and online matching service

Understanding where you sit on the spectrum of relationships is the first step. The distinctions matter because the tests and the practical checks differ:

• Employee. A person working under a contract of employment. These relationships were always in scope under the civil penalty regime and remain so.
• Worker. A person engaged under a worker contract who performs services personally without being in business on their own account as regards the hirer. Hospitality temps, casual shift staff and many agency-supplied individuals commonly fall here. The extension captures the engaging party.
• Individual subcontractor. A self-employed individual engaged to carry out work, typically within a construction or trades supply chain. Where a principal or intermediary engages such a person, the engagement can now fall within scope.
• Online matching service. A platform or intermediary that provides details of service providers to clients, for example, connecting delivery riders, trades or freelance workers with those who need them. Where the platform provides service-provider details to clients, it may be treated as engaging for these purposes.

Practical scenarios of liability

Consider a construction project. A prime contractor engages a labour supplier, which in turn engages individual subcontractors on site. Under the extended regime, the engaging party in each link, not just the ultimate employer, needs to consider its exposure and whether it has a statutory excuse. In hospitality, a venue that takes on casual workers under worker contracts must now carry out checks on those individuals to protect itself. In the gig economy, a delivery platform that supplies rider details to restaurants and customers may be treated as engaging and should assess whether its onboarding generates a statutory excuse. The common thread is that the question “who checked the right to work?

” now has to be answered at each point in the chain, not only at the point of formal employment.

Liability and compliance checklist: employee vs worker vs subcontractor vs platform

How civil penalties for illegal working operate, a quick primer

The civil penalty regime that is being extended to these new relationships sits in the Immigration, Asylum and Nationality Act 2006. Section 15 creates the core liability: a person who employs an adult subject to immigration control who has no right to do the work in question is liable to a civil penalty. The surrounding sections build out the enforcement framework, including how penalties are issued, how objections and appeals work, and the availability of the statutory excuse. The Home Office administers this regime, and its published illegal working civil penalties guidance sets out how penalties are calculated and enforced in practice.

Penalty calculation and mitigation factors

Penalty amounts are determined with reference to Home Office guidance and the applicable maximum set by the relevant regulations, and the amount imposed reflects aggravating and mitigating factors. Having carried out correct checks, reporting suspected illegal working, and cooperating with enforcement can reduce exposure, while repeat breaches increase it. The crucial point under the extended regime is that the extension does not change these mechanics, it changes who they apply to. A labour supplier or platform that would never previously have received a penalty notice can now be assessed under the same framework. That makes the statutory excuse, discussed next, the single most important protection to secure and preserve.

Employers should always check the current maximum penalty levels in the applicable Home Office guidance, as these are subject to change.

Statutory excuse under the extended regime

A statutory excuse is the defence that protects a party from a civil penalty where the person turns out not to have had the right to do the work. It is not automatic. It is earned by carrying out the right-to-work checks prescribed by the Home Office before the work begins and by keeping the correct records. As the regime is extended to workers, subcontractors and online matching services, each in-scope engaging party must build the statutory excuse for itself; it cannot simply assume that someone else in the chain has done the work. The Home Office’s right to work checks guidance for employers remains the authoritative source for the steps required.

Right-to-work checks: documentary, online and identity checks

There are three principal routes to establishing a statutory excuse, and the correct route depends on the individual’s status:

• Manual document checks. Obtaining original acceptable documents, checking them in the individual’s presence (or via a permitted video route), confirming validity and photographs, and retaining a clear copy with the date of the check recorded.
• Home Office online check. Using the Home Office online checking service with the individual’s share code and date of birth, confirming the photograph matches, and retaining the online check response. Many individuals with status granted digitally can only be checked this way.
• Identity verification using certified technology. Where applicable, using a certified Identity Service Provider (IDSP) to verify identity documents digitally, in line with current Home Office guidance.

For workers, individual subcontractors and platform onboarding, the same principles apply as for employees: the engaging party must select the correct check for the person’s status and complete it before work starts. The practical challenge is operational, embedding these checks into onboarding processes that were historically built only for payroll employees.

Timing and recordkeeping requirements

Timing is decisive. The check must be completed before the individual begins work in order to establish the statutory excuse. Records must be retained securely and for the period specified in Home Office guidance, together with an audit trail showing who carried out the check and when. Where status is time-limited, follow-up checks must be diarised and completed before expiry. In a subcontracting or platform context, this means maintaining a central, searchable record across what may be thousands of engagements.

What to do if documentation is later found to be invalid

If a document or online check is later found to be invalid or fraudulent, act quickly. Pause the engagement where there is a genuine concern, carry out a fresh check or seek verification, and take advice before continuing. A statutory excuse properly obtained before work began can still provide protection where the check was carried out correctly and in good faith, but continuing to engage someone after discovering a problem risks losing that protection. Document every step taken, and consider whether the circumstances warrant notifying the Home Office. Taking legal advice at this stage is strongly advisable.

Right to work and identity checks for workers, subcontractors and platforms

Because the civil penalty regime is being extended across the full range of engagements, check procedures need to be mapped to each relationship type rather than applied uniformly.

• Employees. Continue the standard employer check at or before the start of employment, with follow-up checks for time-limited status.
• Engaged workers and self-employed contractors. The engaging party (the hirer) should carry out a right-to-work check before the individual begins providing services, and record it alongside the engagement contract.
• Individual subcontractors in a supply chain. Responsibility depends on the structure of the chain. The party that directly engages the individual is best placed to carry out the check, but principals further up the chain should secure contractual assurance and audit rights so they can verify that checks have in fact been done.
• Online matching services and platforms. Where a platform provides service-provider details to clients and is therefore treated as engaging, it should build identity and right-to-work verification into onboarding and clearly allocate any remaining check responsibilities in its terms.

Remote and digital checks

Digital and remote checks are central to compliance at scale. The Home Office online checking service should be used wherever the individual holds digital status, and certified identity verification technology can be used where permitted. For platforms onboarding large volumes of service providers, digital verification integrated into the sign-up flow is the most realistic way to generate a statutory excuse consistently. Whatever tools are used, the output must be retained as part of the audit trail in line with the Home Office guidance.

Practical checklist for supply-chain onboarding and continuous monitoring

• Map every relationship type across your organisation and supply chain and classify each as employee, worker, subcontractor or platform-sourced.
• Define, for each type, who carries out the right-to-work check and by when.
• Build the correct check (manual, online or digital identity) into onboarding before work starts.
• Centralise records so checks are searchable and expiry dates are diarised.
• Set a cadence for follow-up checks and periodic re-verification of supply-chain partners.

A useful internal callout is to decide, in advance, when a platform should perform checks itself versus when a client must. The answer turns on who is treated as engaging in each scenario, which is why clear contractual allocation is essential.

Contracting and procurement: flow-down clauses and indemnities

Contracts are your front line of control over risk you cannot directly supervise. Procurement and supplier agreements should be updated to allocate responsibility, require evidence, and provide remedies. The following short templates are provided as a starting point only.

Draft clause, for legal review. Right-to-work warranty. “The Supplier warrants that, before any individual performs any services under this Agreement, it has carried out right-to-work checks in accordance with the Home Office guidance then in force sufficient to establish a statutory excuse, and that all such individuals have the right to perform the relevant work.”

Draft clause, for legal review. Audit and document production. “The Supplier shall, within [five] business days of a written request, produce to the Customer evidence of the right-to-work checks carried out in respect of any individual engaged in the provision of the services, and shall permit the Customer to audit such records on reasonable notice.”

Draft clause, for legal review. Flow-down. “The Supplier shall impose obligations equivalent to those in this clause on each sub-contractor it engages in connection with the services and shall procure compliance by each such sub-contractor.”

Draft clause, for legal review. Suspension and termination. “Where the Supplier breaches any provision of this clause, the Customer may suspend the affected engagement with immediate effect and, where the breach is not remedied within [ten] business days, terminate this Agreement in whole or in part.”

Indemnities should be considered carefully alongside limitation of liability. A right-to-work indemnity can allocate financial responsibility for a penalty caused by a supplier’s failure, but it does not remove the engaging party’s own statutory liability, the excuse must still be earned through proper checks. All sample clauses must be tailored to the specific contract and reviewed by counsel before use.

Auditing engagements once the extension is in force

Once the extension is in force, every organisation with a contingent workforce or supply chain should run a focused audit of in-scope engagements. The objective is to confirm that a statutory excuse exists for each in-scope relationship and to identify and remediate gaps before any enforcement activity.

• Scope and timeframe. Cover HR, procurement and platform records from the commencement date forward, and consider ongoing engagements that continue past that date.
• Sampling and full-trace. Sample lower-risk populations, but run full-trace audits in high-risk areas where every record is checked end to end.
• Prioritisation. Prioritise high-risk sectors, construction, hospitality, logistics and delivery, and any relationship type where checks have historically not been performed.
• Reporting and remediation. Escalate gaps through a defined internal route and remediate by carrying out fresh checks or pausing engagements as needed.
• Self-disclosure. Consider, with legal advice, whether voluntary disclosure to the Home Office is appropriate; disclosure can be a mitigating factor but carries its own risks and should be a considered decision.

Suggested audit checklist

• List all in-scope engagements by relationship type.
• For each, confirm a check was carried out before work began and the correct method was used.
• Confirm records are retained and follow-up dates are diarised.
• Flag any missing, expired or invalid checks for immediate remediation.
• Record the audit methodology and findings to evidence good-faith compliance.

Platforms and online matching services: special considerations

Online matching services face the most novel exposure. The trigger in the new provision is the provision of service-provider details to clients, which means platforms that simply connect providers with customers may now be treated as engaging. The practical responses are as follows:

• Onboarding and identity verification. Build right-to-work and identity checks into the provider sign-up journey so that a statutory excuse is created before any work is matched.
• Digital integration. Use the Home Office online checking service and certified identity verification where available, integrated into the platform workflow to handle volume.
• Terms of service. Update provider and client terms to set out who is responsible for checks, require providers to maintain their right to work, and reserve rights to suspend or remove providers who cannot evidence it.
• Allocation of liability. Clarify, in user agreements, the respective positions of the platform and the client so that each party understands its own exposure and its own obligation to establish a statutory excuse where it is treated as engaging.

Because this is the area where the extension reaches into territory that is genuinely new, platform operators should treat compliance design as a priority project rather than a contractual afterthought.

Enforcement, appeals and risk mitigation

Enforcement follows the established route in the Immigration, Asylum and Nationality Act 2006 and the Home Office’s civil penalties guidance. A party believed to be liable will receive a penalty notice setting out the amount and the basis for it. There is an objection process allowing representations to the Home Office, and an onward right of appeal to the court. Judicial review may be relevant in limited circumstances where there is a public-law challenge to the decision-making process. Strategically, the strongest mitigation is preventive: establishing a statutory excuse for every engagement, maintaining robust records, conducting regular audits, and acting promptly and transparently when a problem is found.

Professional guidance on this evolving area is available through resources such as the Law Society’s immigration topic hub.

Conclusion and next steps

The extension of illegal working civil penalties to workers, sub-contractors and online matching services is one of the most consequential compliance developments for UK employers, labour suppliers and platforms in recent years. The core penalty mechanics in the Immigration, Asylum and Nationality Act 2006 are unchanged, but the extension significantly widens who they reach. The practical response is clear: confirm the commencement date against the published regulations, run an audit of in-scope engagements, embed the correct right-to-work checks into onboarding for every relationship type, and update contracts, procurement templates and platform terms to allocate responsibility and secure audit rights.

This article is for general information and is not legal advice; for tailored guidance on your specific engagements and supply chains, consult a qualified solicitor. For more, see Business Immigration, United Kingdom (practice area overview) and the Global Law Experts, Lawyer directory (Business Immigration, United Kingdom).

Sources

1. Immigration, Asylum and Nationality Act 2006 (contents)
2. Illegal working: civil penalties collection (Home Office / gov.uk)
3. Right to work checks: an employer’s guide (gov.uk)
4. Immigration, Asylum and Nationality Act 2006, section 15
5. The Law Society, Immigration topic hub