How to Conduct a Right to Work Check on Staff Who Aren't Employees

The mechanics of a right to work check are the same whether you're checking an employee or a contractor: a manual document check, a Home Office online check, or a check through a registered digital verification provider. What changes for non-employees is everything around the check. You need to work out whether you're even the party responsible for doing it, add contractual protections if you're not the direct employer, and control substitution so the person turning up to do the work is the person you actually checked.

From 1 October 2026, this stops being optional good practice and becomes a legal requirement for a much wider group of employers. If your business engages anyone under a worker's contract, as an individual subcontractor, or through an online matching service or platform, you need a working process before that date. This guide sets out exactly how to run the check, step by step, for each of these arrangements.

Who counts as a non-employee under the right to work scheme?

Three categories sit outside a standard contract of employment but inside the right to work scheme from 1 October 2026.

A worker's contract covers someone who personally performs work for you and isn't operating as your client or customer, such as an individual engaged through a zero-hours or casual arrangement, or supplied by an employment business on a contract for services. An individual subcontractor is someone who has contracted with another person to provide work or services, where that other person has a separate contract with a third party to deliver the same work but the individual hasn't contracted with the third party directly, such as a bricklayer engaged by a contractor on a construction chain. An online matching service is a business that keeps a register of service providers, matches them with clients or customers through an online platform, and charges a fee or commission for making the match, such as a platform connecting tradespeople or delivery drivers with customers.

Genuinely self-employed individuals who trade in their own name or through their own company, and who contract directly with clients for the purchase of a service rather than the supply of their own labour, stay outside the scheme. So does a personal service company invoicing a client directly under a business-to-business arrangement. The label in the contract doesn't settle the question. What matters is whether the individual is personally providing the work through an intermediary, platform or chain, or whether they're genuinely running an independent business.

Step 1: Work out who is responsible for the check

Before you do anything else, establish where you sit in the arrangement. This is the step most businesses skip, and it's the one that causes the most problems later.

If you have the direct contractual relationship with the worker, whether that's a worker's contract, a subcontractor agreement, or a service-provider arrangement through your own platform, you are the employer for right to work purposes and you are responsible for the check.

If you're further up a contractual chain, such as a business that has contracted to deliver work or services to a client and then engaged another business to supply the workers, you may fall within the extended liability rules even though you have no direct relationship with the individual. This applies where you contract to provide work or services to a third party and use another employer or labour supplier to deliver it, where you operate an online matching service, or where a contract you hold permits substitution.

If you're simply purchasing a defined service for your own internal use, such as a retailer paying a facilities management company to clean its own premises, and you're not passing that service on to anyone else, you're a pure end-user and the extended liability rules don't apply to you. The direct employer of the workers remains responsible for checking them.

Get this wrong and you'll either build a compliance process you didn't need, or skip one you did. Map every engagement type in your business against these three categories before deciding what to build.

Step 2: Conduct the underlying check

Once you've established that you (or a business you're contracting with) is responsible for the check, run one of the three lawful methods before the individual starts work. These are the same three methods for a worker, a subcontractor or a platform service provider as they are for an employee.

Method A: Manual document-based check

Obtain the individual's original documents from List A or List B of the Home Office's acceptable document lists. Check the documents in the individual's physical presence, either in person or via live video link provided you hold the originals, and confirm they're genuine, unaltered and belong to the person presenting them. Check that any photograph and date of birth are consistent across the documents and match the individual's appearance. Check any work restrictions, such as hours limits for students, against the work you're actually offering. Make a clear copy of every document, including all pages showing nationality, date of birth, immigration permission, expiry date and any visa or entry stamp. Record the date the check was made using the wording "the date on which this right to work check was made: [insert date]", and retain the copy securely.

Method B: Home Office online check

Where the individual holds an eVisa, this is usually the required route rather than a matter of preference. The individual generates a nine-character share code beginning with the letter W through the GOV.UK "prove your right to work" service, valid for 90 calendar days, and gives it to you either directly or via an email the Home Office sends you. Enter the share code and the individual's date of birth on the "check a job applicant's right to work" service. Confirm the photograph on the result matches the person in front of you, either in person, by video call, or using facial recognition technology through a registered digital verification provider. Do not proceed if it's reasonably apparent the photograph doesn't match. Retain a secure copy of the result, including the reference number, company name and date of check shown on the output.

Method C: Check through a registered digital verification service provider (DVSP)

This route isn't mandatory, but if you choose to run checks digitally, the provider must be registered on the Office for Digital Identities and Attributes register and able to conduct right to work checks. The provider verifies the individual's document, in some cases using passive authentication technology to read the document's data chip, and confirms the photograph matches the individual using facial recognition. You must still obtain and retain the provider's output, including the individual's name, date of birth, an image of the document checked, confirmation of the provider's registration, the date of the check and confirmation that identity was verified. Using an unregistered provider will not establish a statutory excuse, and the responsibility for that failure sits with you, not the provider.

Whichever method you use, a screenshot from the individual's own immigration account is never acceptable. It must be the employer-facing check, not the migrant-facing one.

Step 3: Add the extra layer if you're not the direct employer

If Step 1 showed that extended liability could apply to you, the underlying check alone isn't enough. You need three additional things in place before the work or service starts, and you need to be able to produce evidence of all three if the Home Office asks.

A written statement in your contract with the employer or service provider below you in the chain, requiring them to carry out prescribed right to work checks on anyone performing the work, preventing further subcontracting without your written consent, requiring equivalent obligations to flow down into any subcontracting you do permit, giving you audit rights over their compliance, allowing you to suspend or terminate the arrangement if illegal working is found and no statutory excuse exists, and requiring cooperation with any Home Office investigation, including information about the chain of contracts and the businesses involved.

Substitution controls, where the contract allows the worker to send someone else to do the job. You need a process, agreed before work starts, that ensures any substitute is checked before they begin, that responsibility for the check isn't left to the original worker to manage informally, and that you can show the original worker and any registered substitute are the same individuals whose right to work you've verified.

Identity verification systems, proportionate to the risk, that confirm the person actually doing the work is the person who was checked. This can be identity cards or workplace passes, biometric or attendance systems, facial recognition through a registered provider, checks against training or licensing records, or re-verification at set intervals. The Home Office recommends re-verification at least once in any 24-hour period of activity in higher-risk settings.

You don't need to run every one of these controls yourself. You can rely on assurances from the business you're contracting with that checks have been carried out, provided you've taken reasonable steps to satisfy yourself those assurances are reliable, for example by requesting audit records or evidence of compliance reviews rather than accepting a bare statement that "checks are done."

Step 4: Retain the right records

For every check, retain a clear copy of the documents or online result for the duration of the individual's engagement and for two years afterwards, then securely destroy the file. Where extended liability applies, also retain copies of the relevant contractual terms, any audit records, assurance information received from businesses in the chain, and evidence of how substitution and identity verification controls have actually operated, not just what the contract says should happen. A contract clause that looks compliant on paper but has never been checked in practice will not protect you.

Step 5: Diary the follow-up check

Where the individual has time-limited permission to work, you must carry out a follow-up check on or before the date that permission expires, using any of the three methods, not necessarily the same one used initially. If, on that date, you're reasonably satisfied the individual has an outstanding application, appeal or administrative review pending with the Home Office, your statutory excuse continues for a further 28 calendar days while you obtain a Positive Verification Notice from the Home Office's Employer Checking Service. That 28-day grace period only applies to follow-up checks. It does not apply before an individual first starts work: if you can't complete a prescribed check before day one, you should delay the engagement rather than proceed on the strength of an assurance.

Common mistakes specific to non-employee checks

Assuming a contractor labelled "self-employed" in the paperwork is automatically outside the scheme, without looking at how the arrangement actually operates. Relying on an agency, umbrella company or subcontractor's word that checks have been done, without any audit right or evidence trail behind it. Treating a substitution clause as a formality rather than a live compliance risk, and only thinking about it after a substitute has already started. Using a digital identity provider for onboarding that isn't actually registered as a right to work DVSP. Applying a lighter check, or no check at all, to platform or gig workers because the relationship doesn't feel like conventional employment. And building a written policy that procurement, site managers and onboarding teams have never actually been trained to follow.

The bottom line

For most businesses, the mechanics of checking a document or running a share code don't change when the worker isn't an employee. What changes is the layer around it: knowing whether you're responsible at all, putting written contractual protections in place if you're not the direct employer, controlling substitution, and being able to prove your checks work in practice rather than just on paper. Build that layer before 1 October 2026, not after the Home Office asks you to produce it.

Getting the underlying check right but skipping the contractual and substitution controls around it is one of the most common ways businesses lose their statutory excuse under the expanded regime, and a lost statutory excuse means exposure of up to £60,000 per worker. 

Call UK Immigration Pathways on 0121 812 6600 or email info@ukimmigrationpathways.co.uk to have your contractor and subcontractor checking process reviewed before the new rules take effect.

Frequently Asked Questions

Do I need to check a subcontractor the same way I check an employee? The three lawful checking methods are identical: a manual document check, a Home Office online check, or a check through a registered digital verification provider. What's different is that you first need to confirm you're the party responsible for the check, and if you're further up a contractual chain, you'll need additional written contractual protections, substitution controls and identity verification systems to establish a statutory excuse.

Can I rely on an agency's assurance that it has checked its workers? You can rely on assurances from a business in your contractual chain, but only if you've taken reasonable steps to satisfy yourself those assurances are reliable, such as audit rights, compliance review records or evidence requests. A bare statement that "checks are done," with nothing behind it, is unlikely to protect you if illegal working is later found.

What do I do if a contractor's agreement allows substitution? You need a process, agreed and implemented before work starts, that ensures any substitute is checked before they begin work, that the check isn't delegated informally to the original worker, and that you can evidence the original worker and any registered substitute are the same individuals whose right to work has been verified.

Is a Digital Verification Service Provider mandatory for checking contractors? No. A registered DVSP is one of three lawful checking methods, not a requirement. Manual document checks and the Home Office online check remain equally valid for workers, subcontractors and platform staff, provided they're carried out and evidenced correctly.

How long do I need to keep records for a non-employee? The same retention period applies as for employees: securely for the duration of the individual's engagement and for two years afterwards, then securely destroyed. Where extended liability applies, you should also retain the contractual terms, audit records and evidence of how substitution and identity controls operated in practice.

What if I can't tell whether someone is genuinely self-employed or within the scheme? Look at how the arrangement actually operates rather than the label in the contract. Relevant questions include whether the individual must do the work personally, whether they can send a substitute and how that works, whether they run their own business with their own clients and commercial risk, and whether they're integrated into your workforce or sourced through a platform or intermediary. Keep a record of your reasoning for borderline cases.