State the task honestly and the shape of the work becomes clear. By 1 October, UK organisations must be able to run a statutory-excuse-grade right-to-work process across populations many have never checked, gig workers, agency staff, zero-hours engagements, individual subcontractors, including people they may never meet in person, engaged through suppliers they do not control. The penalty for getting it wrong is up to £60,000 per worker, and the excuse that protects a compliant employer is procedural: the right method, applied before work starts, evidenced and dated.
That is achievable in the time available, but only in sequence. Here is the sequence.
Audit Who Actually Works for You
Everything begins with a census, because you cannot check a population you cannot list.
Map everyone performing work for the organisation in the UK, and classify each arrangement honestly: employees, workers, agency-supplied staff, individual subcontractors, platform and gig engagements, and the genuinely self-employed, since the categories land differently under the new code and the boundaries are where the risk lives. This is precisely the internal audit employment counsel are urging before October, and organisations that built a total-workforce inventory for screening purposes will find they have already done most of it. The badge list and the access register are better starting points than the payroll, for reasons this newsletter has laboured before: the payroll describes your employees, and October is about everyone else.
Expect surprises. The census that finds no long-forgotten contractor cohorts is the census that wasn’t finished.
Fix the Core Process First
Before extending the perimeter, repair the fort, because most penalties arise from ordinary process failure rather than exotic fraud.
Three components make a compliant core. First, the correct method for each person: manual inspection of original acceptable documents where that route applies, the Home Office online check via share code for eVisa holders, or certified digital identity verification where eligible. Second, timing and uniformity: the check happens before work starts, for everyone, British and Irish citizens included, because selective checking is both non-compliant and a discrimination risk. Third, the machinery of proof: a dated record of every check, retained securely, and a follow-up diary for every worker with time-limited permission, so expiries trigger re-checks instead of penalties.
None of this is operationally difficult. Together, in the words of one practitioner guide, it is the difference between a statutory excuse and a civil penalty notice.
Get the Digital Rails Right
The regime is now digital-first, and two rails carry it.
The first is the eVisa. Physical permits are gone; visa holders prove status through share codes generated from their UKVI accounts, checked online by the employer. Build candidate communications around this, because account problems and share-code delays are the worker’s responsibility to resolve but the employer’s onboarding delay to absorb, and a start date lost to a locked account is a cost the process should anticipate rather than discover.
The second rail has a sharp edge: where you use identity verification technology, the provider must be certified on the government’s OfDIA register for right-to-work purposes. An uncertified tool, however sophisticated, earns no statutory excuse. So audit your verification stack now, confirm certification in writing, and treat any onboarding technology in your gig and contractor funnels, including tools embedded by platforms and agencies, as part of the compliance surface rather than a convenience layer.
Decide Who Checks Whom in the Chain
For the extended workforce, the hardest question is not how to check but who must, and the answer is contractual before it is operational.
Work through each supply route in the census. Directly engaged contingent workers are yours to check. Agency-supplied staff will typically be checked by the agency, but the end-user should require it by express term: a contractual obligation on the supplier to conduct compliant checks on everyone supplied, to evidence them on request, and to warrant the method used, exactly as employment counsel now advise. Platform arrangements need the same analysis, since the reform reaches platforms matching freelancers to clients, and residual end-user exposure turns on how the engagement is structured. Subcontract chains, construction above all, need the allocation written down layer by layer.
The principle is the one this newsletter applies to screening generally: an assurance you cannot inspect is a hope, and from October, a hope with a price list. Paper the allocation, collect the evidence, and audit it.
Build the Substitution Controls
Now the frontier the reform is really aimed at: making sure the person working is the person checked.
For remote, high-churn, platform-style populations, a one-time onboarding check is the beginning, not the end. The controls that close the gap are identity controls: a verified identity anchored at onboarding, periodic live re-verification against that anchor, and event-triggered checks where the work pattern suggests an account is being shared, the courier photographed at handover who is not the account holder, the access badge used across impossible shifts. Construction has its own version, tying site access to checked identity rather than to a name on a gate list.
Readers of the recent series on proxy fraud will recognise the architecture: one identity, verified at the first gate, reconciled at the later ones. The UK has, in effect, mandated the first gate for the extended workforce. Organisations serious about the risk, and about the penalties, will build the later gates too, because substitution is precisely the failure mode enforcement teams go looking for in the sectors now under the spotlight.
Prepare for the Visit
Enforcement is not hypothetical: visits and arrests are up 38 percent since mid-2024, with delivery and construction named priorities. Prepare as if the knock is scheduled.
That means evidence retrieval at speed: any worker’s check, method, date, and documents producible quickly, including for agency and subcontract staff via the contractual evidence rights you have now secured. It means trained frontline managers, because the person who accepts the wrong document is rarely in HR. It means treating the sponsor licence, for organisations that hold one, as the crown jewel the process protects, since an illegal working finding can suspend or revoke it and take the sponsored workforce with it. And it means a rehearsed response: who meets the officers, who pulls the records, who briefs leadership.
A compliant process is also the mitigation. The penalty framework rewards employers who checked properly and punishes those who cannot show they did, which returns, always, to the dated record.
Sequence the Weeks That Remain
The runway is short but sufficient if spent in order. The present belongs to the census and the gap analysis: who works for you, through what route, checked by whom, with what evidence missing. The next stretch belongs to contracts and rails: supplier terms amended, verification providers confirmed as certified, candidate communications rebuilt around share codes. September belongs to going live: the extended process running for all new engagements, and the highest-risk existing cohorts, the platform-style and subcontract populations in spotlight sectors, brought inside the perimeter first. From 1 October the perimeter is law, and what remains is rhythm: the follow-up diary, the periodic audits, the supplier evidence checks.
Organisations that run this sequence will cross the deadline without drama. Organisations that wait will discover in late September that contracts take longer than checklists.
The Perimeter Is the Point
There is a way to experience October 1 as a compliance tax, and a way to experience it as confirmation. The second is more useful.
Everything the new rules demand, knowing who works for you, verifying identity where churn is highest, holding suppliers to inspectable standards, is what a mature workforce-integrity programme does anyway, for its own reasons: security, quality, brand, and the simple dignity of knowing who is inside the building. The UK has attached a statutory deadline and a price to it. Firms that are ready will keep onboarding contractors fluidly in Q4 while less-prepared competitors freeze their contingent hiring to catch up, and that difference, in sectors that run on flexible labour, is not compliance. It is capacity.
The label era is ending. The work was always the point, and now, in one major market, the law agrees.
