Right to work liability now runs up the chain

From 1 October 2026, right to work risk on a UK construction site is no longer something you can park with the firm that hired the person. Extended liability under the Border Security, Asylum and Immigration Act 2025 means a main contractor (and, depending on the chain, a developer delivering work to a third party) can face a civil penalty when someone further down the packages is working illegally, even if your commercial team never met them.

That is not abstract theory landing next week. Construction Enquirer published footage on 28 September of workers fleeing a Home Office immigration enforcement operation at London Square's Crayford scheme, where Carey London is main contractor on a 559-home scheme. Carey stated that none of the individuals encountered were Carey employees; they were engaged through the subcontracting chain; Carey requires right to work checks contractually and is cooperating with the investigation. Whatever the outcome of that case, the pattern matches how most large sites run labour. Packages sit with tier-1 subcontractors. When officers arrive, the conversation starts with the name on the site board.

If you sit in a commercial or project director seat for a main contractor or developer, treat 1 October as a contract and package-control date, not an HR diary note.

What actually changes on 1 October

The Home Office draft employer's guide (updated 11 September 2026, in force from 1 October) expands the Right to Work Scheme beyond traditional employment. Worker’s contracts, individual subcontractors and online matching services sit inside the wider definition. Separately, new extended liability provisions (new section 15A of the Immigration, Asylum and Nationality Act 2006) allow civil penalty risk where you are under contract to provide work or services to a third party and you engage another employer to supply the people who fulfil that contract.

The government's construction example is blunt: a property developer wins a contract to build homes and engages businesses through a chain for foundations and bricklaying. That developer may be treated as employing individuals who personally carry out work through that chain, and may need a statutory excuse based on prescribed contractual requirements, not only on someone else's check.

Civil penalties cited by Travers Smith and Harper Macleod sit at up to £45,000 per illegal worker for a first breach and up to £60,000 for repeat breaches. Construction News also flags criminal risk in serious cases, closure notices, and sponsor-licence consequences.

There is no tidy transitional free pass for live work after 1 October. Advisers are clear that new engagements on or after that date can pull older contracts into scope where the chain continues to operate. If your subcontract forms still say "comply with all immigration laws" and stop there, that is unlikely to be enough.

Why contractual confirmation alone will not save you

Most main contractors already write right to work obligations into packages. From 1 October, the statutory excuse against extended liability is more specific. Summarising Construction News, Travers Smith and the Home Office guide, you need three things working together before work starts under the relevant arrangement.

Written contractual terms that oblige the down-chain employer to run prescribed right to work checks; prohibit further subcontracting without prior written consent and push equivalent obligations into any permitted subcontracts; give you audit rights; allow suspension or termination where illegal working is found without a statutory excuse; and require cooperation with Home Office investigations.

Substitution controls so nobody steps onto site as a substitute before a prescribed check is done. Calling the person self-employed on a day rate does not remove that requirement.

Proportionate identity verification so the person on the induction sheet or turnstile is the same person who was checked. Site access systems matter here as much as a passport copy in a subcontractor's shared drive.

Assurances from a package contractor can form part of your evidence, but only if you have taken reasonable steps to satisfy yourself those assurances are reliable. Paper that has never been audited is a weak story after officers have already been on site.

Clients purchasing for their own use can sit outside extended liability in some models. Main contractors delivering through packages, and developers providing work onwards through a chain, should assume they are in the conversation until counsel maps the contracts.

Commercial checklist for live and tendered packages

Run this with commercial, procurement, site management and whoever owns site access. Do it package by package.

• List every live package where labour or services can be further subcontracted, including labour-only, agency-style supply and "self-employed" gangs under a package contractor.

• Pull the subcontract and any LOI or side letters. Mark whether further subcontracting needs written consent today, and whether that consent trail exists in the project file.

• Compare clause wording against the prescribed contractual requirements. Flag gaps for legal to amend before 1 October if the package will be live.

• Confirm who holds audit rights in practice, who last used them, and what evidence you keep when a package contractor says checks are complete.

• Align site access with package appointments so you can show which firm a person sits under on the same day a question is asked.

• On tenders and PCSAs still in flight, make prescribed right to work wording, consent to further subcontracting, audit and termination rights part of the return.

• For developer-side teams, ask your main contractor in writing for tier-1 appointments, known further subcontracting, and how they will evidence the statutory excuse after 1 October.

• Where package visibility earns its keep

You cannot invent a statutory excuse after the event. You can stop being the contractor who cannot say which packages sit under which firm when the call comes in at 09:15.

Ordinary commercial control fails first through scattered appointment letters, a dead procurement tracker, and PQQ evidence stuck in email. Platforms such as SubTrada help main-contracting teams keep directory profiles, 4-tier PQQ status, live insurance expiry and procurement trackers in one place so commercial can see appointed packages when a chain question lands. It does not replace prescribed right to work checks or legal drafting. It does stop the delay that makes every enforcement visit worse than it needs to be.

The job is still yours: contracts, consent, audit, site access, and a clear instruction that no substitute starts until checked.

Worked example: one frame package

Assume a concrete frame package where the tier-1 intends to use two specialist labour suppliers. Your subcontract allows further subcontracting "with consent not to be unreasonably withheld" but has no audit right, no Home Office cooperation clause, and no express ban on unapproved substitutes.

Before 1 October you issue a deed of variation with the prescribed wording; refuse start of the labour suppliers until written consent is on file and equivalent right to work obligations sit in their appointments; require the tier-1 to confirm check method and retention of evidence, and diary a sample audit; and tell the site manager that gate passes for that package only issue against the consented firms and named individuals.

None of that is glamorous. It is cheaper than explaining to a client board why a civil penalty notice and a stopped frame sit on the same project dashboard.

FAQ

Does extended liability mean every developer is automatically liable for every person on site?

No. It turns on contractual arrangements and how they operate in practice. End-users purchasing for their own use can sit outside the provisions. Developers and main contractors who deliver work to a third party and engage others to supply the people doing that work are the arrangements the Home Office guidance illustrates. Take advice on your model.

Is a contractual warranty from the package contractor enough on its own?

Unlikely. The statutory excuse needs prescribed terms, and you should show reasonable steps that assurances are reliable in practice. Unused audit rights and unknown further subcontracting weaken that position.

Do existing subcontracts signed before 1 October escape the rules?

Do not assume so. Advisers note that work and new worker engagements on or after 1 October can bring continuing arrangements into play. Review live packages now.

Who owns this inside a main contractor: HR or commercial?

Both. Commercial leads on forms, further-subcontract consent and package maps; HR or labour compliance leads on check standards; site management owns access control. HR alone cannot cover liability arising outside your own payroll.

What to do this week

Pick your three highest-labour packages. Open the contracts. Check further-subcontract consent, audit rights and site-access alignment against the Home Office prescribed requirements. Instruct amendments where the wording is thin. Then tell every package manager the same rule: nobody new starts under a chain you cannot name, consent and evidence.

The Crayford footage will not be the last clip that reaches a client WhatsApp group. The firms that look organised after 1 October will be the ones that treated right to work as a supply-chain control problem, not a poster in the canteen.