From 1 October 2026, right-to-work checks in the UK stop being an employees-only requirement. Confirmed directly in the Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026, Section 48 of the Act extends illegal working provisions to cover agency workers, individual sub-contractors, and people engaged through a “worker’s contract” — not just staff on a direct payroll.

For an industry that runs heavily on agency and zero-hours arrangements, this isn’t a small compliance footnote. It changes who’s responsible for what, on both sides of the relationship.

What’s Actually Changing

Until now, a business was generally only liable for a civil penalty if it directly employed someone without the right to work. From 1 October, that changes in two important ways:

• The definition of who needs checking widens. It now covers agency workers, individual sub-contractors, and anyone engaged under a worker’s contract, including gig and platform-style arrangements.
• Liability can reach further up the chain. If a business engages labour through a supply chain, illegal working further down that chain can now expose it, not just the party with the direct contract.

Civil penalties rise to £45,000 per worker for a first breach and £60,000 for a repeat breach within three years. Genuinely self-employed individuals contracting directly with their own clients remain outside scope — but misclassifying someone as self-employed when they’re not is exactly the kind of gap this legislation is designed to close.

This matters more for security than most sectors. A large share of the private security workforce isn’t employed on a standard contract; officers move between sites through agencies, work variable hours, and are sometimes subcontracted to a client directly. Every one of those relationships is now squarely in scope, and it comes at a time when right-to-work failures already account for 9 in 10 SIA licence revocations. This expansion adds more checkpoints to a system that’s already enforcing this area more heavily than any other.

If You’re An Employer Or Agency

If your business supplies staff to venues, uses agency workers to cover shifts, or subcontracts any part of a security contract, you need to know exactly where responsibility for the right-to-work check sits in that chain — and be able to show it, not just assume it’s someone else’s job.

What to actually do before 1 October:

• Map every way you engage labour. Direct employees, agency staff, subcontracted officers, and anyone brought in through a third party all need to be categorised against the new definitions.
• Check who’s actually running the right-to-work check in each arrangement, and get it in writing. Assuming an agency or subcontractor has already done it is no longer a safe default.
• Review your contracts with agencies and subcontractors to make sure they include clear right-to-work obligations and a right to audit compliance.
• Don’t rely on a licence card alone as proof of eligibility to work. An SIA licence and a right-to-work check are two separate things; our guide to reading and verifying SIA licence cards covers what a licence actually confirms, and what it doesn’t.
• Brief whoever’s actually onboarding staff. This is rarely just an HR issue — site managers, procurement, and whoever books agency cover on a given night all need to understand the new scope.
• Use the Home Office’s own checking service, not a workaround. The official check a job applicant’s right to work service is the only route that gives you a statutory excuse if something later turns out to be wrong — a photocopy of a passport or a verbal assurance doesn’t count.

If You’re A Security Officer

If your right to work is straightforward and current, i.e. you’re a UK or Irish citizen, or your visa, settled or pre-settled status is valid and up to date, this isn’t a new requirement on you personally. It’s a change to who has to verify it and how thoroughly, not a change to whether you’re allowed to work.

Where it’s worth paying attention: if you work through more than one agency, or move between sites via a subcontractor, you may now be asked to prove your right to work more than once, by more than one party in the chain. That’s not a sign anything is wrong — it’s each business in the chain covering its own new liability.

What you might be asked for:

• A share code, generated through the Home Office’s online service, if your status is visa-based, settled, or pre-settled — this is now the standard way employers and agencies verify status, not a physical document.
• Proof of identity and right to work at each new engagement, even if you’ve already provided it elsewhere. Different agencies and subcontractors are separately responsible now, so duplicate checks are likely to become more common, not less.
• Clarity on how you’re actually engaged — as an employee, agency worker, or subcontractor — since that affects who’s responsible for checking you under the new rules.

If you’re not sure your own documents or visa status are current, our guide to right-to-work checks for foreign national licence holders walks through exactly what to check, and our licence documents guide covers what’s typically needed for an application or check.

If you’re newer to the UK security industry, our guide to getting started in UK security as an immigrant covers the wider picture too.

The Bottom Line

This isn’t a rule that quietly applies to someone else’s part of the business, and it isn’t a new hurdle for officers whose status is already in order either. If your security operation touches agency staff or subcontractors — and in this industry, that’s most operations — 1 October changes what employers are accountable for and how often officers may be asked to prove their status. Three weeks is enough time to get ahead of it, but not much more than that.

If you’re an employer building or expanding a team, or an officer looking for compliant, properly run work, Get Licensed’s SIA security training courses are a good place to start from the same footing.