Quick answer: Section 48 of the Border Security, Asylum and Immigration Act 2025 came into force on 1 October 2026. Right to work checks now cover people engaged under a worker’s contract, individual sub-contractors and online matching services, and a business contracted to deliver work through a chain of contracts can be treated as the employer of the people who do it. Checks are still due before work starts, and the £45,000 and £60,000 penalty starting points match the January 2024 code. The Home Office says there is no general grace period. In a standard agency supply arrangement, where the agency directly engages its chefs and supplies them into your own operations, its guide says the agency does the check and the changes are not intended to require routine duplication by you.
What came into force
The Secretary of State made the Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026, SI 2026/683, on 24 June 2026. Regulation 2 says section 48 “comes into force on 1st October 2026”. The Act received Royal Assent on 2 December 2025, and legislation.gov.uk records section 48 as in force from 1 October 2026.
Section 48 puts two new sections into the Immigration, Asylum and Nationality Act 2006. Section 14A widens who counts as an employer. Section 15A widens who can be liable for a civil penalty. A second instrument, SI 2026/700, took effect the same day and sets the requirements a business must meet to have a defence under the new extended liability.
Our July guide to right to work checks for kitchen staff was published in July, before the final documents appeared. On 1 October 2026 GOV.UK published the final employer’s guide to right to work checks, the code of practice on preventing illegal working, and a code of practice on avoiding discrimination. The penalty code calls itself the seventh version and says it updates the one issued in January 2024.
Who now has to do a check
Section 14A says that in sections 15 to 24 of the 2006 Act, a reference to employing someone now includes engaging an individual under a worker’s contract, engaging an individual sub-contractor, and acting as an online matching service that passes a service provider’s details to potential clients. The statute defines that last one narrowly: a business that keeps a register of service providers, takes online client enquiries and charges a fee or commission for matches.
The statute defines a worker’s contract as a contract, other than a contract of service or apprenticeship, under which the individual agrees to do the work or services personally, and the other party is not a client or customer of a business the individual runs. The Home Office’s consultation page, updated 30 June 2026, describes the aim as covering those who engage “casual or temporary workers under a worker’s contract”. That can include the shift-by-shift casual chef or kitchen porter, if their terms are not a contract of employment. Whether a particular casual fits depends on the contract and how it works in practice.
The guide’s own hospitality example is an employment business that supplies temporary workers to bars and restaurants and engages them on a contract for services. It says the employment business is the employer for the purposes of the Scheme and is responsible for the check.
For freelancers, the guide says to assess the substance of the arrangement. It does not apply to individuals “operating an independent business either in their own name or through their own company” who contract directly with clients or customers. It also says there is “no blanket exclusion simply because a worker is described as a contractor, freelancer or consultant”, and that the label alone does not decide it. Tax status does not settle it either: the guide says an IR35 determination “is a tax assessment and does not determine right to work checking responsibilities under the scheme”. The Home Office states that it cannot approve an organisation’s interpretation of its own arrangements, so each business has to review its own contracts.
Agency chefs: the check stays with the agency
One question for kitchen operators is whether a hirer now has to check agency staff too. The guide answers it in a Q&A: where an employment business directly engages agency workers and supplies them into a hirer’s own operations, “the employment business, as the employer with the direct contractual relationship with the worker, is responsible for conducting the right to work check”. It adds: “In a standard agency supply arrangement, the changes are not intended to require routine duplication of these checks by the hirer.”
Its worked example 12 uses a factory, not a kitchen: a business taking temporary workers into its own operations, with no onward duty to a third party, is outside extended liability, and responsibility stays with the employment business.
A different rule applies to someone you engage yourself. The guide says that, except for a prescribed check by a registered digital verification provider, an employer “cannot establish a statutory excuse by relying on a check carried out independently by an external third party, such as a recruitment agency or professional adviser”. The guide does let an employer delegate a check to someone acting under its control and direction who is accountable to it, but the employer stays liable. More on the wider position is in our guides to agency work in hospitality and how to choose a chef agency.
Contract caterers and chains of contracts
Section 15A is the part contract caterers need to read closely. For the purposes of the civil penalty, it treats a business as employing anyone who personally does the work if the business is contracted to provide, or arrange, work or services and passes that work on under another contract. Subsection (5) says this applies “regardless of whether that contract is the first or any other contract in a chain of contracts”. Subsection (4) says it applies even where the business has no contract with the individual or does not know they are doing the work.
The guide separates buying from delivering. A client that buys work or services for its own use or internal operations, and is not responsible for providing them onwards to a third party, is outside extended liability. A business that is itself contracted to deliver work to a third party and uses someone else to fulfil it is inside. The guide’s examples include a construction company relying on a chain of contracts (example 7) and a logistics company that outsources a managed service (example 10). The guide has no catering or kitchen example: those words and “chef” do not appear in it, and hospitality appears once, in the agency example above. Its food examples include a sandwich producer (example 13) and a food ordering platform (example 14). A contract caterer should hold its own arrangement against the pattern in examples 7 and 10 and not assume either way.
To have a defence under extended liability, the guide lists three requirements to meet before the work commences. The first is a written statement of the terms the next contract in the chain must contain. The guide lists them: the other party carries out prescribed checks on everyone it employs for the work; it does not sub-contract further without your prior written consent, and passes equivalent right to work obligations to any permitted sub-contractor; you can audit its compliance; you can take enforcement action against it, with equivalent provisions in its contract with the individual; and it cooperates with a Home Office investigation, including by giving details of the chain and each business in it and any other information the Home Office considers relevant. The guide says a written statement is mandatory, and that existing vendor onboarding processes cannot replace it.
The second is substitution controls where a contract lets a worker send someone else: a prescribed check on any substitute, the check not left to the individuals doing the work, no substitute working before their right to work is verified, contractual provisions for cases where a substitute is known or believed to be working illegally, and systems that keep the worker and registered substitute the same individuals whose right to work was checked. The third is proportionate identity verification, which the guide says the Home Office recommends repeating at least once in any 24-hour period or shift of work. SI 2026/700 sets out the written-statement terms and the substitution requirements in a new article 5B, which also requires systems, for the duration of the engagement, that ensure the person providing the work is the same individual.
Two points from the guide ease the load. An upstream business does not have to repeat the check on every individual in the chain, but has to show the arrangements work in practice. And the Home Office “would not normally expect to issue a civil penalty notice to more than one employer in a contractual chain in respect of the same illegal worker”. Extended liability, the guide adds, does not mean every organisation in a chain is automatically liable.
Start dates, retrospectivity and grace periods
The guide uses two tests, and a reader should keep them apart. For worker’s contracts, individual sub-contractors and online matching services, a civil penalty “may only be imposed where the employment commenced on or after 1 October 2026”. For extended liability, the prescribed requirements apply where the contractual arrangements “were entered into on or after 1 October 2026”. Annex C says: “The measures are not intended to be retrospective. The relevant date is when the contractual arrangement is entered into, not when the work starts or continues.”
On that wording, a casual whose employment under a worker’s contract commenced in August is not brought within the penalty only because they carry on working after 1 October. The two formulations can point different ways where a contract was signed before 1 October but the individual first starts work after it: the first looks to when employment commenced, Annex C to when the arrangement was entered into. The guide does not reconcile them. If that is your situation, the safe course is to check before their first shift. These dates govern civil-penalty scope. They do not authorise employing someone who is not allowed to do the work: the guide says an employer that knows it is doing so has no statutory excuse, whether or not it ran checks.
A renewal, extension or variation is another open point. The guide says a change “should not be assumed either to bring it within scope or to leave its position unchanged”, and the question is whether the change amounts to entering a new arrangement on or after 1 October.
There is no general grace period for the new requirements. The guide asks, “Will there be a grace period following commencement?” and answers: “No. The requirements apply from 1 October 2026 and there is no general grace period.” Enforcement stays intelligence-led. Separately, the guide gives acquiring employers 60 calendar days for a fresh check after a TUPE transfer, with none for later follow-up checks.
Neither the code nor the guide mentions kitchens, catering or chefs, and neither gives hospitality a separate date.
What the check itself looks like
The guide says the expansion “does not change when right to work checks must be carried out”, so the check is still due before the worker starts. It also says employers “cannot mandate the method”. It lists three routes: a manual document check, a Home Office online check, and a check through a right to work digital verification service provider. Where an intermittent worker stays with the same employer, a fresh check is not needed before each assignment as long as the employer holds a valid statutory excuse and does any follow-up check before permission expires.
The code’s summary of changes lists the new working arrangements, a rule that an official document providing an individual’s name and National Insurance number “may include a digital version issued by or on behalf of a government agency”, the term “RtW DVSP” for a digital provider, and a requirement to use a registered provider if you choose a digital check.
An eVisa holder can only evidence their right to work online. The worker generates a 9-character share code starting with W, valid for 90 calendar days, and you enter it with their date of birth. The guide says to check that the photograph on the result is of the individual in front of you, and that the individual is permitted to do the work in question. Where the online service cannot be used because of a technical issue, it says the Employer Checking Service can be used where applicable. You keep records for the duration of employment and two years afterwards. The discrimination code adds a rule for managers: employers “are not permitted to mandate online or digital checks, except for those workers who have been provided with an eVisa”.
What a breach costs
The civil penalty starting point in the 1 October code is £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years. The explanatory memorandum to SI 2024/82 gives the same figures for the January 2024 code. The code takes £5,000 per worker off the penalty where the employer reported its suspicion to the Home Office and received a Unique Reference Number before the Home Office identified the worker, and another £5,000 for active co-operation. A first breach by an employer with effective right to work checks and both mitigations gets a Warning Notice. For a repeat breach, the code says “A Warning Notice is not available.”
The guide also states that an employer commits a criminal offence under section 21 if it knows or has reasonable cause to believe it is employing an illegal worker, with up to five years’ imprisonment and an unlimited fine. The penalty code says it does not cover that offence.
For 1 January to 30 June 2026 the Home Office recorded 7,270 illegal working visits and 4,756 arrests. Restaurants, takeaways and cafes were the largest listed visit category: 2,195 visits against 1,675 in the same months of 2025, and 1,589 arrests. More than 1,200 businesses were issued a civil penalty in the period, facing fines of over £74 million. The release says “no direct correlation should be made” between its civil penalty figures and visits in the same period, and calls its data provisional (GOV.UK, Illegal working and enforcement activity to the end of June 2026, first published 7 August 2026).
What we would do this week
List every way your kitchen engages labour: employees, casual workers, sole traders, agencies and sub-contracted caterers. For each, write down who the employer is.
Check any casual in scope of the Scheme whom you start from 1 October, before their first shift, by a prescribed route that fits their nationality and immigration status. Ask each agency to confirm in writing that it is the employer and how it checks, and keep the answer. Where extended liability applies to you as a contract caterer using sub-contractors, produce the written statement before the work starts, with every term the guide lists, and keep evidence that the arrangements work. Do not treat a casual whose employment under a worker’s contract commenced before 1 October as newly caught, and do not forget that staff on contracts of employment were already covered.
Need kitchen cover in Manchester, London or further afield? Get Staff Now and tell us how many, where and what time.
Frequently asked questions
Did the right to work rules change on 1 October 2026?
Yes. Section 48 of the Border Security, Asylum and Immigration Act 2025 came into force that day under SI 2026/683. It extends right to work checks to people engaged under worker’s contracts, to individual sub-contractors and to online matching services, and adds extended liability for businesses that pass contracted work down a chain.
Do I need to check casual kitchen staff now?
If you engage them under a worker’s contract and the engagement began on or after 1 October 2026, check before they start. If it began before that date, the guide says a civil penalty may only be imposed where employment commenced on or after 1 October 2026. Its start-date wording is not reconciled for a contract signed earlier with a first shift after that date, so check in that case too. Casuals who are employees were already covered.
Do I have to check agency chefs myself?
Not as a matter of routine, where an employment business directly engages the worker and supplies them into your own operations. The guide says the employment business is responsible for the check, and that the changes are not intended to require routine duplication by the hirer. Keep the agency’s written confirmation of how it checks. A check an agency runs independently does not give you a statutory excuse for someone you engage yourself, apart from a prescribed check by a registered RtW DVSP.
Do I need to recheck staff I already employ?
Employees on contracts of employment were already covered, and follow-up checks still apply “on, or before, the date their permission comes to an end”. For employment under a worker’s contract that commenced before 1 October 2026, the guide says a civil penalty may only be imposed where employment commenced on or after that date. The start-date caveat above and the renewal or variation point still apply.
Is there a grace period?
No general one. The guide says the requirements apply from 1 October 2026 and there is no general grace period. It does have a separate rule that gives acquiring employers 60 calendar days to carry out a fresh check after a TUPE transfer.
Have the penalty amounts gone up?
The code keeps the starting points at £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years, the same as the January 2024 code.
Does a contract caterer count as being in a chain of contracts?
It depends on the contracts. Extended liability applies to a business that is contracted to provide work or services to a third party and uses another party to deliver all or part of it. The guide has no catering example, so compare your own arrangement with its examples 7 and 10 and read the written-statement requirements before the work starts.
Sources checked on 6 October 2026
The legal and statistical discussion above draws on these GOV.UK and legislation.gov.uk sources: the 2025 Act (section 48), SI 2026/683 and SI 2026/700, the three October 2026 Home Office documents, the explanatory memorandum to SI 2024/82, the consultation page and the June 2026 enforcement statistics. We have not cited any law firm or trade body. Where the sources do not say, we say so. This is a summary of published guidance, not legal advice. Related pages: school kitchens, contract catering and DBS-checked kitchen staff.