Construction contractors have two days to prepare for the biggest expansion of the UK right-to-work regime since it began in 2006.
From 1 October 2026, a contractor may face a civil penalty of up to £60,000 for each illegal worker found within a relevant subcontracting chain. This can apply even where the contractor never met the worker, did not know they were on site and had no direct contract with them.
For a business using several subcontractors, labour-only workers, agencies or individual tradespeople, this is not a small HR issue. It is a commercial contract issue, a site management issue and an insurance issue.
The changes are separate from the HMRC Construction Industry Scheme checks discussed recently. CIS deals with tax status, deductions and payment arrangements. The new rules concern immigration liability, right-to-work checks and the defence available if the Home Office investigates.
What changes on 1 October 2026?
The new extended liability rules apply where a business is contracted to provide work or services to a third party and subcontracts part of that work or services to another business.
That means liability can move up a construction supply chain. The Home Office may treat a developer, principal contractor or another business higher in the chain as the employer of a person personally carrying out work, even if that person was engaged several contractual steps below them.
The Home Office’s construction example involves a developer contracted to build new homes. The developer engages bricklayers and groundworkers through a chain of contracts. Under the new regime, the developer may be treated as the employer of anyone working through that chain, alongside other parties above the direct relationship with the worker.
This does not mean every party in every chain will automatically be penalised. The Home Office will decide which party or parties are liable, particularly where it is unclear who engaged the worker. It will examine the contractual structure and how the work operates in practice.
The definition of employment is also wider. It can include:
- Workers engaged under a worker’s contract
- Casual and agency-style labour
- Individual subcontractors
- Labour-only arrangements
- Individuals supplied through certain online matching platforms
- Substitutes who carry out work in place of the contracted individual
Calling somebody self-employed will not, by itself, protect a contractor. The Home Office guidance makes clear that substance matters. Who arranges the work, who supplies the individual, who controls or approves substitutions and how the arrangement operates in practice will all be relevant.
There is an important limit. Extended liability does not apply to a client, customer or end-user at the top of the chain that is purchasing work or services for its own use rather than providing them onwards to another third party. A business buying a defined service for its own operations is not automatically caught simply because the supplier uses subcontractors.
The financial and operational consequences
The headline figure is up to £60,000 per illegal worker. The maximum amount depends on the circumstances and previous breaches, but a five-worker breach could create a £300,000 balance-sheet event before legal costs, disruption and reputational damage are considered.
The civil penalty itself is not insurable. This follows the settled UK position that criminal fines and regulatory penalties cannot be transferred to an insurer. Insurance cannot be used as a substitute for right-to-work compliance.
There are also consequences beyond the civil penalty. In serious or persistent cases, criminal liability can involve an unlimited fine and up to five years’ imprisonment. Immigration officers can issue closure notices affecting premises, which could prevent work from continuing on a site. A sponsor licence may also be suspended or revoked, placing sponsored workers’ immigration status at risk.
For contractors, a closure notice is a business interruption event even where there has been no insured physical damage. The business interruption and increased cost of working sections of a commercial combined policy may become relevant, but the response will depend on the precise policy wording, the trigger for the closure and any applicable exclusions.
This is why it is worth reviewing more than the penalty section of your policy. A commercial combined policy may include business interruption, denial of access, legal expenses or prosecution defence elements, but those covers do not all respond in the same way and none will pay the regulatory penalty itself.
The statutory excuse is all-or-nothing
A contractor higher in the chain can establish a statutory excuse against extended liability, but the prescribed requirements must be met in full before the work starts.
There are three central areas.
1. Contractual terms
Relevant contracts need written terms that:
- Require the contractor or labour provider further down the chain to carry out prescribed right-to-work checks
- Prohibit further subcontracting without prior written consent
- Require equivalent right-to-work obligations to be passed down where consent is given
- Give the contractor audit and inspection rights
- Allow suspension or termination where compliance is not demonstrated
- Require cooperation with Home Office investigations and disclosure of the supply chain
Contract wording alone is not enough. It must reflect how the work is actually arranged and the contractor must be able to show that the controls operated in practice.
A contractor should be able to identify the companies and individuals involved, understand who is responsible for each check and obtain reliable evidence when requested. A clause hidden in a standard subcontract will not be much help if nobody reviews whether it has been followed.
2. Substitution controls
Substitution clauses are a particular risk. From 1 October, if a worker can send somebody else to perform the work, that substitute must not step onto site before a prescribed right-to-work check has been completed.
The process should identify who requested the substitution, who approved it, who checked the substitute and when the substitute was authorised to start. Site access should be blocked until those steps are complete.
This is important for individual subcontractors who may describe themselves as operating independently. If the contract permits substitution, the engaging firm may still face extended liability if an unchecked substitute carries out the work illegally.
3. Identity verification
The contractor must take proportionate steps to confirm that the person on site is the same person who was checked.
Practical controls could include site passes, access cards, attendance systems, photographic records, training records, biometric systems or digital identity checks. The right system will depend on the size of the site, the risk of substitution and the way labour is engaged.
If a digital identity provider is used, contractors should confirm that it is registered for right-to-work checks on the Office for Digital Identities and Attributes register.
These three areas work together. A contractor that has strong contract clauses but no control over substitutes, or good site access systems but no prescribed contractual terms, may not have a statutory excuse. Partial compliance is not a defence.
What contractors should do in the next two days
The first step is to audit every category of labour used by the business. Do not look only at PAYE employees. Include casual workers, agency labour, labour-only subcontractors, individual subcontractors, platform-sourced labour and anyone who may be sent as a substitute.
Then map the contractual chain for each major project. Identify the client, the party responsible for delivering the work, each subcontractor and any further labour provider. Establish where the business is providing services onwards and where it is simply purchasing services for its own use.
Commercial teams and contract managers need to be involved from the start. Your HR team cannot protect you alone from liability arising outside your own workforce. Responsibility also lies with the people drafting and negotiating commercial contracts, approving subcontractors and controlling access to sites.
With only two days left before 1 October, contractors should:
- Review worker engagements and subcontracting arrangements.
- Take reliable immigration and commercial contract advice.
- Update contract templates for relevant contracts entered into from 1 October.
- Insert controls over further subcontracting and substitutions.
- Train commercial teams, site managers, procurement staff and those controlling site access.
- Build a check-before-start workflow for every permitted substitute.
- Link site access to an identified individual and completed checks.
- Confirm any digital identity provider is registered for the correct right-to-work service.
- Keep copies of contracts, checks, audits, approvals and decisions.
- Make sure the business can produce evidence quickly if the Home Office asks for it.
The Home Office guidance is available in its draft employer’s guide to right-to-work checks. Contractors should also consider the practical warnings reported by Construction News.
How this affects construction insurance
The right-to-work failure itself is not an insurable penalty, but it can affect the wider risk profile of the business.
Underwriters look at how a contractor sources labour, manages subcontractors and demonstrates competence. A business that cannot evidence who is working on its sites, how subcontractors are checked or how substitutions are controlled may look like an uncontrolled employers’ liability and public liability risk.
Public liability policies commonly require the insured to take reasonable precautions and comply with relevant safety procedures. If an incident involves a worker who should not have been on site, the absence of identity and right-to-work controls could become relevant when the insurer considers whether reasonable precautions were taken. This does not mean every claim will automatically be declined, but it can create a serious coverage and claims-handling issue.
Employers’ liability and public liability exposure also depends on how labour is classified and controlled. Labour-only and self-employed subcontractor arrangements have always needed careful review. The new regime brings immigration exposure into the same conversation. A single due-diligence process should cover status, competence, insurance, right to work and site access.
Legal expenses and directors’ and officers’ insurance also deserve attention. Criminal investigation and prosecution defence costs, legal representation at interviews and regulatory response costs may be available under separate sections, but they are frequently absent or limited. The policy will not pay the penalty itself.
The Commercial Court’s September 2026 decision in Liberty Managing Agency v Chedid also provides a useful reminder that properly worded D&O policies can protect defence costs while allegations remain unproven. Where the policy requires fraud to be established by a final decision or formal admission before avoidance or an exclusion can be relied upon, defence costs may need to continue to be advanced until that threshold is met. The precise wording remains critical.
Act with only two days left before 1 October
This is a different risk from the recent HMRC CIS changes, but the practical lesson is similar. Labels and assurances are not enough. Contractors need to understand how labour is really engaged, how the subcontract chain is built and what evidence exists when something goes wrong.
At Moyak, our Individual Approach and Care About Every Client means we start with how your business actually operates. A main contractor managing a 40-firm supply chain does not have the same exposure as a small firm with a direct workforce and two regular subcontractors.
As a Business Insurance Broker in Essex, Kent and London, we work with the UK’s leading master insurance brokers to help clients obtain suitable cover for their budget and property, often saving them a fortune on small business insurance quotes. Our general contractor insurance service is designed around the real structure of your business rather than a generic description of your trade.
Bring us your subcontractor list, contract templates and current liability and employers’ liability schedules. We will help you identify where the real exposure sits and whether your insurance arrangements reflect it.
There are now only two days left before 1 October 2026. This article is general information and is not advice on any specific contract, worker or insurance policy. Specialist immigration and employment advice should be taken where required. To discuss your arrangements, contact Moyak Insurance Services.