UK Extends Illegal Working Civil Penalties to Workers, Sub‑contractors and Online Matching Services, What UK Businesses Must Do

This practical guide explains how the UK is extending illegal working civil penalties beyond employees to a far wider range of engagements, and what businesses and platforms must now do. The Border Security, Asylum and Immigration Act 2025 contains a provision that widens the illegal working civil penalty regime so that it reaches engagements beyond traditional employment. It amends the Immigration, Asylum and Nationality Act 2006 so that references to employing a person are extended to include engaging an individual under a worker’s contract, engaging an individual sub-contractor, and an online matching service that provides a service provider’s details to clients.

The practical consequence is that, once the relevant provision is in force, the civil penalty regime for illegal working will reach workers, individual sub-contractors and online matching platforms, not only traditional employees. Commencement is governed by regulations made under the Act, and businesses should confirm the current in-force date and any transitional arrangements before relying on specific timing.

This is general information and not legal advice. Businesses and in-house counsel should seek tailored advice on their specific engagement structures and supply chains, and should verify the current commencement position.

How the UK extends illegal working civil penalties, summary of the change

For almost two decades the civil penalty regime for illegal working has centred on the employer–employee relationship. Businesses secured protection, the statutory excuse, by carrying out prescribed right to work checks before an employee started work and, where relevant, following up with repeat checks for those with time-limited status. The Border Security, Asylum and Immigration Act 2025 materially widens that framework. The way the UK extends illegal working civil penalties means that organisations which engage labour through worker contracts, individual sub-contractors, or online matching arrangements will need to treat those relationships with the same compliance discipline previously reserved for direct employment.

The definitional change is the critical point. By amending the Immigration, Asylum and Nationality Act 2006, Parliament deems certain engagements to fall within the meaning of “employing” a person for civil penalty purposes. This is a legal device that expands liability: an organisation does not need to be the worker’s employer in the ordinary employment-law sense to be caught. The question becomes whether the engagement falls within one of the newly specified categories. Affected businesses in construction, hospitality, delivery, logistics, labour supply and the gig economy should prepare to act on existing engagements as well as future ones, in line with the commencement regulations.

Crucially, the statutory excuse mechanism is preserved. An organisation can still protect itself from a civil penalty by carrying out the checks the Home Office prescribes. What changes is the universe of relationships to which those checks must be applied. The practical effect is that labour suppliers, main contractors, marketplaces and digital intermediaries will need to embed right to work verification into engagement processes that previously sat outside the scope of immigration compliance.

Key statutory references for how the UK extends illegal working civil penalties

• Border Security, Asylum and Immigration Act 2025. The primary legislation that extends the civil penalty regime for illegal working to a wider range of engagements.
• Immigration, Asylum and Nationality Act 2006. The Act amended to expand the meaning of employing a person for civil penalty purposes.
• Commencement regulations. The relevant provisions are brought into force by statutory instrument. Confirm the current in-force date and any transitional provisions on legislation.gov.uk before relying on a specific date.

Who is in scope? Employees, workers, subcontractors and online matching services

The extended regime brings four broad categories of relationship within reach of illegal working civil penalties UK-wide. Understanding where your organisation sits, often in more than one category simultaneously, is the first step to managing risk.

• Traditional employers and employees. The long-standing position is unchanged. If you employ staff under a contract of employment, you must carry out right to work checks to secure a statutory excuse. Sector examples include permanent hospitality staff, salaried site managers in construction, and warehouse employees in logistics.
• Workers engaged under worker contracts. Individuals engaged personally to perform work who are not full employees are captured. Casual hospitality staff, zero-hours workers and short-term operatives fall here.
• Individual sub-contractors. Where a business engages an individual sub-contractor directly, that engagement is treated as employing a person for these purposes. This is particularly significant for construction labour supply chains and trades engaged on a self-employed basis.
• Online matching services. A service that provides a service provider’s details to clients is brought within scope. Gig platforms, courier marketplaces and digital intermediaries that connect clients with individual providers must consider their exposure.

Workers versus employees, practical differences for compliance

In UK employment law a “worker” is a broader category than an “employee”. A worker undertakes personally to perform work or services but need not have the full mutuality of obligation that characterises employment. Historically, the distinction mattered for employment rights but not for illegal working liability, because the civil penalty regime bit only on employees. Once the extension is in force, that will no longer be the case. For compliance purposes, the practical message is that organisations should stop using the worker/employee boundary as a dividing line for right to work checks. If an individual is engaged to perform work personally, verification should be carried out regardless of the precise employment-law label.

Subcontracting chains, where liability can flow

Construction and labour-supply models frequently involve layered chains: a main contractor engages a labour supplier, which in turn engages individual sub-contractors or operatives. Because the UK extends illegal working civil penalties to the engagement of individual sub-contractors, parties at each tier must consider whether they are directly engaging an individual and, if so, whether checks have been carried out. Liability does not pass automatically down the chain; each organisation that directly engages an individual sub-contractor must secure its own statutory excuse. This makes contractual flow-down obligations and audit rights important, because an upper-tier business will want assurance that lower tiers are compliant.

Online matching services, operations covered

The provision reaches an online matching service that provides a service provider’s details to clients. This language is significant. A platform that merely hosts content may sit differently from one that actively supplies a provider’s details to a client to facilitate an engagement. Delivery and courier platforms, home-services marketplaces and on-demand labour apps should review how their model operates against the statutory wording. Where the platform’s function is to connect a client with an individual provider by sharing that provider’s details, the risk of being in scope is high.

How the statutory excuse works under the extended regime

The statutory excuse remains the central protection. An organisation that correctly carries out the checks the Home Office prescribes before an engagement begins, and retains the required evidence, will have a defence to a civil penalty if the individual is later found to lack the right to work. The checks must be followed precisely; a partial or late check will not provide protection. Home Office right to work guidance sets out the acceptable documents, the manual and digital check routes, and the record-keeping standards required.

Step 1, right to work check options (manual versus digital) and acceptable documents

There are established routes to a compliant check, and the correct route depends on the individual’s status and documents:

• Manual document check. Obtain, check and copy original acceptable documents in the individual’s presence (or by live video link while holding the originals), confirming the documents appear genuine and belong to the individual.
• Home Office online check. For individuals whose status can be verified online, use the Home Office online service with a share code and confirm the photograph matches the individual.
• Identity document validation technology (IDVT). For certain holders of valid passports, checks may be completed via a certified identity service provider, following the Home Office guidance precisely.

Applying the correct route to each category of engagement, employee, worker, individual sub-contractor or platform-matched provider, will be essential, because the UK extends illegal working civil penalties across all of them.

Step 2, documenting and retaining evidence

A statutory excuse depends not only on carrying out the check but on retaining evidence of it. Retain clear, dated copies of the documents or online check records, recording the date the check was completed. Use consistent naming conventions and secure storage so that evidence can be produced quickly in the event of an enquiry. Records should be retained for the duration of the engagement and for the period after it ends specified in Home Office guidance. For audit purposes, a timestamped, centrally stored record is far more defensible than scattered copies held by individual managers.

Step 3, handling ambiguous documents or reasonable doubt

Where documents appear inconsistent, where a name does not match, or where there is reasonable doubt about validity or status, the engagement should not proceed on the basis of an incomplete check. In these situations the organisation should pause, seek verification through the Home Office Employer Checking Service where appropriate, and take professional legal advice before engaging. Proceeding despite doubt undermines any statutory excuse and exposes the business to penalty.

Differences for platform interactions

For online matching services the mechanics are more complex, because the platform typically does not directly employ or contract with the end client’s chosen provider in the conventional sense. Where a platform is in scope because it provides a provider’s details to clients, it should build verification into provider onboarding, confirming the provider’s right to work before the provider is made available to clients, and retain that evidence. The practical design question is to ensure that no provider’s details are supplied to a client until a compliant check has been completed and recorded.

Contract terms and flow‑down clauses for subcontracting chains

Because the UK extends illegal working civil penalties to individual sub-contractors, contracts across labour-supply chains should be reviewed. Contractual protection cannot replace an organisation’s own statutory excuse, each party that directly engages an individual must still carry out its own checks, but well-drafted clauses allocate risk, require co-operation, and give upper-tier parties audit visibility over lower tiers. The clauses below are drafting starting points for in-house counsel to adapt; they should be tailored to the specific transaction and reviewed by a qualified adviser.

Model clause, supplier representation and warranty

A short representation and warranty from a labour supplier might provide: “The Supplier represents and warrants that, in respect of every individual engaged, supplied or sub-contracted by it in connection with this Agreement, it has carried out and will maintain all right to work checks required to establish a statutory excuse under the Immigration, Asylum and Nationality Act 2006 (as amended), and will retain evidence of such checks for the periods required by Home Office guidance.” This fixes the supplier’s positive obligation and creates a contractual breach if checks are not performed.

Model clause, flow-down and auditing rights

A flow-down and audit clause might read: “The Supplier shall impose obligations equivalent to this clause on every sub-contractor and sub-supplier engaging individuals under this Agreement, and shall procure that such obligations flow down through every tier of the supply chain. The Client shall be entitled, on reasonable notice, to audit the Supplier’s and any sub-contractor’s right to work records and verification processes, and the Supplier shall provide reasonable co-operation and access.” Audit rights are what turn a paper promise into a verifiable control.

Risk allocation, indemnities versus schedules of responsibility

Parties should decide how to allocate residual risk. An indemnity in favour of the upper-tier party for losses arising from a sub-tier’s failure to carry out checks is common, though it does not remove the upper-tier party’s own obligation to check individuals it directly engages. A clear schedule of responsibility, setting out exactly which party checks which category of individual, reduces disputes about who was supposed to do what. Insurance should also be reviewed, including whether existing policies respond to associated legal costs, bearing in mind that a regulatory civil penalty itself is typically not insurable as a matter of public policy, even if related liabilities may be.

Platforms and online matching services, practical steps to reduce exposure

Because the UK extends illegal working civil penalties to online matching services that provide a service provider’s details to clients, platform operators should treat right to work verification as a core compliance function rather than an afterthought. The goal is to ensure that no provider is surfaced to clients unless a compliant check has been completed and recorded.

Technical and operational controls

• Identity verification at onboarding. Require providers to complete a right to work check, via Home Office online check, certified IDVT, or document verification, before their profile becomes available to clients.
• Verification logs. Maintain tamper-evident, timestamped logs of each verification, linked to the provider’s account, so that evidence can be produced on enquiry.
• Secure document storage. Store evidence securely with access controls and defined retention periods aligned to Home Office guidance, and handle personal data in line with UK GDPR and the Data Protection Act 2018.
• Re-verification triggers. Build automated prompts for re-checks where a provider’s status is time-limited.

Terms of service and client notices

Platform terms of service should require providers to hold and maintain the right to work, to co-operate with verification, and to notify the platform of any change in status. Terms should reserve the platform’s right to suspend or remove providers who fail or do not complete verification. Client-facing notices can set expectations about the platform’s verification approach without over-representing the position.

Intermediary versus “providing service-provider details”

The risk indicator is function. A platform that passively hosts information may be positioned differently from one that actively provides a provider’s details to a client to bring about an engagement. Operators should map their user journeys and identify the precise moments at which provider details are supplied to clients. Where that supply is integral to the matching function, the platform should assume it is in scope and verify accordingly.

How to audit affected engagements

Because the extension affects ongoing as well as new engagements, businesses should look backwards as well as forwards. A structured retrospective audit identifies gaps in checks for engagements within scope and drives timely remediation. Confirm the commencement date applicable to your engagements before fixing the review period.

Audit timetable and prioritisation

1. Scope. Identify all engagement types now in scope: workers, individual sub-contractors and platform-matched providers.
2. Prioritise. Review high-risk, high-turnover roles and sectors first, site labour, casual hospitality, delivery and courier engagements.
3. Sample and escalate. Begin with a representative sample; where failures emerge, expand the review.
4. Evidence standard. For each engagement, confirm that a compliant check was completed before work began and that evidence is retained.

Remedial actions and dispute handling

Where a check was missed, carry out a compliant check as soon as possible, record the remediation, and consider whether the engagement should continue pending verification. Formalise informal arrangements into written contracts with the clauses described above. Keep an internal record of issues identified and steps taken, which evidences reasonable steps and supports any representations if a penalty is later threatened. Where serious issues emerge, take legal advice on disclosure and next steps.

Comparative table, who must do what

Enforcement, penalties and practical risk management

Civil penalties for illegal working are enforced through an administrative process rather than a criminal prosecution in the first instance (separate criminal offences for employing illegal workers also exist in more serious cases). In broad terms, the administrative process follows an investigation, the issuing of a civil penalty notice, and an opportunity for the recipient to make representations, to object to the Home Office and, where applicable, to appeal to the court. Home Office guidance sets out the process and the factors relevant to whether a penalty is imposed and the amount.

The maximum penalty levels are set by the Home Office and have been increased in recent years; confirm the current figures in the Home Office guidance rather than relying on a fixed amount. Aggravating factors typically include previous non-compliance, while demonstrable evidence of reasonable steps, compliant checks, retained records and a robust audit trail, supports mitigation.

Practical mitigation and reporting strategy

The most effective mitigation is prevention: carrying out the prescribed checks for every in-scope engagement and retaining evidence. Where an issue is identified internally, early, documented remediation strengthens any representations. Organisations should appoint a compliance lead, maintain clear records, and keep contractual protections current. Insurance and indemnity arrangements should be reviewed so that, where permissible, associated legal costs and third-party risk are addressed, recognising that the penalty itself is generally not insurable.

Quick checklist, 10 immediate actions

1. Confirm commencement. Check the in-force date and transitional arrangements for the extended regime on legislation.gov.uk.
2. Audit. Review in-scope engagements across all newly captured categories.
3. Update contracts. Add representations, flow-down and audit clauses for subcontracting chains.
4. Update onboarding. Extend right to work checks to workers, sub-contractors and platform providers.
5. Adopt digital identity. Use Home Office online checks and certified IDVT where appropriate.
6. Train staff. Ensure managers and onboarding teams understand the new scope.
7. Record retention. Implement a consistent policy aligned to Home Office guidance.
8. Update terms of service. Require verification and status notifications from providers.
9. Appoint a compliance lead. Give one person clear ownership of the regime.
10. Take legal review. Have your structures and contracts reviewed for the new scope.

Conclusion

The way the UK extends illegal working civil penalties under the Border Security, Asylum and Immigration Act 2025 is one of the most significant widenings of immigration compliance exposure for businesses in years. By amending the Immigration, Asylum and Nationality Act 2006, the Act brings workers, individual sub-contractors and online matching services within reach of the civil penalty regime. The statutory excuse remains available, but only to organisations that carry out the prescribed checks across every in-scope engagement and retain the evidence. Businesses in construction, hospitality, delivery, logistics, labour supply and the gig economy should confirm the commencement position, audit current engagements, update contracts and onboarding, and build verification into their platforms.

For tailored advice, contact a Global Law Experts Business Immigration lawyer in the United Kingdom or visit the Business Immigration, United Kingdom practice area hub.

This article is general information and not legal advice. Specific engagement structures and supply chains should be reviewed with a qualified adviser, and the current commencement and penalty position should be verified against official sources.

Sources

1. Legislation.gov.uk, UK statutes and statutory instruments
2. Immigration, Asylum and Nationality Act 2006 (Legislation.gov.uk)
3. Home Office, Right to work checks: an employer’s guide (GOV.UK)
4. Home Office, Employers: illegal working penalties (GOV.UK)
5. The Law Society, Immigration topic guidance
6. House of Commons Library, parliamentary briefings