Right to work checks for couriers and sub-contractors: what changes on 1 October 2026

On 1 October 2026 the UK's Right to Work Scheme stopped being an employer-only rule. Since that date a business that engages people on a worker's contract, takes on individual sub-contractors or runs an online matching service is treated as their employer for right to work purposes, and faces a civil penalty of up to £45,000 per illegal worker for a first breach, or up to £60,000 for a repeat, if it gets it wrong.^[1] The Home Office named courier services and food delivery among the sectors it had in mind.^[2]

For a delivery operator this closes a gap that has existed since the scheme began: the self-employed courier who signs up through an app, or arrives through a sub-contractor, was never covered by the statutory duty, however sensible checking them was. This guide sets out what changes, who is now in scope, what a compliant check looks like, what happens to drivers you already work with, and what to have in place now. It draws on the Home Office's employer's guide to right to work checks, published in its final form on 1 October 2026 and in force from that date, which replaced the draft of 11 September.^[3] None of this is legal advice.

What changes on 1 October 2026

Section 48 of the Border Security, Asylum and Immigration Act 2025 amends the Immigration, Asylum and Nationality Act 2006, the law behind right to work checks, so that "employer" no longer means only someone with employees.^[4] From 1 October 2026 the guide defines an employer as a person who employs an individual under a contract of employment, under a worker's contract, as an individual sub-contractor, or when operating as an online matching service.^[3]

Three things follow:

1. The duty to check now attaches to those arrangements, before the work starts.
2. Civil penalty liability applies to them, for engagements commencing on or after 1 October 2026.
3. Liability can extend up a contracting chain and to substitutes, under a new set of "extended liability" rules.

What does not change is the check itself. The three prescribed methods, the share code, the follow-up rules and the penalty amounts are the same as for employees. What changes is who has to do it.

Who is now an employer: the three new categories

The guide defines each of the new categories, and the definitions decide whether a delivery business is caught.

A worker's contract is "a contract (other than a contract of service or apprenticeship)" under which an individual "undertakes to perform work or services personally for another person", where that person is not a client or customer of the individual's own business. That is the limb (b) worker of employment law: not an employee, but personally doing the work.

An individual sub-contractor is "an individual who has entered into a contract with a person to provide work or services, in circumstances where that other person has entered into a contract with a third party to provide, or arrange for the provision of, the work or services but the individual has not". In delivery terms: the self-employed driver a courier company engages to fulfil its contract with a retailer. The guide's Example 3, titled "Individual sub-contractor", is a delivery app: "An individual signs up to work through a delivery platform. The individual logs into an app when they want to work, accepts delivery requests and gets paid for each delivery they complete. The delivery platform is the individual's employer for the purposes of the Right to Work Scheme."^[3]

An online matching service is a person who, in the course of a business, "keeps a register of service providers for the purpose of matching them with potential clients or customers", provides an online service through which those customers submit enquiries to be matched, and charges a fee or commission for the match. The guide's example here is a cleaning platform rather than a delivery one. For delivery apps the category matters less than it looks, because Example 3 already puts the platform in scope as the courier's employer.^[3]

Who is outside the scheme. The guide says it "does not apply to individuals who are operating an independent business either in their own name or through their own company and who contract directly with clients or customers to provide goods or services".^[3] Its example is a self-employed plumber who advertises to the public. A courier with their own customers and their own trading name is that plumber. A courier who gets all their work through your app or your sub-contract is not.

Does this apply to my business?

The last row is the trap. Calling a driver "self-employed" in the contract does not take them out of scope if, in practice, they work through your platform or your sub-contract and have no business of their own.

Extended liability: the sub-contractor's driver and the substitute

This is the part of the change written for delivery, and it is the part most operators will find new.

The guide applies extended liability where "a person is under a contract to provide work or services to a third party and enters into a contract with another employer who employs worker(s) to carry out all or part of the work or services required to fulfil that contract". Read that against a typical last-mile chain: a retailer contracts a carrier, the carrier contracts a courier company, the courier company engages drivers. If one of those drivers has no right to work, the courier company that engaged them is the employer. Under extended liability, the carrier above it can also face a penalty, and keeps its statutory excuse only where it "has complied with prescribed requirements in relation to the relevant contractual arrangements" with the courier company.^[3]

Section 3 of the final guide sets those requirements out, and they have to be in place before the work starts. The first is a written statement of contract terms obliging the sub-contractor to carry out prescribed checks, not to subcontract further without your written consent (and to pass the same obligations down if you agree), to let you audit its checks, to face enforcement such as suspension or termination where illegal working is found, and to cooperate with any Home Office investigation. The second is substitution controls and the third is identity verification. The guide adds that contract terms alone are not enough: you should be able to show the arrangements work in practice.^[3] Read that section with whoever drafts your sub-contracts before you next sign or renew one, because the extended liability rules bite on contracts entered into on or after 1 October 2026.

Substitution gets the same treatment. Example 9 describes a food delivery courier who is permitted to substitute and routinely asks a friend to complete deliveries. The guide's conclusion: "the food delivery platform may be treated as the employer of the individual personally carrying out the work or services, including any substitute".^[3] The substitution right that kept Deliveroo's riders outside worker status in the Supreme Court in November 2023^[5] now brings the substitute inside the Right to Work Scheme. If your model allows substitutes, your process has to be able to check them: the guide's substitution controls require a prescribed check on every substitute before they work, and the check cannot be delegated to the courier who sends them.^[3]

What a compliant check is

The methods are unchanged from the employee regime, and our courier background checks guide covers the mechanics. The points that matter for the new categories:

• Before the work starts. The statutory excuse depends on the check being done "before the worker commences employment", which for a platform means before the first job is accepted, not after onboarding is complete.
• Three prescribed methods. A manual check of original documents from the acceptable lists; the Home Office online service, where the individual gives you a nine-character share code beginning with W together with their date of birth;^[6] or a check through a certified Right to Work digital verification service provider, which is permitted for holders of valid British or Irish passports. From 1 October a digital provider has to be certified and registered against the DVS trust framework for the check to count.
• You cannot choose the method for them. Anyone with an eVisa must be checked online. British and Irish citizens are checked manually or digitally. The guide says employers "cannot mandate the method" and must give a reasonable opportunity to prove the right to work, and it warns against treating candidates differently by nationality or appearance.^[3]
• Follow-up checks for time-limited permission. Where the right to work carries an expiry date, you keep your excuse only by re-checking on or before it. Where someone has an outstanding, in-time application, the Employer Checking Service gives a six-month excuse and aims to respond within five working days.^[3]
• Record it. The check type, the date, the outcome, and the follow-up date if there is one. A check you cannot evidence is a check you did not do.

Drivers you already work with

The guide is explicit that the new categories are not retrospective. A civil penalty for a worker's contract, an individual sub-contractor or an online matching service "may only be imposed where the employment commenced on or after 1 October 2026", and the extended liability requirements apply to contractual arrangements "entered into on or after 1 October 2026".^[3]

So a courier who has been delivering for you since June is outside the new penalty regime for as long as that engagement continues. Three cautions:

1. A new engagement is a new engagement. A driver who leaves and comes back, or moves from one sub-contractor to another, starts a new arrangement on the later date. Renewing, extending or varying an existing contract is less clear cut: the guide says the result depends on its legal and contractual effect, so do not assume either way.
2. Voluntary checks must be even-handed. The guide says that where a business chooses to check existing workers retrospectively it "must do so in a non-discriminatory manner". Check the whole fleet or check nobody; never a subset picked on suspicion.
3. Time-limited permission still expires. A follow-up check is due on expiry regardless of when the engagement began.

Most operators will choose to bring the whole fleet up to the same standard over the autumn, because a fleet with two regimes running side by side is harder to audit than one. If you do, treat it as a rolling exercise with a date for everyone, not a filter.

The penalty, and the excuse that beats it

The civil penalty is up to £45,000 per illegal worker for a first breach and up to £60,000 per worker for a repeat within three years, under the code of practice on preventing illegal working in force since 13 February 2024.^[1] The final employer's guide summarises the ceiling as "a civil penalty of up to £60,000 per illegal worker", alongside a criminal offence, business closure and director disqualification for serious cases.^[3] The code allows reductions where the business reported the suspected illegal working itself and where it actively cooperated with the investigation. Sponsors of skilled worker visas also risk their licence.

The number to hold onto is not the fine but the defence. A compliant check, done before work starts and recorded, gives you a statutory excuse against the penalty for that worker, even if the document later turns out to be false. The penalty is for not checking, not for being deceived by a good forgery you checked properly. For a fleet of forty self-employed drivers, the arithmetic is not close.

What to have in place now

1. Map who works for you and how. Employees, workers, self-employed drivers you engage directly, drivers arriving through sub-contractors, and anyone who may substitute. The first two rows of the table above are yours to check; the third is yours to contract for.
2. Move the check to the front of onboarding. For a platform or an app, "before the first job", not "within the first week". If your sign-up flow lets a courier accept work before the check completes, that order has to change.
3. Build for all three methods. A share code path for eVisa holders, a manual or certified digital path for British and Irish passports, and a route to the Employer Checking Service for the cases in between. Confirm any digital provider you use is certified and registered under the DVS trust framework.
4. Fix the sub-contracts. Read section 3 of the guide on the prescribed contractual requirements with your legal adviser and amend your sub-contractor agreements before you next sign or renew one.
5. Decide your substitution policy. Either stop permitting substitutes or build a way to check them before they deliver. There is no third option under Example 9.
6. Set follow-up dates. Every time-limited permission in the fleet needs a re-check date in a system someone reads, not a spreadsheet someone owns.
7. Decide what to do about existing drivers. Nothing is required. If you check, check everyone on the same footing and on the same timetable.

Where this sits in the wider hiring process, from the advert to the first shift, is in our guide to recruiting delivery drivers, and how the record then stays current alongside licences and insurance is in the delivery driver compliance guide. Right to work is one of the ten evidence categories Service Club ® Compliance collects, verifies and renews for an operation, with the follow-up date tracked rather than remembered.

Frequently asked questions

The check was always worth doing. Now it is required

Operators who already checked every driver, employed or not, have one job now: make sure the check happens before the first delivery and that a sub-contractor's drivers and any substitutes are covered by contract. Operators who relied on the self-employed label have a larger one, and it is already overdue. If you want the right to work record kept alongside the licence, the insurance and the follow-up dates in one place, Service Club Compliance is built for that, or get in touch and tell us how your drivers are engaged.