Right to work checks now reach subcontracted security staff

On 1 October 2026 the Home Office published the final version of its employer's guide to right to work checks, and it came into force the same day. Most of the coverage has focused on delivery riders. Security companies should read it more closely than most.

Here is why. Guarding work runs on subcontracting. A firm wins a retail estate or a festival, then calls in a second company to cover the nights it can't staff. Until October, the right to work check on those officers was the second company's problem. Now some of the risk can travel back up the chain.

What changed in right to work checks on 1 October 2026?

Two things, both from section 48 of the Border Security, Asylum and Immigration Act 2025, as the guide explains.

First, "employer" now means more than someone with staff on payroll. It covers people engaged under a worker's contract, individual sub-contractors and online matching services. If you engage a self-employed officer directly, you now owe a prescribed right to work check, just as you would for an employee.

Second, and bigger for our industry, there is extended liability. If you are contracted to provide services to a client and you bring in another employer to supply the people, the Home Office can treat you as the employer of anyone who does that work. The guide's own example is a construction firm using a chain of subcontractors. Swap bricklayers for door supervisors and nothing in the logic changes.

The penalty hasn't softened. It is up to £60,000 per illegal worker, and serious cases can mean up to five years in prison.

Which side of the line is your contract on?

The guide is clear that labels don't decide it. The substance does. This is how its examples map onto typical security arrangements:

That fourth row matters for clients. The guide's facilities-management example says a retailer buying cleaning for its own stores is not in scope; the company employing the cleaners is. A shopping centre buying guarding for itself sits in the same place. The firm delivering the contract is the one exposed.

What does a prime contractor have to do?

Three things, and all of them must be in place before the work starts. That timing is what most procurement processes will trip on.

1. A written statement in the subcontract. It must require the supplier to run prescribed checks, forbid further subcontracting without your written consent, let you audit their checks, let you act if illegal working turns up (suspension or termination, for example), and oblige them to help any Home Office investigation. Equivalent wording buried elsewhere in your paperwork doesn't count.
2. Substitution controls, if the contract lets an officer send someone else. Substitutes must be checked before they work, and the check can't be left to the officer.
3. Identity verification. You need a proportionate way to know the person on site is the person who was checked. The guide's examples include site passes, biometric attendance systems, checks against licences held for the role and re-verification at the start of each shift. It recommends doing this at least once in any 24-hour period or shift.

For security firms, that third point overlaps with something you should be doing anyway. Matching the officer on the door to a live SIA licence is the kind of check the guide describes. If your team needs a refresher, here is how to check an SIA licence on the public register.

What is still unclear?

More than you'd like. The Home Office won't approve contract clauses or tell you whether your approach is compliant; the guide and the companion code of practice set out the requirements and leave the rest to you. There is no set audit frequency and no minimum evidence pack. Both depend on "the nature, size and complexity" of the arrangement, which leaves you to judge it.

Renewals are the awkward one. A contract signed before 1 October isn't caught just because the work carries on. But a renewal, extension or variation might be, depending on its legal effect. If a big guarding contract renews in the spring, take advice before you sign.

And there's no general grace period. The rules applied from day one.

What to do this month

Start with a list. Which of your contracts involve a second company supplying officers, and which of those were signed or varied after 1 October? For each, check the subcontract against the five terms above and decide how you'll confirm identity on shift.

Keep the evidence where you can find it, alongside the rest of each officer's BS7858 screening file. If you run that screening on Yezda, the right to work result, the SIA licence check and the audit trail already sit in one place. The contract terms are still yours to write.

More on how this lands for security companies and event security is in our sector pages.