Right to work checks and sponsor system changes: what employers should do

Two sets of Home Office changes matter to employers and sponsors this autumn. The first widens right to work checks and has been in force since 1 October 2026. The second changes how sponsors use the Sponsorship Management System (SMS), with a firm deadline of 8 March 2027.

Right to work checks: what changed on 1 October 2026

A right to work check confirms that a person is legally allowed to do the work they are doing. Until now, the legal duty fell mainly on employers who had a contract of employment with the worker.

From 1 October 2026, section 48 of the Border Security, Asylum and Immigration Act 2025 extends the illegal working regime beyond employment contracts. The newly covered arrangements include:

• individuals working under a worker's contract;
• individual subcontractors, in the circumstances set out in the legislation;
• online matching services that give clients the details of individual service providers; and
• companies that contract workers or individual subcontractors to provide services under the company's name, such as agency or gig-economy workers.

Existing arrangements

For the new categories, the Home Office employer's guide says a civil penalty can only be imposed where the work began on or after 1 October 2026. The extended-liability rules are aimed at contractual arrangements entered into from that date. Businesses should read the official guide to see how the start-date rules apply to each of their arrangements, particularly where contracts are renewed or varied.

Liability across contracting chains

Normally the party with the direct contractual relationship with the worker must carry out the check. Under the extended rules, civil penalty liability can reach beyond that party in certain arrangements. Examples include:

• a business that contracts to supply services to a third party and subcontracts some or all of the work to another company that employs the workers;
• a business running an online platform where the service provider then contracts directly with the client; and
• an arrangement where the contract allows another person to do the work in place of the named individual (a substitution arrangement).

The practical effect is that, if a worker at the bottom of a chain has no right to work, businesses higher up the chain may face penalties even without a direct contract with that worker. The guidance indicates that extended liability is most likely to arise where the Home Office cannot identify the business with the direct contractual relationship.

A supplier that only supplies workers is responsible for the checks. A business contracted to deliver a project or service that uses agency workers or subcontractors to do so may fall within extended liability.

The statutory excuse

A statutory excuse is a legal defence against a civil penalty. For extended liability, it depends on having the right protections in place. These include prescribed contract terms, controls over substitution and identity verification processes. The terms reported from the guidance include:

• carrying out right to work checks on the individuals employed to do the work;
• no further subcontracting without prior written consent, with the same check obligations passed down the chain; and
• allowing audits of compliance.

The full list of required terms is in the Home Office guide and code of practice. Many existing supply contracts will need review.

Penalties

Civil penalties are up to £45,000 per illegal worker for a first breach and up to £60,000 per illegal worker for a repeat breach. A repeat breach is generally one within three years of the previous penalty.

Criminal liability is separate. Where a business knew, or had reasonable cause to believe, that a person did not have the right to work, the penalties include an unlimited fine and up to five years' imprisonment. A sponsor also risks action against its licence. See our guide to sponsor licence suspension and revocation.

Digital checks

Employers using digital identity checks should confirm that their provider is specifically authorised for right to work checks. General identity verification authorisation is not enough.

Sponsorship Management System changes

The SMS is the online system sponsors use to manage their licence and sponsored workers. Sponsor guidance (version 08/26) introduces security and user changes that affect every sponsor.

Mandatory multi-factor authentication

Multi-factor authentication (MFA) means logging in with more than a password. From 3 September 2026 the Home Office began introducing it for SMS users, in phases. It applies to organisations granted a new licence from 9 September 2026. Existing sponsors were expected to be brought in by November 2026, so you may be asked to set it up at any point.

Once MFA is active on a licence, each login needs a username, password and a one-time code. Codes are sent by mobile phone where a number is registered. Level 1 Users without a valid phone number, and all Level 2 Users, receive codes by email.

Level 2 Users are being removed

Level 1 Users are the main users of the SMS. Level 2 Users have narrower access: they can create and assign certificates of sponsorship and report worker activity on certificates they have assigned or been given.

• Since 9 September 2026, sponsors can no longer appoint new Level 2 Users.
• By 8 March 2027, existing Level 2 Users must be converted to Level 1, where eligible and still needed, or deactivated.
• After that date, the Home Office will deactivate any remaining Level 2 accounts.

A Level 1 User must carry out the conversion, and not every Level 2 User will be eligible. Organisations that rely on agency staff, outsourced HR teams or external advisers may be most affected. Level 1 carries broader permissions and responsibility, so decide carefully who needs it.

Inactive accounts

An account is inactive if it has not been accessed for 12 months or more. If the Home Office identifies an inactive Level 1 User, that person must log in and check or update their details within three months of being contacted. Level 2 Users are not contacted directly, so the sponsor must spot those accounts itself.

Every sponsor must have at least one active Level 1 User. If deactivation leaves a sponsor with none, the Home Office may take compliance action, which could include revocation. Authorising Officers will also receive email notifications of key licence activity, such as new Level 1 Users or assigned certificates.

What to do now

• Map your contracting chains. Identify where you use agencies, subcontractors, platforms or substitution rights.
• Review contracts. Check that they include the protections needed for the statutory excuse.
• Audit SMS users. Remove leavers and update emails and mobile numbers.
• Decide on each Level 2 User well before 8 March 2027: convert or deactivate.
• Keep Level 1 Users active. Have them log in regularly, and make sure you always have at least one.

For more on your wider duties, see our pages on sponsor licence compliance and the Skilled Worker visa.

How Garth Coates Solicitors can help

We advise employers and sponsors on right to work compliance, sponsor licence duties and SMS management. If you would like to review your contracts, users or processes, please request a consultation with our team.