Right to Work Checks Are Expanding to Gig, Agency and Platform Workers

Section 48 extends the illegal working civil penalty regime beyond direct employment. According to law firm summaries of the Act, the newly in-scope categories include non-employees engaged under a worker's contract, individual contractors, agency workers, gig economy workers and platform-based service providers, and casual, temporary and zero-hours workers.

This does not make these people employees for employment-law purposes. It means the business that engages them, including a platform or agency further up the chain, can now face a civil penalty if it has not checked them.

Primary source: Border Security, Asylum and Immigration Act 2025, Section 48. As of this writing, gov.uk's own employer's right-to-work guide has not yet been updated to reflect it, so most current commentary comes from employment-law firms tracking the Act.

Civil penalties of up to £60,000 per illegal worker, with criminal exposure in serious cases, already apply to employees. From 1 October 2026 that exposure extends to the wider categories above, whether or not your business has run a right-to-work check on a non-employee before.

On the figures: £60,000 is the maximum for a repeat breach within three years. A first breach is capped lower, at £45,000 per worker. Both are set out in the Home Office's code of practice on illegal working penalties.

Gig and marketplace platforms, and staffing agencies placing workers with multiple end-clients, are exactly the businesses this extension targets, and exactly the businesses most likely to be onboarding people continuously rather than a handful of times a year. gov.uk still offers one route to check a share code: a human filling in a three-page form, one applicant at a time, with no bulk upload and no API.

POST /api/check turns that form into one HTTP call, so checking a new worker fits into the onboarding flow you already run them through instead of becoming a separate manual step for a population you've never had to screen before. See the full integration picture in the right to work check API guide.

Sandbox keys (rtw_test_…) return deterministic fixtures for every outcome, so you can build the check into your onboarding flow now and flip to a live key when you're ready, well ahead of 1 October.

const res = await fetch('https://checksharecode.co.uk/api/check', {
  method: 'POST',
  headers: {
    'content-type': 'application/json',
    authorization: 'Bearer rtw_test_...',
  },
  body: JSON.stringify({
    share_code: 'AB1CD2EF3',
    date_of_birth: '1990-01-01',
    company_name: 'Acme Gig Platform Ltd',
  }),
});

const data = await res.json();
// { outcome: 'ACCEPTED', name: 'JANE EXAMPLE DOE', conditions: [], reference: 'WE-EXAMPLE-12', ... }

Walk through a full integration in the Node.js quickstart or read the API docs.