A consultant has a candidate on the phone. The candidate is reading out a share code, digit by digit, while the consultant types it in. There is a school waiting for cover tomorrow, or a care home short a shift on Saturday. The check needs to be done today. Underneath the admin sits a bigger question that most desks never stop to ask: whose job is this check, and what makes it stand up if anyone ever looks?
That second half is where agencies get caught out. When an agency employs and pays an agency worker, the right to work check is the agency's to run, and running it correctly before the first shift is what gives the agency a statutory excuse against a civil penalty of up to £60,000 per worker. Get the routine right and it is quick. Get the duty split wrong and you can do a perfectly good check that protects nobody.
We ran an education recruitment agency for seven years. Right to work sat next to references and DBS in the same Friday-afternoon scramble, and it was the one people were least sure about. Here is how it actually works: what changed on 1 October 2026, who owns the check, the three ways to do it, what gives you a statutory excuse, and where a busy temp desk tends to slip.
What changed on 1 October 2026
The Home Office published a new employer's guide on 1 October 2026, and three things changed for agencies.
The fine reaches more of your agency workers. Before, the civil penalty covered employees. It now also covers people engaged on a worker's contract or a contract for services, and individual sub-contractors, where the work starts on or after 1 October. The Home Office's own example is an agency that engages workers on a contract for services: the agency is the employer for right to work, and it can be fined if one of them works illegally without a proper check behind them.
Chains carry the risk upwards. Say you win a contract and pass some of the work to another agency or a sub-contractor. If one of their workers turns out to work illegally, you can now be fined too, unless you met the Home Office's requirements before the work started: a written statement in the contract, controls on substitution, and identity checks, and be able to show they work in practice. The written statement has to require them to:
- carry out right to work checks on everyone doing the work
- not subcontract further without your written consent
- let you audit their checks
- accept action, up to ending the contract, if illegal working is found without a proper check
- co-operate with any Home Office investigation, including details of the chain
This applies to contracts entered into from 1 October. Section 3 of the Home Office guide has the detail.
An expired BRP no longer works for a manual check. The Home Office stopped issuing biometric residence permits on 31 October 2024. If a candidate hands you an expired one, looking at it and taking a copy gives you no statutory excuse. Do the online check instead.
There is no grace period. What has not changed is standard supply: when an agency employs its own agency workers and supplies them to a school or care home, the agency does the check, and the guide says the hirer is not meant to repeat it.
The bit everyone gets wrong: whose check is it?
Ask around a temp desk and you will hear two answers. Some think the school or care home does it, because that is where the person turns up to work. Others assume it is shared and leave it vague. Both create risk.
The rule the Home Office works to is simple in principle. The party that employs the worker is the party that must have carried out a correct check to hold a statutory excuse. In the standard temp model the duty sits with the agency, not the school, because the agency holds the contract of employment or worker's contract, runs the payroll, and pays the worker. The school or care home is the hirer. It does not employ that worker, so it does not run the check and does not carry the civil penalty for them.
There is a piece of discretion worth naming. The guidance says responsibility depends on the contractual arrangements between the parties, and an arrangement can be built where a hirer takes a worker under its own direct control in a way that shifts the employer relationship. That is the exception. For a normal supply-teacher or supply-carer placement, where the agency employs and pays, the check is the agency's. The safe move is to write down who does it in the terms of business. A check nobody did, because each side thought it was the other's, is the worst outcome of all.
This is the same shape as references, where the duty also travels with the agency rather than the setting. We set that out in the KCSiE reference requirements guide for education and the care worker references guide for the CQC world.
The three ways to check
There are three lawful routes. Which one you use depends on who the worker is, not on which is most convenient.
The online check, using a share code. Anyone with a digital immigration status proves their right to work this way. That now covers most visa holders, people with EU Settlement Scheme status, and former holders of biometric residence permits, whose status is now an eVisa. The worker generates a share code through the gov.uk "prove your right to work" service. The right code starts with a W. Codes starting with R or S are for other services and will not work. You enter that code and the worker's date of birth on the Home Office online checking service, and you confirm the photo on the response matches the person in front of you. The check is free. A share code is valid for 90 days, so use it while it is live.
The manual document check. You examine the person's original documents, in their physical presence or on a live video call while they hold the originals. You confirm the documents are genuine, that the photo and date of birth are consistent with the person, and you keep a clear copy with the date you checked. British and Irish citizens cannot get a share code, so a passport checked manually is a normal route for them.
The digital identity check, IDVT. For British and Irish citizens who hold a valid passport, or an Irish passport card, you can use a certified identity service provider that offers Identity Document Validation Technology. The provider verifies the passport digitally and confirms the person's identity, and you keep the output. This route is optional. A manual passport check remains perfectly lawful, so nobody is forced down a paid IDVT route. It exists to let you check a British or Irish passport holder remotely without handling the physical document.
So the idea that every worker needs a paid identity check is wrong. Only British and Irish passport holders can use IDVT, and everyone with a digital status uses the free online share code.
What actually gives you a statutory excuse
A statutory excuse is the point of the whole exercise. It is the legal protection you earn by doing the prescribed check correctly, before the worker starts, and keeping the evidence. If the worker later turns out not to have the right to work, a valid excuse stands between you and a civil penalty. Since 13 February 2024 that penalty runs up to £45,000 per worker for a first breach and £60,000 for repeat breaches, so the protection is worth having.
Each route earns the excuse a specific way. For the online check, it comes from saving the checking service response that shows the person can do the work. For a manual check, from following the prescribed steps and keeping a dated copy. For IDVT, from using a certified provider and keeping their output. On any route, the excuse does not apply if you knew or had reasonable cause to believe the person could not work. Doing the check does not cover you if you looked the other way.
For workers whose permission is time-limited, the excuse is not permanent. You have to run a follow-up check before the permission expires, or it lapses while the worker is still on shift. This is the one that quietly bites a temp desk. British and Irish citizens and people with settled status hold permanent status, so they need no follow-up. Everyone on time-limited leave needs a date in the calendar.
Where a temp desk slips
In seven years we saw the same handful of failures, and they were rarely about not knowing the rules. They were about a fast desk under pressure.
The school does the check as a favour. A helpful school office says they will look at the new supply teacher's passport on arrival. Kind, and worth nothing to you. The school is not the worker's employer, so its check does not give the agency a statutory excuse. The agency still needs its own compliant check on file before the worker starts. A favour is not a compliance record.
A photocopy stands in for a check. A passport gets scanned and dropped in the file, and everyone treats the worker as cleared. A copy on its own is not a check. Without the prescribed steps, seeing the original, checking it in the person's presence, confirming the likeness and dating the copy, there is no statutory excuse behind it.
A share code screenshot stands in for the check. The candidate sends an image of their status and it gets saved as proof. The excuse comes from you running the online check against the code and their date of birth and confirming the photo, not from a picture they sent you. Do the check yourself and keep the response the service gives you.
And the follow-up that never got diarised. Time-limited permission needs a recheck before it expires, or a clean first check quietly lapses while the worker is still on shift.
None of this needs scaremongering. Most agencies are doing broadly the right things. The gaps are in consistency and in the record, and both are fixable with a process that runs the same way on a frantic Friday as on a quiet Tuesday.
Where PassQ fits
Right to work is one strand of the worker record we clear. PassQ handles the full record on one person, references, DBS, right to work, and qualifications, chased where it needs chasing and kept as an audit-ready file the agency can hand to a school, a care home, or an inspector. Each worker runs to the correct route, and where permission is time-limited the follow-up date is part of the record rather than a note someone has to remember. The same discipline we apply to references in the safer recruitment guide runs through the whole clearance. See PassQ for education recruitment agencies and for care staffing agencies.
Our founding-partner pricing is on the pricing page. If you want to see what a cleaner, better-documented clearance looks like for your desk, get in touch.
The short version
Since 1 October 2026 the fine also covers agency workers on a worker's contract or a contract for services. If you pass work down a chain, your contracts need the five written terms. The check belongs to whoever employs and pays the worker, which in a standard temp placement is the agency, not the school or care home. Write down who does it so nobody assumes the other side has. Use the right route: the free online share code for anyone with a digital status, a manual check or optional IDVT for British and Irish passport holders. Do it correctly before the first shift, keep the evidence, and that is your statutory excuse. Diary a follow-up for anyone on time-limited permission. The rules are not the hard part. Running them the same way every time, under pressure, is.
Frequently asked questions
What changed in the right to work rules on 1 October 2026? The civil penalty now covers people engaged on a worker's contract or a contract for services, and individual sub-contractors, for work starting on or after 1 October 2026. Before, it covered employees only. A business higher up a contract chain can also be fined for a check missed further down, unless it met the Home Office's requirements before the work started. The first is a written statement of five set terms in the contract. There is no grace period. Standard agency supply is unchanged: the agency does the check and the hirer does not need to repeat it.
Who is responsible for an agency worker's right to work check, the agency or the hirer? It follows the contract. The party that employs and pays the worker needs a correct check to hold a statutory excuse. In the standard temp model that is the agency, so the check is the agency's job. The school or care home does not employ the worker and does not run the check. Agree it in writing so nobody assumes the other side has it covered.
Do all agency workers need a paid identity check? No. People with a digital immigration status prove their right to work with a free online share code check. British and Irish citizens with a valid passport can be checked manually against the original, or through a certified identity service provider using IDVT. The IDVT route is optional and manual passport checks remain lawful, so a paid check is never the only option.
What is a statutory excuse? It is the legal protection an employer gets by carrying out the prescribed check correctly, before employment starts, and keeping the evidence. If the worker later turns out not to have the right to work, a valid excuse protects the employer from a civil penalty of up to £45,000 for a first breach and £60,000 per worker for repeat breaches. It does not apply if you knew, or had reasonable cause to believe, the person could not work.
When do you need to recheck an agency worker's right to work? When their permission is time-limited, you recheck before it expires. Miss the date and the statutory excuse lapses while the worker is still on assignment, even though the first check was done properly. British and Irish citizens and people with settled status hold permanent status, so no follow-up is needed.
Does a photocopy of a passport give you a statutory excuse? On its own, no. For a manual check you have to see the original, check it in the person's presence or on a live video call while they hold it, confirm the photo matches, and keep a clear copy with the date you checked. Anything short of that is a document on file, not a compliant check.