Right to Work and Right to Rent: What Changes on 1 October 2026 and How to Get Ready
Latest News,Legislation
The rules around checking who you employ and, increasingly, who you house are about to change significantly. From 1 October 2026, a package of reforms takes effect that widens the net of who must carry out Right to Work checks, raises the stakes for getting them wrong, and tightens the standards that digital identity checks must meet for both Right to Work and Right to Rent.
If your organisation employs staff, engages contractors, runs an online platform that connects workers with customers, or lets property, October’s changes will touch you. Here’s what’s coming, and how to prepare.
Why the rules are changing
The changes flow principally from the Border Security, Asylum and Immigration Act 2025, which amends the long-standing illegal working regime established under the Immigration, Asylum and Nationality Act 2006. Alongside the legislation, the Home Office is issuing a revised Code of Practice on preventing illegal working, which sets out how checks must be performed and what evidence organisations need to retain.
At the same time, the UK’s digital identity ecosystem has been put on a statutory footing. The Office for Digital Identities and Attributes (OfDIA) now maintains a public register of Digital Verification Service (DVS) providers, and from October, digital Right to Work and Right to Rent checks must be carried out through a provider on that register. The days of informal or unaccredited “ID checking” tools being good enough are over.
The illegal working net gets much wider
Until now, the duty to carry out Right to Work checks and the civil penalty risk for failing to do so has sat squarely with direct employers of employees. From 1 October 2026, the definition of who counts as an “employer” for these purposes expands dramatically to include:
– Businesses engaging workers, not just employees on employment contracts;
– Those engaging individual sub-contractors, including in multi-tier contracting chains where one party contracts with another to deliver services onward;
– Online matching services, digital platforms that hold a pool of service providers, pair them with customers online, and earn a fee on each successful pairing.
This is aimed directly at the gig economy and at labour supply chains where, historically, no one in the chain was clearly responsible for verifying a worker’s status. That ambiguity disappears in October.
There’s also a new focus on substitution. Where a business permits an individual to send a substitute to perform work, the business itself must ensure prescribed Right to Work checks are carried out on that substitute. Responsibility cannot simply be delegated to the person doing the work.
One important carve-out: someone buying a service simply as the final consumer, with no obligation to pass that work on to anyone else, stays outside the extended regime.
Higher penalties, harder questions
Civil penalties for illegal working now run to up to £60,000 per worker. Where a contractual chain is involved, the Home Office will weigh up how the contracting arrangements were structured and what each party actually did before deciding who pays. That means every link in the chain needs to be able to show its own compliance.
In practice, the revised Code of Practice expects affected organisations to:
– Put written agreements in place requiring other parties in the chain to carry out prescribed Right to Work checks
– Restrict subcontracting without consent, and retain audit rights over compliance
– Keep records showing what was done, and be ready to hand them over if asked
– Cooperate with Home Office investigations, including disclosing the make-up of the contractual chain and the details of each employer or service provider within it.
The message is clear: it will no longer be enough to have done the check. You’ll need to be able to prove it, quickly, across your whole labour supply chain
Digital checks must come from a registered provider
Digital identity verification has been an accepted route for Right to Work and Right to Rent checks for several years, letting British and Irish citizens prove their status remotely using a valid passport rather than presenting original documents in person. What changes on 1 October 2026 is the bar the technology provider must clear: providers must be registered with OfDIA on the DVS register, having been certified against the UK Digital Identity and Attributes Trust Framework (v0.4 or v1.0).
The revised Code also sets expectations for ongoing identity assurance in remote and platform-based work, recognising methods such as biometric and facial recognition technology, workplace access credentials, and periodic identity re-verification. For platforms and labour providers, verifying someone once at onboarding may not be the end of the story; being able to re-confirm that the person doing the work today is the person you checked is becoming part of the compliance picture.
Landlords and letting agents should take note too. Right to Rent checks follow the same trajectory: digital checks must be delivered through a registered DVS provider, and with civil penalties for renting to someone without status reaching up to £20,000 per occupier for repeat breaches, informal checking processes carry real financial risk.
Part of a bigger shift to digital verification
October’s changes don’t sit in isolation. On 30 June 2026, the government’s digital identity unit announced legislation enabling digital age verification for alcohol sales in England and Wales, removing the requirement for proof of age to carry a physical security feature like a hologram, and allowing pubs, clubs, restaurants and shops to accept digital verification from registered DVS providers instead. Crucially, those checks must operate at a defined level of confidence under the trust framework and be validated through secure technological means, not just a glance at a screen.
The direction of travel is unmistakable: across employment, housing, retail and hospitality, the UK is standardising on registered, certified digital verification as the trusted way to prove who you are and what you’re entitled to do. Organisations that build their processes around a registered DVS provider now will find each successive regulatory change an update, not an upheaval.
What to do before 1 October
1. Identify your workforce. Identify every category of labour you use and establish who is responsible for checking each.
3. Check your provider. If you already use digital Right to Work or Right to Rent checks, confirm your provider is certified under the trust framework and registered with OfDIA as a RTW DVSP or RTR DVSP.
4. Address substitution. If substitutes or not, ensure that there is a process in place to check them directly.
5. Keep an audit-ready record. Every check, agreement and audit should be logged and instantly retrievable if the Home Office comes knocking.
Ministerial Statement
Read the responsible minister, Alex Norris MP’s statement here
How Luciditi helps
These changes are exactly the problem Luciditi was built to solve. Luciditi has long been certified under the UK Digital Identity and Attributes Trust Framework across multiple provider roles (identity, holder, attribute and orchestrator) including the specific “supplementary codes” for right to work and right to rent.
Luciditi provides a secure single administration portal called Luciditi Central to run and manage checks across your entire organisation. The Luciditi Trust API enables direct integration from 3rd party systems, bypassing the management portal altogether.
Luciditi adds more than a typical checking service
Most providers verify an identity at the moment of the check and stop there. Luciditi is different: as a certified holder service under the trust framework, we can (with the individual’s consent) securely hold verified identity data beyond the original check, ready to be used again.
That capability turns one of October’s hardest requirements into a solved problem. Substitution rules demand ongoing certainty that the person actually doing the work is the person you checked. Because Luciditi retains the verified identity, a quick biometric facial match against the original check confirms in seconds that the individual in front of you, on site or on screen, is not someone else standing in unchecked. No repeat document checks, no gaps in your audit trail, and no way for a substitute to slip through on someone else’s credentials.
With Luciditi you can:
– Carry out compliant digital identity checks through a certified, registered provider — satisfying the new October requirements out of the box
– Manage checks across employees, contractors and tenants from one place, however your labour or lettings operation is structured
– Solve the difficult substitution problem
– Maintain a complete, timestamped audit trail for every check — a compliance file that’s ready the moment the Home Office asks
– Configure and scale your subscription as your needs grow, adding age assurance and other verification services from the same platform.
Whether you’re an employer untangling a contracting chain, a platform facing Right to Work obligations for the first time, or a letting agent moving to digital Right to Rent checks, Luciditi turns October’s compliance burden into a straightforward, managed process.
Want to know more?
The changes land on 1 October 2026 but the preparation starts now. Get in touch to see how Luciditi can get you ready. Contact us for a chat today.
