The UK's Right-to-Work Rules Are Expanding to Contractors, and Your PEO Won't Take the Liability

For the last few years, the standard move for a US or EU company that needed a handful of people in the UK without opening a local entity was simple: route them through a PEO, hire contractors through an Employer of Record relationship, or work with a staffing agency and treat right-to-work verification as somebody else's job. Draft Home Office guidance confirms that assumption stops holding on October 1, 2026. The rules aren't getting stricter for the same population of workers, they're getting wider, pulling in categories of workers and categories of employer that were never inside the regime before.

A Regime Built for Employees Is Expanding to Everyone Else

Today, UK right-to-work duties attach to individuals under contracts of employment, service, or apprenticeship, a familiar, bounded category. From October 1, that scope grows to include workers under worker's contracts, individual subcontractors, people engaged through online matching services, and workers inside multi-tier contractual supply chains where one employer subcontracts work to another. The Home Office is calling the new exposure "extended liability," and it specifically targets businesses that have no direct contract with the individual doing the work but sit upstream in the chain, gig economy platforms, facilities-management arrangements, and substitution-worker agreements among them.

The practical effect lands hardest on exactly the contingent-workforce models that small and midsize companies lean on to expand internationally without the overhead of a local entity. Current civil penalties start at £45,000 per illegal worker for a first breach within three years and rise to £60,000 for a repeat breach in the same window, figures that already sting for a company discovering a single misclassified contractor. Two mitigating factors, proactive reporting and active cooperation during an investigation, can each shave £5,000 off the total, but neither erases the exposure. Genuinely self-employed individuals and end-user clients purchasing a service for their own business use remain outside the expanded regime, a narrow carve-out that most contractor and platform arrangements won't fit into.

The Enforcement Numbers Behind the New Scope

This expansion is landing on top of an enforcement environment that's already sharply more aggressive than it was two years ago. Home Office quarterly data shows 748 penalty notices worth a combined £41.6 million issued in the first quarter of 2025 alone, easing only slightly to 548 notices worth £28.3 million in the second quarter. The average penalty per case has climbed from around £18,000 in 2023 to roughly £51,000 since the February 2024 cap increase tripled the maximum from the old £15,000 to £20,000 range, peaking above £55,000 in early 2025. Two structural changes are driving that: automatic sponsor-licence renewals freed up Home Office resources for audit activity starting in April 2024, and the tripled penalty caps mean every case the Home Office does pursue now costs an employer far more.

Layer the October scope expansion on top of that enforcement trend and the risk profile changes for a company that never thought of itself as having UK right-to-work exposure at all. A US-based company using a staffing agency to place UK contractors, or running a gig-platform-style substitution arrangement, now sits inside a regime that was designed, until this year, for direct employers only.

Why "We Use a PEO" No Longer Ends the Conversation

The detail most likely to catch HR and legal teams off guard is who stays on the hook. Recent legal guidance is direct about this: organizations using contractors and subcontractors, staffing agencies and temporary-worker suppliers, online matching platforms, and PEO or Employer of Record providers in worker-substitution arrangements cannot delegate compliance responsibility to those intermediaries. Right-to-work checks must be completed before an individual starts work, and they can't be handed off to a third party except through an approved digital verification provider. A PEO or EOR relationship can still carry real operational value, absorbing payroll, tax, and local employment-law complexity that would otherwise require a UK entity, but it was never designed to be a liability shield for right-to-work checks specifically, and the October changes make that gap explicit rather than theoretical.

For HR teams with any UK contractor, staffing-agency, or platform-based workforce, the practical next steps look like this:

• Inventory every UK worker who isn't a direct employee now. Contractors, subcontractors, staffing-agency placements, and platform-sourced workers all need to be identified before October 1, not after.
• Confirm who is actually running right-to-work checks in each arrangement. A PEO or staffing agency's assurance that "we handle that" needs to be verified against the new extended-liability rules, not taken on faith.
• Review supply-chain and subcontracting relationships for upstream exposure. A company that subcontracts work to another employer can now face penalty exposure even without a direct contract with the worker.
• Complete checks before work starts, not after. The rule that verification can't happen retroactively applies with equal force to the newly covered categories.
• Use an approved digital verification provider where checks can't be done directly. It's the one delegation path the guidance explicitly permits.
• Budget for the cost of getting it wrong, not just the cost of compliance. At roughly £51,000 average per case, one missed check now costs more than most companies' entire annual UK contractor spend.

None of this is a distant regulatory horizon story. October 1 is weeks away, the enforcement data shows penalties already trending sharply upward before the scope even expands, and the guidance on delegation closes off the assumption that a vendor relationship quietly handles the risk. For companies that built their UK presence on contractors, staffing agencies, or platform labor precisely to avoid the complexity of direct employment, the complexity just found them anyway.