A logistics company in Manchester hires fifteen agency workers through a national staffing firm to cover a seasonal surge. Six months later, an immigration enforcement visit reveals two of those workers had no right to work in the UK. The company points to the agency: "They vetted them." The agency points to the company: "They were on your site, under your supervision." Both receive civil penalty notices. Neither has a statutory excuse.
This scenario plays out across UK businesses every week. The question of who is responsible for right to work checks on agency workers sounds simple. The answer is anything but.
The legal framework: two types of agency
UK employment law draws a critical distinction between two types of staffing intermediary, and misunderstanding it is the root cause of most agency worker compliance failures.
An employment business supplies temporary workers to a client (the hirer). The worker is employed by the employment business or works under a contract for services with it. This is what most people mean when they say "agency" — the staffing firm that sends workers to your warehouse, care home, or construction site.
An employment agency introduces candidates to a client, who then employs them directly. Think traditional recruitment consultants. The worker becomes the client's employee.
The distinction matters because the right to work obligation follows the employment relationship. Under the Immigration, Asylum and Nationality Act 2006, the employer is the party liable for civil penalties if a worker is found to have no right to work. For agency workers supplied by an employment business, the employment business is technically the employer. For workers introduced by an employment agency, the hirer is the employer.
So far, so clear. But in practice, it falls apart almost immediately.
The practical gap: everyone assumes someone else checked
The legal distinction between employment businesses and employment agencies creates a false sense of security. Here is what actually happens on the ground.
The agency assumes the hirer will verify at site. Many employment businesses conduct right to work checks at the point of registration — when the worker first signs up with the agency. They may check documents, take copies, and record share codes. But when the worker is deployed to a client site, the agency assumes the hirer will confirm identity on arrival. After all, they reason, the hirer is the one who will be supervising the worker day to day.
The hirer assumes the agency has done it. The client business, receiving workers from a staffing firm, assumes — often explicitly through contract terms — that the agency has completed all necessary pre-employment checks, including right to work verification. When fifteen workers arrive at 6am on a Monday, the site manager checks names against a list, not documents against faces.
The result is a verification vacuum. The agency checked documents weeks or months ago. The hirer never checked at all. Neither party has a complete, current, verifiable record that links a specific person to a specific right to work status at the point they started working.
This is the gap the Fair Work Agency was designed to close. And both parties sit inside it.
What the Home Office guidance actually says
The Home Office employer's guide to right to work checks is explicit on this point. The party that employs the worker is responsible for the check. For agency workers supplied by an employment business, the employment business holds the primary legal obligation.
But — and this is the part that catches businesses out — the guidance also makes clear that the hirer can be liable if they know, or have reasonable cause to believe, that the worker does not have the right to work. In practice, this means that ignorance is not a reliable defence. If an enforcement visit reveals that you had no process in place to verify the identity of workers on your site, "we trusted the agency" will not satisfy an inspector.
The penalty regime does not distinguish between direct employees and agency workers. First offence: up to £45,000 per illegal worker. Repeat offence: up to £60,000. These penalties apply to whichever party the Home Office determines was the employer — and in complex supply chain arrangements, both parties may be treated as employers.
Real enforcement examples
The enforcement landscape is not hypothetical. Several patterns recur in published civil penalty notices and tribunal decisions.
Care sector substitutions. An agency sends a worker to a care home. The worker is checked at registration. Three months later, a different person turns up for a shift using the original worker's booking reference. The care home records a name on a paper sign-in sheet. Nobody checks ID. When CQC and immigration enforcement investigate a safeguarding concern, the person on shift cannot be identified. Both the agency and the care home face enforcement action.
Construction site layering. A main contractor hires a subcontractor, who uses an employment business to supply labourers. The employment business checks documents at registration. The subcontractor never sees the documents. The main contractor never sees the workers' names. Three layers of separation, zero verification at the point of work. When enforcement visits the site, nobody can produce a compliant record for the workers present. Penalties are issued up the chain.
Hospitality last-minute fills. A restaurant calls an agency at 4pm for an evening shift cover. The agency sends whoever is available. The restaurant manager is too busy with service prep to check documents. The worker may or may not be the person the agency intended to send. No record is created. This repeats weekly.
In each case, the compliance failure is not malicious. It is structural. The gap between who is supposed to check and who actually checks remains open because nobody closes it.
The contractual layer
Many businesses attempt to resolve the agency worker compliance question through contract terms. The supply agreement between the agency and the hirer will typically include clauses specifying that the agency warrants it has conducted right to work checks on all supplied workers.
These contractual warranties are useful for commercial disputes. They are not useful for immigration enforcement. The Home Office does not consider contractual allocation of responsibility when issuing civil penalties. The legal obligation falls where the law places it, regardless of what two commercial parties agreed between themselves.
A contractual warranty may give you a basis to recover costs from the agency after the fact. It will not prevent the penalty being issued in the first place. It will not provide a statutory excuse.
How to close the gap
The solution is not to argue about who should check. It is to ensure that a verifiable check happens, and that both parties have evidence of it.
1. Verify at the point of arrival, not just the point of registration. The agency's initial right to work check establishes eligibility. But eligibility changes — visas expire, permissions are revoked, share codes become invalid. A check conducted three months ago does not confirm right to work today. Verification must happen when the worker arrives at the client site, every time.
2. Match identity to the individual, not just the name. A name on a rota is not identity verification. When an agency worker arrives for a shift, you need to confirm that the person physically present is the person whose documents were checked. This means some form of identity matching — not just asking someone to confirm their name.
3. Create a shared, auditable record. Both the agency and the hirer should have access to a compliance record for every placement. This record should show what was checked, when, by whom, and what the outcome was. When a compliance audit happens, both parties should be able to produce the same evidence independently.
4. Address the substitution problem explicitly. Contracts should require agencies to notify hirers of any substitution before the worker arrives. Hirers should refuse to accept any worker who has not been verified, regardless of operational pressure. The "Dave couldn't make it" problem only exists because businesses accept unverified substitutes. Stop accepting them, and the problem stops.
5. Track time-limited permissions jointly. For workers with visa expiry dates or time-limited right to work, both the agency and the hirer need visibility of those dates. If a worker's visa expires mid-placement, waiting for the agency to notice is not a compliance strategy.
The cost of getting it wrong
Beyond the headline penalty figures, a compliance failure involving agency workers creates cascading costs. The investigation disrupts operations. Other workers on site may be checked, revealing additional gaps. The agency relationship is damaged or terminated, leaving staffing gaps. CQC or HSE involvement may follow if the sector is regulated. And the reputational damage — "company fined for employing illegal workers" — does not distinguish between deliberate exploitation and process failure.
For sectors that rely heavily on agency workers — care, hospitality, construction, logistics — the risk is not occasional. It is built into the operating model. Every shift filled by an agency worker is a potential compliance event. The question is whether you have a system that treats it as one.
Certifyd's Right to Work Portal gives both agencies and hirers a shared verification layer — real-time identity confirmation at point of arrival, automated document checks, and audit-ready records that both parties can access instantly. One system, no gaps, no arguments about who was supposed to check.