On a major residential development in east London, a site safety audit in 2024 found that 14 of the 87 workers on site that day could not be matched to any subcontractor's records. They were working, wearing high-visibility vests, using power tools — and nobody could confirm who had hired them, who had checked their right to work, or who was responsible for their presence on site.
The principal contractor was shocked. They had contractual agreements with five subcontractors, each of which was required to verify their own workers and maintain compliant records. But those five subcontractors had, between them, engaged a further eleven sub-subcontractors. Some of those had brought in labour from agencies. And at the bottom of a chain four layers deep, workers were arriving on site with nothing more than a verbal instruction to "turn up at 7."
This is the on-site blind spot in construction. It is structural, it is widespread, and it is becoming increasingly difficult to ignore as enforcement agencies expand their reach and the consequences of non-compliance escalate.
The subcontractor chain problem
Construction is built on subcontracting. A principal contractor wins the project. They engage specialist subcontractors for groundworks, steelwork, electrical, plumbing, plastering, roofing, cladding, and finishing. Those subcontractors may engage their own sub-subcontractors for specific tasks. Those sub-subcontractors may bring in agency workers or self-employed individuals.
On a large site, this creates chains three, four, or five layers deep between the principal contractor and the person actually doing the work. At each layer, the assumption is that the level below has conducted the necessary checks. The subcontractor assumes the agency verified the worker. The agency assumes the worker's documents are genuine. Nobody verifies at the point of arrival on site.
According to the Construction Industry Training Board (CITB), the UK construction sector employs approximately 2.7 million people, with a significant proportion working through subcontractor and agency arrangements. The sector's reliance on self-employed and agency labour — estimated at over 40% of the workforce — means that traditional employer-employee verification processes often do not apply.
The right-to-work obligation falls on the employer. But when a worker is technically employed by an agency, subcontracted to a specialist firm, working on a site managed by a principal contractor, who is the employer? The legal answer is the entity that pays the worker. The practical answer is that nobody takes ownership of the verification.
CSCS cards: the false sense of security
The Construction Skills Certification Scheme (CSCS) card is the industry's standard competency card. Most major sites require workers to hold a valid CSCS card to gain access. The card includes a photograph, the holder's name, their qualification level, and an expiry date.
Many principal contractors and site managers treat the CSCS card as a de facto identity document. If a worker has a valid CSCS card, they must be who they say they are, and they must have been checked — right?
Wrong. The CSCS card verifies that the holder has achieved a certain level of construction competency. It does not verify immigration status, right to work, or identity in the way that a right-to-work check requires. A worker can hold a genuine CSCS card and still not have the right to work in the UK — if, for example, their visa has expired since the card was issued. Alternatively, a CSCS card can be borrowed, forged, or used by someone other than the named holder.
Relying on the CSCS card as a proxy for right-to-work verification creates a compliance gap. The card was never designed for that purpose, and treating it as sufficient exposes the principal contractor and every layer of the subcontractor chain to liability.
Lessons from Grenfell and the Building Safety Act
The Grenfell Tower inquiry, while focused on fire safety and building regulation failures, exposed broader problems with workforce accountability in construction. The inquiry found that workers on the Grenfell refurbishment project were not consistently identified, that record-keeping about who was on site and when was inadequate, and that the subcontractor chain made it difficult to establish who was responsible for what.
The Building Safety Act 2022 was, in part, a legislative response to these accountability gaps. The Act creates a new regulatory framework for higher-risk buildings, including enhanced duties on principal contractors to maintain oversight of everyone working on their projects.
While the Building Safety Act focuses primarily on safety rather than immigration compliance, the underlying principle is the same: if you are the principal contractor, you are responsible for knowing who is on your site, whether they are qualified, and whether they are authorised to be there. The Act reinforces an expectation of traceability — the ability to identify every worker, trace their engagement through the subcontractor chain, and demonstrate that appropriate checks were conducted.
This expectation applies whether the worker is installing cladding, laying bricks, or cleaning up at the end of the day. It applies to directly employed workers, subcontractor employees, agency temps, and self-employed tradespeople.
The distributed site challenge
Construction workers are mobile. A plasterer might work on three different sites in a week. An electrician might be on one project for two days before moving to another. A labour-only subcontractor might send different workers to the same site each morning.
This mobility creates verification challenges that are fundamentally different from those in an office, factory, or care home:
No fixed entry point. A care home has a front door. A construction site has a hoarding with multiple access points, deliveries arriving from different directions, and workers entering from car parks, adjacent sites, and public footpaths. Controlling access is physically more difficult.
No persistent workforce. In an office, the same people generally show up every day. On a construction site, the workforce changes daily as different trades arrive and leave according to the project schedule. The electricians are there this week but not next week. The roofers arrive when the structure is ready. Each phase brings a different set of workers.
No centralised HR. The principal contractor may have an HR function, but the subcontractors, sub-subcontractors, and agencies each manage their own workforce. There is no single system that holds right-to-work records for every person on site.
Time pressure. Construction projects run to tight schedules with penalties for delay. When a subcontractor's team is a person short and the programme depends on completing that day's pour, the temptation to let an unverified worker on site "just this once" is significant.
What enforcement looks like on construction sites
Immigration Enforcement conducts targeted operations on construction sites, often in collaboration with HMRC and the Gangmasters and Labour Abuse Authority (GLAA). These operations typically involve multiple officers arriving at a site, controlling the access points, and systematically checking every worker present.
The Fair Work Agency, consolidating these enforcement bodies from April 2026, will have enhanced powers to conduct exactly this type of multi-agency operation. The FWA's ability to share intelligence across immigration, employment standards, and labour abuse enforcement makes construction sites — with their complex subcontractor chains and mobile workforces — a prime target.
When enforcement officers arrive, the principal contractor is the first point of contact. They will be asked to account for every person on site. For directly employed workers, this is manageable. For workers engaged through three layers of subcontracting, it is often impossible without a system that tracks the full chain.
Civil penalties of up to £60,000 per illegal worker apply to the employer — which may be the subcontractor, the agency, or in some cases the principal contractor, depending on the employment arrangements. In practice, enforcement tends to follow the money: whoever pays the worker bears the primary liability, but reputational damage and project disruption affect the entire chain.
Building verification into site operations
The construction sector needs verification systems that work within its operational realities: mobile workforces, multiple employers, distributed sites, and daily workforce changes.
Site-level identity verification
Every worker arriving on site should be verified at the point of entry — not by showing a CSCS card or signing a paper register, but through a digital check that confirms their identity, their right to work, and their association with a named subcontractor. This verification should take seconds, not minutes, and should work on a mobile device at the site gate.
Subcontractor compliance requirements
Principal contractors should make digital verification a contractual requirement for all subcontractors, at every level of the chain. Before a subcontractor's worker sets foot on site, their right-to-work status should be visible to the principal contractor through a shared compliance platform.
Real-time site workforce visibility
Site managers need to know, at any point during the working day, who is on their site, who verified them, and whether their documentation is current. This is not just a compliance requirement — it is a safety requirement. In the event of an incident, knowing exactly who is on site and who is responsible for them is critical.
Audit trails that follow the worker
A worker who moves between sites should carry a verification record that persists. If they were verified on Monday at Site A, that verification should be visible when they arrive at Site B on Tuesday — provided the underlying documents remain valid. This eliminates duplicate checking while maintaining the audit trail that enforcement agencies require.
Technology for distributed verification
Certifyd's verification platform is designed for environments where the workforce is mobile, distributed, and managed through complex chains. Workers verify once and carry a digital identity that can be checked at any site in seconds. Principal contractors get a dashboard showing compliance status across all subcontractors. Subcontractors can demonstrate to their clients that every worker has been verified. And when enforcement arrives, the records are there — organised by site, date, and subcontractor, accessible in minutes.
For construction businesses navigating the compliance challenges of multi-site, multi-employer projects, explore how Certifyd works for the trades sector.