Excuse — right-to-work gate for UK subcontracting firms

1. One-liner

Decides which subbies are in scope, checks them and their substitutes before day one, and keeps the statutory-excuse file.

2. Trend signal — why now?

On 1 October 2026 the UK’s illegal-working regime stops being about employees. It reaches the self-employed individual working under someone else’s contract, the substitute he sends when he is on another job, and everyone up the chain who contracted for that labour. The penalty is £45,000 per worker, £60,000 on repeat. The only defence is a set of “prescribed requirements” the Home Office wrote out in June. Every vendor in the market sells the identity check. Nobody sells the rest.

The statute and the date. Section 48 of the Border Security, Asylum and Immigration Act 2025 amends the Immigration, Asylum and Nationality Act 2006 to catch workers’ contracts, individual sub-contractors and online matching services, and to introduce extended liability along labour supply chains. The Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026, published 24 June 2026, bring it into force on 1 October 2026 (DLA Piper, 2026; Lewis Silkin, 2 July 2026). Home Office minister Alex Norris: “The reforms introduce, for the first time, an extension of the Right to Work Scheme and the associated civil penalties for non-compliance, to cover companies who contract workers or individual subcontractors to provide services under their company name, such as agency workers or workers in the gig economy” (Construction Enquirer, 2 July 2026).

The Code that defines the defence. The Home Office published the draft revised Code of practice on preventing illegal working on 30 June 2026, framed to come into force on 1 October (gov.uk draft Code PDF). The definitions and the duties, quoted from it:

• Who is caught: “‘Individual sub-contractor’ means an individual who has entered into a contract with a person to provide work or services, in circumstances where that other person has entered into a contract with a third party to provide, or arrange for the provision of, the work or services but the individual has not.”
• Who is not: “Individuals who are operating in business on their own account, trading in their own name or as part of their own business, who contract directly with clients or customers for the provision of work or services, are not in scope of the Scheme.” But: “This does not include individuals who obtain work through an intermediary, platform, or similar arrangement where the individual is not operating an independent business in their own right.”
• The chain: “A person who is not in a direct contractual relationship with the worker will establish a statutory excuse against extended liability under this section where the prescribed requirements set out in this section have been met in full and can be evidenced.” Those requirements are “contractual terms and conditions (written statement)”, “substitution controls, and” “identity verification systems and processes”. The written statement “must” be “in place before the work or service commences” and must (a) require prescribed checks on “any individual employed to perform the relevant work or services”, (b) forbid further subcontracting “without the prior written consent”, (c) “permit … audits”, (d) enable suspension or termination, and (e) require co-operation with any Home Office investigation including “details of each employer or service provider involved”. “The application of these provisions is not limited to a single tier of contracting.”
• Substitutes: the employer gets an excuse only if, “before the work or service commences”, it has processes ensuring “a prescribed right to work check is carried out in respect of any substitute”, that “responsibility for such checks is not delegated to individuals carrying out the work or services, including where the contractual arrangement describes that individual as operating in business on their own account”, and that “no individual may carry out work or services as a substitute before their right to work has been verified”.
• Identity, every day: the person must “maintain proportionate systems and processes to ensure that the individual carrying out the work or services is the same individual on whom a right to work check has been conducted”, via “identity cards or workplace access passes”, “facial verification technology”, or “biometric or attendance management systems”.
• Timing and evidence: liability for the new categories arises only “where the employment commenced on or after 1 October 2026”, and a person relying on the excuse “must be able to demonstrate compliance with the prescribed requirements. This will require the person to retain sufficient evidence of the steps taken, and to provide evidence of that compliance on request.”
• Money: the Code’s penalty table reads “Employers £45,000 (per worker) £60,000 (per worker)” for first and repeat breaches.

The industry’s own arithmetic. Ian Anfield, managing director of Hudson Contract, the largest payer of subcontractors in UK construction: “Construction has one of the highest rates of self-employment of any sector. If there are 900,000 freelancers and operatives each working for three different clients in a year, that’s 2.7 million checks, every one of which comes with a cost in time and money and a potential delay in getting people onto site.” And: “around half of businesses think they’re already doing Right to Work checks but the chances are most of those wouldn’t provide a statutory excuse and could leave firms facing significant liabilities.” And: “The government also suggests companies can’t rely on digital checks alone, despite that being widely reported as the direction of travel.” Hudson had “already completed more than 18,000 checks on behalf of our clients” by July (Construction Enquirer, 2 July 2026). Mandeep Khroud, head of immigration at Irwin Mitchell, on 3 September: “The Home Office has made clear that it will focus on the reality of working arrangements rather than the labels used in contracts. Businesses that assume a worker is outside the regime simply because they are described as self-employed could be taking a significant risk” (Business Matters, 3 September 2026).

Enforcement is already pointed at these sectors. Home Office transparency data for 1 January to 30 June 2026: 7,270 illegal working visits and 4,756 arrests, up 31% and 20% on the same period of 2025; more than 1,200 businesses issued civil penalties worth over £74 million; construction visits up 150% to 268; warehousing, distribution and delivery visits up 147% to 635 (gov.uk, illegal working and enforcement activity to end June 2026). Those numbers were produced under the old regime, against employees only.

The population. ONS counts 748,000 self-employed workers in construction at the end of 2025, the most of any industry (Construction News, 12 November 2025; Whito, UK self-employment statistics 2026), and roughly 385,000 VAT or PAYE registered construction firms (ONS construction statistics). Watson Farley & Williams names the sectors that will feel it: “construction, food delivery, courier services, beauty salons, warehousing, logistics, hospitality, cleaning, security, facilities management and production” (WFW, 2026).

Feasibility. The check itself is a commodity: uComply sells right-to-work and digital onboarding at “£0.90 a unit” (uComply); Credas sells “gateway level subscriptions for £60 a month which includes 40 checks” with an API for integration (Small Business UK); TrustID, Yoti, Rightcheck and Xydus are all certified IDSPs. The Code’s identity-verification requirement accepts “attendance management systems” and “facial verification technology”, both buildable with a phone camera and a commodity face-match API. The scope logic is a finite decision tree written out in a public PDF.

Provenance:

• Signal 1 (regulatory, dated): s.48 Border Security, Asylum and Immigration Act 2025 commenced 1 October 2026 by Commencement No. 4 Regulations 2026 (24 June 2026); draft Code of practice on preventing illegal working published 30 June 2026 with the “individual sub-contractor” definition, the prescribed requirements for chains, substitution controls, daily identity verification and the £45,000/£60,000 table — https://assets.publishing.service.gov.uk/media/6a608779f869f6a53d0c89e7/30_June_-_Code_of_practice_on_preventing_illegal_working_-_Right_to_Work_Scheme_for_employers.pdf — observed 2026-09-09
• Signal 2 (demand): Hudson Contract’s 2.7-million-checks-a-year estimate, “half of businesses think they’re already doing Right to Work checks” but “most of those wouldn’t provide a statutory excuse”, 18,000 checks already run for payroll clients; Irwin Mitchell warning that self-employed labels will not protect firms — https://www.constructionenquirer.com/2026/07/02/right-to-work-checks-for-self-employed-start-in-october/ and https://bmmagazine.co.uk/legal/right-to-work-checks-subcontractors-october-2026/ — observed 2026-09-09
• Signal 3 (economic / enforcement): Home Office H1 2026 data — 7,270 visits, 4,756 arrests, 1,200+ businesses penalised, £74M in penalties, construction visits +150%, warehousing/delivery +147% — https://www.gov.uk/government/publications/returns-from-the-uk-and-illegal-working-activity-since-july-2024/illegal-working-and-enforcement-activity-to-the-end-of-june-2026 — observed 2026-09-09
• Signal 4 (feasibility): certified IDSP checks at £0.90 per unit (uComply) and £60/month for 40 with API (Credas); ONS 748,000 self-employed construction workers; Code accepts attendance and facial verification as identity systems — https://ucomply.co.uk/ and https://smallbusiness.co.uk/virtual-right-to-work-check-who-offers-them-2563278/ — observed 2026-09-09 Category: Regulatory arbitrage (a newly-in-scope population — individual sub-contractors, substitutes and the firms above them — dragged into a penalty regime on a fixed date) + Underserved niche (every vendor sells the identity check to the employer; the scope verdict, the chain statement, the substitute register and the daily identity record on a site with no turnstile belong to nobody)

3. The opportunity

The market has priced the wrong thing. IDSPs sell a £0.90 check. Law firms sell a £2,000 supply-chain review. Hudson Contract sells checks to the firms it already pays subbies for. Biosite, MSite and Datascope sell facial-recognition turnstiles to main contractors on big sites. None of them sells what a 20-operative groundworks, roofing, dry-lining, cleaning or courier firm actually needs on 1 October, which is four things that are not a check:

1. A scope verdict per engagement. The Code’s line is not “self-employed or not”. It is whether the individual “contract[s] directly with clients or customers” as an independent business, or works under your contract with a third party. A CIS subbie on your site under your main-contractor package is in. The same man doing a private extension for a homeowner is out. A limited-company subcontractor is out for himself but you may still be liable for the labourer he brings, because “the application of these provisions is not limited to a single tier”. Khroud’s warning is that labels will not save you. The verdict has to be made per person, per engagement, and written down.

2. The written statement for the chain. Five prescribed terms (checks, no onward subcontracting without consent, audit rights, enforcement, Home Office co-operation) “in place before the work or service commences”. Firms that subcontract labour to a labour-only gang need this document with every gang, and the gang needs it with each of its men.

3. A substitute register. The Code is blunt: responsibility for checking the substitute “is not delegated to individuals carrying out the work or services, including where the contractual arrangement describes that individual as operating in business on their own account”. Subbies swap men constantly. The firm must know who turned up, check him before he starts, and record it.

4. A daily identity record. The person on site must be “the same individual on whom a right to work check has been conducted”, evidenced by “identity cards or workplace access passes”, “facial verification technology” or “biometric or attendance management systems”. Big sites have turnstiles. A four-man roofing job has a WhatsApp group.

Anfield’s data point is the whole opportunity in one sentence: half of firms think they are doing checks, and most of those would not give a statutory excuse. The difference between a check and an excuse is items 1 to 4 plus the evidence file the Home Office may demand “on request”. Excuse is that file, built before the work starts.

4. Target market

• Primary customer: The owner or contracts manager of a UK subcontracting firm with 5–80 operatives, most of them self-employed individuals paid under CIS or by invoice, working inside a main contractor’s or a client’s contract: groundworks, brickwork, roofing, dry-lining, M&E, scaffolding, cleaning contractors, security firms, facilities subcontractors, courier and last-mile subcontractors. Annual turnover £500K–£15M. No HR department; the person who books the subbies is the person who will be fined.
• Why they buy: The penalty is £45,000 per worker with “no statutory excuse unless” a list they have never seen; their main contractor’s supply-chain letter is already asking them to confirm compliance and grant audit rights; and Home Office visits to their sector rose 150% before the rule even changed. In Anfield’s words, most firms’ current checks “wouldn’t provide a statutory excuse”.
• Rough TAM reasoning: ~385,000 VAT/PAYE-registered construction firms; 748,000 self-employed construction workers turning over three clients a year each; plus cleaning, security, FM and courier subcontractors named by WFW. If 60,000 firms sit in the 5–80-operative subcontracting band across those sectors, a 5% share at £79 a month is a £2.8M ARR business.
• Why now for them: Engagements that “commenced on or after 1 October 2026” are the liability trigger, so the clock starts on the first new subbie or substitute booked after that date. Main contractors will push the prescribed terms down the chain in Q4 2026 because their own excuse depends on it.

5. Product sketch (MVP)

• Scope verdict: Add each subbie with how they are engaged (direct to a homeowner, under your package, via a gang, via a platform, limited company or sole trader); get an in/out verdict with the Code paragraph that decides it, and a list of what must exist before their next start.
• Pre-start gate: No operative or substitute is marked “cleared to start” until a prescribed check (IDSP or manual document check) is on file; site leads see the list on their phone before the van leaves.
• Substitute register: A subbie who is sending someone else taps “substitute”, the substitute completes the check on his own phone, and the firm’s record shows who was checked and when, before the shift.
• Written statement generator: The five prescribed terms, drafted for the firm’s relationship upward (to the main contractor) and downward (to gangs and individuals), issued and signed before work commences, stored per contract.
• Daily identity record: A morning selfie or QR tap per operative per site, matched to the checked identity; the Code’s “attendance management” requirement satisfied without a turnstile.
• Repeat-check clock: Time-limited permissions get a follow-up date; the firm is warned before the excuse lapses.
• Excuse file on request: One export per worker or per contract showing the verdict, the check, the written statement, the substitute record and the attendance trail, in the order a Home Office officer asks for it.

6. AI angle — what’s load-bearing

The scope verdict is a judgment over messy facts: a WhatsApp booking, a CIS statement, a gang leader’s invoice, a main-contractor order. A language model reads those and maps them onto the Code’s definitions (“contract with a third party”, “operating in business on their own account”, “obtain work through an intermediary”) with the paragraph cited, so the firm’s answer is defensible rather than a guess. The written statement has to be redrafted for each relationship in the chain, in plain English a groundworker will sign. The identity record uses commodity face matching between the IDSP-checked photo and the morning selfie. Remove the model and you are left with a checklist PDF the firm already ignores, and a lawyer at £300 an hour for each verdict.

7. Localization angle (if any)

UK-only by construction: the duty, the definitions, the penalty table and the IDSP scheme are Home Office instruments. Within the UK the wedge is the sector, not the region: construction first (CIS, gangs, substitutes are the norm), then cleaning, security and courier subcontractors, which carry the same chain structure. Welsh-language site prompts are a nice-to-have. No version of this product exists outside the UK, and none is needed.

8. Business model — path to $1M–$5M ARR

• Pricing: £79/month per firm up to 25 active operatives, £149 up to 80, £299 above; IDSP checks passed through at cost plus £1. Written statements and the excuse export included. Annual prepay at 10 months.
• ACV: ~£1,100 (about $1,400) per firm.
• Rough math to $1M ARR: 720 firms × £1,100 ≈ £790K ≈ $1.0M. That is 1.2% of a 60,000-firm target band.
• Rough math to $5M ARR: 3,600 firms at a blended £1,100, or 2,500 firms plus a main-contractor tier (£500–£1,500/month) that buys the downstream view of every subcontractor’s excuse file on its sites.
• Expansion path: operatives grow with the firm; main-contractor tier; accountant and CIS-payroll-bureau white-label at £29/firm; adjacent sectors (cleaning, security, couriers) on the same product with different verdict trees.

9. Go-to-market wedge — first 100 customers

• CIS payroll bureaus and construction accountants. They already hold every client’s subbie list and file the monthly CIS return. Offer 30 bureaus a white-label pre-start gate for their client books, with a revenue share; each bureau brings 20–200 subcontracting firms. The bureau’s pitch to its clients writes itself: “your CIS list is now a liability list.” Target: 40 firms from 5 bureaus in the first 60 days.
• The main contractor’s supply-chain letter. Build UK members and every tier-one contractor will send subcontractors a “confirm your right-to-work compliance and grant audit rights” letter before or just after 1 October. Publish the reply — a written statement in the Code’s five terms plus an excuse-file summary — as a free generator; capture the subcontractor’s details. Target: 1,000 generated, 4% converting. 40 firms.
• Trade bodies with a webinar slot. FMB local branches, NFRC, FIS, ECA/SELECT, the Scaffolding Association, BCC for cleaning. One 30-minute session: scope verdict live on three real engagements. Target: 20 firms.
• Hudson Contract’s non-clients. Hudson runs checks for firms whose subbies it pays. Firms that pay their own subbies are the gap. Advertise the scope verdict in Construction Enquirer and on LinkedIn to CIS contractors, with the 2.7-million-checks figure as the headline.
• Free scope verdict as the funnel: paste a subbie list and how each is engaged; get in/out per person and a countdown to their next start. The verdict sells the gate.

10. Build complexity — justification

Medium. Off-the-shelf: IDSP API (Credas or TrustID), face-match API, document storage, e-signature. Custom: the scope decision tree encoded from the Code with citations, the pre-start gate and substitute flow on a phone, the daily attendance-selfie record, the excuse export. The written statement needs a solicitor’s review once. A two-person team ships the construction version in 10–12 weeks; cleaning and security verdict trees are a fortnight each after that. The build risk is the Code itself, which is still a draft until commencement and may shift wording in the final version.

11. Gating checklist

Gate	Pass?	Note
Legal in target market	✅	Implements a statutory scheme using certified IDSPs; no immigration advice given, verdicts cite the public Code.
Ethical — no harm / dark patterns	✅	The Code’s companion draft on avoiding unlawful discrimination applies; the product checks everyone the same way and never screens by name or appearance.
Market exists (evidence above)	✅	Statutory duty on a fixed date; £74M in penalties in H1 2026 under the narrower regime; named industry voices.
1–5 person team can build this	✅	Two people, 10–12 weeks.
Launchable with <$50K / ₹40L	✅	IDSP volume commitment, one solicitor review, hosting: under £15K.

12. Feasibility score

Axis	Weight	Score	Notes
Problem intensity	20	16/20	£45,000 per worker, first offence, from a fixed date, with the sector already under a 150% enforcement rise. Not yet felt daily by most small firms, which is the gap between 16 and 20.
Demand evidence	15	11/15	Hudson’s 18,000 pre-emptive checks and its own survey line; a flood of law-firm and vendor content; main contractors preparing supply-chain letters. No grassroots complaints from small firms found yet, because the duty has not bitten.
Build feasibility	15	11/15	IDSP APIs and face-match are commodity; the verdict tree and the substitute flow are real work; the Code is still a draft.
Distribution clarity	15	10/15	Bureaus, supply-chain letters and trade bodies are named and reachable; conversion of small builders is slow and phone-heavy.
Revenue mechanics	15	10/15	£79–£299/month benchmarked against £60/month IDSP subscriptions and £2,000 legal reviews; 720 firms to $1M is modest. The per-firm price must survive firms that only need the check twice a year.
Time to first revenue	10	6/10	The duty lands 1 October; firms buy in the fortnight around it, but the build is 10–12 weeks, so first paid month is likely November–December 2026.
Defensibility	10	4/10	Credas, TrustID or Hudson could add scope verdicts and a substitute register; the moat is the accumulated excuse files and the bureau channel.
Total	100	68/100

13. Qualitative modifiers

Founder-fit tags

technical-heavy · domain-expertise-required

Key assumptions to validate (3–5)

1. Assumption: Small subcontracting firms will pay monthly for a gate, not just per-check. How to test: 40 discovery calls via two CIS bureaus; ask what they are doing today and what the main contractor has asked for; count who says yes to £79 before 1 October.
2. Assumption: The scope verdict is the thing they cannot do themselves. How to test: Run 20 firms’ subbie lists through a manual verdict; measure how many engagements they had classified wrongly against the Code.
3. Assumption: The final Code keeps the substitution and identity requirements as drafted. How to test: Track the final Code at commencement; if identity verification is dropped for small sites, the daily record feature goes and the price drops to £49.
4. Assumption: Main contractors will push the five prescribed terms downstream within a quarter. How to test: Collect 10 supply-chain letters from subcontractor customers in October; check whether they demand a written statement and audit rights.
5. Assumption: IDSPs will not ship the verdict + register layer within six months. How to test: Monitor Credas, TrustID, Rightcheck and Hudson release notes monthly.

Risk flags

1. Regulatory drift: The Code is a draft; commencement could slip or the final text could soften the chain and substitution requirements. The scope verdict survives; the daily identity record may not.
2. Incumbent adjacency: Hudson Contract already runs checks for its payroll clients and could bundle a register; IDSPs have the customer relationship for the check.
3. Sales friction: Small builders buy on the phone, late, and under pressure from a main contractor; a self-serve funnel alone will not convert them.
4. Discrimination exposure: Any product that decides who to check must apply the same process to every worker; the companion Code on avoiding unlawful discrimination is a compliance duty for the product itself.

14. Structured verdict

Score:                  68/100
Verdict:                VALIDATE
Confidence:             Medium
Best-fit builder:       Technical founder paired with a UK employment/immigration solicitor or a CIS payroll-bureau owner
Time to revenue:        8–12 weeks (build lands after the 1 October commencement; first paid month Nov–Dec 2026)
Capital to launch:      <£15K ($20K)
Top 3 assumptions to validate first:
  1. Firms pay monthly for the gate — 40 bureau-sourced discovery calls before 1 October, count yeses at £79
  2. Scope verdicts are wrong today — manually classify 20 firms' subbie lists against the Code and measure the error rate
  3. Final Code keeps substitution controls and identity verification — check the commencement text on 1 October
Kill criteria:
  - Abandon if commencement is delayed past Q1 2027 or the final Code drops the prescribed-requirements structure
  - Abandon if fewer than 8 of 40 discovery-call firms commit to £79/month before 1 October
  - Abandon if Credas, TrustID or Hudson ship a scope verdict plus substitute register before your v1

15. Next step — 1-week validation sprint

• Day 1–2: Sign two CIS payroll bureaus as discovery partners; get introductions to 40 subcontracting firms with 5–80 operatives. Build the scope-verdict decision tree on paper from the draft Code with paragraph citations.
• Day 3–4: Run 20 firms’ actual subbie lists through the verdict by hand on calls; record what each firm is doing today, what its main contractor has asked for, and whether it would pay £79 a month for a gate that includes substitutes and the daily record.
• Day 5: Decide go / no-go on three numbers: share of engagements misclassified against the Code (need ≥30%), firms committing to pay before 1 October (need ≥8 of 40), and bureaus willing to white-label (need ≥2). Two of three misses is a PASS.