UK Spa Right-to-Work Checks: October 2026 Hiring Guide
From 1 October 2026, the UK Right to Work Scheme reaches beyond conventional employees to several arrangements common in flexible service businesses. Spa groups, beauty salons, staffing agencies and online wellness marketplaces need to identify who is responsible, complete the prescribed check before work starts, retain the evidence and apply the same fair process to every candidate.
The change matters because a therapist may work through a worker’s contract, accept shifts as an individual subcontractor or reach clients through a matching platform. Calling the person “freelance” does not settle whether an arrangement falls within the scheme. The Home Office says the contract and the way work is actually organised both matter.
This guide turns the official material into an operating checklist for UK wellness hiring. It is general editorial information, not legal advice. Complex agency chains, substitution clauses and uncertain employment status should be reviewed against the final Home Office guidance and, where necessary, with a qualified UK adviser.
What changes on 1 October 2026?
The Home Office’s 11 September 2026 employer guide says the expanded scheme applies to organisations engaging people under contracts of employment, worker’s contracts and individual subcontracting arrangements, as well as certain online matching services. For these newer categories, civil-penalty liability applies where the engagement starts on or after 1 October 2026.
The underlying expansion appears in the Border Security, Asylum and Immigration Act 2025. The 2026 regulations bring the revised prevention and anti-discrimination codes into force on 1 October. This is therefore more than an optional HR trend, even though the detailed employer guide was still labelled draft when reviewed on 28 September.
Within this scheme, “employer” is a specific Right to Work concept. It can include a person engaging a worker or subcontractor and a qualifying platform that introduces service providers to clients. It does not automatically decide employment status for tax or wider employment-rights purposes. Keep those analyses separate.
A compliant check can establish a “statutory excuse”—a defence against a civil penalty if the person is later found to be working illegally. The official guide says a civil penalty can reach £60,000 per illegal worker. That headline should prompt preparation, but not rushed or discriminatory screening.
Map the real working arrangement first
Begin with a role map, not a document request. List every person who may personally deliver treatments, consultations, fitness sessions, reception cover or other paid services through the business. Record the contracting parties, who allocates the work, who pays, who controls substitutions and who meets the client.
Employees and people on worker’s contracts
A receptionist employed on payroll is a familiar case. A therapist accepting personally performed shifts under a contract for services may also fall within the expanded definition. Review the agreement and the day-to-day arrangement; the label at the top of a template is not enough.
Individual subcontractors and mobile practitioners
An individual subcontractor can be within scope where a business has contracted to provide services to a third party and then engages the individual to perform them. By contrast, the guide gives examples of genuinely independent businesses contracting directly with their own clients as outside the scheme. If the facts sit between those examples, obtain advice rather than assuming.
Online matching services and agency chains
The official definition of an online matching service involves a business keeping a register of providers, offering an online way for customers to request a match, and charging a fee or commission for the match. Booking directories, therapist platforms and concierge services should compare their actual model with that definition. A chain can also create extended liability even when the organisation does not contract directly with the individual doing the work.
Employers planning international recruitment should connect this mapping exercise with HiSoLife’s candidate-safety and skills-recognition checklist. Right to work, professional competence, insurance and safe recruitment are separate questions; passing one does not answer the others.
Know the three prescribed checking routes
The employer guide sets out three routes: a manual document-based check, the Home Office online service, or a check using a registered Right to Work digital verification service provider (RtW DVSP). The correct route depends on the person’s nationality, evidence and immigration status. With limited exceptions tied to eVisas, an employer should not force every person through one preferred channel.
Manual document-based check
For a manual check, obtain an acceptable original document, examine it in the holder’s presence, confirm that it appears genuine and belongs to the person, check relevant dates and restrictions, then make a clear copy in the prescribed way. Record the date of the check. A casual photocopy collected by email is not the full process.
Home Office online check
Where a share code is used, the employer must access the official Home Office right-to-work service with the individual’s date of birth. Confirm that the photograph matches the person presenting for work and that the result permits the proposed duties and hours. Save the profile page showing the photo and check date; a candidate’s screenshot or eVisa view is not a substitute for the employer-side result.
Registered digital verification provider
A registered RtW DVSP can support digital checks for eligible British and Irish passport holders and can provide identity-verification services described in the guidance. The employer still has responsibilities: use an appropriate provider, obtain the required output and confirm that the person who presents for work is the person checked.
Build one fair spa hiring workflow
The safest process is consistent, staged and owned. Put the right-to-work step at the same point for everyone considered for the role, after skills-based selection and before the engagement begins. This reduces last-minute decisions and makes differential treatment easier to detect.
- Define the work. Record duties, location, hours, contract route, client relationship and any permitted substitute.
- Assign accountability. Name the person responsible for the check, evidence review, follow-up diary and escalation.
- Give neutral instructions. Explain that every successful candidate must show a right to work and describe the permitted routes without making assumptions about nationality.
- Complete the prescribed check. Do it before work starts, using the route applicable to the person.
- Match permission to the role. Confirm that any limits on duties or hours fit the actual rota, not merely the job title.
- Retain and protect evidence. Store the required dated output securely and restrict access.
- Schedule follow-up. Where permission is time-limited, set a controlled reminder and allow reasonable time to resolve evidence problems.
Once the role and process are ready, employers can publish a clearly specified wellness vacancy or review available spa and wellness candidates. The advert should describe skills and work accurately; it should not invite only particular nationalities or imply that a passport type is a selection criterion.
Control agency, supplier and platform risk
Extended liability is the part most likely to surprise a spa operator. A hotel may buy spa services through an operator; a spa may source temporary practitioners through an agency; a platform may match a client with a business that sends a different individual. Draw the complete chain from the client request to the person who physically performs the service.
The 11 September guide describes prescribed requirements for some chains. Before work begins, the relevant contract should address who conducts checks, limits on further subcontracting, audit rights, enforcement when illegal working is found, and cooperation with a Home Office investigation. The guide also expects the organisation to take reasonable steps to test whether assurances from another party are reliable.
Ask for evidence of the process rather than a vague warranty. Sample the dated outputs, inspect how expiring permissions are tracked and test whether the named worker matches the person arriving on site. Record the audit and what happened when a gap was found. A contract clause without operational verification may leave the real risk untouched.
Do not confuse delegation with transfer of accountability. The guidance permits an employer to delegate checks to accountable people acting under its control, but special restrictions apply in substitution arrangements. If the chain is unclear, pause the assignment and resolve responsibility before the practitioner starts.
Make substitution controls work in practice
Substitution clauses deserve a separate review because the checked person may not be the person who arrives to deliver the massage, facial or fitness session. The Home Office guide says a prescribed check must cover any substitute before work starts and that responsibility cannot simply be delegated to the person supplying the substitute.
Create a pre-approval route. Require the substitute’s details early enough for the proper check, block unverified substitutes from the rota, and make the booking or access system show who was approved. Tell reception and duty managers what to do when a different person appears.
Identity assurance should be proportionate. The aim is to confirm that the person working is the person whose right was checked, not to create intrusive surveillance. Use the approved profile or secure identity output, limit access to people with a genuine need and create a route for resolving mismatches sensitively.
Retain evidence without creating a data problem
The employer guide requires a clear record of the check for the duration of the engagement and for two years afterwards, followed by secure destruction. Online outputs should include the photograph and date of check. Manual copies also need the prescribed annotation and must be readable.
Build retention into the hiring file rather than leaving images in personal email, chat threads or a manager’s phone. Use role-based access, a consistent filename, an expiry field where relevant and a deletion date. Keep only the evidence the official process calls for and route unusual cases to a trained owner.
Follow-up checks are required when permission is time-limited and the business intends to continue the engagement. The official guide says they must be completed on or before the permission end date. A temporary technical problem or pending in-time application does not automatically prove that the person has lost the right to work; the Employer Checking Service may be required.
Prevent discrimination at every stage
The Home Office’s October 2026 anti-discrimination code says employers should be consistent with all workers, including British citizens. Do not check only people who seem foreign, or make assumptions from a name, accent, appearance, nationality or length of UK residence.
If one candidate at a selection stage is checked, check all candidates at that stage. Do not treat someone less favourably merely because their acceptable evidence shows time-limited permission. Ask immigration-status questions only where necessary to establish limits on hours or the type of work, and keep the questions separate from subjective judgements about “fit.”
Train anyone involved in recruitment, rota control or onboarding. Give them a short decision tree and an escalation contact. Audit outcomes by route and stage so the business can identify whether one group is repeatedly delayed, excluded or asked for extra evidence without a legitimate reason.
This fair process belongs within wider workplace standards. HiSoLife’s decent-work checklist for spa hospitality can help managers connect compliant onboarding with clear terms, realistic workloads, safety, worker voice and development after hiring.
A 30-day implementation plan
Days 1–7: inventory and triage
List every engagement route, supplier and platform. Flag new starts on or after 1 October, time-limited permissions, substitution clauses and any chain where the responsible party is uncertain. Confirm that existing employee processes still follow the correct route.
Days 8–14: design the control
Write one workflow covering role classification, candidate communication, permitted check routes, identity matching, evidence storage, follow-up dates and escalation. Update supplier and platform terms where extended-liability requirements apply. Have difficult interpretations reviewed.
Days 15–21: train and test
Use realistic spa scenarios: a new employed receptionist, a self-scheduling therapist, an agency practitioner, a permitted substitute and a candidate whose online evidence is temporarily unavailable. The test should show who acts, what evidence is saved and when the case escalates.
Days 22–30: audit and improve
Sample completed files and compare them with the rota and access record. Confirm checks happened before work, permissions fit the duties, follow-ups are scheduled and evidence is secure. Ask whether candidates received the same instructions and reasonable opportunity to prove their status.
Right-to-work checklist for spa employers
- Scope: every contract, subcontract, agency and matching-platform route is mapped.
- Ownership: one accountable person oversees checks, records and follow-ups.
- Timing: the prescribed check is completed before the person starts work.
- Method: the manual, Home Office online or registered DVSP route fits the evidence.
- Role fit: any restriction on duties or hours is compared with the real rota.
- Identity: the person doing the work is the person whose right was checked.
- Substitution: no substitute starts before verification and approval.
- Supply chain: required terms, audit rights and investigation cooperation are documented.
- Fairness: candidates at the same stage receive a consistent process.
- Records: evidence is secure, retrievable, dated and set for timely destruction.
- Follow-up: time-limited permissions have an owner and controlled reminder.
- Escalation: uncertain scope, evidence failures and possible discrimination reach qualified help.
Treat the checklist as an evidence index, not a certificate. Record where each answer is proved: contract, procedure, check output, training log, system control or audit. If the answer exists only in a manager’s memory, the control is fragile.
What wellness candidates should expect
Candidates should expect a legitimate employer to explain why the check is needed, use an accepted route and apply the process consistently. Prepare the evidence relevant to your circumstances, but do not send identity documents to an unverified contact or pay someone who claims to guarantee immigration permission.
Check that the role, hours and location match the permission and written offer. Keep copies of the vacancy, offer and material correspondence. HiSoLife’s resume submission route can support a job search, but every candidate should independently verify the employer, immigration route and final contract.
If the evidence is time-limited or an application is pending, provide accurate information and raise technical problems promptly. A fair employer should give reasonable opportunity to resolve them and use the official service where appropriate, not treat the issue as proof of wrongdoing.
Frequently asked questions
Do UK spas need to check every self-employed therapist?
Not automatically. From 1 October 2026, some worker, individual-subcontractor and online-matching arrangements fall within the expanded scheme, while genuinely independent businesses may fall outside it. Review the contract and actual operating model against the final guidance and seek advice where the position is uncertain.
Can a spa require every candidate to use a digital provider?
Generally, the official guidance says employers cannot mandate one method for everyone. The correct route depends on nationality and immigration evidence, with specific rules for people who hold eVisas. Offer the permitted routes that apply and avoid disadvantaging someone because of the evidence type they can lawfully use.
How long should right-to-work evidence be kept?
The 11 September employer guide says to retain a clear, secure copy for the duration of employment or engagement and for two years afterwards, then securely destroy it. Follow the detailed requirements for the chosen check route and your wider data-protection duties.
Does a successful check prove that a therapist is qualified?
No. A right-to-work check addresses permission to work and the statutory-excuse process. Employers must separately verify professional competence, references, any local licensing or registration, insurance and the person’s readiness for the specific services assigned.
Next step: map every person who can deliver a paid wellness service through your business, assign the check owner and test one end-to-end case before 1 October. Where the model crosses agencies, platforms or substitution clauses, use wellness recruitment support alongside qualified UK legal or HR advice rather than relying on labels alone.
