Analysis of the new draft right to work Code of Practice

Right to work checks are about to change for everyone: Home Office publishes draft Code of Practice on the expanded illegal working regime

What is changing under the new draft Code of Practice?

The Home Office has published the draft Code of Practice on preventing illegal working, which is due to come into force on 1st October 2026. This is the seventh version of the statutory code and the first to set out, in operational detail, how the expansion of the right to work regime under section 48 of the Border Security, Asylum and Immigration Act (BSAI) 2025 will work in practice.

The headline points for businesses:

• The definition of "employer" is expanded well beyond traditional employment. From 1 October 2026, right to work obligations will apply to those engaging individuals under workers' contracts, engaging individual sub-contractors, and online matching services (gig economy platforms) connecting service providers with clients.
• A new extended liability regime means a business can be liable for a civil penalty in respect of an illegal worker it has no direct contractual relationship with, where that worker sits further down a chain of contracts, is engaged via a platform, or is working as a substitute.
• To defend against extended liability, businesses must comply with newly prescribed requirements covering contractual terms, substitution controls and identity verification systems. These go far beyond anything the regime has required before, including identity re-verification at intervals of no less than once in any 24-hour period of activity for substitute workers.
• Civil penalties remain at £45,000 per worker for a first breach and £60,000 per worker for repeat breaches, and these amounts will now apply across the full range of expanded working arrangements.

If your business engages contractors, casual workers, agency labour, platform workers or outsourced services, this code will affect you, whether or not you consider yourself their "employer".

How will the new Code of Practice affects employers

Who is now an "employer"?

Under the current guidance, on where a worker is directly employed is the employer required to establish a statutory excuse. Where the business holds a Sponsor Licence the guidance is a bit more vague, it states that you should carry our a right to work check even where the worker is not your direct employee, however it fails to adequately explain exactly who is captured by this requirement.

Section 48 of the BSAI 2025 amends the 2006 Act so that, for the purposes of the Right to Work Scheme, an "employer" includes a person who engages an individual:

1. under a contract of employment (as now);
2. under a worker's contract, meaning a contract under which an individual undertakes to perform work or services personally, and the other party is not a client or customer of a business carried on by that individual;
3. as an individual sub-contractor, where the individual contracts to provide work or services that the engaging party has itself contracted to provide to a third party; or
4. through an online matching service, being a business that keeps a register of service providers, matches them with clients or customers through an online service, and charges a fee or commission for doing so. Simply put, Gig Economy platforms such as Deliveroo, Uber, etc.

The code confirms that "worker" for these purposes is deliberately broader than the familiar definition in the Employment Rights Act 1996. HR teams should not assume that their existing employment status analysis maps neatly onto the new regime.

Individuals who are genuinely self-employed, operating a business on their own account and contracting directly with clients or customers, remain outside the Scheme. Traditional business-to-business contracts for the supply of services are also excluded. However, the code is explicit that this carve-out does not extend to individuals who obtain work through an intermediary, platform or similar arrangement where they are not operating an independent business in their own right. In other words, labelling someone a self-employed contractor will not take them out of scope if the reality is platform or intermediary-dependent work.

When will the new rules take effect?

The code comes into force on 1st October 2026. For the new categories (workers' contracts, individual sub-contractors and online matching services), civil penalty liability can only arise where the engagement commenced on or after that date. There is no requirement to conduct retrospective checks on existing arrangements, but any new engagement, and any follow-up check falling due, from 1st October 2026 will be assessed against the new code.

One important structural point: the code in force at the time a check is carried out (or the prescribed requirements fall to be complied with) governs whether a statutory excuse exists, while the code in force at the date of the breach governs the penalty amount.

Extended liability: responsibility moves up the chain

The most significant development is a new section 15A of the 2006 Act, which extends civil penalty liability beyond the business holding the direct contractual relationship with the worker. It applies in three scenarios:

1. Contractual chains: a business contracts to provide work or services to a third party, and then contracts with another employer who supplies the workers to fulfil that contract;
2. Online matching services: a platform matches a service provider with a client or customer, and the service provider contracts with that client or customer; and
3. Substitution clauses: an employer engages an individual under a contract permitting that individual to send a substitute to perform the work.

In each case, the business at the top of the arrangement may be treated as employing any individual who personally performs the work, even though it never engaged them directly.

The code does offer some comfort on how this will be applied. The Home Office states that its first objective on identifying illegal working will be to pursue the employer in the direct contractual relationship with the worker. Extended liability operates as a backstop, engaged where that direct employer cannot be identified or where the upstream business has not met the prescribed requirements. End-users, clients and customers who simply commission or purchase services, without contracting to provide them onwards to a third party, are not caught.

That comfort only goes so far. In labour supply chains involving informal arrangements, shell entities or unidentifiable intermediaries, precisely the environments where illegal working is most prevalent, the direct employer will often be the party that cannot be found. The businesses left standing will be the ones with assets and a reputation to protect.

The prescribed requirements: your only defence

compliance with prescribed requirements, evidenced and produced on request. These fall into three categories.

Contractual terms (written statement): Before work or services commence, the upstream business or platform must have a written statement in place requiring the downstream employer or service provider to:

a.    Conduct prescribed right to work checks on anyone employed to perform the work;

b.    not sub-contract further without prior written consent, and replicate equivalent right to work obligations in any permitted sub-contracting;

c.    permit audits of right to work compliance;

d.    accept enforcement action (which may include suspension or termination) where illegal working is identified without a statutory excuse; and

e.    co-operate with any Home Office investigation, including disclosing the make-up of the contractual chain and the identity details of each business within it.

​​​​​​Critically, the code confirms these provisions are not limited to the first tier of a contractual chain. Whether liability attaches will be assessed case by case, including by reference to how the arrangements operate in practice. Paper compliance will not be enough if the reality on the ground diverges from the contract.

Substitution controls: Where a contract permits substitution, the engaging business must have processes in place, before work commences, ensuring that a prescribed check is carried out on any substitute before they start; that responsibility for checks is not delegated to the workers themselves (even where the contract describes them as self-employed); that contractual sanctions exist where a substitute is known or believed to be working illegally; and that the business verifies, throughout the engagement, that the individuals actually performing the work are the individuals who were checked.

The code acknowledges that a statutory excuse may still be available where substitution occurs entirely outside the employer's knowledge or control, or where fraud circumvents suitable controls, but the burden of demonstrating reasonable and proportionate processes sits squarely with the business.

Identity verification: Businesses relying on the extended liability defence must maintain proportionate systems ensuring the person doing the work is the person who was checked. The code gives examples including workplace passes, facial verification technology, biometric or attendance systems, and verification against training records or licences. Most strikingly, it contemplates re-verification of identity at set intervals, for example at the start of each shift or assignment, and in any event “no less than once in any 24-hour period of activity”. For platforms and labour suppliers, this points towards continuous, technology-enabled identity assurance rather than a one-off onboarding check.

Businesses may rely on identity verification systems operated by another party in the chain or a third-party provider, but only where they have taken reasonable steps to satisfy themselves those systems are effective.

Changes to the checks themselves

Beyond the expansion, the code makes several changes to checking mechanics:

• Digital verification is formalised. The former "IDSP" terminology is replaced by the "Right to Work Digital Verification Service Provider" (RtW DVSP), underpinned by the Data (Use and Access) Act 2025. Where a business chooses to use a digital provider, it is now mandatory that the provider is registered on the OFDIA register with confirmation it can provide right to work checks. Using an unregistered provider destroys the statutory excuse.
• Digital National Insurance documents. The acceptable document lists are updated so that official evidence of a name and National Insurance number may be a digital version issued by or on behalf of a government agency, provided reasonable steps are taken to check it appears genuine and originates from a reliable source.
• Facial recognition technology. Where an employer wishes to verify identity digitally rather than in person or by video call, this must be done through a RtW DVSP, with the comparison output retained alongside the check records, and the worker given a reasonable opportunity to verify their identity if the technology fails to match them.

Penalties and wider consequences

The penalty framework is unchanged in structure but now applies across the expanded regime: £45,000 per worker for a first breach and £60,000 per worker for repeat breaches within three years, with reductions of £5,000 per worker for pre-emptive reporting and for active co-operation, and a Warning Notice available on a first breach where effective right to work practices are also evidenced. The 30 per cent Faster Payment Option remains available for first penalties paid within 21 days.

For sponsor licence holders, the stakes are higher still. A civil penalty for illegal working will ordinarily lead to revocation of a sponsor licence, with the consequential curtailment of sponsored workers' visas. The code also lists the familiar wider consequences: criminal liability in the most serious cases, director disqualification, business closure orders, licence reviews in the alcohol, late-night refreshment, taxi and private hire sectors, and publication on the Home Office's list of non-compliant employers. Under the expanded regime, these risks now attach to engagement models that many businesses have historically treated as outside immigration compliance altogether.

Key takeaways for employers

This draft code confirms that from 1st October 2026, right to work compliance stops being a pure HR onboarding exercise and becomes a whole-of-business issue spanning HR, procurement, legal and operations. Businesses should act now to:

1.    Map your workforce beyond employees. Identify everyone performing work or services for your business: casual and atypical workers, individual contractors, agency and outsourced labour, and anyone engaged via platforms. Classify each against the new definitions.

2.    Audit contracts for substitution clauses. Substitution clauses have often been included to support self-employment status. Each one now carries a compliance obligation. Decide whether to retain them with proper controls or remove them.

3.    Review your supply chain contracts. If you contract to provide services to clients and use other businesses' labour to deliver them, your contracts need the prescribed written statement terms: mandated checks, sub-contracting consent, audit rights, enforcement provisions and Home Office co-operation obligations.

4.    Plan identity verification. Consider what proportionate systems your business needs to ensure the person doing the work is the person who was checked, particularly for substitutes and multi-site or shift-based workforces.

5.    Check your digital provider. If you use a digital verification provider for checks, confirm it will hold RtW DVSP registration on the OFDIA register before October.

6.    Protect your sponsor licence. Sponsors should treat the expanded regime as a licence-critical risk and build it into their compliance frameworks now.

7.   Train beyond HR. Procurement and commercial teams negotiating labour supply and services contracts need to understand these requirements as well as HR does.

The code remains in draft and some detail may change before October, with supporting Home Office guidance still to follow. But the direction of travel is settled, and three months is not long to re-paper supply chain contracts and stand up new verification processes.

Next steps

If you would like to discuss how the expanded regime affects your business, or need support reviewing your contracts and right to work processes ahead of 1st October 2026, please contact Chris Harber, Partner and Head of Immigration, at [email protected].