The Home Office recently published a revised draft Code of Practice on Preventing Illegal Working, alongside an updated draft Employer’s guide to right to work checks. The changes set out in these documents are expected to come into force on 1 October 2026 and represent the most significant expansion of the illegal working regime since right to work checks were introduced. These changes stem from the Border Security, Asylum and Immigration Act 2025, which broadens the scope of the illegal working civil penalty regime.
While traditional right to work checks remain essential, the new regime will extend responsibility for the prevention of illegal working and the risk of civil penalties far beyond the current employer and employee relationship. At the moment, employers can only be issued with a civil penalty if an employee is found to be working unlawfully. The employer will have a statutory excuse (or defence) against a civil penalty if they undertook a fully compliant right to work check.
From 1 October 2026 these rules are going to be expanded to other classes of direct contractual relationship, including workers and individual sub-contractors. Businesses may be issued with a civil penalty if they are found to be engaging anyone directly without immigration permission. In order to establish a statutory excuse, businesses will need to ensure they also undertake right to work checks in respect of all individuals with whom they directly contract. There are also certain changes to the way in which right to work checks must be undertaken and the information that must be retained so employers shiould review their procedures.
Importantly, for the first time, new rules in relation to extended liability will apply which mean that businesses may also be liable for a civil penalty if a worker who is engaged further down a supply chain is found to be working illegal. The changes will therefore place significantly increased compliance obligations on businesses that engage workers through labour supply chains, subcontractors, agencies and certain online platforms.
The key changes
Right to work checks required for all staff, not just employees
As above, prior to 1 October 2026 the civil penalty regime only applies in respect of employees – not other personnel engaged by the business. From 1 October 2026, for the purposes of this area of law, “employer” and “employee” are widely defined. The guidance is somewhat ambiguous but our view is that the Home Office could potentially issue a civil penalty to a business if anyone directly engaged by it is found to be working unlawfully. This means that businesses should undertake right to work checks in respect of all staff whom they directly engage, including workers and freelancers.
The guidance says that these new rules do not apply to individuals operating their own independent business in their own name or through their own personal service company, so where there is a genuine business to business contract for the supply of services, right to work checks may not be required. However, there is always the risk that a self-employed contractor may in reality be classed as a worker under employment law. Therefore, businesses should be cautious in relying on this exception.
Increased focus on identity verification
There are also some changes in relation to how right to work checks must be conducted. Identity verification plays a much larger role under the new framework as part of establishing a statutory excuse.
Digital verification providers receive greater prominence
The draft guidance also includes detailed provisions relating to Right to Work Digital Verification Service Providers (DVSPs).
Although using technology and engaging third party providers to undertake certain right to work checks is not new, businesses will need to ensure that any provider they engage can properly support compliance with the scheme and that appropriate records are retained.
Extended liability beyond the direct employer
Probably the most significant change is the introduction of extended liability for civil penalty liability.
Until now, civil penalties could only be issued if an employee was found to be working unlawfully and responsibility for carrying out right to work checks generally rested with the employer that had the direct employment relationship with the employee. Under the new regime, liability may extend to other businesses higher up the contractual supply chain in certain circumstances.
Examples identified in the draft guidance include:
- Labour supply chains involving subcontractors.
- Arrangements where an individual can provide a substitute worker.
- Certain online matching or platform-based service arrangements.
In certain circumstances, including where the Home Office cannot identify the direct employer a business further up the supply chain may become liable for a civil penalty. However, importantly it seems that the end-user client in each case will not be liable.
What this means for businesses?
HR teams can no longer view right to work compliance solely through the lens of their direct employees. Procurement, legal, operations and contract management functions will also need to understand the new rules and be involved. In order to be able to challenge a civil penalty, the business further up the supply chain would need to demonstrate that certain prescribed contractual terms had been included in the subcontractor contracts.
Different rules apply to different types of contractual relationship. For example, service providers who are subcontracting for delivery of that work or services, must have in place a written statement before the work or service commences. That statement must set out certain terms and conditions to be included in the relevant contract including a requirement for the subcontractor to carry out right to work checks, to not further subcontract the work without certain conditions being met, to permit audits and enforcement action and to co-operate with any Home Office investigation.
Greater scrutiny of labour supply chains
Including these prescribed contractual provisions in the various contracts in the supply chain is just the first step. Businesses will also need to be able to demonstrate that appropriate checks and verification processes in relation to preventing illegal working in the supply chain have actually been carried out. Businesses relying on third parties to supply workers will need to understand how identities are being verified and ensure they can evidence those processes if challenged by the Home Office.
Clearer expectations around evidence retention
The Home Office expects businesses seeking to rely on a statutory excuse to retain sufficient evidence demonstrating compliance and to be able to produce that evidence if requested.
This may require a business to produce details of contractual arrangements, audit records, assurance information received, compliance reviews and information showing how concerns were identified and acted upon.
What is not changing?
Many of the core principles of right to work compliance remain familiar:
- Employers must carry out right to work checks before the individual’s employment or engagement starts.
- Manual checks, online checks and approved verification methods remain available.
- Follow-up checks will still be required where the individual has time limited immigration permission.
- Employers must continue to avoid unlawful discrimination when carrying out checks and should undertake the checks in respect of everyone whom they directly engage.
The revised Code and guidance therefore builds on the existing framework rather than replacing it.
What should businesses do now?
Although the guiodance is still in draft form, businesses should begin preparing for implementation.
1. Map your workforce and labour supply arrangements
Identify all categories of labour used by the organisation, including:
- Employees.
- Workers, including casual or zero hour workers.
- Agency workers.
- Contractors.
- Freelancers
- Sub-contracted labour.
- Platform-based workers.
- Consultants operating through substitution arrangements.
In many cases there will be parts of your workforce who were previously considered outside of the scope of right to work checks and the civil penalty regime who will now present a compliance risk.
2. Review contractual arrangements
Businesses should review agreements with:
- Employment agencies.
- Outsourcing providers.
- Labour suppliers.
- Service providers.
- Contractors.
In addition to, where required, including the prescribed contractual terms, contracts should clearly allocate responsibilities and support the collection of evidence demonstrating compliance. Businesses should consider requiring indemnities to cover any liabilities the business may incur if it transpires that someone was engaged unlawfully further down in the supply chain.
3. Strengthen right to work processes
Businesses should review:
- Onboarding procedures.
- Repeat check processes.
- Record retention.
- Audit arrangements.
- Escalation procedures for immigration concerns.
4. Involve more than just HR
A key feature of the new regime is that a risk of civil penalties may now arise from procurement and supply chain decisions.
Training should therefore be extended to:
- HR teams.
- Legal teams.
- Procurement professionals.
- Operations managers.
- Contract managers.
- Business leaders responsible for outsourced services.
5. Create an evidence pack approach
The revised guidance places considerable emphasis on demonstrating compliance. Businesses should consider maintaining readily accessible records showing:
- Checks undertaken.
- Verification processes followed.
- Supplier due diligence.
- Contractual arrangements.
- Audit outcomes.
Final thoughts
The draft 2026 guidance represents a very significant policy shift in terms of the role of businesses in the prevention of illegal working. The Home Office is moving beyond a model focused solely on the direct employer and towards a framework that places greater responsibility on organisations that benefit from, arrange or facilitate work through complex contractual structures and supply chains.
For many businesses, the biggest challenge will not be checking their own staff’s immigration status. It will be understanding where liability sits within their wider labour supply chain and ensuring they have the evidence needed to demonstrate compliance if the Home Office comes calling.
Organisations that start reviewing their arrangements now will be in a much stronger position when the new regime takes effect on 1 October 2026.