Major expansion of right to work compliance beyond direct employees from 1 October 2026

For the newly covered categories (including workers, individual sub-contractors, substitutes and online matching services), civil penalty liability will only apply to engagements commencing on or after that date. Individuals engaged under existing arrangements will not need to be re-checked retrospectively, although any new engagements and follow-up checks from 1 October 2026 onwards will fall under the new rules.

Genuinely self-employed individuals who run their own business and contract directly with clients remain excluded. This includes services provided to the public or through normal business-to-business contracts, where a service is being purchased rather than an individual being employed.

Whilst the Code remains in draft form, the Home Office’s intention to broaden liability for illegal working to any individual operating within an organisation’s extended labour supply chain is now clear, and businesses should begin preparing for the significantly increased compliance burden. Civil penalties remain at £45,000 per worker for a first breach and £60,000 per worker for repeat breaches, but these penalties will apply across a much wider range of working arrangements.

Key changes under the draft Code of Practice on Preventing Illegal Working

Under the current regime, employers are only liable for illegal working penalties in respect of their direct employees. Under the new model:

• The definition of “employer” is widened to include businesses engaging individuals under worker contracts, individual sub-contractors and substitutes, as well as operators of online matching services and gig economy platforms. The Code confirms that the definition of “worker” is broader than the position under employment law, meaning existing employment status assessments may not align with the new regime.
• A new extended liability regime means a business may face a civil penalty for an illegal worker even where there is no direct contractual relationship, including where workers are supplied through contractual chains, online matching platforms or substitution arrangements. Civil penalty liability may move up the supply chain where the direct employer cannot be identified or fails to comply, albeit the Home Office is clear that its primary objective will be to pursue the employer with the direct contractual relationship where they can be identified.
• Businesses seeking to rely on a defence against extended liability will need to meet new ‘prescribed requirements’ relating to contractual controls, substitute worker arrangements and identity verification processes (see further below). These obligations go significantly beyond the current regime and include regular identity re-verification for substitute workers.

Prescribed requirements defence against extended liability

To establish a defence to civil penalties, businesses will need to demonstrate compliance with ‘prescribed requirements’ in three key areas:

1. Contractual controls: Businesses will need written arrangements requiring those further down the labour supply chain to carry out right to work checks, restrict unauthorised sub-contracting, permit audits, accept enforcement measures where illegal working is identified and cooperate with Home Office investigations.
2. Substitute worker controls: Where substitution is permitted, businesses must ensure substitutes are checked before work starts, maintain appropriate contractual sanctions and have systems in place to verify that the individual performing the work is the person who was checked.
3. Identity verification: Businesses must operate proportionate processes to ensure that the individual carrying out the work is the same individual whose right to work was verified. The Code refers to measures such as workplace passes, facial recognition technology, biometric systems and licence or training record checks, with ongoing verification expected throughout the engagement for substitute workers, at intervals no less than once in any 24-hour period of activity.

Recommended next steps to support your right to work compliance

Given the breadth of these changes, we recommend businesses begin preparations now:

1. Map your workforce – identify all individuals providing work or services, including contractors, casual workers, agency labour, outsourced workers and platform-based workers.
2. Review substitution clauses – assess whether existing substitution provisions remain appropriate and ensure suitable controls are in place where they are retained.
3. Audit supply-chain contracts – ensure standard terms and contracts contain the prescribed terms relating to right to work compliance, sub-contracting, audit rights, enforcement and Home Office cooperation.
4. Develop identity verification processes – consider what systems will be required to verify the identity of individuals carrying out the work on an ongoing basis.
5. Review digital verification providers – confirm that any provider used for outsourced right to work checks hold the required Home Office registration before October 2026.
6. Protect your Sponsor Licence – sponsor licence holders should treat these developments as a significant compliance risk and incorporate them into existing compliance frameworks.
7. Provide wider training – procurement, legal and commercial teams, as well as HR, should understand the implications of the new regime.

If you would like to discuss how these changes may affect your organisation or require assistance reviewing your current arrangements, please do not hesitate to get in touch with our Business Immigration team.