Quick links

• What should businesses do now?
• Background
• Wider scope of ‘employers’ under the right to work scheme
• Key new definitions in the Code
• How a statutory excuse works in the context of non-direct contractual arrangements
• Right to Work Digital Verification Service Providers (RtW DVSPs)
• Digital National Insurance number documents
• How we can help

Background

In our previous client alerts we reported on the Border Security, Asylum and Immigration Act 2025 (BSAI 2025) and the Government’s intention to extend the illegal working regime beyond traditional employment relationships.

Section 48 of BSAI 2025 amends the Immigration, Asylum and Nationality Act 2006 (IANA 2006) to catch a much broader range of working arrangements than currently, bringing them in scope for potential illegal working civil penalties and criminal liability. It is due to come into force from 1 October 2026.

On 30 June 2026 the Home Office published a draft revised Code of practice on preventing illegal working (the Code), which is also due to come into force on 1 October 2026. The Code sets out how the illegal working civil penalty scheme will operate in practice under the expanded framework. It applies:

• When determining civil penalty liability where an initial right to work check on a prospective individual worker or repeat check on an existing worker is required on or after 1 October 2026;
• When determining civil penalty liability in relation to the newly captured working arrangements, where the requirements to establish a statutory excuse against liability apply on or after 1 October 2026; and
• When calculating illegal working civil penalty amounts where a breach occurs on or after 1 October 2026.

The Code goes into some detail about what steps organisations should take to obtain a statutory excuse against liability for a civil penalty, however the main guidance document on this, the Employer's guide to right to work checks (the Employer’s guide) has not yet been updated for the changes in effect from 1 October 2026. For the time-being, readers of the draft Code should be aware that cross-references to the Employer’s guide will not link to the version that’s due to be in place by October. We’ll provide a further update once a draft version of the Employer’s guide has been published.

Wider scope of ‘employers’ under the right to work scheme

Section 48 of BSAI 2025 inserts a new section 14A into IANA 2006. This provision extends the scope of ‘employers’ who may be subject to an illegal working civil penalty or criminal sanction.

For the purposes of the right to work scheme, from 1 October 2026 references to an ‘employer’ of an ‘individual’ will include:

• Employing an individual under a contract of employment (contract of service or apprenticeship);
• Engaging an individual under a ‘worker’s contract’;
• Engaging an ‘individual sub-contractor’; and
• Operating an ‘online matching service’ and providing details of an individual ‘service provider’ to clients or customers.

This wide definition goes well beyond the traditional direct employer. It is also important to understand what each defined term (e.g. ‘worker’s contract’) means when interpreting who an ‘employer’ is. Some of the key new definitions are discussed below.

Key new definitions in the Code

The Code introduces several new definitions for the purposes of the right to work scheme:

‘Employer’ which, as noted above, means a person who employs an individual under a contract of employment (contract of service or apprenticeship), under a worker’s contract, as an individual sub-contractor, or when operating as an online matching service providing details of an individual service provider to potential clients or customers. References to ‘employment’ in the Code of practice include all of these working arrangements, and references to a ‘contract’ includes express or implied contracts, whether oral or written.

‘Individual sub-contractor’ which means an individual who has entered into a contract with a ‘person’ to provide work or services, in circumstances where the other person has entered into a contract with a third party to provide, or arrange for the provision of, the work or services, but the individual has not.

We anticipate the ‘individual sub-contractor’ definition may prove complex for businesses to apply in practice (especially whether an individual’s work or services are provided for the purposes of fulfilling a third party contract) and could present a significant new risk area for compliance.

‘Online matching service’ which means a ‘person’ who, in the course of their business, keeps a register of ‘service providers’ in order to match them with potential clients/customers via an online service, and who charges a fee or commission when a match is made.

‘Person’ which means a company, organisation, business or other entity – it doesn’t mean an individual worker unless the Code expressly states so.

‘Service provider’ which, in the context of an online matching service, means a ‘person’ providing, or seeking to provide work or services for payment.

‘Substitution’ which refers to where a worker is permitted to substitute their work or services to another individual, including through a contractual clause allowing the worker to be replaced by another individual to perform the same work or services.

In practice, a right of substitution will exist where the individual engaged is self-employed and the contract involved is a contract for services.

‘Worker’ or ‘individual’ which means an individual engaged to carry out work or provide services under a contract of employment (employee), under a ‘worker’s contract’, as an ‘individual sub-contractor’, or through an ‘online matching service’.

‘Worker’s contract’ which means any non-employee contract whereby the individual undertakes to perform work or services personally for another person (whether or not that person is mentioned in the contract), and where that person is not a client or customer of any profession or business undertaking carried on by the individual.

The Code notes that this definition is broader than the ‘limb (b) worker’ definition contained in section 230(3)(b) of the Employment Rights Act 1996.

How a statutory excuse works in the context of non-direct contractual arrangements

Where an ‘employer’ may be potentially liable for an illegal working civil penalty, it can protect itself from liability by completing ‘prescribed requirements’ to obtain a statutory excuse.

Currently, this generally means completing and evidencing a manual, online or Digital Verification Service (DVS) right to work check before employment begins, as well as completing and evidencing follow-up right to work checks before any time-limited statutory excuse expires.

Section 3 of the Code addresses the extended liability that will arise for ‘employers’ engaged in non-direct contractual arrangements from 1 October 2026, i.e. where an individual who doesn’t have the right to work in the UK personally provides work or services in the following contexts:

• Where a ‘person’ is under contract to provide work or services to a third party and in turn contracts with another employer who employs the individual to carry out some or all of the work or services required to fulfil the third party contract;
• Where a ‘person’ is an online matching service and a registered service provider is engaged by a user of the online platform to carry out a job; or
• Where a ‘person’ engages an individual under a contract that includes a right of substitution.

In each of these circumstances, the ‘person’ may be treated as employing the individual who personally provides the work or services, irrespective of how long the chain of contracts is between them and that individual.

The Code makes it clear however that end-users/clients/customers of a service who commission or buy work or services for their own benefit (and are not under a contract to provide those services onwards to a third party) are not within scope of the extended liability provisions.

The Home Office’s states its objective will continue to be identifying the employer in the direct contractual relationship with the individual worker. However, where the direct ‘employer’ can’t be identified or another ‘person’ in a chain of contracts isn’t able to show sufficient evidence that they have complied with the ‘prescribed requirements’ discussed below (i.e. contractual terms and conditions, substitution controls and identity verification), that ‘person’ may be liable for an illegal working civil penalty.

The Home Office states it will ‘have regard to the nature of the contractual arrangements and the extent to which each party has complied with the prescribed requirements’ when deciding whether to apply liability to each relevant person in a chain of contracts. What this means in practice is that relevant persons should not be complacent about satisfying the prescribed requirements, even where a direct employer is identifiable, and even if the contractual arrangement they are a party to is multiple contracts removed from the one under which the illegal worker is engaged.

Contractual terms and conditions (written statement)

This prescribed requirement will apply where:

• A ‘person’ is under a contract to provide work or services and contracts with another employer to provide or arrange delivery of that work (including by providing individuals to carry out the work); or
• A ‘person’ is an online matching service and one of its registered service providers contracts with a client or customer.

Before the work or service commences, the ‘person’ in each of these circumstances must have a written statement in place with the other employer/service provider that includes the following terms and conditions:

• Requiring the other employer/service provider to conduct prescribed right to work checks on individuals engaged to perform the relevant work or services;
• Preventing further subcontracting without the prior written consent of the ‘person’, and requiring equivalent right to work checking obligations in any permitted subcontracting;
• Permitting the ‘person’ to do audits of the right to work compliance of the other employer/service provider;
• Enabling the ‘person’ to take enforcement action against the other employer/service provider (including, but not limited to, suspension or termination of the contract) where illegal working is identified and a statutory excuse has not been established, and equivalent provisions in respect of the direct contractual relationship between the employer or the service provider and the individual who is carrying out the work or services; and
• Requiring cooperation with Home Office investigations by providing:
  • Information about the purpose and make-up of the contractual chain;
  • Details of each other employer/service provider involved in the contractual chain; and
  • Any other information the Home Office considers is/may be relevant to its investigation.

These ‘persons’ must also comply with the prescribed ‘identity verification’ requirements.

Substitution controls

This prescribed requirement will apply where a contractual arrangement between an ‘employer’ and individual worker permits substitution.

The ‘employer’ in this circumstance will only obtain a statutory excuse where, before the work or service commences, it has processes ensuring that:

• A prescribed right to work check is carried out directly by the ‘employer’ for any substitute;
• Responsibility for right to work checks on substitutes is not delegated to individuals carrying out the work or services, including where the contractual arrangement describes that individual as operating in business on their own account;
• No individual carries out work or services as a substitute before their right to work is verified;
• Contractual provisions are in place between ‘employer’ and individual worker (including, but not limited to, suspension or termination of the contract) where the ‘employer’ or the worker knows, or has reasonable cause to believe, that a substitute is working illegally – this may include where the substitute has failed to comply with a request to complete a right to work check; and
• For the duration of the engagement, the ‘employer’ ensures the worker and registered substitute are the same individuals for whom right to work checks have been completed, including by using identity verification systems (see below).

The Code emphasises that:

• If illegal working occurs and the Home Office requests this, the ‘employer’ must provide the necessary information to allow the Home Office to determine whether a statutory excuse is established and, if not, the amount of any civil penalty to be applied;
• When considering if a statutory excuse is established, the Home Office will consider whether the ‘employer’ has implemented and maintained the required processes reasonably and proportionately, including where substitution occurs without the employer’s knowledge or control, the individual worker doesn’t have a substitution clause in their contract and/or where the individual worker uses fraud or other criminal activity to get around right to work checks despite the ‘employer’ having suitable mitigations and controls in place; and
• If there’s evidence that the substitution controls don’t align with operational practice, the Home Office will consider this when determining if a statutory excuse is established and whether to apply a civil penalty.

Identity verification

In order to obtain a statutory excuse, all persons to whom extended liability relates must, as part of the prescribed requirements, maintain proportionate systems and processes to ensure the individual performing the work or services is the person whose right to work has been checked.

The Code isn’t prescriptive about what these systems and processes must be, but states these ‘can include’:

• Identity cards or workplace access passes;
• Facial verification technology, including using registered RtW DVSPs;
• Biometric or attendance management systems;
• Verification against training records, qualifications or licences relating to the role; and
• Identity re-verification at set intervals, provided this is no less than once in any 24-hour period of activity.

A ‘person’ may rely on identity verification systems and processes operated by another party in the chain of contracts or by a third party provider (e.g. a registered RtW DVSP), but must  take reasonable steps to satisfy themselves that those systems and processes are effective and that the prescribed requirements are being met.

This is a significant new area of risk, and further elaboration on how the Home Office contemplates compliance should operate will be set out in the (as yet unpublished) Employer’s guide.

Right to Work Digital Verification Service Providers (RtW DVSPs)

The Code updates the term ‘Digital Verification Service’ (DVS), replacing this with ‘Right to Work Digital Verification Service Provider’ (RtW DVSP).

A ‘RtW DVSP’ is defined in the Code as being a service provider that enables people to digitally prove who they are, information about themselves or their eligibility to do something.

Under the draft Code, RtW DVSPs will be able to conduct:

• Digital right to work checks on holders of valid British and Irish passports (including passport cards);
• Facial recognition as part of a right to work check; and
• Facial recognition as part of identity verification systems and processes.

Importantly, when choosing to engage a RtW DVSP, it will be mandatory from 1 October 2026 that the provider is registered on the Office for Digital Identities and Attributes (OFDIA) register and has a note confirming it can provide right to work checks.

It will not be mandatory for employers to use a RtW DVSP if another checking method is available and appropriate.

Digital National Insurance number documents

Under the draft Code, the lists of acceptable documents for manual right to work checks are updated to reflect that an official document providing an individual’s name and National Insurance number may include a digital version issued by or on behalf of a government agency, provided it is used in combination with the other relevant document.

How we can help

We appreciate these changes will have significant operational impacts for many businesses and that compliance measures will need to be determined on a case-by-case basis.

We are running a webinar on 21 July 2026 to provide an overview of the changes and how to prepare for them. You can sign up for this here.

We also can assist with:

• Developing a project plan;
• Carrying out a mock audit of your current right to work compliance;
• Reviewing proposed measures to comply with the new requirements;
• Suggesting draft contract wording; and
• Providing communication toolkits and training for your staff.

Please get in touch with a member of our Immigration team to discuss a specific approach for your business.