The Home Office has published a draft updated Code of Practice on preventing illegal working following changes introduced by the Border Security, Asylum and Immigration Act 2025.
From 1 October 2026, illegal working compliance will no longer be limited to traditional employment relationships. The right to work regime will extend to a wider range of working arrangements, including certain workers, individual subcontractors and online matching platforms.
The legislation also introduces a new statutory excuse for organisations that do not have a direct contractual relationship with the worker but may still face liability under the extended rules.
What is changing to the right to work regime?
One of the most significant changes set out in the draft Code is the expansion of the definition of an “employer” for right to work purposes.
Historically, the illegal working regime has focused on traditional employment relationships. However, the new provisions recognise that many businesses now engage individuals through more complex labour supply arrangements.
As a result, the duty to prevent illegal working will apply to a much wider range of organisations and working relationships.
Who will the new right to work duty apply to?
The draft Code confirms that the duty will now apply to:
- Employers engaging individuals under contracts of employment: This is the traditional employer-employee relationship already covered by the existing regime.
- Businesses engaging individuals under a worker’s contract: This extends the regime beyond employees to individuals who personally perform work for an organisation but may not have full employee status.
- Businesses engaging individual subcontractors: This applies where an individual is contracted to provide work or services as part of a wider arrangement involving a third party. It will be particularly relevant to businesses operating through subcontracting chains.
- Operators of online matching services: This applies where a platform provides the details of individual service providers to potential customers or clients, reflecting the growing use of digital platforms and marketplace models to source labour and services.
When could liability extend beyond the direct employer?
The changes also create situations in which liability may extend beyond the organisation that has the direct contractual relationship with the worker.
Under the draft Code, this may arise where:
- A business has contracted with a third party to provide work or services and then engages another employer to supply workers to fulfil that contract. In these circumstances, liability may potentially extend up the supply chain.
- An online matching service connects a service provider with a customer or client and the service provided enters into a contract with that client or customer.
- An employer engages an individual under a contract which allows for substitution, enabling another individual to perform the work or services in their place.
The Home Office will initially seek to identify the employer that has the direct contractual relationship with the worker. However, if that employer cannot be identified, or the prescribed requirements have not been met, liability for a civil penalty may be imposed on another person within the chain of contracts.
What is a statutory excuse against illegal working liability?
Currently, employers can protect themselves from a civil penalty for illegal working by carrying out a prescribed right to work check before employment starts.
If the check is completed correctly, the employer obtains a statutory excuse. This can provide protection from a civil penalty if it later emerges that the individual did not have the right to undertake the work in question.
The extended liability provisions create a particular difficulty for organisations that may now be treated as an “employer” but do not have a direct contractual relationship with the individual carrying out the work. In some cases, they may never meet that individual and may not be in a position to conduct a traditional right to work check.
Recognising this, the legislation introduces a separate statutory excuse for organisations caught by the extended liability regime.
Where there is no direct contractual relationship with the worker, a business can establish a statutory excuse against extended liability where proscribed requirements as set out in the draft Code of Practice have been met (and evidence of the steps taken is kept).
What are the proscribed requirements?
The proscribed requirements cover three main areas:
- Contractual terms and conditions
- Substitution controls
- Identity verification
Contractual terms and conditions
This requirement applies where:
- A business is contracted to provide work or services to a third party and engages another employer to provide or deliver that work or those services; or
- An online matching service connects a service provider with customers or clients.
In these circumstances, the business or online matching service must have a written statement in place before the work or service begins.
That statement must include five specific terms requiring:
- Right to work checks to be carried out.
- Further subcontracting to be restricted unless equivalent right to work obligations are included in the new arrangements.
- The business to be permitted to audit compliance with right to work requirements.
- The business to be able to take enforcement action where right to work checks have not been carried out.
- The employer or service provider to cooperate with any Home Office investigation.
Substitution controls
Where a contractual arrangement between an employer and a worker allows for substitution, processes must be implemented before the work is carried out.
These processes must ensure that:
- Right to work checks are completed for any substitute.
- Responsibility for the checks is not delegated to the individuals carrying out the work.
- No individual starts work as a substitute before their check is complete.
- Contractual provisions allow the arrangement to be suspended or terminated where the employer or worker knows, or has reasonable cause to believe, that a substitute is working illegally.
- The worker and their substitute are the same individuals for whom the relevant checks have been completed.
Identity verification
A business within a chain of contracts, an online matching service or an employer operating a substitution clause must have proportionate systems and processes in place to confirm that the individual carrying out the work is the person whose right to work has been checked.
Importantly, the new statutory excuse should not be viewed as a replacement for traditional right to work checks. Where an organisation directly employs or engages an individual and is already required to undertake a right to work check, those obligations will continue.
5 key steps employers should take before October 2026
Employers should begin preparing now, particularly if they use contractors, subcontractors or outsourced labour.
- Map your labour supply chain
Identify all arrangements in which work is carried out by individuals who are not your direct employees. This should include subcontractors, consultants, outsourced service providers and any workers sourced through online platforms.
- Review contracts and terms of engagement
Review existing contracts to determine whether they contain appropriate immigration compliance obligations.
Pay particular attention to provisions dealing with:
- Right to work compliance
- Further subcontracting
- Information-sharing
- Audit rights
- Enforcement and termination
- Cooperation with Home Office investigations
- Audit substitution clauses
Substitution provisions are likely to attract particular scrutiny under the new framework. Identify any arrangements that allow one individual to be replaced by another and assess whether sufficient controls are in place to confirm who is actually carrying out the work and whether the appropriate right to work check has been completed.
- Strengthen identity verification processes
The draft Code places significant emphasis on identity verification. Consider how your organisation verifies the identity of contractors and substitute workers, what evidence is retained, and whether those processes would stand up to Home Office scrutiny.
- Involve procurement, legal and operational teams
Illegal working compliance can no longer be viewed solely as an HR issue.
Procurement teams negotiating contracts, legal teams drafting terms and conditions, and operational managers overseeing service delivery all need to understand the new obligations.
Training key stakeholders now will help businesses avoid compliance gaps when the changes take effect.
Prepare for the extension of right to work checks
The proposed changes represent the most significant expansion of the illegal working regime since right to work checks were introduced.
Employers that rely on complex labour supply chains should review their arrangements and ensure they have appropriate contractual and verification measures in place before the new rules come into force.
