At a glance
- The Home Office has published a draft employer’s guide to right to work checks, dated 16 July 2026 (Guidance), alongside a draft code of practice on preventing illegal working (Code) dated June 2026. Both are stated to come into force on 1 October 2026.
- Extended liability will not generally apply to a client, customer or end user buying work or services for its own internal operations. The key question is whether the business is contractually responsible for providing or arranging the relevant work or services onwards to a third party.
- Genuine business-to-business and personal service company arrangements should generally remain outside scope, but labels are not determinative and the practical arrangements must still be assessed.
- Where extended liability applies, the relevant contractual and operational safeguards must be in place before the work begins. Contractual wording alone will not be enough.
- The Code is a statutory code, and, on identity re-verification and supplier assurance, it is stricter than the employer’s guide. Where the two differ, the Code is the safer planning assumption.
- The expanded civil penalty regime applies where the relevant engagement commences on or after 1 October 2026.
Background
Our earlier article explained that section 48 of the Border Security, Asylum and Immigration Act 2025 will extend the illegal working regime beyond traditional contracts of employment. The Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026 confirm that section 48 comes into force on 1 October 2026. The Home Office has now published the draft employer’s guide to right to work checks and the draft Code, which together provide practical detail on the arrangements the Home Office considers to be within scope, and the steps businesses can take to establish a statutory excuse against civil penalty liability.
The Code matters more than its title suggests. It is issued under section 19 of the Immigration, Asylum and Nationality Act 2006, has been approved by the Secretary of State and laid before Parliament. The courts must have regard to it where an appeal concerns the level of a civil penalty and may take account of other relevant parts of the Code.
Direct engagements and extended liability
Section 48 introduces two distinct forms of potential liability. First, businesses with a direct relationship are employers for Right to Work Scheme purposes where they engage an individual under a worker’s contract, engage an individual subcontractor, or operate an online matching service which provides the details of an individual service provider to potential clients or customers. In these cases, the business generally establishes a statutory excuse by completing the prescribed right to work check before the work begins.
Secondly, civil penalty liability may extend beyond the employer holding the direct contractual relationship in certain contractual chains, online matching arrangements and substitution models. The direct employer remains responsible for carrying out the prescribed check. Extended liability does not automatically transfer that responsibility to every other party in the chain.
Genuine PSC and business-to-business arrangements
The Guidance confirms that the scheme will not generally apply where an individual operates a genuine independent business, in their own name or through their own company, and contracts directly with clients or customers to provide goods or services.
The Guidance gives the example of a graphic designer engaged for a specific project through the designer’s own personal service company. The client is not required to conduct a right to work check because it is purchasing services under a genuine B2B arrangement.
However, using a PSC or describing an individual as self-employed is not conclusive. The contractual terms and the practical reality must still be assessed, including how the work is arranged, supplied and performed. The exclusion for genuine client or customer relationships has statutory footing, but it is not a blanket exemption for all PSC arrangements.
No general end-user liability
The draft Guidance provides a helpful clarification for businesses using agency labour and outsourced services, and the Code puts it beyond doubt. The Code states expressly that the provisions do not apply to persons who act solely as end users, clients or customers of a service, or who commission or purchase work or services, where they are not under a contract to provide those work or services onwards to a third party as part of a chain of contracts.
The Guidance indicates that extended liability would not apply to a retailer buying cleaning services for its own premises, a manufacturer obtaining temporary production workers for its own factory, or a food producer using temporary workers to manufacture goods. In each example, responsibility for prescribed right to work checks remains with the business holding the direct contractual relationship with the workers.
Workforce integration is therefore not, by itself, sufficient to trigger extended liability. As an initial filter, businesses should ask whether they are contractually responsible for providing or arranging the relevant work or services onwards to a third party. Separate analysis will still be required for direct engagements, online matching services and substitution arrangements.
Where extended liability applies
Extended liability applies where a business is itself contracted to provide or arrange work or services to a third party and uses another business or contractual chain to fulfil that obligation. It also applies in specified online matching and substitution arrangements. The provisions are not limited to the first contract in a chain.
The applicable prescribed requirements depend on the arrangement. For contractual-chain and online-matching arrangements, the safeguards include specified written terms requiring right to work compliance, controls on further subcontracting, audit rights, enforcement provisions and cooperation with Home Office investigations. The business must also maintain proportionate systems and processes to ensure that the individual carrying out the work is the same individual on whom a right to work check has been conducted.
Prescribed checks remain the responsibility of the direct employer. An upstream business may put in place arrangements to obtain assurance that those checks have been carried out. The Employer’s guide frames this as taking reasonable steps to satisfy itself that the assurances are reliable, while the Code requires it to ensure that the prescribed requirements have been met. On either formulation, unverified self-certification will not be sufficient. Contracts alone will not establish the statutory excuse, the arrangements must operate effectively in practice, and the Code requires the prescribed requirements to be met in full and evidenced.
One related point is easily missed. Apart from prescribed checks carried out by a registered digital provider, an employer must not delegate responsibility for conducting right to work checks to a third party. Where a check is performed by a recruitment agency or professional adviser, the employer will not establish a statutory excuse.
Substitution and identity controls
Where a contract permits substitution, a prescribed check must be completed on any substitute before the substitute begins work. Responsibility for that check cannot be delegated to the individual carrying out the work, even where the contract describes that individual as operating in business on their own account. Appropriate contractual enforcement and identity verification controls must also be maintained.
There is helpful protection for businesses that operate proper controls. The Code confirms that the Home Office will have regard to whether the employer has implemented and maintained these processes in a reasonable and proportionate manner, including where substitution occurs without the employer’s knowledge or control, or where an individual uses fraud or other criminal activity to circumvent the checks despite suitable mitigations being in place.
On identity re-verification the two documents differ, and the difference is material. The Employer’s guide describes re-verification at least once in any 24-hour period or shift as a recommendation. The Code permits such interval as is appropriate to the work being performed, but subject to a minimum of once in any 24-hour period of activity. Businesses should plan against the Code. Above that floor, frequency should remain proportionate to the nature of the work and the risk of substitution or impersonation, and a controlled process for approving and recording substitutes is likely to provide stronger evidence of compliance than ad hoc replacement.
Digital checks
Where a business chooses to use digital verification, it must use a Right to Work Digital Verification Service Provider registered for right to work purposes on the Office for Digital Identities and Attributes register. The employer remains responsible for ensuring that the prescribed requirements are met and that the required evidence is retained.
A business may rely on identity verification systems operated by another party in the chain or by a third-party provider, provided it has taken reasonable steps to satisfy itself that those systems are effective and that the prescribed requirements are being met.
Commencement and existing arrangements
The Guidance and the Code confirm that the expanded civil penalty regime for worker contracts, individual subcontractors, online matching services and extended liability applies where the relevant employment or engagement commences on or after 1 October 2026.
The immediate priority is therefore engagements commencing from that date. Businesses should nevertheless identify existing arrangements that may be renewed, replaced, materially varied or involve new assignments after commencement, as neither the draft Guidance nor the Code explain in detail when those changes will amount to a new engagement.
What should businesses do now?
- Distinguish direct engagements from outsourced services and other non-direct arrangements.
- Identify genuine B2B and PSC engagements, while avoiding blanket assumptions based on labels.
- Map contractual chains where the business provides or arranges work or services onwards to a third party.
- Review substitution clauses and how substitution operates in practice.
- Update relevant supplier contracts against the prescribed requirements and introduce workable audit and assurance processes.
- Establish proportionate identity verification controls and confirm that any digital provider is registered for right to work purposes.
- Confirm that checks are carried out by the business itself rather than delegated to an agency or adviser.
- Retain evidence of compliance, since a statutory excuse against extended liability must be met in full and evidenced on request.
- Apply the process consistently across the relevant workforce population to avoid discrimination.
Comment
The draft Guidance is more helpful to end users than the earlier government materials suggested. It confirms that the reforms do not impose a general right to work obligation on every end user of agency labour or outsourced services. The harder work will sit with businesses delivering work or services onwards through contractual chains, online matching services and models that permit substitution.
For those businesses, the requirements are prescriptive, must be addressed before work begins and must operate in practice. The correct approach is not to conduct blanket checks on every contractor, but to classify each arrangement and apply the relevant checking, contractual and operational requirements.
Both the Guidance and the Code remain in draft, and the examples in the Guidance are expressly illustrative. The financial exposure is significant. The Code sets a starting point of GPB45,000 per worker for a first breach within three years and GBP60,000 per worker for a repeat breach, reduced by GBP5,000 per worker where the employer has reported the suspected illegal worker and obtained a unique reference number, and by a further GBP5,000 per worker for active co-operation. A Warning Notice is available for a first breach only where the employer satisfies all three mitigating factors: Prior reporting of the suspected illegal worker and receipt of a unique reference number; active cooperation with the Home Office investigation; and evidence of effective right to work practices. Businesses with complex labour supply, platform, subcontracting or substitution models should obtain advice on how the new rules apply to their particular arrangements.
This article is for general information only and does not constitute legal advice.
More to explore
