Right to work checks from 1 October 2026: why immigration compliance is moving beyond HR

From 1 October 2026, the Home Office is expected to bring into force a revised Code of Practice on preventing illegal working. This is not simply a technical update to the right to work checking regime. It marks a significant shift in how immigration compliance risk will be allocated across modern working arrangements.

The legal framework sits in the Border Security, Asylum and Immigration Act 2025, which amends the Immigration, Asylum and Nationality Act 2006 to bring a broader range of working arrangements within the scope of the illegal working civil penalty regime and potential criminal liability. The Home Office published a draft revised Code of Practice on preventing illegal working on 30 June 2026 and a draft Employer's guide to right to work checks on 16 July 2026.  These drafts set out how the expanded civil penalty scheme is expected to operate in practice from 1 October 2026.

The draft Code reflects the expansion of the illegal working regime to cover a wider range of labour arrangements, including certain worker contracts, individual subcontractors and online matching platforms. It also introduces the concept of extended liability, under which civil penalty exposure may move beyond the direct employer and further up the contractual chain.

For employers, contractors and businesses that rely on agency labour, subcontractors, consultants, outsourced service providers or platform based workers, this will require more than updated onboarding procedures. It will require a broader review of how labour is sourced, who carries out right to work checks, what contractual protections are in place, and whether the business can evidence compliance if challenged by the Home Office.

We have highlighted below the key changes employers should be aware of, and the practical steps employers should consider taking now.

Key changes

1. The illegal working regime will extend beyond traditional employees

Historically, businesses have primarily focused on checking individuals engaged under contracts of employment. From 1 October 2026, the right to work regime will also apply to certain non-employment working arrangements, including worker contracts, individual subcontractors and some online matching services. This means that organisations that do not consider themselves to be the direct employer may nevertheless fall within the right to work compliance framework.

This policy shift appears to prevent businesses from distancing themselves from immigration compliance by outsourcing labour or relying on layered contractual arrangements.

There is, however, an important distinction between a business that is merely buying services for its own use and a business that sits within a wider chain of service provision. Ordinary end-user arrangements, such as commissioning cleaning, repairs or consultancy support for the business itself, are unlikely to engage the extended provisions where those services are not being supplied onwards. The risk is more likely to arise where services are passed through a contractual chain to another party.

For example, a company that appoints a contractor to carry out repairs at its own office, or engages a consultant to advise on an internal project, will generally be receiving those services as the end user. In that scenario, the contractor or consultancy firm would remain responsible for managing right to work compliance for the individuals it engages.

By contrast, if that same company is contracted to provide services to its own client and subcontracts part of the work to another provider, it is no longer simply purchasing services for its own use. It forms part of the chain through which the services are delivered. In that case, the company should ensure it has sufficient visibility over who is carrying out the work, controls around substitution, and contractual rights to obtain information or evidence that compliant checks have been completed.

2. Extended liability and civil penalty

Where the Home Office cannot identify the employer or engager with the direct contractual relationship with the worker, or where the prescribed requirements have not been met, civil penalty liability may move upstream to another person in the contractual chain through which the work or services are being delivered. In deciding whether to impose liability on an upstream party, the Home Office is expected to consider the nature of the contractual arrangements, how they operate in practice, and whether each party has complied with the prescribed requirements. 

These include appropriate written contractual terms, controls around subcontracting and substitution, audit and information-sharing rights, co-operation obligations in the event of a Home Office investigation, and proportionate identity verification processes to confirm that the person doing the work is the person whose right to work was checked. An upstream party seeking to rely on a statutory excuse will therefore need to retain sufficient evidence that these safeguards were in place before the work or services began and that they were followed in practice. 

The regime is not limited to the first tier of contracting and liability will be assessed on a case by case basis, making documentary evidence, contract management and operational controls central to managing civil penalty risk.

3. Identity verification service providers will need closer scrutiny

Employers using Digital Verification Service Providers should note that providers must be registered on the Office for Digital Identities and Attributes register and authorised to carry out right to work checks. Reliance on third party onboarding platforms will not be enough if those providers do not meet the prescribed requirements.

The revised Code also updates the lists of acceptable documents to reflect that an official document showing an individual’s name and National Insurance number may include a digital version issued by or on behalf of a government agency.

What employers should be doing now

Employers should use the lead in period to map all labour arrangements, including agencies, subcontractors, consultants, outsourced providers, online platforms and substitution arrangements, and identify which fall within the revised Code.

They should update policies, onboarding processes, staff training, contract templates, supplier obligations, audit rights, substitution controls, digital verification arrangements and record retention systems. 

Businesses using a Digital Verification Service Provider should confirm that it is registered on the Office for Digital Identities and Attributes register and authorised for right to work checks, and make alternative arrangements if needed.

Employers and sponsors should also monitor further Home Office guidance and engage with familiarisation sessions where available. This will require input from HR, procurement, legal, compliance, operations and contract management teams.

The key message is that immigration compliance is becoming a business-wide risk management issue. The greatest exposure may be failing to recognise that the business sits within a wider compliance chain.

Our immigration team, led by partner Nicolette Bostock, can help employers assess their exposure under the revised regime and review right to work processes, contractual protections and supply chain compliance arrangements ahead of ahead of October 2026.