What employers need to know before October 2026

There has been a significant update in relation to right to work checks for all businesses, which will come into force from 1 October 2026. This may substantially change the processes and policies employers and sponsors need to implement to maintain compliance.

A draft code of practice was published on 1 July 2026. There are many smaller, detailed changes throughout the new code.

Expansion in scope to non-employment working arrangements

The scope of employers’ right to work checks will be expanded to the following working arrangements, established by the new section 14A which will be inserted to the 2006 Act. These are treated as employment when considering whether a worker has been employed without the requisite right to work. Note that the definitions provided in the references section of the draft code are really very important for understanding this new right to work scheme, including the definitions of ‘person’ which can be broadly read to mean a business, rather than an individual, unless otherwise specified. Readers should consult those definitions carefully whilst interpreting the draft code.

• Contract of employment. This already applies to employers under the current rules.
• Worker’s contract. A contract for work or services between an individual and a person (see definitions below), excluding clients and customers of that individual’s profession or business.
• Individual sub-contractor. A contract for work or services between an individual and a person, where that person has been contracted by a third party to provide the same work or services.
• Online matching services. A company which operates as an online matching service providing the details of an individual service provider to potential clients or customers. Simply providing the details (within the more detailed definition of an online matching service provided in the draft code) is enough to constitute employment.

Where a business unlawfully employs a worker under one of these arrangements, it may face a civil penalty of up to £60,000 per worker, on top of various other penalties such as a criminal conviction, closure of business premises and sponsor licence revocation.

Employers can establish a statutory excuse against a civil penalty by carrying out a compliant right to work check, and the specifics on how to do this are contained in the draft code of practice for employers.  

Extension of liability for civil penalties

The new section 15A which has been inserted to the 2006 Act extends civil penalty liability in specific contractual arrangements. The draft code of practice explains that employers can receive a civil penalty of up to £60,000 even where they are not directly employing a worker in the following circumstances:

• Subcontracting. For example, Company A is contracted to provide work or services to a third party and subcontracts Company B, who employs workers to carry out the work. Both Company A and Company B can be liable for a civil penalty if Company B’s workers do not have the right to work. It would be the same for Company C, D and E’s workers where there is further subcontracting.
• Online matching. For example, Company A is an online matching service which matches a service provider, Company B, with a client or customer to provide work or services, and Company B then enters into a contract with the client or customer. Both Company A and Company B may be liable for a civil penalty if Company B’s workers do not have the right to work.  
• Substitution. For example, where Company A employs Worker A to provide work or services under a contract that permits substitution, and Worker B carries out the work in their place. Company A may be liable for a civil penalty if Worker B does not have the right to work, even where there is no direct relationship with Worker B.

In each case, the company subcontracting, the online matching service, or the employer of the substituting worker may be treated as employing any individual who personally provides the work or services. Effectively, a business can be liable for the decisions of the people it subcontracts to, or the workers it engages. The code suggests that this may happen only where the Home Office cannot identify the person with a direct contractual relationship with the worker in question, but any company in the chain will still be exposed to the risk of a civil penalty if that party cannot be identified.

An updated employer’s guide to right to work checks will contain detailed examples illustrating how the extension of liability will work in practice. At the time of writing, the link to this updated guidance provided in the draft code redirects to the current version from 26 June 2025.

Statutory excuse against extended liability

We now have a new concept and two different kinds of statutory excuse! Businesses can establish a statutory excuse against extended liability by meeting the following prescribed requirements in full:

Contractual terms and conditions

The employer or the online matching service must have a written statement in place before the work or service commences. There are five mandatory headline items to include, and many commercial contracts will likely have similar provisions based on the suggestions made in the current code of practice. This includes for example requiring the other party to carry out right to work checks and not to further subcontract without prior written consent, with equivalent right to work obligations replicated in any permitted subcontracting arrangements. The application of these provisions is not limited to a single tier of contracting.

Substitution controls

Before the work or service commences, businesses must implement and maintain various processes in a reasonable and proportionate manner. Again, there are five mandatory headline items which include ensuring that a right to work check is carried out in respect of any substitute, that responsibility for such checks is not delegated to the workers themselves and that no individual may carry out work or services as a substitute before their right to work has been verified.

Identity verification systems and processes

The employer must maintain proportionate systems and processes to ensure that the individual carrying out the work or services is the same individual whose right to work has been checked. The draft code suggests five processes, including identity cards or workplace access passes, facial verification technology (including use of registered right to work digital verification service providers – these are sneaking in everywhere) and re-verification of identity at set intervals.

Digital identity verification providers

From 1 October 2026, where an employer relies on a digital verification service provider to establish or maintain a statutory excuse, it is now mandatory to use a right to work digital verification service provider registered on the Office for Digital Identities Attributes register. Registration alone is not sufficient – the provider must be specifically authorised for right to work checks and not just, for example, identity checks.

In a welcome change, a valid British or Irish passport or Irish passport card will now be considered valid up to six months past the expiry date for the purposes of a digital identity verification check. This should allow more British or Irish employees to rely on remote pre-employment checks.

Other interesting changes

‘Days’ has been given two definitions. In relation to the civil penalty scheme, it means calendar days. In relation to the Employer Checking Service, it refers to working days. Part of the draft code’s definition somehow also implies that Christmas Day or Good Friday are not, in fact, bank holidays.

List A has had a minor tweak. It previously included the following as evidence of an ongoing right to work:

A passport (current or expired) showing the holder is a British citizen or a citizen of the UK and Colonies having the right of abode in the UK.

This now reads:

A passport (current or expired) showing the holder is a British citizen.

Citizens of the United Kingdom and Colonies (CUKCs) with the right of abode can presumably now establish an ongoing right to work under the following List A item:

A current passport endorsed to show that the holder is exempt from immigration control, is allowed to stay indefinitely in the UK, has the right of abode in the UK, or has no time limit on their stay in the UK.

This can probably be welcomed, as explaining what a citizen of the United Kingdom and Colonies is can sometimes get a bit complicated.

Recommended next steps

Employers and sponsors are well advised to take the following steps ahead of 1 October 2026.

• Categorise the ways in which the organisation engages with workers, based on the type of employment relationship and the definitions provided by the code of practice. Then, identify which will be affected. This dovetails with the updating of policies and training of human resources staff, detailed below, as employers must be able to identify where they may be liable.
• Where a business presently relies on a DVS provider for right to work checks (known as an IDSP in the current code), it must be registered and specifically authorised for right to work checks. If not, make arrangements to switch providers. Many background checking organisations subcontract this function to a registered provider and so if it is not immediately obvious, enquiries should be made with existing providers.
• Update right to work policies and working practices well in advance of 1 October 2026. Existing policies will be out of date by then and relying on them will expose the organisation to risk of a civil penalty.
• Train staff responsible for carrying out the checks on the new right to work scheme.
• Review template contracts to account for the prescribed requirements required to protect the business against extended liability, and review existing contracts to manage any downstream liability from 1 October 2026.
• Engage with the Home Office. As far as, key personnel in the sponsorship system are being invited by the Home Office to attend an online familiarisation event as the Home Office prepares to implement these changes, with sessions in July, August and September. Engaging with these events might be very helpful, if you have access.