Historically, right to work compliance has been viewed as a recruitment or onboarding requirement managed primarily by HR teams.
The draft Code of practice signals a significant shift in approach.
The Home Office appears increasingly concerned that modern labour supply chains can obscure responsibility for immigration compliance. Businesses often engage workers through agencies, subcontractors, outsourced providers and digital platforms, creating multiple layers between the organisation benefiting from the work and the individual actually performing it.
The proposed reforms seek to close those perceived accountability gaps.
As a result, compliance will increasingly become a broader governance issue involving:
Human Resources teams
Recruitment teams
Procurement departments
Contract management teams
Operations teams
Senior leadership teams
The key question is no longer simply: Does this individual have the right to work?
Increasingly, organisations will need to ask:
Do we know who is working on our behalf, how they are supplied, and whether appropriate right to work checks have been completed throughout the labour supply chain?
One of the most significant changes is the expansion of the definition of an employer for right to work purposes.
From 1 October 2026, the definition of "employer" will be expanded to include organisations engaging individuals under:
Contracts of employment
Workers' contracts
Individual subcontractor arrangements
Online matching services
Platform-based labour models
This reflects the Government's intention to adapt the right to work regime to modern workforce structures.
For many organisations, this means compliance obligations could arise even where they do not regard themselves as the direct employer of the individual carrying out the work.
Perhaps the most commercially significant change is the introduction of extended liability provisions.
The draft Code of practice suggests that responsibility may not stop with the organisation directly engaging the worker. Liability may arise where:
Businesses that deliver services using workers supplied through agencies, subcontractors or other intermediaries may face increased compliance obligations.
The Home Office is signalling that organisations cannot simply assume compliance sits with another party in the chain.
Digital platforms that connect customers with service providers may also fall within scope, reflecting the growing use of platform-based labour models across the UK economy.
Where individuals are permitted to provide substitute workers, organisations may be responsible for ensuring that substitute workers have the right to work in the UK.
For organisations that have relied heavily on contractual delegation, these proposals represent a significant shift in risk allocation and compliance responsibility.
The draft Code appears to reflect growing Home Office concern that labour supply chains can obscure responsibility for immigration compliance.
By extending obligations beyond direct employment relationships, the Government is effectively placing greater due diligence expectations on organisations that benefit from labour, regardless of how that labour is supplied.
For many businesses, workforce compliance is evolving into supply-chain compliance.
To establish a statutory excuse and defend against potential civil penalties, businesses will need to demonstrate compliance with specific prescribed requirements.
Businesses will need written contractual provisions covering:
Right to work checks to be conducted
Controls on further subcontracting
Audit rights
Enforcement measures
Termination rights
Cooperation with Home Office investigations
For many organisations, contract management will become a central component of immigration compliance.
Organisations allowing substitution arrangements must
Verify the right to work status of substitute workers
Prevent substitutes from starting work before checks are completed
Apply contractual sanctions
Monitor who is performing the work
The draft Code introduces broader expectations around identity assurance.
Organisations will need proportionate systems to confirm that the individual performing the work is the same person whose right to work was checked.
Examples include:
Workplace access passes
Facial verification technology
Biometric attendance systems
Identity verification against licences, qualifications and training records
Periodic re-verification of identity
Notably, the draft Code refers to identity re-verification at intervals and potentially at least once every 24-hour period of activity in certain circumstances.
This may create operational, surveillance and data-protection considerations that many employers have not previously encountered.
The draft Code formalises the role of Right to Work Digital Verification Service Providers (RtW DVSPs).
Key proposals include:
Organisations using digital verification providers must ensure the provider is appropriately registered on the OFDIA register.
Using an unregistered provider could invalidate a statutory excuse.
Facial recognition technology may be used through approved providers.
Digital National Insurance documentation may become an acceptable form of evidence in certain circumstances.
Organisations should review whether their existing digital providers will continue to meet the proposed requirements.
The proposed reforms do not reduce the financial risks associated with non-compliance.
The Home Office intends to maintain the current penalty framework. Current civil penalties remain:
£45,000 per illegal worker for a first breach.
£60,000 per illegal worker for repeat breaches.
For sponsor licence holders, the consequences may extend beyond financial penalties and could include:
Sponsor licence revocation
Curtailment of sponsored workers' immigration permission
Reputational damage
Publication on the Home Office's non-compliant employer list
When combined with the proposed expanded liability, these penalties significantly increase potential compliance exposure.
The proposals are likely to have the greatest impact on organisations that rely on:
Agency workers
Contractors and consultants
Outsourced service providers
Recruitment supply chains
Temporary labour
Gig economy workers
Platform-based workforce models
Multi-tier subcontracting arrangements
Attention should be paid by organisations operating in sectors such as construction, logistics, hospitality, social care, facilities management and healthcare.
Although implementation is not expected until 1 October 2026, organisations should avoid treating these proposals as a distant compliance issue.
For businesses operating complex labour supply chains, reviewing workforce models, supplier relationships, contractual arrangements and compliance processes can take considerable time. The proposed changes may also require coordinated input from HR, recruitment, procurement, contract management, operations and senior leadership teams.
Businesses that begin assessing their arrangements now will be better positioned to identify compliance gaps, strengthen governance frameworks and implement any necessary changes in a controlled and proportionate way ahead of implementation.
We recommend organisations begin preparations immediately by:
Identify all categories of labour used by the business.
Assess whether contractors, agency workers, casual workers and outsourced service providers may fall within expanded framework.
Audit labour supply chains.
Update contracts with agencies, suppliers and subcontractors.
Update onboarding processes.
Assess repeat-check procedures.
Review document retention practices.
Review identity verification tools and workforce monitoring systems
Confirm whether existing digital right to work providers will satisfy the new requirements.
Training should extend beyond HR teams and include:
Recruiters
Procurement professionals
Contract managers
Operational managers
Senior leaders
The organisations best positioned for October 2026 are likely to be those that treat these reforms as a governance challenge rather than simply an immigration compliance issue.
While the Code remains subject to consultation, the direction of travel is clear.
The Home Office is seeking to modernise the right to work regime to reflect increasingly complex workforce structures and to prevent illegal working risks being passed down supply chains through contracting arrangements.
For many businesses, compliance will no longer end once a right to work check has been completed. The focus is moving towards ongoing oversight, contractual accountability and workforce visibility.
The organisations that begin reviewing their workforce arrangements now will be in a significantly stronger position when the new framework comes into force on 1 October 2026.
The Home Office expects the revised Code of Practice to take effect on 1 October 2026, although the Code remains subject to consultation.
Potentially. The draft Code introduces extended liability provisions that may create compliance obligations beyond direct employment relationships and throughout labour supply chains.
Civil penalties remain up to £45,000 per illegal worker for a first breach and £60,000 per illegal worker for repeat breaches.
Yes. The draft Code specifically contemplates online matching services and platform-based labour models falling within the expanded framework.
Yes. Non-compliance could lead to sponsor licence revocation, reputational damage and disruption to sponsored workers.