The UK Visas and Immigration Authority has published a draft code of practice on undertaking right to work checks which will take effect on 1 October 2026 (“Updated Code”). The Updated Code broadens right-to-work check obligations beyond the traditional employment relationship and the liability for a civil penalty (£45,000 per worker for the first breach and £60,000 per worker for any repeated breaches) applies to this wider group.

We have set out below a summary of the key changes included within the Updated Code and due to come into force on 1 October 2026 (there is no retrospective effect):

Extended Scope: Right to work checks are now required in the following scenarios:

  • engaging an individual under a worker’s contract (for the avoidance of doubt, the use of the term worker for this purpose, is wider than the use of the term Worker for employment status purposes under the Employment Rights Act 1996);
  • engaging an individual sub-contractor; and
  • employing another individual through an online matching service which provides details of an individual service provider, to potential clients or customers.

Extension of Liability: those liable to receive a civil penalty for failing to prevent illegal working has also been expanded in the Updated Code. In addition to the employer with a direct contractual relationship with a worker, there are now the following scenarios of “extended liability”:

  • a person who is under a contract to provide work or services to a third party and that person enters into a contract with another employer, who provides workers to fulfil the contract. It should be noted there is a requirement to provide work or services onwards to a third party as part of a contractual chain, where this element is missing, the employer is not in scope for extended liability. Therefore, for the avoidance of doubt, (i) does not cover self-employed individuals who contract directly with clients or customers to provide goods or services;
  • where an online matching service provides details of a service provider to clients or customers and that service provider enters into a contract with the client or customer; and
  • an employer employs an individual to provide work or services, and the contract has a substitution provision or clause, to allow another individual to carry out the work in their place.

We have highlighted in italics those who are now liable for a civil penalty. For extended liability, the civil penalty only applies where the employment commenced on or after 1 October 2026. Extended liability can make employers further up the contractual chain liable for illegal working, even if, there is no direct contractual relationship with the worker.

Other changes: In addition to the above, other changes included within the Updated Code are: (i) updates to the ways employers (including those covered by extended liability) can obtain a statutory excuse and scenarios in which a statutory excuse will not be established, (ii) removing reference to Identity Service Providers (IDSPs) and replacing this with Right to Work Digital Verification Service Providers (“RtW DVSP”) (note that under the Updated Code it is now mandatory, when using an RtW DVSP to use a registered provider, who has a note confirming they are able to undertake right to work checks), and (iii) allowing the use of facial recognition technology provided by an RtW DVSP to verify an online check against the individual presenting for work.

Due to the substantive changes made to the Updated Code we would recommend that all businesses read and familiarise themselves with the Updated Code before it comes into force. A review and assessment of the workforce and commercial agreements in place within the business should be undertaken to identify what relationships may be caught by the extended liability provisions from 1 October 2026.  Template agreements should be amended to include provision for the changes  Any steps adopted to address the changes in the Updated Code should be implemented in a non-discriminatory manner.