Draft Code of Practice on Preventing Illegal Working: what businesses need to know

A new draft Code of Practice on Preventing Illegal Working and draft Employer’s Guide to Right to Work Checks were published in July. The Code will come into effect from 1 October 2026.

Although the Code confirms that responsibility for conducting right to work checks continues to remain with the employer that has a direct contractual relationship with the worker, it also introduces a concept of extended liability.

Employers can prevent illegal working and establish a statutory excuse against liability by conducting a prescribed right to work check before employment commences.

The legislative framework underpinning right to work checks and civil penalties is referred to in the Code as “the Scheme”.

Application to non-direct contractual arrangements: extended liability

Section 48 of the Border Security, Asylum and Immigration Act 2025 (“BSAI 2025”) extends the scope of employers required to prevent illegal working under the civil penalty scheme and the sanctions for non-compliance to a wider range of working arrangements.

Civil penalty liability may extend beyond the employer who holds a direct contractual relationship with the worker to apply as follows:

Where a person is under a contract to provide work or services to a third party and enters into a contract with another employer who employs workers to carry out all or part of the work or services to fulfil that contract.
Where an employer employs an individual to provide work or services and the contract has a substitution clause which permits that individual to substitute their work or services to be carried on by another individual in their place.
Where an online matching service provides details of a service provider to clients or customers and the service provider enters into a contract with the client or customer.

In these circumstances, a person contracted to provide work or services to a third party, an online matching service or the employer in the case of a substitution clause may be treated as employing any individual who personally provides the work or services.

Nature of extended liability

Where illegal working is identified, the Home Office’s stated objective is to identify the employer who is in the direct contractual relationship with the worker. Where the Home Office cannot identify the employer who holds the direct contractual relationship with the worker, or where the prescribed requirements have not been met, liability for payment of a civil penalty may be imposed on any person upstream in the chain of contracts in relation to work or services. In determining whether to apply liability to any person upstream in the chain of contracts, the Home Office will have regard to the nature of the contractual arrangements and the extent to which each party has complied with prescribed requirements.

Establishing a statutory excuse

A person can establish a statutory excuse against extended civil liability for payment of a civil penalty where the following prescribed requirements have been met.

The prescribed requirements relate to:

Contractual terms and conditions (written statement)
Substitution controls
Identity verification systems and processes

Contractual terms and conditions (written statement)

The Code states that where the employer is an online matching service who is matching a service provider to clients or customers and the service provider enters into a contract with the customer, the online matching service must have a “written statement” in place before the work or services commences. This also applies to a person who contracts to provide work or services to a third party and enters into a contract with another employer to provide delivery of that work or services including providing workers to carry out that work.

The Code states that a written statement must be in place with the other employer or service provider that includes the following terms and conditions:

Require the employer or service provider to conduct prescribed right to work checks on any individual employed to perform the work or services.
Not to further subcontract the work without the prior written consent of the person or the online matching service and replicate equivalent right to work obligations in any permitted subcontracting arrangements.
Permit the person or online matching service to conduct audits of the employer or service provider’s compliance with prescribed right to work checks to establish a statutory excuse.
Enable the person or online matching service to take enforcement action against the employer or service provider where illegal working is identified and a statutory excuse has not been established, and equivalent provisions in respect of the direct contractual relationship between the employer or service provider and the individual carrying out the work or services. These provisions may include suspension or termination of the contract.
Require the employer or service provider to co-operate with the Home Office investigation including providing information relating to the chain of contracts.

A person or online matching service may, as part of the meeting these requirements, put in place arrangements to obtain assurance from an employer in the chain of contracts or a service provider that prescribed right to work checks have been carried out, providing that the person or online matching service ensures that the prescribed requirements have been met.

The Code states that these provisions are not limited to a single tier of contracting and whether liability for illegal working applies will be considered on a case-by-case basis. This will include how the arrangements operate in practice. It remains to be seen how the Home Office will approach these situations.

In the case where a contractual arrangement between employer and worker permits substitution the employer will only establish a statutory excuse against liability for a civil penalty where they have implemented the following processes before work or services commence:

A prescribed right to work check is carried out on any substitute.
Responsibility for such checks is not delegated to individuals carrying out the work or services.
No individual may carry out work or services as a substitute before their right to work has been verified.
Contractual provisions are in place between employer and worker including suspension or termination of the contract where the employer or worker know or have reasonable cause to believe that a substitute is working illegally.
For the duration of the employment the employer ensures that the worker and their registered substitute are the same individuals in respect of whom the right to work checks have been carried out.

Identity verification

To establish a statutory excuse against a civil penalty a person in a chain of contracts, an online matching service or an employer in the case of a substitution clause must maintain proportionate systems and processes to ensure that the individual carrying out the work or services is the same individual on whom the right to work check has been conducted.

Such systems and processes can include identity cards and workplace access records, facial verification technology including the use of registered Right to Work digital verification service providers (RtW DVSPs), biometric or attendance management systems, verification against training records or licences and re-verification at set intervals.

Persons beyond the scope of the scheme

Individuals who are operating in business on their own account, trading in their own name or as part of their own business who contract directly with clients or customers for the provision of services are not in the scope of the Scheme. This includes arrangements where services are provided directly to members of the public or under traditional business-to-business contracts for the supply of services, where the arrangement is for the purchase of a service rather than the employment of an individual to carry out work or services.

What should businesses do now?

Given that the Home Office is seeking to extend liability for civil penalties and that the penalty level for a first breach is £45,000 per worker, rising to £60,000 per worker for a repeat breach within three years, businesses must take action to protect themselves.

Ahead of the changes businesses should consider taking the following action:

Identify contractual arrangements which could come within the scope of extended liability and consider the content of future contracts.
Check all types of labour or workers used.
Review all existing contracts with service providers, subcontractors and any other agencies.
Review all HR systems and processes regarding right to work checks.
Review documentation to be collated to establish a statutory excuse.
Provide appropriate training to all relevant personnel including HR, contract and procurement teams.

For more details of recent Immigration developments read our articles on the Government’s Earned Settlement proposals and new concierge service and visa fees’ reimbursement scheme.