Print article
Author
Article:
The Home Office has published updated right to work guidance ahead of significant changes to the illegal working regime, which are due to take effect on 1 October 2026. Whilst much of the media commentary has focused on an apparent expansion of right to work checks, the reality is more nuanced. The fundamental obligation to conduct right to work checks remains with the employer that directly engages the worker. The real change is that businesses higher up the labour supply chain may now face civil penalty exposure if they fail to implement prescribed compliance measures.
For HR teams, this means right to work compliance is no longer simply about checking employees. It is increasingly becoming a supply chain risk management issue.
What has changed?
The new Code of Practice introduces an “extended liability” regime in specific contractual arrangements. The provisions apply where:
- a business contracts to provide work or services to a third party and engages another employer to provide workers to deliver those services;
- an online matching platform connects service providers with customers; or
- an individual is engaged under a contract that permits them to send a substitute to perform the work.
Where illegal working is identified, the Home Office will continue to seek to identify the employer with the direct contractual relationship with the worker. However, if that employer cannot be identified, or prescribed compliance requirements have not been met, liability may extend to another party higher up the contractual chain.
This represents a significant shift in risk allocation.
Do employers now need to conduct right to work checks on everyone in their supply chain?
No.
The Code is clear that the employer with the direct contractual relationship with the worker remains responsible for carrying out the prescribed right to work check and establishing a statutory excuse.
However, organisations can no longer assume that responsibility ends there.
Businesses that use agencies, labour providers, subcontractors or other outsourced labour arrangements must now ensure that appropriate contractual protections and compliance controls are in place throughout the contractual chain. Failure to do so could expose them to civil penalties if illegal working is subsequently identified.
Which businesses are most likely to be affected?
The changes are likely to have the greatest impact on businesses that:
- source workers through agencies
- utilise subcontracted labour
- provide outsourced services for clients
- operate through multiple tiers of contractors
- engage consultants or contractors with substitution rights
- use online platforms to match workers with customers
For these organisations, compliance will no longer stop at confirming that direct employees have been checked.
The new compliance requirements
To establish a statutory excuse against extended liability, businesses within the contractual chain must be able to demonstrate compliance with a series of prescribed requirements. These include:
- written contractual terms requiring right to work checks to be carried out
- restrictions on further subcontracting without consent
- audit rights to verify compliance
- enforcement mechanisms where illegal working is identified
- cooperation obligations in relation to Home Office investigations
- substitution controls
- identity verification processes to ensure that the individual carrying out the work is the same person whose right to work was checked
Importantly, businesses must retain evidence that these arrangements have been implemented and operated in practice. The Code expressly states that a person seeking to rely on a statutory excuse must be able to evidence compliance with the prescribed requirements.
Substitution clauses: an overlooked risk
Many organisations engage consultants or contractors under agreements that allow the contractor to provide a substitute.
The new Code places significant emphasis on these arrangements. Where substitution is permitted, employers must have processes in place to ensure that:
- right to work checks are conducted on substitutes
- substitutes cannot commence work until those checks have been completed
- responsibility for checks is not delegated to the contractor
- systems exist to verify that the individual performing the work is the same individual who has been checked
This is likely to require many organisations to review standard consultancy agreements and contractor onboarding procedures before October.
Other key operational changes
The updated Employer’s Guide also clarifies that expired physical Biometric Residence Permits (BRPs) are not acceptable evidence of a right to work. Employers should ensure that recruitment and onboarding teams are aware of this change.
The Home Office also continues to move towards digital immigration status verification and eVisa-based checking processes. Employers should therefore review existing procedures and ensure staff are comfortable conducting online right to work checks where appropriate.
What should employers do now?
Before 1 October 2026, organisations should:
- review agency, contractor and subcontractor arrangements
- update labour supply contracts to include the prescribed right to work provisions
- assess whether existing audit rights are sufficient
- review substitution clauses and related controls
- ensure appropriate identity verification processes are in place
- train HR, procurement and operational teams on the new requirements
- undertake an audit of existing right to work compliance processes
Key changes at a glance:
| Change | Current Position | Position from 1 October 2026 | Recommended Action |
| Direct employees | Direct employer responsible for right to work checks | No substantive change | Continue existing compliant checking processes |
| Agency and subcontracted labour | Compliance typically focused on direct employer | Liability may extend up the contractual chain if prescribed requirements are not met | Review labour supply arrangements and contracts |
| Labour supply chains | Limited exposure for parties further up the chain | Extended liability provisions apply in specified arrangements | Implement contractual protections and audit rights |
| Substitution clauses | Often not specifically addressed in RTW processes | Specific controls required for substitute workers | Review contractor agreements and onboarding processes |
| Identity verification | No prescribed extended liability framework | Ongoing identity verification systems expected | Implement proportionate verification controls |
| Expired BRPs | Frequently encountered in legacy processes | Not acceptable evidence of right to work | Update recruitment guidance and training |
| Evidence and record keeping | Required for statutory excuse | Critical for establishing protection against extended liability | Retain evidence of compliance measures |
Michelmores’ view
The most important takeaway for employers is this:
The question is no longer simply “Have we checked our employees?”
It is now:
“If illegal working is discovered anywhere within our labour supply arrangements, can we demonstrate that we have the contractual protections, verification processes and compliance controls required by the Code?”
For many businesses, particularly those relying on agency workers, subcontractors, outsourced service providers or contractor models, that will require a broader review of compliance arrangements well before 1 October 2026. The organisations that act now will be best placed to avoid civil penalties and demonstrate a statutory excuse if the Home Office comes calling.