With the Home Office significantly increasing enforcement activity, employers are facing greater scrutiny than ever before, particularly in relation to right to work checks and sponsor licence compliance. At the same time, penalties for non-compliance have become increasingly severe.
In this article, we highlight what employers need to know about the new right to work scheme, including how organisations can protect themselves and what actions employers should take now.
Following the enactment of the Border Security, Asylum and Immigration Act 2025, the government has published a draft code of practice on preventing illegal working.
The proposed changes in the scheme will substantially expand the scope of the UK's right to work and civil penalty framework, extending it beyond traditional employment relationships to include workers, individual subcontractors and certain online matching service providers. In some circumstances, liability may also extend beyond the organisation with the direct contractual relationship with the individual performing the work.
With Home Office audits on the rise and employers reportedly facing more than £130 million in civil penalties during 2025 alone, the financial, operational and reputational risks are significant. Employers should familiarise themselves with the new requirements and review their compliance frameworks in readiness for the scheme's implementation date of 1 October 2026.
Under UK law, organisations have a duty to prevent illegal working. An employer that employs an individual without the necessary permission to undertake the work in question may be liable for a civil penalty of up to £60,000 per worker.
A legal defence can be established by conducting a compliant right to work check before employment or engagement begins.
Historically, the scheme applied primarily to traditional employment relationships. Under the new framework, however, the definition of 'employer' is significantly broadened and will include organisations engaging individuals:
under a contract of employment, service or apprenticeship, for example, a traditional employment relationship,
under a worker's contract,
as an individual subcontractor; or
when operating as an online matching service providing the details of an individual who is a service provider to potential clients or customers.
An 'online matching service' is defined as an organisation that, in the course of business:
keeps a register of service providers for the purpose of matching them with potential clients or customers,
provides an online service by which potential clients or customers can submit enquiries for the purpose of being matched with suitable service providers; and
charges a fee or commission in return for making such matches.
Importantly, these definitions apply specifically for the purposes of the scheme and do not alter the wider employment law status of the individuals concerned.
To establish a legal defence, organisations must conduct right to work checks in one of the prescribed ways.
1. Manual document-based check
This method applies where an individual can present an acceptable document from Lists A or B of the Home Office's employer's guide to right to work checks guidance.
2. Home office online right to work service
This method must be used for all individuals who hold an eVisa.
3. Digital identity verification through an approved provider
Approved Identity Service Providers may undertake digital right to work checks for holders of valid British or Irish passports, including Irish passport cards. Certain expired British or Irish passports may also be accepted, for example if they expired within six months, although individual providers may not support verification of expired documents.
Approved providers may also be used to verify certain acceptable documents contained within Lists A and B when and where they are available from the issuing authority in a digital format.
The new scheme introduces circumstances in which liability for illegal working may extend beyond the organisation with the direct contractual relationship with the worker.
Although the Home Office will generally seek to identify and pursue the direct employer first, liability may extend where:
A company is under a contract to provide work or services to a third party and enters into a contract with another employer who employs worker(s) to carry out all or part of the work or services required to fulfil that contract.
An online matching service matches a service provider with a client or customer to provide work or services, and the service provider enters into a contract with the client or customer.
An employer employs an individual to provide work or services, and the contract permits that individual to substitute their work or services to be carried out by another individual in their place.
However, the extended liability provisions are not intended to apply to businesses merely purchasing services from another business, nor to client, customer or end users procuring services for their own internal operations.
The Home Office has clarified in their revised draft code of practice that the extended liability provisions would only apply to contractual arrangements entered into from 1 October 2026.
The Home Office has outlined a number of measures that organisations should adopt to reduce exposure to civil penalties and establish a legal defence where applicable.
Organisations should ensure they have written contractual protections with service providers. The Home Office recommends the following protections:
requiring the service provider to carry out right to work checks;
requiring the service provider obtaining the organisation’s consent to subcontract any work;
allowing the organisation to take enforcement action against the service provider where illegal working is identified; and
requiring the service provider to cooperate with any Home Office investigation in relation to illegal working.
If substitution for the performance of any aspect of work is permitted, the Home Office also suggests action organisations must take before a substitute begins work. This includes a prescribed work check on the substitute and, for the duration of employment, ensuring the substitute is the same individual whose right to work has been checked.
Organisations must introduce and maintain systems to ensure that the individual undertaking the work is the same person on whom the right to work check was carried out. The Home Office suggests methods including issuing identity cards or workplace passes; biometric or attendance management systems; and reverification at set intervals, for example when a worker starts a period or shift of work or when they are allocated a new task or assignment service. The Home Office recommends reverification occurs at least once in any 24 hour period.
Although the new scheme will not take effect until 1 October 2026, organisations should begin preparing now. Recommended actions include:
reviewing and updating internal right to work policies and procedures,
auditing existing right to work records and evidence,
confirming that any identity service provider used is Home Office approved,
identifying all non-employee engagements that fall within the expanded definition of 'employer',
reviewing and updating existing outsourcing, subcontracting, labour supply and platform contracts,
ensuring future contracts incorporate the prescribed right to work provisions,
implementing appropriate identity verification and substitution controls; and
training staff on the new scheme.
Employers that fail understand the requirements of this new scheme risk substantial civil penalties, operational disruption and reputational damage. Given the complexity of the new framework and its potential impact across supply chains and the workforce, employers should seek legal advice on how to implement the scheme.
For further information, please contact our employment team.
