# IAA Code of Standards 2024: a guide for UK advisers

> The UK IAA Code of Standards 2024 explained: who must register, the nine Principles, levels, renewal fees, audits, records, complaints and the 2025 Act.

Pillar guide · Immigration compliance · By Syed Husnain Khalid · Published 8 October 2026 · Last checked 8 October 2026
Drafted with AI. Each claim was checked against the primary sources listed below by AI on 8 October 2026; a person has not reviewed it yet.
Canonical: https://vexralabs.com/insights/iaa-compliance-guide

Short answer

The IAA Code of Standards 2024 is the UK Immigration Advice Authority’s rulebook for immigration advisers: **nine Principles, each supported by numbered Codes**. It applies to anyone giving immigration advice or services in the UK on a “relevant matter”. They need IAA registration unless another legal regulator authorises them, as with solicitors in SRA-regulated firms, or an exception applies.

This guide is for owners and advisers at UK organisations registered with the Immigration Advice Authority (IAA), and for anyone about to apply. Three things changed recently: the regulator took its new name on 16 January 2025, parts of the Border Security, Asylum and Immigration Act 2025 came into force on 2 February 2026, and on 23 September 2026 the IAA announced that the competence assessment is paused. Building Filyst, our case management product, showed us that the Code sets a six-year retention period without a start date. The sections cover what the Code is, who it applies to, the nine Principles, levels, renewal, audits, records, complaints and the 2025 Act.

**Diagram: The IAA compliance cycle.** Five stages: register at a level and category after a competence assessment; follow the nine Principles of the Code of Standards; keep the records the Code requires; pass an IAA audit, which the IAA aims to carry out within 12 months of approval for new organisations; and re-register every year with CPD details and professional indemnity insurance.

*Registration is the start, not the finish: the Code, records, audits and annual renewal run continuously.*

## What is the IAA Code of Standards 2024?

The [Code of Standards 2024](https://assets.publishing.service.gov.uk/media/6776b2ef6c34906cc84c9499/IAA_Codes_of_Standards_2024.pdf) is the set of conduct standards that UK-regulated immigration advisers and organisations must meet. The Immigration Services Commissioner, who heads the IAA, makes it under paragraph 3(1) of Schedule 5 of the Immigration and Asylum Act 1999. The published version is dated September 2024.

The Immigration Advice Authority regulates immigration advisers in the UK. It was the Office of the Immigration Services Commissioner (OISC) until the [transition took effect on 16 January 2025](https://www.gov.uk/government/news/enhanced-agenda-and-identity-for-uk-immigration-advice-regulator), and the same news story says all existing OISC registrations and arrangements remain valid. Older material calls the same document the OISC Code of Standards. The UK IAA is a different body from New Zealand’s Immigration Advisers Authority.

The IAA also issues Guidance Notes on the Code. The Code says Guidance Notes “are not themselves provisions of the Code”, but an organisation that departs from one must be prepared to explain why and to prove the Principle was still met.

## Who must follow the Code and register with the IAA?

The Code applies to any organisation or person providing immigration advice or immigration services in the UK in relation to a “relevant matter” listed in section 82 of the 1999 Act, except those listed in Schedule 5, paragraph 3(3).

Relevant matters include asylum claims, entry clearance and permission to stay, nationality and citizenship, removal or deportation, bail, and appeals or judicial review on those matters ([IAA registration explained](https://www.gov.uk/government/publications/iaa-adviser-registration-explained/iaa-adviser-registration-explained), section 1.1).

[Section 84(1) of the Immigration and Asylum Act 1999](https://www.legislation.gov.uk/ukpga/1999/33/section/84) prohibits giving immigration advice or services unless you are a qualified person, and [section 91](https://www.legislation.gov.uk/ukpga/1999/33/section/91) makes doing so an offence. Section 84(2) lists four ways to be a qualified person:

- registered with the IAA;
- authorised by a designated professional body (DPB) to practise as a member of the profession it regulates, such as a solicitor or barrister;
- authorised to give immigration advice or services by a designated qualifying regulator (DQR);
- acting on behalf of, and under the supervision of, a person in one of the three groups above.

The offence carries up to six months’ imprisonment or a fine up to the statutory maximum on summary conviction, and up to two years or a fine on indictment (section 91(1)). The IAA’s guidance adds that advertising or offering immigration advice before the Commissioner approves an application is a separate offence under section 92B.

Section 1.3 of the guidance says you do not need IAA registration if a DPB or DQR already authorises you, which includes SRA-regulated law firms. Having a solicitor or barrister review your work outside a firm regulated by the SRA (Solicitors Regulation Authority) or BSB (Bar Standards Board) does not count, and IAA registration is still required. Registration is also not needed for:

- people holding an office under the Crown, employed by or for a government department, acting under a department’s control, or otherwise exercising Crown functions (section 84(6));
- organisations that only give second-tier advice to other advisers or signpost clients;
- licensed sponsors, relevant employers, and named educational institutions and health sector bodies, under three ministerial exemption orders, provided they meet and keep meeting the conditions in each order.

Licensed sponsors still carry their own Home Office duties, which [Appendix D sponsor licence record keeping](https://vexralabs.com/insights/sponsor-licence-record-keeping) covers.

## What do the nine Principles of the Code require?

The Code sets nine Principles, and each is supported by numbered Codes that begin “You must”. The Code says the listed Codes “are not exhaustive”: an adviser can breach a Principle without breaching a listed Code.

| Principle | Wording (shortened) | Key Codes |
| --- | --- | --- |
| 1 | Uphold the rule of law and proper administration of justice | 1.2 never knowingly or recklessly let clients, the Commissioner, the Home Office, courts, tribunals or third-party agencies be misled |
| 2 | Behave with honesty and integrity | 2.3–2.4 report serious misconduct; 2.5–2.6 no referral inducements; 2.7 no fees if registered as non-fee charging |
| 3 | Comply with legal and regulatory requirements to the IAA, openly, promptly and co-operatively | 3.3 no work above your Level or Category without written permission; 3.5 written complaints procedure; 3.6–3.7 notify changes, charges and convictions |
| 4 | Act competently and respect confidentiality | 4.4 meet the Commissioner's CPD requirements; 4.5 keep client affairs confidential |
| 5 | Act in the client's best interest and give a good quality of service | 5.3–5.4 client care letter and its agreement; 5.5 written progress updates; 5.8 closure letter; 5.10 keep files at least six years |
| 6 | Maintain high standards of conduct and public trust in the scheme | 6.1 display the registration number; 6.3 no touting; 6.5 no success-rate statements |
| 7 | Treat everyone fairly and without prejudice | 7.1 fairness and dignity; 7.2 equal opportunity whatever the client's vulnerability |
| 8 | Manage business affairs and client records effectively | 8.2 professional indemnity insurance; 8.4 file management system; 8.5 attendance notes |
| 9 | Charge fairly and transparently and deal properly with client money (fee-charging organisations) | 9.1 fee scale; 9.2 invoices and proof of payment; 9.4 separate client account for money taken in advance |

The Code gives an example of the spirit rule: Code 6.3 bans touting, and an adviser who uses a third party to tout may not breach the Code but would breach the spirit of the Principle. The reverse can also happen. Where a client in detention cannot sign the client care letter, the Commissioner may decide that Code 5.4 was not met but Principle 5 was not breached.

## What does the Code ban outright?

Several Codes are worded as outright prohibitions. They include:

| Prohibited conduct | Code |
| --- | --- |
| Knowingly or recklessly allowing clients, the Commissioner, the Home Office, courts, tribunals or third-party agencies to be misled | 1.2 |
| Demanding, accepting or offering an inducement for referring or recommending a client | 2.5–2.6 |
| Charging a fee as a registered non-fee-charging organisation | 2.7 |
| Working above your authorised Level or Category without the Commissioner's written permission | 3.3 |
| Touting for immigration business | 6.3 |
| Criticising other organisations or advisers in promotional material | 6.4 |
| Making public promotional statements about success rates | 6.5 |

## What are the IAA levels and categories?

The IAA authorises each adviser at one of three levels, within one or more of three categories of work (registration guidance, sections 2.2 and 3.1).

| Level | What it allows | Experience normally expected |
| --- | --- | --- |
| Level 1: Advice and Assistance | Applications that rely on the straightforward presentation of facts to meet a set of qualifying criteria | 3 months full-time UK immigration advice, or 6 months full-time non-immigration advice |
| Level 2: Casework | Level 1 work plus asylum and more complex, discretionary matters; can lodge notices of appeal but cannot represent at appeal | 12 months, including 6 months of Level 2 work |
| Level 3: Advocacy and Representation | All Level 1 and 2 work plus representation before the First-tier and Upper Tribunal (Immigration and Asylum Chamber) | 18 months, including 6 months of Level 3 work |

The categories are Immigration, Asylum and Protection, and Judicial Review Case Management, which only Level 3 advisers can apply for. Under the current arrangements the competence assessment pass mark is 60% for Level 1 and 65% for Levels 2 and 3.

On 23 September 2026 the IAA [announced that the online competence assessment is temporarily paused](https://www.gov.uk/government/news/iaa-announces-changes-to-the-competence-assessment-process). Assessments are anticipated to resume from November 2026 under new arrangements: revised syllabuses, an added component on the Code of Standards, ethics and professional behaviours, and the assessment moved to the start of the application. The [IAA Level 1 exam guide](https://vexralabs.com/insights/iaa-level-1-exam) tracks those changes.

## How do annual re-registration, fees, PII and CPD work?

Registered organisations must re-register with the IAA every year. Nine weeks before the registration expires, the primary contact receives an email invitation to apply for continued registration (registration guidance, section 8.1).

Under the Immigration and Nationality and Immigration Services Commissioner (Fees) (Amendment) Regulations 2022, continued registration costs from £733 (Level 1) to £2,698 (Levels 2 and 3 with 10 or more advisers). [IAA fees 2026](https://vexralabs.com/insights/iaa-fees) sets out every band, including the higher initial registration fees.

No organisation can be part of the scheme without professional indemnity insurance (PII), the cover Code 8.2 requires. Every adviser must demonstrate compliance with the Commissioner’s Continuing Professional Development (CPD) requirements and gives CPD details each year at continued registration; the [IAA CPD requirements](https://vexralabs.com/insights/iaa-cpd-requirements)post explains the scheme. Changes that may affect competence or fitness, such as a new adviser or a new address, are notified within 10 days, and a new adviser must wait for the Commissioner’s authorisation before advising.

## What happens at an IAA audit?

An IAA audit checks that the policies and procedures the Code requires are being followed and examines client files and adviser competence. The IAA’s regulations summary (updated 25 October 2024) says it aims to audit every newly regulated organisation within 12 months of approval, and the registration guidance says it selects organisations for audit each year.

The audit is where the Code is tested file by file, so the [Immigration Advice Authority audit checklist](https://vexralabs.com/insights/iaa-audit-checklist) turns each Principle into evidence to have ready.

## What records does the Code require?

The Code names these records directly:

- a client care letter, with a signed and dated copy or evidence of electronic agreement (Codes 5.3–5.4);
- written progress updates (5.5) and a closure letter or statement (5.8);
- attendance notes of all dealings with and on behalf of the client (8.5);
- complete, clear and accurate financial records, and invoices with proof of payment (8.3, 9.2);
- every client file and record for at least six years, then securely destroyed (5.10).

The [IAA client care letter](https://vexralabs.com/insights/iaa-client-care-letter) post covers the first record and includes a template. Code 5.10 sets the retention duty explained in [how long UK immigration advisers must keep client records](https://vexralabs.com/insights/immigration-adviser-file-retention).

## How do complaints against IAA advisers work?

Every regulated organisation must have and implement an effective written complaints procedure (Code 3.5), and the client care letter must give its details. A complaint can also go to the IAA, which assesses whether the conduct breached the Principles or the Codes under the IAA Complaint Scheme.

Complaints can come from any source and should normally be made within 12 months of the complainant first becoming aware of the issue (registration guidance, section 11.3). A serious failure, or a persistent pattern, can lead to regulatory action. The [IAA complaints procedure](https://vexralabs.com/insights/iaa-complaints-procedure) post sets out what a firm’s own procedure needs.

## What does the 2025 Act change for IAA advisers?

The Border Security, Asylum and Immigration Act 2025 amends Part 5 of the 1999 Act through section 43 and Schedule 1. It received Royal Assent on 2 December 2025, and only some of Schedule 1 is in force on the date this guide was checked.

**Diagram: IAA Code of Standards: key dates 2024 to 2026.** September 2024: Code of Standards 2024 published. 16 January 2025: the OISC becomes the Immigration Advice Authority. 2 December 2025: the Border Security, Asylum and Immigration Act 2025 receives Royal Assent. 2 February 2026: parts of Schedule 1 come into force. 23 September 2026: the IAA announces that the competence assessment is paused. November 2026: assessments anticipated to resume under new arrangements.

*The Code itself has not changed since September 2024; the law around it and the assessment have.*

According to the commencement notes on [Schedule 1 on legislation.gov.uk](https://www.legislation.gov.uk/ukpga/2025/31/schedule/1), the parts in force from 2 February 2026 (S.I. 2026/59) include a power for the Secretary of State to amend the list of relevant matters by regulations, and a new section 93A that lets fees be set by order. The suspension powers for the Commissioner, where conduct creates a risk of serious harm (new paragraph 4AA of Schedule 6) or where an adviser is charged with certain offences (paragraph 4B), are shown as not yet in force. The new monetary penalties for failing to comply with the Code are in force only so far as they confer power to make regulations ([section 65(3)(f)](https://www.legislation.gov.uk/ukpga/2025/31/section/65)). [OISC vs IAA: what changed](https://vexralabs.com/insights/oisc-to-iaa-changes) follows each power as it comes into force.

## Which Code records can case software keep?

Case software keeps the Code’s records as a by-product of the work: dates, approvals and who did what. It does not write a complaints procedure, buy insurance or make a firm compliant; the adviser’s conduct does. Filyst, our own case management product for immigration firms, records three items that the Code and an audit look for:

- sign-off by a second person, because a case stage cannot be approved by the person who asked for the approval;
- an audit log of who did and approved what, and when;
- a retention date set when a case is closed, six years by default for UK firms, with a reminder when destruction is due.

Code 5.10 says “at least six years” and names no start date. Filyst starts the clock on the day a case closes, and a firm’s written retention policy needs to name its own start point in the same way. No regulator approves case software. This guide is the hub of our [immigration compliance](https://vexralabs.com/insights/topics/immigration-compliance) topic, and [software for immigration firms](https://vexralabs.com/immigration-firms) describes how we set Filyst up to keep these records.

Not legal advice

This guide summarises the IAA Code of Standards 2024, IAA guidance and the legislation as checked on the date shown. It is not legal advice. For your firm’s situation, read the Code itself and contact the IAA.

## Frequently asked questions

### Is the OISC the same as the IAA?

Yes. The Office of the Immigration Services Commissioner became the Immigration Advice Authority on 16 January 2025, and all existing OISC registrations and arrangements remained valid.

### Do solicitors need to register with the IAA?

Usually not. Solicitors and barristers authorised by their own regulator, such as the SRA or BSB, are qualified persons under section 84(2) without IAA registration. A solicitor working inside an IAA-regulated organisation can still act as an IAA adviser and must then follow the Code.

### How often must an IAA-registered organisation re-register?

Every year. The primary contact receives an email invitation nine weeks before the registration expires.

### Can an IAA adviser advertise success rates?

No. Code 6.5 says advisers must not make public promotional statements about their success rates, orally or in writing.

### Is the Code of Standards 2024 still the current version?

Yes, on the date this guide was checked. The published Code is dated September 2024; the IAA's registration guidance was last updated on 5 October 2026.

## Sources

1. [IAA, Code of Standards 2024 (PDF)](https://assets.publishing.service.gov.uk/media/6776b2ef6c34906cc84c9499/IAA_Codes_of_Standards_2024.pdf)
2. [IAA, IAA registration explained (updated 5 October 2026), sections 1.1, 1.3, 2.2, 3.1, 6.2, 8.1, 9.1, 11.2 and 11.3](https://www.gov.uk/government/publications/iaa-adviser-registration-explained/iaa-adviser-registration-explained)
3. [IAA, Regulations that immigration advisers must follow (updated 25 October 2024)](https://www.gov.uk/government/publications/regulations-that-immigration-advisers-must-follow--2/regulations-that-immigration-advisers-must-follow)
4. [Immigration and Asylum Act 1999, section 84](https://www.legislation.gov.uk/ukpga/1999/33/section/84)
5. [Immigration and Asylum Act 1999, section 91](https://www.legislation.gov.uk/ukpga/1999/33/section/91)
6. [IAA, IAA announces changes to the competence assessment process (23 September 2026)](https://www.gov.uk/government/news/iaa-announces-changes-to-the-competence-assessment-process)
7. [Enhanced agenda and identity for UK immigration advice regulator (16 January 2025)](https://www.gov.uk/government/news/enhanced-agenda-and-identity-for-uk-immigration-advice-regulator)
8. [Border Security, Asylum and Immigration Act 2025, section 43](https://www.legislation.gov.uk/ukpga/2025/31/section/43)
9. [Border Security, Asylum and Immigration Act 2025, Schedule 1](https://www.legislation.gov.uk/ukpga/2025/31/schedule/1)
10. [Border Security, Asylum and Immigration Act 2025, section 65](https://www.legislation.gov.uk/ukpga/2025/31/section/65)