On 19 August 2026, the Security Industry Authority (SIA) published five years of licence revocation data in response to a Freedom of Information request (FOI reference 0621). The release covers every SIA licence revocation recorded between 1 January 2022 and 2 August 2026, broken down by reason, alongside a second dataset showing right-to-work revocations by nationality.

Most security employers plan their vetting around the risks that make headlines: violence, weapons, dishonesty. The SIA’s own numbers say that’s not where the licensed workforce is actually being lost.

The Compliance Blind Spot the Data Exposes

Of the 24,969 SIA licences revoked between January 2022 and 2 August 2026, 22,526 (90.2%) were pulled for one reason: the licence holder no longer had the right to work in the UK.

Violent or abusive behaviour, sexual behaviour, drug use or supply, dishonesty and fraud, offensive weapons, criminal damage, abuse or neglect of children, and driving offences: these are the categories most operators actually build their vetting programmes around, and together they account for 2,006 cases. That’s just over 8% of everything the SIA has revoked in almost five years.

Revocation reason	Total (Jan 2022–Aug 2026)	Share of total
No right to work	22,526	90.2%
Violent/abusive behaviour	1,065	4.3%
Other (predominantly right-to-work related)	640	2.6%
Sexual behaviour	265	1.1%
Drug use/supply	231	0.9%
Dishonesty (theft & fraud)/proceeds of crime	162	0.6%
Offensive weapons/firearms	129	0.5%
Criminal damage	80	0.3%
Abuse or neglect of children	58	0.2%
Private Security Industry Act offences	41	0.2%
Driving offences	16	<0.1%
Operation Siren/espionage & terrorism (combined)	<20	<0.1%

Source: SIA licence revocation data, January 2022–2 August 2026.

“9 in 10 SIA licence revocations in the past five years had nothing to do with violence, weapons or dishonesty. They came down to one thing: the licence holder’s right to work had lapsed.”

The SIA also notes that the “Other” category (640 revocations) is largely linked to right-to-work issues. When these cases are included, right-to-work problems could account for more than 92% of all licence revocations in the dataset. 

Why This Should Change How You Think About Risk

Here’s the strategic problem. A vetting programme built to catch the 8% (the officer who hides a conviction, the candidate with an undisclosed weapons charge, the applicant who fails a drugs screen) is necessary work, and it should stay part of any serious screening process. But it isn’t what’s actually thinning out licensed workforces at scale.

The thing quietly costing operators their headcount is administrative: a Biometric Residence Permit that expired without anyone noticing, a pre-settled status condition that changed, a visa route that ran out mid-contract.

A right-to-work check at the point of hire only proves one thing: that someone was eligible to work on the day the check was done. It says nothing about whether they’re still eligible six months later, or eighteen. Visas expire on fixed dates. Pre-settled status has to convert to settled status by a deadline. None of that resurfaces unless someone goes looking for it, and for most security employers checking manually or only at onboarding, nobody is.

The Trend is Accelerating, Not Stabilising

The SIA only began systematically recording revocation reasons in December 2021, which makes 2022 the first full year of comparable data. Right-to-work revocations since then:

Right-to-work licence revocations by year: 2022 – 734 · 2023 – 3,363 · 2024 – 6,445 · 2025 – 7,740 · 2026 (to 2 August, partial year) – 4,244.

That’s more than a tenfold increase from 2022 to 2025. With exactly five months of 2026 still to run at the time of this release, the year is already tracking toward a similar range to 2025, not a decline. Whatever combination of tighter Home Office enforcement, sharper SIA checks and workforce composition shift is driving this, the direction has held for four years running. Plan your compliance calendar around a curve that’s still rising, not one you’re hoping will flatten. 

Where the Risk Concentrates

The second dataset breaks the 22,526 right-to-work revocations down by the licence holder’s nationality, across 110 separate categories (a small number of which are administrative labels such as ‘Other’, ‘None’ and ‘Not Known’, rather than nationalities). Five nationalities account for the large majority:

Nationality	Revocations (Jan 2022–Aug 2026)	Share of RTW total
Pakistani	9,625	42.7%
Indian	7,861	34.9%
Nigerian	2,898	12.9%
Bangladeshi	707	3.1%
Ghanaian	429	1.9%

These five nationalities alone account for roughly 95% of all right-to-work revocations in the dataset.

It’s important to be clear about what this data shows. A ‘no right to work’ revocation usually reflects a change in immigration status, such as an expired visa or change in settled status. It does not mean the licence holder has acted dishonestly or done anything wrong. For employers with large numbers of workers from these communities, the message is simple: right-to-work checks should be monitored regularly, not just once a year. 

The Legal Exposure You’re Already Carrying

The risk goes beyond losing a member of staff. Under the Immigration, Asylum and Nationality Act 2006, employers who complete the correct right-to-work check when hiring are protected from a civil penalty if that person later loses their right to work. However, for workers with time-limited permission, this protection only lasts until that permission expires. 

The Home Office’s own guidance is explicit: employers have to carry out a follow-up check on or before the date that permission expires to keep the excuse and keep employing that person lawfully.

Miss that check, and the risk goes beyond having a licensed officer missing from the rota. Since February 2024, employers can face civil penalties of up to £45,000 per illegal worker for a first breach and £60,000 for a repeat breach. When you look at the SIA’s figures, this isn’t just a potential risk. It’s an issue already affecting the security industry at scale. 

Build This Into Your Compliance Strategy, Not Your Onboarding Checklist

A right-to-work check at onboarding confirms someone’s status at that point in time. It does not tell you what happens when their permission changes months or years later. That’s the gap this data exposes.

The answer is to make right-to-work part of your ongoing compliance process, with clear expiry dates, follow-up checks and a reliable record of what was checked and when.

GuardCheck consolidates the right-to-work, identity, DBS, employment history and SIA licence checks you’d otherwise run separately, and is independently certified to BS 7858:2019 and NSI NCP 111. For licence validity day to day, Licence Hub checks your register against the official SIA database daily and flags issues by email.

What This Means For Your Compliance Strategy

The data points to a simple shift in priorities. Right-to-work should be an ongoing workforce responsibility, not something that ends when an employee passes their initial checks.

• Track time-limited permission: Record when each employee needs a follow-up check and act before the deadline.
• Keep clear records: Maintain evidence of checks, documents and follow-up actions.
• Review your workforce regularly: Don’t rely on onboarding checks to catch changes later in an employee’s contract.
• Keep broader vetting in place: Violence, dishonesty and other risks still matter, even though they account for a much smaller share of SIA revocations.
• Reduce manual admin: Use a centralised process to make checks easier to manage and provide evidence.

The key lesson from five years of SIA data is simple: vetting cannot end at onboarding. People’s circumstances change, and your compliance process needs to be built to catch those changes before they become a licence revocation, an empty shift or a larger compliance problem.

Conclusion

The SIA’s latest data highlights a gap that many security employers cannot afford to overlook. Right-to-work status can change long after an employee has passed their initial checks, and without a process for monitoring those changes, a compliance issue can quickly become a staffing and operational problem.

GuardCheck helps make security vetting simpler and faster to manage, bringing key screening checks together in one digital process so employers spend less time chasing paperwork and more time keeping their workforce ready to deploy.

If your current vetting process still relies heavily on manual checks and spreadsheets, it may be time to rethink how you manage compliance beyond onboarding.

Book a free demo to see how GuardCheck can streamline your security screening process.

The vast majority of security company HR managers lose sleep over the same issue: the ever more difficult quest to find reliable, SIA-licensed and professional officers who can genuinely do the job. It’s a security recruitment problem that starts long before the interview stage.

Since the start of this decade, demand for good security personnel has grown dramatically while the pool of suitably licensed people has contracted by a similar margin. Big events, the retail crime epidemic, hospital security contracts, the rise of Street Wardens, data centres popping up everywhere, and gargantuan distribution facilities are all draining what was already a shallow talent pool.

Add horrendous cost of living pressures, antisocial hours, and the abysmal public perception of private security, and you have a sector that could not be less appealing to good people.

Unfortunately, there’s an issue having an even bigger negative impact on the industry: the calibre and quality of the security personnel themselves. This problem starts with the mandatory SIA licence.

How Are Some People Getting SIA Licences?

The Security Industry Authority licence was designed as a baseline of competence and integrity. In practice, the system has weak points that bad actors have become highly adept at exploiting.

Site managers regularly inherit officers whose spoken English is minimal, who couldn’t write a coherent incident report, had no grasp of conflict management, and in some cases couldn’t give a coherent account of their own training when pressed. Yet they were still badged.

Three routes keep cropping up:

Training Malpractice

A minority of training providers still cut corners to push volume — “fast-track” courses where physical intervention may be demonstrated once, exam papers are coached, and attendance sheets are signed off despite no-shows. The SIA does audit providers, but rogue operators open, churn out candidates, and close before sanctions bite. The candidate leaves with a certificate, the provider banks the cash, and the employer takes on the risk.

Identity and Exam Fraud

Impersonation at exams isn’t new, and neither is the selling of answers. Organised groups target centres with lax ID checks. Once the certificate is issued, the SIA application process relies on that certificate being genuine — turning the licence into a passport into the industry for someone who was never properly assessed.

Organised Crime Adapts

The SIA’s criminality checks are robust, but they depend on declared identities and convictions. False documents, undisclosed overseas convictions, and the time lag between charge and conviction all create gaps. When an unsuitable individual gets a licence, every assignment they attend undermines public trust and puts clients, the public, and everyone around them at risk.

The result for employers is brutal: you spend on recruitment, vetting, uniform and onboarding, only to remove the officer within weeks. Your client loses confidence, your remaining team picks up the slack, insurance risk rises, and the good officers you do have get tarred with the same brush.

What Makes a Professional Security Officer

A professional security officer isn’t just anyone with an SIA licence. They demonstrate five key attributes before they ever step on site.

Attribute	What It Looks Like on the Ground	How Employers Verify It
Competence	Can handle conflict, write an MG11-ready statement, operate CCTV and access control	Practical assessment + documented CPD
Verified training history	Certificates from audited, reputable providers with dates and trainer names	Digital credentials, direct provider confirmation
Spotless compliance	No hidden sanctions, right to work confirmed, 5-year history checked	BS7858:2019 screening with digital audit trail
Character suitability	Punctuality, communication, adherence to assignment instructions, standard of dress, attitude	Reference data, attendance history, ratings
Digital literacy	Uses reporting and shift management apps, understands GDPR, is aware of cybersecurity	App usage data, short skills checks

If you’re hiring without evidence of those five, you’re hiring on hope. And hope isn’t a reliable vetting policy.

Raising the Bar Starts With Better Tools

The industry can’t wait for regulation to catch every loophole. It needs systems that make it harder for malpractice to enter the workforce and easier for genuine professionals to stand out. That’s where purpose-built technology changes the game.

For my money, GuardPass has become the practical answer for HR teams tired of sifting CVs and chasing paper.

Why GuardPass Shifts the Security Recruitment Dynamic

GuardPass isn’t a job board. It’s an end-to-end security recruitment system built around SIA licensing and the real workflows of UK security firms. It tackles two problems at once: keeping unqualified people out, and speeding up the hiring of the right people.

Licence-First Candidate Verification

Every candidate profile links directly to their SIA licence record. Expiry dates, sectors, conditions and suspensions update automatically — no more “I’ll bring my badge on day one” surprises. If the licence isn’t valid, the profile doesn’t reach your shortlist.

Training Provenance and CPD Tracking

GuardPass partners with audited training providers. Certificates are uploaded with provider, trainer, date and location metadata, and the system flags anomalies — like the same trainer running courses in Leeds and Plymouth on the same day. Officers also log CPD, from ACT Awareness to mental health first aid, so you see who invests in their own standards.

Digital Right to Work and BS7858:2019 Screening

The app guides candidates through compliant ID checks, share code capture, and 5-year history. HR gets a structured screening pack, not a zip file of photos, with gaps flagged before you spend time interviewing. That alone cuts screening admin by 60% for most teams.

Skills and Role Matching, Not Keyword Bingo

Roles on GuardPass are tagged by sector, site type, shifts and required competencies. Candidates complete short, scenario-based assessments for door supervision, CCTV, retail, corporate, construction and healthcare — so filtering for “conflict management + incident reporting + night shifts + Canary Wharf” surfaces people who actually match, not just people who typed those words.

Compliance-Ready Document Vault

Uniform sizes, bank details, insurance documents, licences and certificates are all stored with expiry alerts. When you onboard, you’re not chasing PDFs, and the audit trail is there if the SIA or your client asks.

Attendance and Performance Data

Once placed, officers clock in through the app, file digital incident reports, and receive site-specific assignment instructions. HR and ops see punctuality, report quality and client feedback over time, building a bench of proven officers you can redeploy first — ending the cycle of “new face, new risk” on every contract.

Fraud-Resistant Onboarding

Liveness checks and ID document NFC reads during app registration make impersonation harder. Combined with provider-verified certificates, it closes the door on the most common routes malpractice uses to get a licence into the wrong hands.

Direct Applicant Communication

In-app messaging and interview scheduling cut ghosting. Candidates pick slots, get reminders, and upload anything missing before the interview — and HR teams report show-up rates rising because the friction is gone.

Analytics for Workforce Planning

The dashboard shows licence expiries across your pool, training gaps by site, and time-to-hire by role. You can see, for example, that 14% of your door supervisors expire in September and that CCTV PSS competence is thin in Kent — letting you train or recruit before the client feels it.

Putting It Into Practice: A Better Hiring Flow

Here’s what security recruitment looks like when you use GuardPass properly.

1. Define the Real Requirement

Don’t just post “SIA DS” — tag the site type, systems used, report standards and physical requirements, so the matching engine respects it.

2. Auto-Filter for Compliance

The system hides anyone without a valid, appropriate licence, right to work, or core certificates, so you start from a clean pool.

3. Assess What Matters

Use the built-in scenario questions or upload your own — you’re testing decision making, not memory.

4. Interview With Context

You see training provenance, previous sites and performance data before the call, so the conversation starts two steps ahead.

5. One-Click Offer and Onboarding

Contracts, assignment instructions and uniform requests go out through the app. The officer accepts, completes remaining checks, and you have a start date with confidence.

The Wider Impact on Malpractice

When the major employers in a region all recruit through a system that verifies licences, checks training provenance and logs performance, the economics of malpractice collapse.

There’s no point paying a dodgy provider if the certificate won’t get you past the first filter. There’s no value in exam fraud if liveness checks catch you at onboarding. The bad actors move on, and the professionals get the work faster.

A Final Word to Hiring Managers

We won’t fix the UK’s officer shortage by lowering standards. We fix it by protecting the standards we have and making it easy to hire people who meet them. That means treating vetting as a process, not a paperwork pile. It means using data from the field to reward reliability. And it means backing tools built by the industry, for the industry.

GuardPass doesn’t replace human judgement — it gives that judgement better information, earlier. In a market where one bad hire can lose a contract, and one good hire can save it, that difference is everything.

If you’re reviewing your security recruitment process this quarter, start with two questions: Can you prove every officer’s licence and training before interview? And can you see how they actually perform once deployed? If the answer to either is no, you already know where your risk sits.

The professionals are out there. Your job is to make sure the system finds them first. Start hiring with GuardPass and build a workforce you can actually verify.

If you run a security business, BS7858 isn’t optional. It’s the standard your clients expect, the standard your ACS accreditation and NSI or SSAIB audits are measured against, and increasingly the standard written directly into contract tenders. Lose your grip on it, and you’re not just risking a failed audit. You’re risking the contracts that keep your business running.

Yet most security firms still handle vetting the most expensive way possible: in-house, on spreadsheets, with an office manager or HR person chasing references between a dozen other jobs.

Here’s what that actually costs you, and why the firms growing fastest right now have stopped doing it.

What BS7858:2019 Actually Demands

The BS7858:2019 standard is far more demanding than most operators realise. For every single hire, you need:

• Full identity verification against official documents
• Right to work checks in line with DBS identity requirements
• Five years of verified employment and activity history, with every gap over 31 days accounted for and evidenced
• A financial probity check, including credit history and insolvency records
• Global watchlist, sanctions and fraud database screening — a mandatory addition under the 2019 revision, not just the old HMG sanctions list
• A basic DBS check where the individual isn’t already SIA licensed
• Secure, GDPR-compliant record keeping: screening files retained for the full duration of employment, unsuccessful applicant files for 12 months, and specified records for up to seven years after employment ends

And critically, the standard is explicit on one point: responsibility sits with top management. If your screening process fails, the accountability is yours — whether you did the checks yourself or not. Which is exactly why who you trust with it matters so much.

The Hidden Cost Nobody Puts on a Spreadsheet

Ask most MDs what vetting costs them, and they’ll quote a DBS fee. The real number is much bigger.

Staff Time

A single BS7858 file done properly takes 8 to 12 hours of admin: chasing employers who don’t respond, verifying gaps, running credit and sanctions checks, compiling the file. At even a modest fully loaded staff cost, that’s £150 to £250 of hidden labour per candidate before you’ve paid for a single check.

Deployment Delays

Industry averages put a typical in-house BS7858 screen at 4 to 8 weeks. Every week a cleared candidate sits waiting is a week of unfilled shifts, overtime cover, or worse, a candidate who takes another offer. In this labour market, slow vetting is a recruitment problem, not just a compliance one.

Audit Exposure

Incomplete files, missing gap evidence, no documented risk assessment, inconsistent record retention. These are the findings that turn a routine ACS or NSI audit into a remediation plan — and in the worst cases, cost firms client contracts. Screening files done casually are a liability sitting in your filing cabinet.

Screening the Screeners

BS7858 requires that the people conducting vetting are themselves trained for the task. An untrained administrator doing vetting “on the side” is itself a compliance gap.

Add it up, and a “free” in-house process routinely costs £200 to £300 per hire in real terms, delivers slower clearance, and carries all of the audit risk with none of the specialist protection.

Why Outsourcing Has Become the Default for Well-Run Firms

Outsourced BS7858 screening used to be seen as a luxury. It’s now simply the cheaper, safer option — for four reasons:

• Fixed, predictable cost per check. You know exactly what each file costs. No hidden hours, no overtime, no chasing.
• Speed. Specialist providers using automated verification clear candidates in days, not weeks. Faster clearance means faster deployment and better candidate retention.
• Audit-ready files, every time. Consistent, complete, correctly retained screening files that stand up to ACS, NSI and SSAIB scrutiny without a scramble the week before your audit.
• Transferred expertise. The standard evolves — watchlist requirements, digital identity verification, right to work rules. A specialist provider keeps you current so you don’t have to.

Why GuardCheck Specifically

Plenty of providers do background checks. GuardCheck was built for the security industry, by the team behind GuardPass — the UK’s largest security recruitment platform. That matters in practice.

NSI Silver Approval

GuardCheck’s BS7858 screening methodology has been independently audited and approved by the National Security Inspectorate. For firms where ACS accreditation and client contract compliance are non-negotiable, that external mark of approval matters — it’s not a claim, it’s a verified standard.

AI-Powered Speed

GuardCheck automates document verification, gap analysis and candidate chasing — the part that eats most of your admin time. Candidates are prompted automatically, so files don’t stall waiting on paperwork.

Credits That Never Expire

Most providers push you into monthly minimums or credits that vanish if hiring slows. GuardCheck credits sit in your account until you need them. Buy for the year, use them at your pace — whether you hire two people in January or twenty in July.

GuardCheck Plus

Your own branded, bespoke onboarding form that feeds directly into vetting. Candidates complete one journey, your data is captured once, and screening starts the moment they apply. No duplicate forms, no drop-off between offer and clearance.

Security Sector Fluency

GuardCheck understands SIA licensing, ACS requirements and how TUPE transfers, subcontractor screening and rescreening actually work in this industry — because it’s the only industry it serves.

One Platform for Hiring and Vetting

Recruit through GuardPass, vet through GuardCheck, and close the gap between “candidate found” and “officer on site” to days rather than weeks.

A Quick, Honest Comparison

	In-house vetting	GuardCheck
True cost per file	£200–£300 in hidden staff time, plus check fees	One transparent fixed fee, from £49 + VAT
Typical turnaround	4–8 weeks	Days, with automated candidate chasing
Audit readiness	Depends on whoever did the file that week	Consistent, compliant files every time
Unused capacity	Staff time spent regardless of hiring volume	Credits never expire, pay only for what you use
Standard updates	You track them yourself	Built into the platform
Independent approval	None	NSI Silver approval

The Question Worth Asking

It isn’t “can we do BS7858 ourselves?” Most firms can — badly, expensively and slowly.

The question is: what is it costing you to keep doing it that way? In admin hours, in delayed deployments, in audit risk, and in the candidates who accepted another offer while their file sat in a tray.

If you’ve considered outsourcing your vetting before, the maths has only moved further in its favour. With GuardCheck, you can prove it on your own hires with a no-commitment trial: send us your next candidates, see the turnaround, see the file quality, and compare it to what you’re doing today.

Book a 15-minute walkthrough or start a trial

From 6 April 2026, changes are in force to the UK umbrella company sector that substantially alter how tax risk is allocated across labour supply chains.

Joint and Several Liability means that if an umbrella company fails to pay the correct PAYE or National Insurance Contributions, HMRC can go after recruitment agencies and end clients for the full unpaid amount. Every party in the labour supply chain becomes jointly and severally liable for tax obligations that stem from an umbrella company’s failure.

Two points are critical to understand from the outset. First, liability is joint and several, meaning HMRC can pursue any party in the chain for 100% of the unpaid amount, regardless of where the failure originated. Second, and perhaps most importantly, there is no reasonable care defence — even if an agency carried out thorough due diligence, it can still be held fully liable.

The new rules aim to combat tax non-compliance, protect workers, and level the playing field by eliminating rogue umbrella providers. The security sector is directly in scope.

How Does the Liability Chain Actually Work?

Understanding the mechanics matters because your position in the chain determines your direct exposure.

Umbrella companies remain employment intermediaries and the PAYE employer in the standard model, but they are no longer the only party potentially liable for payroll taxes where things go wrong. Where a worker is supplied via an umbrella company and there is a UK recruitment agency in the chain, the agency will generally be the party that HMRC can pursue for any PAYE and Class 1 NIC shortfall.

If the client contracts directly with the umbrella, or the agency is offshore or connected to the umbrella, the end client may instead be exposed.

Liability for the taxes occurs from the moment that a payment is due to HMRC. The liability falls on both the umbrella company and the other liable party at the same time — so technically the amount the umbrella has to pay is an amount the other liable party also owes, even though they are not the ones reporting to HMRC.

The practical implication: if your staffing agency uses an umbrella model and that umbrella fails — through insolvency, fraud, or simple non-compliance — HMRC can pursue the agency first, or you directly if the agency is offshore, connected to the umbrella, or otherwise unavailable. HMRC is under no obligation to warn you that a non-compliant umbrella is in your supply chain, and no one should rely on receiving a warning before enforcement begins.

Critically, insolvency does not extinguish the liability: HMRC can pursue you for unpaid taxes even after the umbrella company has collapsed or gone into administration. The most likely scenario in which security companies face a JSL demand is not an investigation into a live umbrella — it is post-insolvency pursuit once the umbrella itself cannot pay.

Does Joint and Several Liability Apply to Security Companies?

Yes, if umbrella companies are present in your labour supply chain — and in the security sector, they frequently are.

The reforms are primarily focused on arrangements involving umbrella companies. Where umbrella companies are used to employ and pay temporary workers, liability for unpaid PAYE and National Insurance may extend beyond the umbrella itself.

In practical terms, this applies to you if you:

• Use a staffing agency that places officers through an umbrella or third-party employment arrangement
• Use subcontractors whose payroll model you have not verified
• Have not mapped the employment structure behind every person currently filling your shifts

The security industry’s reliance on subcontracting to manage demand spikes, fill last-minute absences, and mobilise new contracts quickly makes this an active risk, not a theoretical one. The operational model that has served the industry for decades now carries a direct tax compliance dimension it did not have before April 2026.

It is worth being precise about scope: JSL applies specifically where an umbrella company is involved. Direct subcontracting between two security companies — where workers are direct employees of the subcontractor on a standard PAYE payroll — is a different arrangement. The critical question is not whether you use subcontractors, but how the people in your supply chain are actually employed and paid.

What Happens If You Are Found Liable?

The financial exposure is straightforward: HMRC can pursue any party in the chain for 100% of the unpaid amount, regardless of where the failure originated. There is no apportionment, no cap tied to your share of the relationship, and no good faith defence.

The reputational consequences in a regulated sector are arguably more damaging. If HMRC issues a recovery notice, the issue rarely remains private. It may appear in financial disclosures, auditor commentary, or media coverage. Stakeholders do not distinguish between deliberate avoidance and structural failure. Investors see unmanaged risk. Clients see instability.

For a security company, add the sector-specific consequences: ACS accreditation reviews, client contract compliance clauses triggered by tax enforcement action, and reputational damage in a relationship-driven market where your next contract win often depends on a reference from your last one.

One important misconception to address: HMRC publishes a list of known tax avoidance schemes and non-compliant umbrella operators, and some security companies assume that checking this list is sufficient protection. It is not.

JSL is a separate enforcement mechanism from the avoidance blacklist — it is a recovery tool that applies regardless of whether the umbrella in your supply chain appears on any published register. A non-compliant umbrella can generate a JSL liability without ever having been named by HMRC. Do not treat the absence of a name on the list as confirmation of compliance.

The Employment Rights Act 2025 received Royal Assent in December, and the Fair Work Agency launched on 7 April 2026 with a remit to enforce workers’ rights across the labour market. The Fair Work Agency is expected to take on direct regulation of umbrella companies from 2027, further consolidating supply chain oversight under a single enforcement body. The direction of travel is clear: the government intends to hold every party in the supply chain accountable. Security companies that treat this as a one-time compliance exercise rather than a standing operational discipline are misjudging the trajectory.

What Should Security Companies Do Now?

There is no published government checklist and no single accreditation that eliminates JSL exposure. HMRC has made clear that it expects agencies and end-clients to conduct regular, documented checks on their umbrella suppliers. Those that cannot demonstrate a reasonable process for verifying compliance may find themselves exposed.

For security companies, that translates into five concrete actions.

1. Map your supply chain in full. Identify every staffing agency and subcontractor you currently use. For each one, establish how their workers are employed — specifically, whether an umbrella company sits anywhere in the arrangement. If you cannot answer this today, that is your first priority.
   
2. Request documented PAYE compliance evidence. Ask your labour suppliers to confirm in writing that workers are employed on PAYE and that Income Tax and National Insurance are being correctly remitted to HMRC. Consider what processes are necessary to obtain comfort — potentially in real time — that PAYE and NIC have been calculated, reported through Real Time Information, disclosed on workers’ pay slips, and paid correctly and on time. Document everything you request and everything you receive.
   
3. Prefer FCSA-accredited suppliers where possible. FCSA accreditation provides independent assurance of payroll and tax compliance. Ensure umbrella partners are financially secure and consistently meeting PAYE and NIC obligations. Accreditation is not a complete defence under JSL, but it is evidence of a documented compliance process if HMRC investigates.
   
4. Review your BS7858 vetting exposure simultaneously. If you are using agency-supplied staff whose vetting status you cannot verify, you have a compliance problem that runs alongside — and compounds — your JSL exposure. An officer who is not properly vetted and whose employment arrangement is not clean creates regulatory and tax risk at the same time.
   
5. Rethink how you meet flexible demand. The operational pressure that drives subcontracting in security does not go away. What changes is the risk calculation. PAYE-employed flexible staffing, where the employment relationship is direct and the audit trail is complete, removes the JSL exposure that umbrella or agency arrangements create.

How Does JSL Interact With Other 2026 Compliance Pressures?

JSL does not sit in isolation. Security companies in 2026 are managing several concurrent compliance obligations, and they interact with each other.

BS7858 vetting remains the baseline for every security hire. The 2025 tightening of SIA criminality criteria means the standard your vetting process must meet has moved, and any agency-supplied worker whose vetting you have not verified independently represents a gap in your compliance posture.

Martyn’s Law, which received Royal Assent in April 2025 and enters enforcement no earlier than April 2027, subject to the Home Office’s implementation timeline, will require venues above 200-person capacity to demonstrate compliant security arrangements. Security companies supplying those venues will face increased scrutiny of their staffing documentation — including employment status.

The Fair Work Agency, launched on 7 April 2026, has a remit that overlaps with how security workers are employed and paid. Its enforcement focus on labour market compliance means the supply chain questions JSL raises are being examined from multiple regulatory angles simultaneously.

The companies that will navigate this period well are those that treat compliance as an integrated operational discipline — not a series of separate box-ticking exercises.

Frequently Asked Questions

How GuardPass Can Help

JSL exposure doesn’t start with a compliance failure — it starts with not knowing how the people filling your shifts are actually employed. The security companies most at risk are those operating with gaps in their supply chain visibility, relying on agency arrangements they haven’t audited, and treating staffing as an operational question rather than a compliance one.

If that’s where you are, GuardPass gives you the tools to close those gaps — from licence verification and vetting through to how you source and manage your security workforce.

The direction of travel from HMRC, the Fair Work Agency, and the SIA is consistent: every party in the labour supply chain will be held accountable. The security companies that come through this period without disruption won’t be the ones that got lucky — they’ll be the ones that made deliberate decisions about how they staff.

Disclaimer: This blog is for informational purposes only. Please verify details independently before making decisions.

The UK private security industry stands on the edge of what may prove to be its most significant structural reform since the introduction of individual licensing under the Private Security Industry Act 2001. For over two decades, regulation has focused almost entirely on the individual operative. Now, attention is shifting, decisively, towards the businesses that employ them.

At the centre of this shift sits the proposed Business Approval Scheme (BAS), the successor to the long-standing Approved Contractor Scheme (ACS). To understand its significance, we must first understand why it exists at all.

How We Got Here

The current regulatory framework, overseen by the Security Industry Authority (SIA), was built on a simple principle: license the individual, and you regulate the industry. That approach has striven to deliver a baseline of competence. Today, hundreds of thousands of licensed operatives work across the UK under that system.

But there has always been a gap, one that seasoned professionals have known about for years. The SIA licenses people, not companies. There is no legal requirement for a security business itself to be approved, registered, or even inspected before trading.

The Approved Contractor Scheme was introduced to fill that gap. It is, and remains, a voluntary quality mark. Companies that opt in are assessed against standards of service delivery, management and compliance.

And therein lies the problem.

Voluntary schemes attract the willing, the better operators, the established firms, those already invested in compliance. Meanwhile, a significant proportion of the market operates entirely outside that framework. Currently, only around 750 businesses are approved, representing a small fraction of the total industry.

The result is a two-tier market: one regulated by choice, the other only by minimum legal obligations.

The Case for Change

The SIA has been candid in its assessment. The existing model is no longer sufficient to deliver consistent standards or robust public protection. The consultation launched in 2024 made that clear, seeking views on a new approach that would place “public protection at the heart” of business approval.

What followed was not a minor tweak, but a recognition that the ACS, in its current form, has reached the limits of what a voluntary scheme can achieve.

The proposed Business Approval Scheme represents a fundamental redesign. It is intended to shift the focus from process-driven audits to the outcomes that security companies actually deliver on the ground.

This is more than semantics. It signals a move away from annual, tick-box assessments towards a more intelligence-led, risk-based, model of oversight. Higher risk businesses will face greater scrutiny, and specialist providers will be expected to demonstrate sector-specific competence.

In short, the regulator is attempting to become more agile, more targeted, and more aligned with real-world risk.

How BAS Differs from the ACS

At first glance, BAS may appear to be a rebranded ACS. That would be a mistake.

The ACS was built as a quality assurance scheme, an optional badge of credibility. BAS is being designed as something closer to a regulatory framework in waiting.

Key differences are already emerging:

1. From Voluntary Badge to Strategic Lever

The ACS has always been optional. BAS, while initially likely to remain voluntary, is clearly being positioned as a stepping stone to something more formal. The language of “public protection” and “outcomes” reflects a regulatory mindset rather than a purely commercial one.

2. Risk-Based Assessment

Under the ACS, companies undergo periodic assessments, often three-yearly. BAS proposes a more dynamic model, focusing regulatory effort where the risk is greatest. This is a more modern approach, aligned with how other regulators operate.

3. Sector Specific Standards

The new scheme is expected to introduce enhanced requirements for specialist sectors, events, healthcare, and critical infrastructure, recognising that one-size-fits-all standards are no longer adequate.

4. Greater Emphasis on Service Delivery

There is a clear intention to shift assessment time towards how services are actually delivered, rather than purely how systems are documented.

Taken together, these changes represent a move from compliance on paper to performance in practice.

The Impact on Security Companies

For reputable operators, the direction of travel will feel familiar, perhaps even overdue. Many already operate to standards that exceed those currently required by the ACS.

However, BAS will raise the bar in several important ways.

First, it will demand greater transparency. Companies will need to demonstrate not just that they have policies, but that those policies are effective. That means better data, better reporting, and stronger governance.

Second, it will increase scrutiny on labour models. Issues such as subcontracting, use of labour providers, and employment practices will come under closer examination. For those operating on razor-thin margins, that scrutiny may prove uncomfortable.

Third, it will widen the gap between compliant and non-compliant businesses. Those already invested in quality will adapt. Those relying on minimal compliance, or worse, will find it increasingly difficult to compete in a market where clients are encouraged to look beyond price.

The Link to Mandatory Business Licensing

We cannot discuss BAS without addressing the larger question: is this a precursor to mandatory business licensing?

The honest answer is yes. At least in principle….

The SIA itself has acknowledged that any move to mandatory licensing would require government approval and legislative change. But the direction of travel is unmistakable. The development of BAS sits alongside wider consultation on business licensing, described by many as a “defining moment” for the industry.

Why does this matter?

Because mandatory licensing would fundamentally change the industry landscape. For the first time, every security business, not just individuals, would need to meet defined standards to operate legally.

That would address one of the sector’s most persistent weaknesses: the ability of poor or unethical operators to enter the market with minimal oversight.

BAS, in this context, can be seen as both a testing ground and a bridge. It allows the SIA to refine standards, develop assessment models, and build industry consensus before any legislative step is taken.

Risks and Realities

There are, of course, risks.

If BAS remains voluntary, it may struggle to achieve the scale required to drive meaningful change. The same structural limitation that affects the ACS could persist.

If it becomes mandatory, the challenge shifts to proportionality. Over-regulation could stifle smaller, legitimate businesses, particularly in a sector already under intense commercial pressure.

There is also the question of enforcement. Standards, however well designed, are only as effective as the resources and mechanisms used to enforce them.

What It Means for Clients

Clients, as ever, play a critical role.

A more robust business approval framework, whether voluntary or mandatory, will only deliver its intended benefits if buyers engage with it. Selecting providers based on verified standards rather than the lowest cost will be essential.

BAS offers the potential for a clearer, more meaningful benchmark of quality. But it will require clients to value that benchmark.

Recommended Reading: Why the Cheapest Bid Can Fund Organised Crime

Final Thoughts

The Business Approval Scheme is not just another industry initiative. It is a signal of intent, a recognition that the current model has limits, and that the future of security regulation must extend beyond the individual licence.

Whether BAS becomes a stepping stone to mandatory licensing or remains a strengthened voluntary framework, its impact will be significant.

For those who have long argued that the industry needs to move beyond minimum compliance, this is a moment of opportunity.

For those who have built their business on the margins of that compliance, it may be a moment of reckoning.

Either way, the message is clear: the days of light-touch oversight at the business level are numbered, and in a sector that exists to protect the public, that can only be a good thing.

Is Your Business Ready for What’s Coming?

Whether BAS remains voluntary or becomes mandatory, the direction is clear: standards are rising. GuardPass helps security companies stay ahead — connecting you with SIA-licensed professionals through the UK’s largest talent pool, with BS7858-compliant vetting through GuardCheck built in from the start.

See how GuardPass supports compliant security operations →