Winning a new security contract is the part everyone celebrates. Whether it’s a retender you’ve taken from another provider, a private client adding sites, or a call-off from a public-sector framework, the client expects SIA-licensed, properly screened officers on site from the first shift.

The weeks between award and go-live, the mobilisation window, are where new contracts are won or quietly lost. Too few officers, a vetting backlog or an expired licence on day one can damage a client relationship before it has properly started.

It’s a challenge more mid-sized contractors are facing. Manchester-based Universal Support Services Group, for example, recently secured places on CCS and ESPO security frameworks, which open the door to public-sector call-offs covering static guarding, mobile patrols, keyholding and alarm response. Every one of those wins comes with a mobilisation to deliver.

“Winning the contract gets you in the door. Mobilisation decides whether you keep it.”

Security Contract Mobilisation in Five Steps

These five steps take you from award letter to a fully staffed first shift. Each one removes a reason your go-live date could slip.

1. Work Out How Many Security Officers the Contract Needs

Start with the specification, not your gut feel. Every post has hours, a licence requirement and a pattern of cover, and those three things set your hiring number. For each post, record:

• Hours of cover per week (a 24/7 static post is 168 hours)
• The SIA licence type required: Security Guarding, Door Supervision, CCTV (Public Space Surveillance) or Close Protection
• Any extra requirements, such as keyholding, first aid or a site-specific induction
• Whether the post is static, mobile or response

Then convert hours into people. Under the Working Time Regulations, officers work an average of 48 hours a week unless they have opted out. Statutory holiday is 5.6 weeks a year, roughly 11% of working time, so relief has to be built in from day one. Here’s how that works for a single 24/7 post:

Calculation	Figure
Weekly hours for one 24/7 post	168
÷ Average hours per officer	48
= Core officers, with no relief	3.5
+ Relief at 15.8% (holiday plus 5% absence)	0.55
= Officers needed, rounded up	5

The 5% absence allowance is an example. Use your own sickness and training data.

Running a contract with several posts or sites? Our free Contract Mobilisation Workforce Planner includes a headcount worksheet and the common shift patterns to work it out post by post.

2. Check Who Transfers Under TUPE When You Take Over a Contract

Most guarding contracts change hands at retender, so many mobilisations start with a team that already exists. A change of contractor is a service provision change, and TUPE usually applies where there is an organised group of employees working on that contract. Acas guidance is clear that everyone assigned to that work transfers automatically, and the new employer cannot pick and choose.

Your external hiring number may be smaller than the headcount suggests, but you inherit people you have not recruited, screened or managed. Before go-live, ask the outgoing contractor for the employee liability information and check each transferring officer’s SIA licence type and expiry, right to work documentation, screening records and contracted hours. Treat any gaps as hiring needs, and take employment law advice on the transfer itself.

3. Recruit SIA-Licensed Officers, Not Just Applicants

Once you know the gap, speed comes from where you look. A general job board brings volume, but many applicants may not hold the right licence, or any licence at all. Every one of them costs you screening time you do not have.

Recruiting from a pool of SIA-licensed security professionals removes that first filter. Whatever the source, check every licence against the SIA’s public register before you make an offer and confirm the licence type matches the post. Fake and borrowed licences are a real risk, and a rushed mobilisation is exactly when they slip through.

4. Plan Your BS7858 Vetting Timeline Backwards From Go-Live

Screening is where most mobilisations stall. BS7858 requires a minimum five-year screening period, and a candidate with gaps, self-employment or slow referees can take far longer than a straightforward case. So work backwards: fix the date every officer must be screened and inducted, subtract your realistic screening time plus a buffer, and you have the latest date any new hire can start screening.

Start screening as soon as a candidate accepts, not once the whole team is hired, and run checks in parallel rather than one after another. BS7858 does allow provisional employment in defined circumstances, but it depends on preliminary checks, a documented risk assessment and completing full screening within the timescales the standard sets. Check your client’s contract terms too.

5. Build a Relief Bench Before You Need It

The first month of a new contract is when sickness, no-shows and early leavers hurt most. A small bench of screened, licensed and site-inducted relief officers is the safety net, and it lets you say yes when the client adds posts or asks for temporary emergency cover. For more on this, see how to build a flexible guard pool without sacrificing standards.

Where the Risk Concentrates

The second dataset breaks the 22,526 right-to-work revocations down by the licence holder’s nationality, across 110 separate categories (a small number of which are administrative labels such as ‘Other’, ‘None’ and ‘Not Known’, rather than nationalities). Five nationalities account for the large majority:

Common Security Contract Mobilisation Mistakes

• No relief built in. The rota works on paper and breaks the first time someone books a holiday.
• Screening started too late. Vetting the whole team in one batch creates a bottleneck right before go-live.
• Licence expiry ignored. An officer whose licence lapses mid-contract is a compliance gap waiting to happen.
• TUPE assumptions. Assuming the transferring team is fully licensed and screened without checking.
• Records not audit-ready. Clients, especially in the public sector, may ask for evidence of licensing and screening at short notice.

Frequently Asked Questions

How many security officers do you need for a 24/7 site?

At 48 hours per officer, one 24/7 post needs 3.5 officers for core cover. Once you add relief for holiday, sickness and training, most contractors need four to five officers per 24/7 post.

Does TUPE apply when you take over a security contract?

Often, yes. A change of contractor is a service provision change, and TUPE usually applies where an organised group of employees works on the contract. Take employment law advice for your specific situation.

Can security officers start work before BS7858 screening is complete?

BS7858 allows provisional employment in defined circumstances, subject to preliminary checks, a documented risk assessment and completing full screening within set timescales. Check your client’s contract terms too.

Conclusion

Winning the contract gets you in the door. Plan the headcount early, check every licence and every TUPE record, start screening the moment someone accepts, and have relief ready before you need it.

GuardHire puts your vacancies in front of SIA-licensed security professionals, and GuardCheck runs BS7858:2019 screening with checks carried out in parallel, so a new contract doesn’t stall on vetting admin.

Planning your next go-live? Download the free Contract Mobilisation Workforce Planner for the headcount worksheet, timeline and day-one checklists.

Book a free demo to see how GuardPass can help you mobilise your next contract

On 19 August 2026, the Security Industry Authority (SIA) published five years of licence revocation data in response to a Freedom of Information request (FOI reference 0621). The release covers every SIA licence revocation recorded between 1 January 2022 and 2 August 2026, broken down by reason, alongside a second dataset showing right-to-work revocations by nationality.

Most security employers plan their vetting around the risks that make headlines: violence, weapons, dishonesty. The SIA’s own numbers say that’s not where the licensed workforce is actually being lost.

The Compliance Blind Spot the Data Exposes

Of the 24,969 SIA licences revoked between January 2022 and 2 August 2026, 22,526 (90.2%) were pulled for one reason: the licence holder no longer had the right to work in the UK.

Violent or abusive behaviour, sexual behaviour, drug use or supply, dishonesty and fraud, offensive weapons, criminal damage, abuse or neglect of children, and driving offences: these are the categories most operators actually build their vetting programmes around, and together they account for 2,006 cases. That’s just over 8% of everything the SIA has revoked in almost five years.

Revocation reason	Total (Jan 2022–Aug 2026)	Share of total
No right to work	22,526	90.2%
Violent/abusive behaviour	1,065	4.3%
Other (predominantly right-to-work related)	640	2.6%
Sexual behaviour	265	1.1%
Drug use/supply	231	0.9%
Dishonesty (theft & fraud)/proceeds of crime	162	0.6%
Offensive weapons/firearms	129	0.5%
Criminal damage	80	0.3%
Abuse or neglect of children	58	0.2%
Private Security Industry Act offences	41	0.2%
Driving offences	16	<0.1%
Operation Siren/espionage & terrorism (combined)	<20	<0.1%

Source: SIA licence revocation data, January 2022–2 August 2026.

“9 in 10 SIA licence revocations in the past five years had nothing to do with violence, weapons or dishonesty. They came down to one thing: the licence holder’s right to work had lapsed.”

The SIA also notes that the “Other” category (640 revocations) is largely linked to right-to-work issues. When these cases are included, right-to-work problems could account for more than 92% of all licence revocations in the dataset. 

Why This Should Change How You Think About Risk

Here’s the strategic problem. A vetting programme built to catch the 8% (the officer who hides a conviction, the candidate with an undisclosed weapons charge, the applicant who fails a drugs screen) is necessary work, and it should stay part of any serious screening process. But it isn’t what’s actually thinning out licensed workforces at scale.

The thing quietly costing operators their headcount is administrative: a Biometric Residence Permit that expired without anyone noticing, a pre-settled status condition that changed, a visa route that ran out mid-contract.

A right-to-work check at the point of hire only proves one thing: that someone was eligible to work on the day the check was done. It says nothing about whether they’re still eligible six months later, or eighteen. Visas expire on fixed dates. Pre-settled status has to convert to settled status by a deadline. None of that resurfaces unless someone goes looking for it, and for most security employers checking manually or only at onboarding, nobody is.

The Trend is Accelerating, Not Stabilising

The SIA only began systematically recording revocation reasons in December 2021, which makes 2022 the first full year of comparable data. Right-to-work revocations since then:

Right-to-work licence revocations by year: 2022 – 734 · 2023 – 3,363 · 2024 – 6,445 · 2025 – 7,740 · 2026 (to 2 August, partial year) – 4,244.

That’s more than a tenfold increase from 2022 to 2025. With exactly five months of 2026 still to run at the time of this release, the year is already tracking toward a similar range to 2025, not a decline. Whatever combination of tighter Home Office enforcement, sharper SIA checks and workforce composition shift is driving this, the direction has held for four years running. Plan your compliance calendar around a curve that’s still rising, not one you’re hoping will flatten. 

Where the Risk Concentrates

The second dataset breaks the 22,526 right-to-work revocations down by the licence holder’s nationality, across 110 separate categories (a small number of which are administrative labels such as ‘Other’, ‘None’ and ‘Not Known’, rather than nationalities). Five nationalities account for the large majority:

Nationality	Revocations (Jan 2022–Aug 2026)	Share of RTW total
Pakistani	9,625	42.7%
Indian	7,861	34.9%
Nigerian	2,898	12.9%
Bangladeshi	707	3.1%
Ghanaian	429	1.9%

These five nationalities alone account for roughly 95% of all right-to-work revocations in the dataset.

It’s important to be clear about what this data shows. A ‘no right to work’ revocation usually reflects a change in immigration status, such as an expired visa or change in settled status. It does not mean the licence holder has acted dishonestly or done anything wrong. For employers with large numbers of workers from these communities, the message is simple: right-to-work checks should be monitored regularly, not just once a year. 

The Legal Exposure You’re Already Carrying

The risk goes beyond losing a member of staff. Under the Immigration, Asylum and Nationality Act 2006, employers who complete the correct right-to-work check when hiring are protected from a civil penalty if that person later loses their right to work. However, for workers with time-limited permission, this protection only lasts until that permission expires. 

The Home Office’s own guidance is explicit: employers have to carry out a follow-up check on or before the date that permission expires to keep the excuse and keep employing that person lawfully.

Miss that check, and the risk goes beyond having a licensed officer missing from the rota. Since February 2024, employers can face civil penalties of up to £45,000 per illegal worker for a first breach and £60,000 for a repeat breach. When you look at the SIA’s figures, this isn’t just a potential risk. It’s an issue already affecting the security industry at scale. 

Build This Into Your Compliance Strategy, Not Your Onboarding Checklist

A right-to-work check at onboarding confirms someone’s status at that point in time. It does not tell you what happens when their permission changes months or years later. That’s the gap this data exposes.

The answer is to make right-to-work part of your ongoing compliance process, with clear expiry dates, follow-up checks and a reliable record of what was checked and when.

GuardCheck consolidates the right-to-work, identity, DBS, employment history and SIA licence checks you’d otherwise run separately, and is independently certified to BS 7858:2019 and NSI NCP 111. For licence validity day to day, Licence Hub checks your register against the official SIA database daily and flags issues by email.

What This Means For Your Compliance Strategy

The data points to a simple shift in priorities. Right-to-work should be an ongoing workforce responsibility, not something that ends when an employee passes their initial checks.

• Track time-limited permission: Record when each employee needs a follow-up check and act before the deadline.
• Keep clear records: Maintain evidence of checks, documents and follow-up actions.
• Review your workforce regularly: Don’t rely on onboarding checks to catch changes later in an employee’s contract.
• Keep broader vetting in place: Violence, dishonesty and other risks still matter, even though they account for a much smaller share of SIA revocations.
• Reduce manual admin: Use a centralised process to make checks easier to manage and provide evidence.

The key lesson from five years of SIA data is simple: vetting cannot end at onboarding. People’s circumstances change, and your compliance process needs to be built to catch those changes before they become a licence revocation, an empty shift or a larger compliance problem.

Conclusion

The SIA’s latest data highlights a gap that many security employers cannot afford to overlook. Right-to-work status can change long after an employee has passed their initial checks, and without a process for monitoring those changes, a compliance issue can quickly become a staffing and operational problem.

GuardCheck helps make security vetting simpler and faster to manage, bringing key screening checks together in one digital process so employers spend less time chasing paperwork and more time keeping their workforce ready to deploy.

If your current vetting process still relies heavily on manual checks and spreadsheets, it may be time to rethink how you manage compliance beyond onboarding.

Book a free demo to see how GuardCheck can streamline your security screening process.

The vast majority of security company HR managers lose sleep over the same issue: the ever more difficult quest to find reliable, SIA-licensed and professional officers who can genuinely do the job. It’s a security recruitment problem that starts long before the interview stage.

Since the start of this decade, demand for good security personnel has grown dramatically while the pool of suitably licensed people has contracted by a similar margin. Big events, the retail crime epidemic, hospital security contracts, the rise of Street Wardens, data centres popping up everywhere, and gargantuan distribution facilities are all draining what was already a shallow talent pool.

Add horrendous cost of living pressures, antisocial hours, and the abysmal public perception of private security, and you have a sector that could not be less appealing to good people.

Unfortunately, there’s an issue having an even bigger negative impact on the industry: the calibre and quality of the security personnel themselves. This problem starts with the mandatory SIA licence.

How Are Some People Getting SIA Licences?

The Security Industry Authority licence was designed as a baseline of competence and integrity. In practice, the system has weak points that bad actors have become highly adept at exploiting.

Site managers regularly inherit officers whose spoken English is minimal, who couldn’t write a coherent incident report, had no grasp of conflict management, and in some cases couldn’t give a coherent account of their own training when pressed. Yet they were still badged.

Three routes keep cropping up:

Training Malpractice

A minority of training providers still cut corners to push volume — “fast-track” courses where physical intervention may be demonstrated once, exam papers are coached, and attendance sheets are signed off despite no-shows. The SIA does audit providers, but rogue operators open, churn out candidates, and close before sanctions bite. The candidate leaves with a certificate, the provider banks the cash, and the employer takes on the risk.

Identity and Exam Fraud

Impersonation at exams isn’t new, and neither is the selling of answers. Organised groups target centres with lax ID checks. Once the certificate is issued, the SIA application process relies on that certificate being genuine — turning the licence into a passport into the industry for someone who was never properly assessed.

Organised Crime Adapts

The SIA’s criminality checks are robust, but they depend on declared identities and convictions. False documents, undisclosed overseas convictions, and the time lag between charge and conviction all create gaps. When an unsuitable individual gets a licence, every assignment they attend undermines public trust and puts clients, the public, and everyone around them at risk.

The result for employers is brutal: you spend on recruitment, vetting, uniform and onboarding, only to remove the officer within weeks. Your client loses confidence, your remaining team picks up the slack, insurance risk rises, and the good officers you do have get tarred with the same brush.

What Makes a Professional Security Officer

A professional security officer isn’t just anyone with an SIA licence. They demonstrate five key attributes before they ever step on site.

Attribute	What It Looks Like on the Ground	How Employers Verify It
Competence	Can handle conflict, write an MG11-ready statement, operate CCTV and access control	Practical assessment + documented CPD
Verified training history	Certificates from audited, reputable providers with dates and trainer names	Digital credentials, direct provider confirmation
Spotless compliance	No hidden sanctions, right to work confirmed, 5-year history checked	BS7858:2019 screening with digital audit trail
Character suitability	Punctuality, communication, adherence to assignment instructions, standard of dress, attitude	Reference data, attendance history, ratings
Digital literacy	Uses reporting and shift management apps, understands GDPR, is aware of cybersecurity	App usage data, short skills checks

If you’re hiring without evidence of those five, you’re hiring on hope. And hope isn’t a reliable vetting policy.

Raising the Bar Starts With Better Tools

The industry can’t wait for regulation to catch every loophole. It needs systems that make it harder for malpractice to enter the workforce and easier for genuine professionals to stand out. That’s where purpose-built technology changes the game.

For my money, GuardPass has become the practical answer for HR teams tired of sifting CVs and chasing paper.

Why GuardPass Shifts the Security Recruitment Dynamic

GuardPass isn’t a job board. It’s an end-to-end security recruitment system built around SIA licensing and the real workflows of UK security firms. It tackles two problems at once: keeping unqualified people out, and speeding up the hiring of the right people.

Licence-First Candidate Verification

Every candidate profile links directly to their SIA licence record. Expiry dates, sectors, conditions and suspensions update automatically — no more “I’ll bring my badge on day one” surprises. If the licence isn’t valid, the profile doesn’t reach your shortlist.

Training Provenance and CPD Tracking

GuardPass partners with audited training providers. Certificates are uploaded with provider, trainer, date and location metadata, and the system flags anomalies — like the same trainer running courses in Leeds and Plymouth on the same day. Officers also log CPD, from ACT Awareness to mental health first aid, so you see who invests in their own standards.

Digital Right to Work and BS7858:2019 Screening

The app guides candidates through compliant ID checks, share code capture, and 5-year history. HR gets a structured screening pack, not a zip file of photos, with gaps flagged before you spend time interviewing. That alone cuts screening admin by 60% for most teams.

Skills and Role Matching, Not Keyword Bingo

Roles on GuardPass are tagged by sector, site type, shifts and required competencies. Candidates complete short, scenario-based assessments for door supervision, CCTV, retail, corporate, construction and healthcare — so filtering for “conflict management + incident reporting + night shifts + Canary Wharf” surfaces people who actually match, not just people who typed those words.

Compliance-Ready Document Vault

Uniform sizes, bank details, insurance documents, licences and certificates are all stored with expiry alerts. When you onboard, you’re not chasing PDFs, and the audit trail is there if the SIA or your client asks.

Attendance and Performance Data

Once placed, officers clock in through the app, file digital incident reports, and receive site-specific assignment instructions. HR and ops see punctuality, report quality and client feedback over time, building a bench of proven officers you can redeploy first — ending the cycle of “new face, new risk” on every contract.

Fraud-Resistant Onboarding

Liveness checks and ID document NFC reads during app registration make impersonation harder. Combined with provider-verified certificates, it closes the door on the most common routes malpractice uses to get a licence into the wrong hands.

Direct Applicant Communication

In-app messaging and interview scheduling cut ghosting. Candidates pick slots, get reminders, and upload anything missing before the interview — and HR teams report show-up rates rising because the friction is gone.

Analytics for Workforce Planning

The dashboard shows licence expiries across your pool, training gaps by site, and time-to-hire by role. You can see, for example, that 14% of your door supervisors expire in September and that CCTV PSS competence is thin in Kent — letting you train or recruit before the client feels it.

Putting It Into Practice: A Better Hiring Flow

Here’s what security recruitment looks like when you use GuardPass properly.

1. Define the Real Requirement

Don’t just post “SIA DS” — tag the site type, systems used, report standards and physical requirements, so the matching engine respects it.

2. Auto-Filter for Compliance

The system hides anyone without a valid, appropriate licence, right to work, or core certificates, so you start from a clean pool.

3. Assess What Matters

Use the built-in scenario questions or upload your own — you’re testing decision making, not memory.

4. Interview With Context

You see training provenance, previous sites and performance data before the call, so the conversation starts two steps ahead.

5. One-Click Offer and Onboarding

Contracts, assignment instructions and uniform requests go out through the app. The officer accepts, completes remaining checks, and you have a start date with confidence.

The Wider Impact on Malpractice

When the major employers in a region all recruit through a system that verifies licences, checks training provenance and logs performance, the economics of malpractice collapse.

There’s no point paying a dodgy provider if the certificate won’t get you past the first filter. There’s no value in exam fraud if liveness checks catch you at onboarding. The bad actors move on, and the professionals get the work faster.

A Final Word to Hiring Managers

We won’t fix the UK’s officer shortage by lowering standards. We fix it by protecting the standards we have and making it easy to hire people who meet them. That means treating vetting as a process, not a paperwork pile. It means using data from the field to reward reliability. And it means backing tools built by the industry, for the industry.

GuardPass doesn’t replace human judgement — it gives that judgement better information, earlier. In a market where one bad hire can lose a contract, and one good hire can save it, that difference is everything.

If you’re reviewing your security recruitment process this quarter, start with two questions: Can you prove every officer’s licence and training before interview? And can you see how they actually perform once deployed? If the answer to either is no, you already know where your risk sits.

The professionals are out there. Your job is to make sure the system finds them first. Start hiring with GuardPass and build a workforce you can actually verify.

If you run a security business, BS7858 isn’t optional. It’s the standard your clients expect, the standard your ACS accreditation and NSI or SSAIB audits are measured against, and increasingly the standard written directly into contract tenders. Lose your grip on it, and you’re not just risking a failed audit. You’re risking the contracts that keep your business running.

Yet most security firms still handle vetting the most expensive way possible: in-house, on spreadsheets, with an office manager or HR person chasing references between a dozen other jobs.

Here’s what that actually costs you, and why the firms growing fastest right now have stopped doing it.

What BS7858:2019 Actually Demands

The BS7858:2019 standard is far more demanding than most operators realise. For every single hire, you need:

• Full identity verification against official documents
• Right to work checks in line with DBS identity requirements
• Five years of verified employment and activity history, with every gap over 31 days accounted for and evidenced
• A financial probity check, including credit history and insolvency records
• Global watchlist, sanctions and fraud database screening — a mandatory addition under the 2019 revision, not just the old HMG sanctions list
• A basic DBS check where the individual isn’t already SIA licensed
• Secure, GDPR-compliant record keeping: screening files retained for the full duration of employment, unsuccessful applicant files for 12 months, and specified records for up to seven years after employment ends

And critically, the standard is explicit on one point: responsibility sits with top management. If your screening process fails, the accountability is yours — whether you did the checks yourself or not. Which is exactly why who you trust with it matters so much.

The Hidden Cost Nobody Puts on a Spreadsheet

Ask most MDs what vetting costs them, and they’ll quote a DBS fee. The real number is much bigger.

Staff Time

A single BS7858 file done properly takes 8 to 12 hours of admin: chasing employers who don’t respond, verifying gaps, running credit and sanctions checks, compiling the file. At even a modest fully loaded staff cost, that’s £150 to £250 of hidden labour per candidate before you’ve paid for a single check.

Deployment Delays

Industry averages put a typical in-house BS7858 screen at 4 to 8 weeks. Every week a cleared candidate sits waiting is a week of unfilled shifts, overtime cover, or worse, a candidate who takes another offer. In this labour market, slow vetting is a recruitment problem, not just a compliance one.

Audit Exposure

Incomplete files, missing gap evidence, no documented risk assessment, inconsistent record retention. These are the findings that turn a routine ACS or NSI audit into a remediation plan — and in the worst cases, cost firms client contracts. Screening files done casually are a liability sitting in your filing cabinet.

Screening the Screeners

BS7858 requires that the people conducting vetting are themselves trained for the task. An untrained administrator doing vetting “on the side” is itself a compliance gap.

Add it up, and a “free” in-house process routinely costs £200 to £300 per hire in real terms, delivers slower clearance, and carries all of the audit risk with none of the specialist protection.

Why Outsourcing Has Become the Default for Well-Run Firms

Outsourced BS7858 screening used to be seen as a luxury. It’s now simply the cheaper, safer option — for four reasons:

• Fixed, predictable cost per check. You know exactly what each file costs. No hidden hours, no overtime, no chasing.
• Speed. Specialist providers using automated verification clear candidates in days, not weeks. Faster clearance means faster deployment and better candidate retention.
• Audit-ready files, every time. Consistent, complete, correctly retained screening files that stand up to ACS, NSI and SSAIB scrutiny without a scramble the week before your audit.
• Transferred expertise. The standard evolves — watchlist requirements, digital identity verification, right to work rules. A specialist provider keeps you current so you don’t have to.

Why GuardCheck Specifically

Plenty of providers do background checks. GuardCheck was built for the security industry, by the team behind GuardPass — the UK’s largest security recruitment platform. That matters in practice.

NSI Silver Approval

GuardCheck’s BS7858 screening methodology has been independently audited and approved by the National Security Inspectorate. For firms where ACS accreditation and client contract compliance are non-negotiable, that external mark of approval matters — it’s not a claim, it’s a verified standard.

AI-Powered Speed

GuardCheck automates document verification, gap analysis and candidate chasing — the part that eats most of your admin time. Candidates are prompted automatically, so files don’t stall waiting on paperwork.

Credits That Never Expire

Most providers push you into monthly minimums or credits that vanish if hiring slows. GuardCheck credits sit in your account until you need them. Buy for the year, use them at your pace — whether you hire two people in January or twenty in July.

GuardCheck Plus

Your own branded, bespoke onboarding form that feeds directly into vetting. Candidates complete one journey, your data is captured once, and screening starts the moment they apply. No duplicate forms, no drop-off between offer and clearance.

Security Sector Fluency

GuardCheck understands SIA licensing, ACS requirements and how TUPE transfers, subcontractor screening and rescreening actually work in this industry — because it’s the only industry it serves.

One Platform for Hiring and Vetting

Recruit through GuardPass, vet through GuardCheck, and close the gap between “candidate found” and “officer on site” to days rather than weeks.

A Quick, Honest Comparison

	In-house vetting	GuardCheck
True cost per file	£200–£300 in hidden staff time, plus check fees	One transparent fixed fee, from £49 + VAT
Typical turnaround	4–8 weeks	Days, with automated candidate chasing
Audit readiness	Depends on whoever did the file that week	Consistent, compliant files every time
Unused capacity	Staff time spent regardless of hiring volume	Credits never expire, pay only for what you use
Standard updates	You track them yourself	Built into the platform
Independent approval	None	NSI Silver approval

The Question Worth Asking

It isn’t “can we do BS7858 ourselves?” Most firms can — badly, expensively and slowly.

The question is: what is it costing you to keep doing it that way? In admin hours, in delayed deployments, in audit risk, and in the candidates who accepted another offer while their file sat in a tray.

If you’ve considered outsourcing your vetting before, the maths has only moved further in its favour. With GuardCheck, you can prove it on your own hires with a no-commitment trial: send us your next candidates, see the turnaround, see the file quality, and compare it to what you’re doing today.

Book a 15-minute walkthrough or start a trial

From 6 April 2026, changes are in force to the UK umbrella company sector that substantially alter how tax risk is allocated across labour supply chains.

Joint and Several Liability means that if an umbrella company fails to pay the correct PAYE or National Insurance Contributions, HMRC can go after recruitment agencies and end clients for the full unpaid amount. Every party in the labour supply chain becomes jointly and severally liable for tax obligations that stem from an umbrella company’s failure.

Two points are critical to understand from the outset. First, liability is joint and several, meaning HMRC can pursue any party in the chain for 100% of the unpaid amount, regardless of where the failure originated. Second, and perhaps most importantly, there is no reasonable care defence — even if an agency carried out thorough due diligence, it can still be held fully liable.

The new rules aim to combat tax non-compliance, protect workers, and level the playing field by eliminating rogue umbrella providers. The security sector is directly in scope.

How Does the Liability Chain Actually Work?

Understanding the mechanics matters because your position in the chain determines your direct exposure.

Umbrella companies remain employment intermediaries and the PAYE employer in the standard model, but they are no longer the only party potentially liable for payroll taxes where things go wrong. Where a worker is supplied via an umbrella company and there is a UK recruitment agency in the chain, the agency will generally be the party that HMRC can pursue for any PAYE and Class 1 NIC shortfall.

If the client contracts directly with the umbrella, or the agency is offshore or connected to the umbrella, the end client may instead be exposed.

Liability for the taxes occurs from the moment that a payment is due to HMRC. The liability falls on both the umbrella company and the other liable party at the same time — so technically the amount the umbrella has to pay is an amount the other liable party also owes, even though they are not the ones reporting to HMRC.

The practical implication: if your staffing agency uses an umbrella model and that umbrella fails — through insolvency, fraud, or simple non-compliance — HMRC can pursue the agency first, or you directly if the agency is offshore, connected to the umbrella, or otherwise unavailable. HMRC is under no obligation to warn you that a non-compliant umbrella is in your supply chain, and no one should rely on receiving a warning before enforcement begins.

Critically, insolvency does not extinguish the liability: HMRC can pursue you for unpaid taxes even after the umbrella company has collapsed or gone into administration. The most likely scenario in which security companies face a JSL demand is not an investigation into a live umbrella — it is post-insolvency pursuit once the umbrella itself cannot pay.

Does Joint and Several Liability Apply to Security Companies?

Yes, if umbrella companies are present in your labour supply chain — and in the security sector, they frequently are.

The reforms are primarily focused on arrangements involving umbrella companies. Where umbrella companies are used to employ and pay temporary workers, liability for unpaid PAYE and National Insurance may extend beyond the umbrella itself.

In practical terms, this applies to you if you:

• Use a staffing agency that places officers through an umbrella or third-party employment arrangement
• Use subcontractors whose payroll model you have not verified
• Have not mapped the employment structure behind every person currently filling your shifts

The security industry’s reliance on subcontracting to manage demand spikes, fill last-minute absences, and mobilise new contracts quickly makes this an active risk, not a theoretical one. The operational model that has served the industry for decades now carries a direct tax compliance dimension it did not have before April 2026.

It is worth being precise about scope: JSL applies specifically where an umbrella company is involved. Direct subcontracting between two security companies — where workers are direct employees of the subcontractor on a standard PAYE payroll — is a different arrangement. The critical question is not whether you use subcontractors, but how the people in your supply chain are actually employed and paid.

What Happens If You Are Found Liable?

The financial exposure is straightforward: HMRC can pursue any party in the chain for 100% of the unpaid amount, regardless of where the failure originated. There is no apportionment, no cap tied to your share of the relationship, and no good faith defence.

The reputational consequences in a regulated sector are arguably more damaging. If HMRC issues a recovery notice, the issue rarely remains private. It may appear in financial disclosures, auditor commentary, or media coverage. Stakeholders do not distinguish between deliberate avoidance and structural failure. Investors see unmanaged risk. Clients see instability.

For a security company, add the sector-specific consequences: ACS accreditation reviews, client contract compliance clauses triggered by tax enforcement action, and reputational damage in a relationship-driven market where your next contract win often depends on a reference from your last one.

One important misconception to address: HMRC publishes a list of known tax avoidance schemes and non-compliant umbrella operators, and some security companies assume that checking this list is sufficient protection. It is not.

JSL is a separate enforcement mechanism from the avoidance blacklist — it is a recovery tool that applies regardless of whether the umbrella in your supply chain appears on any published register. A non-compliant umbrella can generate a JSL liability without ever having been named by HMRC. Do not treat the absence of a name on the list as confirmation of compliance.

The Employment Rights Act 2025 received Royal Assent in December, and the Fair Work Agency launched on 7 April 2026 with a remit to enforce workers’ rights across the labour market. The Fair Work Agency is expected to take on direct regulation of umbrella companies from 2027, further consolidating supply chain oversight under a single enforcement body. The direction of travel is clear: the government intends to hold every party in the supply chain accountable. Security companies that treat this as a one-time compliance exercise rather than a standing operational discipline are misjudging the trajectory.

What Should Security Companies Do Now?

There is no published government checklist and no single accreditation that eliminates JSL exposure. HMRC has made clear that it expects agencies and end-clients to conduct regular, documented checks on their umbrella suppliers. Those that cannot demonstrate a reasonable process for verifying compliance may find themselves exposed.

For security companies, that translates into five concrete actions.

1. Map your supply chain in full. Identify every staffing agency and subcontractor you currently use. For each one, establish how their workers are employed — specifically, whether an umbrella company sits anywhere in the arrangement. If you cannot answer this today, that is your first priority.
   
2. Request documented PAYE compliance evidence. Ask your labour suppliers to confirm in writing that workers are employed on PAYE and that Income Tax and National Insurance are being correctly remitted to HMRC. Consider what processes are necessary to obtain comfort — potentially in real time — that PAYE and NIC have been calculated, reported through Real Time Information, disclosed on workers’ pay slips, and paid correctly and on time. Document everything you request and everything you receive.
   
3. Prefer FCSA-accredited suppliers where possible. FCSA accreditation provides independent assurance of payroll and tax compliance. Ensure umbrella partners are financially secure and consistently meeting PAYE and NIC obligations. Accreditation is not a complete defence under JSL, but it is evidence of a documented compliance process if HMRC investigates.
   
4. Review your BS7858 vetting exposure simultaneously. If you are using agency-supplied staff whose vetting status you cannot verify, you have a compliance problem that runs alongside — and compounds — your JSL exposure. An officer who is not properly vetted and whose employment arrangement is not clean creates regulatory and tax risk at the same time.
   
5. Rethink how you meet flexible demand. The operational pressure that drives subcontracting in security does not go away. What changes is the risk calculation. PAYE-employed flexible staffing, where the employment relationship is direct and the audit trail is complete, removes the JSL exposure that umbrella or agency arrangements create.

How Does JSL Interact With Other 2026 Compliance Pressures?

JSL does not sit in isolation. Security companies in 2026 are managing several concurrent compliance obligations, and they interact with each other.

BS7858 vetting remains the baseline for every security hire. The 2025 tightening of SIA criminality criteria means the standard your vetting process must meet has moved, and any agency-supplied worker whose vetting you have not verified independently represents a gap in your compliance posture.

Martyn’s Law, which received Royal Assent in April 2025 and enters enforcement no earlier than April 2027, subject to the Home Office’s implementation timeline, will require venues above 200-person capacity to demonstrate compliant security arrangements. Security companies supplying those venues will face increased scrutiny of their staffing documentation — including employment status.

The Fair Work Agency, launched on 7 April 2026, has a remit that overlaps with how security workers are employed and paid. Its enforcement focus on labour market compliance means the supply chain questions JSL raises are being examined from multiple regulatory angles simultaneously.

The companies that will navigate this period well are those that treat compliance as an integrated operational discipline — not a series of separate box-ticking exercises.

Frequently Asked Questions

How GuardPass Can Help

JSL exposure doesn’t start with a compliance failure — it starts with not knowing how the people filling your shifts are actually employed. The security companies most at risk are those operating with gaps in their supply chain visibility, relying on agency arrangements they haven’t audited, and treating staffing as an operational question rather than a compliance one.

If that’s where you are, GuardPass gives you the tools to close those gaps — from licence verification and vetting through to how you source and manage your security workforce.

The direction of travel from HMRC, the Fair Work Agency, and the SIA is consistent: every party in the labour supply chain will be held accountable. The security companies that come through this period without disruption won’t be the ones that got lucky — they’ll be the ones that made deliberate decisions about how they staff.

Disclaimer: This blog is for informational purposes only. Please verify details independently before making decisions.

There was a time when retail security in the United Kingdom could at least pretend to be a deterrent. Uniformed presence, store detectives, and the occasional well-judged apprehension created a fragile but functional ecosystem. Today, that ecosystem has fractured. The modern retail security officer stands not as an enforcer, but as a witness, often unwilling, frequently unsupported, and increasingly irrelevant.

Recent headlines paint a bleak picture. Across London and other major cities, shoplifting has surged, in some cases approaching what senior politicians have described as a “free-for-all.” Incidents have become both more frequent and more brazen, with organised groups sweeping through stores and individuals stealing in plain sight of staff and customers alike. The uncomfortable truth is that this is not merely a spike in crime; it is the predictable outcome of a system that has quietly abandoned enforcement.

The Optics Of Inaction

Security officers are now routinely criticised by the public for “doing nothing.” Social media is awash with footage of thieves calmly filling bags while uniformed guards stand by. Yet this apparent inaction is not negligence; it is policy.

Retailers, unions, and industry bodies have converged, whether intentionally or not, on a doctrine of non-intervention. Security staff are increasingly instructed to observe and report, not to intervene physically. The reasoning is simple: confrontation carries risk. Risk to staff safety, risk to corporate liability, and perhaps most significantly, risk to brand reputation in the age of trial by YouTube.

This has created an operational paradox. The very individuals employed to prevent loss are formally discouraged from preventing it. Instead, they are recast as evidence gatherers, human CCTV systems tasked with documenting crime rather than stopping it.

Zero Intervention: Valid Policy Or Admission Of Defeat?

Let’s be clear: zero intervention is not always written in policy manuals, but it is now widely embedded in practice. Reports indicate that many retail workers are effectively told not to challenge shoplifters, particularly where violence is a possibility.

The rationale is grounded in health and safety legislation. Employers have a duty of care to their staff, and rightly so. Confronting a potentially aggressive offender over low-value goods is difficult to justify in a risk assessment. However, this logic, when applied universally, results in a de facto decriminalisation of shoplifting at the point of sale.

Criminals, unsurprisingly, have noticed.

The Collapse Of Deterrence

Deterrence in retail has always been a delicate balance. CCTV, electronic stock tagging, and uniformed presence are designed not to eliminate theft entirely, but to raise the perceived risk. When that risk disappears, behaviour changes rapidly.

Data suggests that shoplifting has risen dramatically in recent years, with some areas experiencing increases of over 100% across a four-year period. In London alone, tens of thousands of cases are recorded annually, with significant year-on-year growth.

More concerning is the perception, widely shared among offenders, that consequences are unlikely. In some regions, a substantial proportion of shoplifting cases are closed with no further action, often within weeks. This creates a feedback loop: low enforcement leads to increased offending, which in turn overwhelms enforcement capacity.

The result is what frontline staff increasingly describe as ‘open season.’

When Intervention Becomes A Sackable Offence

Perhaps the most demoralising aspect of the current environment is the treatment of those who do choose to act. There have been high-profile cases of long-serving retail employees dismissed for challenging or detaining suspected shoplifters.

One such case, involving a supermarket worker intervening in a theft, drew national attention and political comment. The message to staff is unmistakable: intervene at your peril.

From a corporate perspective, the calculation is cold but rational. A wrongful detention claim, an injury, or a viral video depicting a confrontation can cost far more than the value of stolen goods. In this equation, stock loss is simply a cost of doing business.

For security professionals, however, this represents a fundamental erosion of purpose. If enforcement is penalised, and inaction is mandated, the role becomes untenable, and the image of the security industry in general takes an undeserved hammering.

Health And Safety: The Unanswerable Constraint

No serious practitioner would argue that staff should be placed at undue risk. The escalation of violence in retail environments is well documented. Incidents involving threats, weapons, and physical assault are increasingly common, often linked to organised crime gangs, repeat offenders or substance abuse.

Surveys indicate that a majority of retail workers have experienced abuse, with a significant proportion facing threats or violence. In such an environment, the imperative to prioritise staff safety is both ethical and legal.

Yet ‘health and safety’, while essential, has become a blunt instrument. It is applied uniformly, regardless of context, effectively removing discretion from trained security personnel. The experienced officer, trained in the ASCONE procedure, capable of assessing risk and acting proportionately, is treated no differently from an untrained employee.

This is not safety; it is risk avoidance at any cost, and a road to disaster.

Recommended Reading: Top 10 Characteristics Of A Good Security Officer

The YouTube Effect

Compounding these challenges is the role of social media. Platforms such as YouTube and TikTok have transformed shoplifting into a form of performance. Videos of thefts, often filmed by the perpetrators themselves, circulate widely, sometimes garnering millions of views.

For retailers, this presents a reputational nightmare. A poorly handled incident can become a viral scandal within hours. The fear of negative publicity often outweighs the financial impact of theft, reinforcing the preference for non-intervention.

From the offender’s perspective, the situation is inverted. The absence of consequences, combined with the prospect of notoriety, creates a powerful incentive. Crime becomes both low risk and high visibility.

Policing: The Missing Link

It is impossible to discuss retail security without addressing the role of law enforcement. Retailers do not operate in isolation; they are part of a broader criminal justice ecosystem. When that system falters, the effects are immediate and profound.

Criticism of police response to shoplifting is widespread. In some areas, the majority of cases are not pursued, often due to resource constraints or evidential thresholds. The historic reluctance to investigate lower-value thefts has further undermined confidence, although recent policy changes aim to address this.

Government initiatives, including increased funding and legislative reform, signal recognition of the problem. New measures seek to strengthen protections for retail workers and remove perceived loopholes that have benefited offenders.

These are welcome developments, but they remain, at present, aspirational. On the shop floor, little has changed. Unless and until there is substantial investment in Police Services, and a genuine increase in Officers on the ground, all the political aspirations and commitments are meaningless.

The Illusion Of Technological ‘Solutions’

Retailers have invested heavily in technology. CCTV, body-worn cameras, electronic tagging, and even forensic marking systems. These tools have their place, and in some cases have delivered measurable reductions in crime.

However, technology is not a substitute for enforcement. A camera may record a theft, but it does not prevent it. A tag may trigger an alarm, but without intervention, it is merely noise. Even advanced systems rely on a fundamental assumption: that there will be a response.

Without that human physical response, technology simply becomes theatre.

A No-Win Scenario

The phrase “no win” is not used lightly. Retail security in the UK is caught between competing imperatives:

• Protect staff from harm
• Protect the business from loss
• Protect the brand from reputational damage
• Operate within legal and regulatory constraints

These objectives are not always compatible. In the current climate, the balance has shifted decisively towards risk avoidance and reputational management. Loss prevention, ironically, has become secondary.

For security personnel, this creates a professional dead end. They are held accountable for losses they are not permitted to prevent, criticised for inaction they are instructed to maintain, and exposed to risk without meaningful authority.

The Only Viable Way Forward

There is no technological fix, no policy tweak, and no training programme that can resolve this imbalance in isolation. The fundamental issue is one of consequence.

Until shoplifting carries a credible risk of detection, arrest, and sanction, it will continue to grow. This requires a coordinated response:

• Consistent police engagement with retail crime
• Swift and visible consequences for offenders
• Clear, unified guidelines for intervention
• Legal protections for staff acting in good faith

Without these elements, the current trajectory will persist.

Retailers can continue to invest millions in prevention, but without enforcement, these efforts amount to little more than containment. As one industry figure put it, crime must have consequences.

Conclusion

Retail security in the UK has not failed; it has been systematically disarmed. The shift towards non-intervention, driven by legitimate concerns over safety and liability, has created an environment in which theft can flourish with minimal resistance.

Security officers have become spectators in their own domain, tasked with documenting a problem they are powerless to solve. It is a situation that satisfies no one: not the staff, not the retailers, and certainly not the public.

Until the balance between prevention and enforcement is restored, loss prevention will remain exactly what it has become, a no-win endeavour.

Raise The Standard Of Your Retail Security Team 

If the system has stripped officers of authority, the one thing employers still control is the calibre of the people they deploy. In an environment where every intervention is scrutinised, putting properly vetted, properly trained officers on the ground is no longer a nice-to-have — it is the difference between a defensible incident and a viral disaster.

GuardCheck delivers BS7858-compliant vetting in days rather than weeks, and GuardTrain gives your officers access to the UK’s largest training network, including conflict management modules that matter most when policy demands restraint. Professionalism is the only edge left worth investing in.

Find out how GuardPass supports retail security operations.