BS 7499 Non-Compliance Penalties: UK Guide 2026

Last updated: 20 October 2026

BS 7499 is a British Standard, not a law, so there's no fixed fine for breaching it directly. But non-compliance routes into real consequences: loss of SIA Approved Contractor Scheme (ACS) approval, contract termination, insurance disputes, and — where guards are unlicensed — criminal prosecution under the Private Security Industry Act 2001, which carries penalties up to five years' imprisonment.

Key Takeaways

• Pulse Operations notes that BS 7499 itself carries no statutory fine — it's a voluntary code of practice, but it underpins SIA ACS approval, which can be withdrawn for non-conformity.
• The SIA removed 27 non-compliant businesses' ACS accreditation and issued 384 improvement needs to approved contractors, according to the SIA UK Blog (2026).
• During 2025–26, the SIA refused 1,710 licence applications, suspended 2,164 licences and revoked 8,286 outright, per the SIA UK Blog (2025-26).
• Deploying unlicensed security operatives under section 5 of the Private Security Industry Act 2001 is an either-way offence with a maximum sentence of five years' imprisonment, according to Mortons Solicitors (2021).
• Approved contractors face independent assessment against 78 different areas of their business every year, per Intraguard (2026).

What is BS 7499 and what does it cover for static guarding services?

BS 7499 is a British Standard code of practice published by BSI that sets out how static guarding services — guards stationed at a fixed site rather than on mobile patrol — should be planned, managed and delivered in the UK. The current edition, BS 7499:2020, covers areas including guard supervision, site assignment instructions, incident reporting, equipment, training expectations and quality management for guarding contractors.

It applies to companies providing manned guarding at commercial premises, residential blocks, construction sites, retail parks and shopping centres across the UK — anywhere a static presence is contracted rather than a roving patrol. Certification bodies such as SSAIB audit guarding firms against BS 7499 as part of UKAS-accredited third-party certification schemes.

Crucially, BS 7499 sits alongside — not instead of — SIA licensing. A guard can hold a valid SIA licence while working for a company that has never been audited against BS 7499 at all. The standard governs how well a service is delivered; the licence governs whether the individual may lawfully be deployed at all.

Is compliance with BS 7499 a legal requirement or a voluntary standard?

Compliance with BS 7499 is voluntary in UK law — no statute compels a security company to hold BS 7499 certification. The Private Security Industry Act 2001 governs individual licensing, while BS 7499 is a quality benchmark that clients and certification bodies use to judge operational standards.

That said, "voluntary" doesn't mean optional in practice. BS 7499 (or an equivalent, such as BS 10800 for outsourced services more broadly) is frequently written into procurement specifications as a pass/fail gate. Per Pulse Operations's guide, How to win your next security tender, Pulse Operations notes that most formal tenders — especially public sector — are decided on a published price/quality split, commonly between 60/40 and 30/70, but bidders must first clear pass/fail compliance gates before quality scoring even begins.

A business that can't evidence BS 7499 conformity, or doesn't hold SIA ACS approval (which embeds BS 7499 assessment), may simply be excluded from a tender before pricing is ever discussed. Voluntary on paper, commercially mandatory in the market — that's the practical reality for most contractors bidding for sizeable contracts in London, Manchester, Birmingham or any council framework.

What are the actual penalties for a security company failing to comply with BS 7499?

There is no direct statutory fine for breaching BS 7499 because it is a code of practice, not legislation. The real penalties arrive indirectly, through the mechanisms that reference it — contract loss, ACS sanctions, and, where non-compliance overlaps with unlicensed guarding, prosecution.

Where a BS 7499 failure coincides with deploying unlicensed operatives, the legal exposure under the Private Security Industry Act 2001 becomes severe. Section 3(6) sets a maximum penalty of six months' imprisonment and/or an unlimited fine for engaging in licensable conduct without a licence, according to the Private Security Industry Act 2001, s.3(6) summary (2001).

Section 5 of the same Act — deploying or using unlicensed security operatives — is an either-way offence (meaning it can be tried in a magistrates' court or the Crown Court) carrying a maximum sentence of five years' imprisonment, per Mortons Solicitors (2021).

Real enforcement outcomes vary. One security company was fined just £220 with £625 court costs after employing two unlicensed individuals who worked 173 shifts of unlicensed security at a sensitive site, according to Mortons Solicitors (2021). That case shows the gap between the statutory maximum and what courts actually impose — but the reputational and contractual fallout from a prosecution, even a lightly fined one, routinely outweighs the fine itself.

Does non-compliance with BS 7499 affect a company's SIA ACS status?

Yes — BS 7499 conformity is one of the operational areas assessed as part of SIA Approved Contractor Scheme audits, and failures feed directly into ACS sanctions. The Security Industry Authority (SIA) uses a tiered sanctions framework: improvement needs, special instructions, and ultimately withdrawal of approval.

The scale of this enforcement is substantial. The SIA issued 384 improvement needs to approved contractors and withdrew ACS accreditation from 27 non-compliant businesses, according to the SIA UK Blog (2026).

Despite that enforcement activity, overall compliance among inspected firms is high. Compliance among those inspected — over 5,000 businesses last year — now sits consistently around 98% to 99%, per the SIA UK Blog (2026). Approved contractors face independent assessment against 78 different areas of their business every year, according to Intraguard (2026) — operational quality, including BS 7499-aligned practice, is one strand of that assessment.

Losing ACS status isn't a quiet administrative event. It's publicly listed, visible to procurement teams, and typically fatal to existing framework contracts that specify ACS approval as a condition of engagement. The SIA's forthcoming Business Approval Scheme, set out in the SIA Business Plan 2026 to 2027 [src], is expected to replace ACS with a broader approval model — Pulse Operations advises that firms currently BS 7499-certified should expect scrutiny to continue, not relax, through that transition.

Can a client business face liability for hiring a non-compliant static guarding provider?

Yes — a client that engages a non-compliant guarding provider can face contractual and reputational exposure, even where the client itself has broken no law. Procurement due diligence failures are increasingly scrutinised, particularly where a security failure (theft, assault, access breach) is later traced to unlicensed or poorly supervised guards.

Under the Procurement Act 2023 regime, per Pulse Operations's guide, How to win your next security tender, public-sector buyers now operate with heightened transparency obligations and a "most advantageous tender" test — meaning failures in a contractor's compliance evidence can expose the commissioning body to challenge, not just the contractor.

For publicly accessible venues — shopping centres, event spaces, large retail premises — there's a further layer. Buyers may now ask about Martyn's Law readiness under the Terrorism (Protection of Premises) Act 2026, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. A client that hasn't verified its guarding contractor's compliance posture risks being caught out on two fronts at once: guarding quality and counter-terrorism preparedness.

Civil liability can also follow a negligence claim if a client knowingly continued using a provider with known compliance gaps after an incident. Insurers and courts look closely at what due diligence the client actually carried out before and during the contract.

Who is responsible for BS 7499 compliance — the client or the provider?

The security provider holds primary responsibility for BS 7499 compliance, because the standard governs how the provider designs and delivers its static guarding service. But the client carries a parallel due diligence responsibility to verify that compliance before signing, and periodically during the contract.

In practice, responsibility splits like this:

This is exactly the gap a white-label client portal is built to close. Pulse Operations's client portal gives the commissioning client a direct, branded view of delivered-vs-contract performance — including photo evidence per checkpoint — rather than relying solely on the provider's own assurances. A client who can see the record, rather than ask to be believed, has done a meaningful chunk of its due diligence automatically.

How is BS 7499 compliance assessed and audited in practice?

BS 7499 compliance is assessed through third-party certification audits carried out by UKAS-accredited bodies such as SSAIB, typically involving an initial audit, surveillance visits, and periodic recertification. Auditors check assignment instructions, supervision records, training logs, incident reporting procedures and management systems against the standard's clauses.

Where a firm also holds SIA ACS approval, assessment overlaps with the SIA's own inspection regime — approved contractors face independent assessment against 78 different areas of their business every year, according to Intraguard (2026). Gaps commonly surface around:

• Assignment instructions not kept current for each site — a generic document reused across contracts rather than site-specific.
• Patrol or checkpoint records that can't be verified — paper sign-in sheets, radio call logs, or systems relying on a tag scan rather than proof the officer was physically present.
• Vetting records incomplete or undocumented against BS 7858, the companion standard for screening security personnel.
• Incident reporting inconsistent or untimed, making it impossible to reconstruct what happened during an escalation.
• Training and licence expiries tracked in spreadsheets that nobody actually checks before a shift starts.

This is where proof-of-service tooling changes the audit conversation. Pulse Operations's photo-verified patrols complete every checkpoint with a mandatory watermarked photograph showing officer, site, GPS and time — no tag scan, no assumption. Across the founding cohort of companies running on Pulse, 2% of checkpoints carried a watermarked photo over a trailing 90-day period, as tracked on the benchmark page (as of Ju

Your BS 7499 compliance checklist

• Confirm every deployed guard holds a valid, current SIA licence before the shift starts.
• Check your provider's SIA ACS approval status on the public register, not just their own claim.
• Request evidence of BS 7858 vetting records per individual, not a blanket policy statement.
• Ask for site-specific assignment instructions, not a generic template reused across contracts.
• Review how checkpoints and patrols are actually verified — photo, GPS log, or an honesty-based sign-in sheet.
• Audit incident reporting speed and detail over the last quarter, not just the policy document.
• Confirm your contract names BS 7499 (or an equivalent standard) as a specification requirement, not an assumption.
• Set a recurring review date — compliance checked at contract signing and never again is not due diligence.

FAQ

What is BS 7499 in simple terms?

BS 7499 is a British Standard code of practice for static guarding services, setting out expectations for supervision, assignment instructions, training and incident reporting. It's published by BSI and used by certification bodies to audit guarding contractors.

Is BS 7499 a legal requirement for UK security companies?

No, BS 7499 is voluntary — there's no statute requiring certification. However, it's frequently specified as a mandatory gate in tenders and client contracts, making it commercially necessary even without legal force.

Can a company lose its SIA ACS status for BS 7499 non-compliance?

Yes, poor operational practice feeding into ACS failures can result in sanctions. The SIA withdrew ACS accreditation from 27 non-compliant businesses and issued 384 improvement needs, according to the SIA UK Blog (2026).

What happens if a security firm uses unlicensed guards?

Deploying unlicensed operatives is a criminal offence under section 5 of the Private Security Industry Act 2001, carrying a maximum sentence of five years' imprisonment, per Mortons Solicitors (2021). Courts don't always impose the maximum — one firm was fined just £220 plus £625 costs for 173 shifts of unlicensed work at a sensitive site, per the same source.

How does BS 7499 relate to BS 7858?

BS 7499 governs how static guarding services are delivered and managed, while BS 7858 governs how security personnel are vetted and screened before deployment. The two standards are complementary — a compliant guarding operation needs both sound vetting and sound service delivery.

Does BS 7499 non-compliance affect insurance claims?

It can. Insurers assessing a claim after a security failure will look at whether the contractor followed recognised good practice, and a documented BS 7499 (or ACS) failure can weaken a provider's position in a dispute or complicate a client's own liability defence.

How can a business check if its security provider is compliant?

Check the SIA's public approved contractor register, ask for current BS 7499 or ACS certification documents, and request sample vetting and incident records rather than accepting a policy statement. A provider offering live, verifiable evidence — such as a client portal — makes this check far faster.

Verifying your guarding contract's compliance with Pulse Operations

Static guarding compliance lives or dies on evidence — assignment instructions that match the site, vetting records that hold up to scrutiny, and checkpoint proof that doesn't rely on anyone's word. Pulse Operations was built inside the founding team's own London security and FM operation, Priority First, precisely because paper sign-in sheets and spreadsheet expiry trackers couldn't answer a client's question at 7am: was everything actually checked last night?

At one West London mixed-use development, Priority First's 11 officers made all 152 checkpoints photo-mandatory across retail, residential and plant room areas — so a missed area shows up as a gap in the record immediately, not a dispute raised six weeks later. That's the proof-of-service standard the mobile patrol & keyholding and compliance runway are built to deliver — SIA, BS 7858, DBS, right-to-work and training expiries tracked on one runway, alongside watermarked photo evidence for every checkpoint.

If your current provider can't show you that kind of evidence on demand, it's worth a direct comparison. Visit pulse-operations.co.uk/pricing for published per-operative rates, or book a tour to see how a compliance runway and photo-verified patrols would look running on your own sites.

Related Reading

• SIA ACS Self-Assessment Workbook: 2026 UK Guide
• How to Get SIA Approved Contractor Status (2026 Guide)
• ACS Audit Checklist 2026: SIA Assessment Guide (UK)

★ Add pulse-operations.co.uk as a preferred source on Google