Last updated: 7 September 2026

Key Holding Register Template: The Complete UK Guide for 2026

A key holding register template is a spreadsheet, form, or digital log that records who holds which key, for which premises, under what authority, and when it was issued or returned. UK businesses use it to satisfy insurers, meet BS 7984 (the British Standard for key holding and response services), and maintain an audit trail if a key is lost or a break-in occurs.

Key Takeaways

• A key holding register template records key identity, holder details, issue and return dates, and authorisation for every key in circulation.
• The SIA Key Holding Licence — a non-front-line licence issued by the Security Industry Authority — costs £220 and is valid for three years, according to Get Licensed (2026).
• SSAIB confirms an SIA licence is legally required whenever a person keeps custody of, or controls access to, any key or similar device used to operate a lock, per SSAIB (2026).
• Get Licensed confirms no formal SIA training course is required to obtain a Key Holding Licence, though performing manned guarding duties on the same licence would breach its terms (2026).
• BS 7984 is the British Standard covering the management, staffing, and operation of key holding and response services companies in the UK, as detailed by the IS Certification Service.

What Is a Key Holding Register Template?

A key holding register template is a standardised document — in Excel, Google Sheets, or a digital compliance platform — that logs every key issued within an organisation, along with who holds it, why, and when it must be returned. A key holding register template differs from a simple key cabinet inventory because it tracks people and accountability, not just physical stock.

Businesses use a key holding register template to answer three questions at any moment: who currently holds each key, which premises or asset that key unlocks, and what authority permitted the issue. This matters for insurers assessing risk after a break-in, for facilities managers auditing access control, and for outsourced key holding companies operating under BS 7984, published via the IS Certification Service.

Many organisations confuse a "key register" with a "key log". A key register is the permanent master record of every key that exists and who is currently responsible for it. A key log — sometimes called a key issue log — is the transactional record of individual sign-outs and returns. A robust key holding register template usually combines both: a master list of keys plus a running log of movements.

Key Register vs Key Holding Register vs Key Log

The terminology gets used loosely across the UK security and facilities sector, which causes real confusion when auditors or insurers ask for records.

• Key register: the master inventory of every key, its identifying code, and the lock or door it operates.
• Key holding register: extends the key register to include named holders, their contact details, and the legal or contractual basis for holding the key (e.g. a keyholding contract with a security company).
• Key log (or key issue log): the day-to-day transactional record — who signed a key out at 08:14 and returned it at 17:32, for example.

For businesses that outsource keyholding to a security provider, all three typically need to exist and reconcile with each other. If your daily occurrence book or incident log references "key handed to contractor at 22:10", that entry should trace back to a specific line in the key holding register.

What Should a Key Holding Register Template Include?

A compliant key holding register template captures enough detail to answer who, what, where, when, and why for every key in circulation, without becoming so cumbersome that staff stop updating it. At minimum it needs a unique key reference, the premises or asset it unlocks, the current holder's full name and contact details, the date of issue, the expected return date, and the authorising manager's name.

Beyond the basics, well-designed templates include a master key hierarchy field (to distinguish a grand master key from a sub-master or individual suite key), a "key type" column (cut key, fob, code, or electronic credential), and a status flag showing whether the key is currently out, returned, or reported lost.

Core fields every template needs

Optional but valuable additions

• Master key hierarchy notes — showing whether a key is a grand master (opens everything), a sub-master (opens a defined zone), or a standalone key.
• Signature or digital confirmation — a scanned signature or app-based confirmation reduces disputes.
• Insurance reference number — links the register entry to your buildings or contents insurance policy, useful if a claim follows a break-in.
• GDPR retention flag — a key holding register stores personal data (names, contact numbers, sometimes home addresses), so it falls within the scope of the UK GDPR and the Data Protection Act 2018, enforced by the Information Commissioner's Office (ICO). Templates should include a review or deletion date once a holder no longer needs access.

Is a Key Holding Register a Legal Requirement in the UK?

No single UK statute states that every business must keep a key holding register, but insurers and licensing rules make one effectively mandatory in practice. Insurers frequently require evidence of key control as a condition of a commercial policy, and any business that outsources key holding to a third party will find that provider operating under the Private Security Industry Act 2001 and, typically, the BS 7984 standard.

Where a company or individual takes custody of keys to premises they don't own — such as a mobile patrol or keyholding response firm — the activity becomes licensable. An SIA licence, issued by the Security Industry Authority under the Private Security Industry Act 2001, is required when keeping custody of, or controlling access to, any key or similar device for operating any lock, according to SSAIB (2026). All SIA licences, including the non-front-line category, cover key holding activity under that same source.

This means a facilities manager holding keys to their own building doesn't need a licence, but a contracted security company holding client keys almost certainly does — and the register becomes the paper trail that proves the licensing condition was met and that access was properly controlled.

The SIA Key Holding Licence explained

The Key Holding Licence is classed as a non-front line SIA licence, meaning the licence holder is not expected to perform manned guarding duties such as static guarding or door supervision. Get Licensed confirms the licence costs £220 and remains valid for three years (2026 figures).

No SIA training course is legally required to obtain the licence itself, but if a key holder starts performing manned guarding functions — responding to alarms with a security presence, for instance — that would breach the non-front line licence and require the full front-line SIA licence and associated training, per Get Licensed (2026). GOV.UK's official SIA licence guidance confirms the same point: no licence-linked qualification is needed to obtain a non-front-line licence such as key holding (2026).

Paper vs Digital: Which Key Holding Register Should You Use?

A paper key holding register — a bound logbook or printed spreadsheet in a folder — costs almost nothing to set up but is vulnerable to loss, illegible handwriting, and tampering, none of which stand up well if an insurer or the police ask for evidence after a break-in. A digital register, whether a shared Google Sheet or a purpose-built compliance platform, gives you timestamps, searchability, and an audit trail that can't quietly go missing along with the key.

For a single-site small business, a well-maintained Excel or Google Sheets template is often adequate. For any organisation running multiple sites, outsourcing key holding, or operating under SIA licensing and BS 7984, a tamper-evident digital system is close to essential — the same logic that applies to choosing a security patrol app over paper checksheets.

Comparing paper and digital key holding registers

Building a key holding register template in Excel or Google Sheets

For businesses starting with a spreadsheet, a practical build follows this sequence:

1. Create a header row using the core fields listed above (Key reference, Premises, Holder, Date issued, Date returned, Status).
2. Apply data validation to the "Status" column so only "Out", "Returned", "Lost", or "Retired" can be entered — this prevents free-text errors.
3. Add a conditional formatting rule that highlights any row where "Expected return" has passed and "Date returned" is blank, flagging overdue keys in red.
4. Use a simple formula (e.g. =IF(AND(TODAY()>D2,F2="") ,"OVERDUE","")) to auto-generate an overdue flag column.
5. Protect the sheet with view/edit permissions restricted to authorised managers, given the personal data it contains.
6. Keep a separate tab for "retired" or "lost" keys so the active register stays clean and quick to scan.
7. Back up or version the sheet regularly — a spreadsheet with no backup is a single point of failure for your entire key control system.

This approach works, but it depends entirely on staff discipline — a spreadsheet doesn't stop someone forgetting to log a key, and it can't verify that the person updating it was actually on site.

How Does a Key Holding Register Support BS 7984 and SIA Compliance?

BS 7984 sets out requirements for the management, staffing, and operation of key holding and response services companies operating in the UK, as detailed by the IS Certification Service. A key holding register is one of the core pieces of documentary evidence assessors look for when certifying a company against this standard, because it demonstrates that access to client keys is controlled, recorded, and reviewable.

Certification bodies such as SSAIB audit security services firms against standards including BS 7984, and a well-maintained register is typically the first document requested during that audit. Beyond certification, the register also underpins day-to-day SIA licensing compliance — since key holding is licensable conduct under the Private Security Industry Act 2001, a register that shows exactly which licensed individual held which key, and when, is direct evidence of lawful operation.

Where a register fits in an incident response

If a key goes missing, the register becomes the first document any competent security manager pulls. It should immediately answer: who last held the key, when was it issued, which premises does it unlock, and has the lock been changed since. Best practice links every "lost key" entry in the register to a corresponding incident report, so the two records corroborate each other rather than existing in isolation. This is exactly the kind of cross-referencing that a tamper-evident daily occurrence book is designed to support, rather than a loose paper trail that can be edited after the fact.

Outsourced Keyholding vs In-House Key Management

In-house key management gives an organisation direct control and no third-party cost, but it demands someone is always contactable to respond to an alarm activation — often at 3am — and that person must still comply with SIA licensing rules if the keys belong to premises they don't own outright (for example, a managing agent holding keys for multiple landlords).

Outsourcing to a licensed keyholding and alarm response provider shifts that burden to a company already operating under BS 7984 and SIA licensing, with response arrangements built for out-of-hours call-outs. The trade-off is cost and a reliance on the provider's own register and audit trail being accurate — which is precisely why any outsourcing decision should include a direct look at how the provider maintains its key holding register, not just its response times. Our guide to proving patrols actually happened explains what verifiable evidence looks like in practice, and the same standard applies whether you're comparing an in-house team or evaluating providers via a Silvertrac alternative or similar platform.

Your Key Holding Register Template Checklist

• Assign a unique reference code to every key, fob, or access credential in circulation.
• Record the holder's full name, role, and organisation against every issued key.
• Capture issue date, expected return date, and actual return date for each entry.
• Flag master, sub-master, and individual keys separately to show the access hierarchy.
• Confirm SIA licensing status for any external contractor named as a key holder.
• Apply a GDPR-compliant retention and deletion schedule to holder personal data.
• Cross-reference any "lost" or "overdue" status with a formal incident report.
• Review the register on a fixed schedule (monthly or quarterly) rather than only after an incident.

FAQ

The questions UK facilities and security teams ask most, answered plainly. (This page is published with schema.org markup so AI assistants can cite it accurately.)

What is a key holding register template?

A key holding register template is a standardised record — spreadsheet or digital form — that logs every key in an organisation, its current holder, and the dates it was issued and returned. It provides an auditable trail of who has access to which premises at any given time.

What should be included in a key holding register?

A compliant key holding register includes a unique key reference, the premises it unlocks, the holder's name and contact details, issue and return dates, the authorising manager, and current status (out, returned, or lost). Adding a master key hierarchy field and a GDPR retention date strengthens the template further.

Is a key holding register a legal requirement in the UK?

No single law mandates a key holding register for every business, but it becomes essential where a third party takes custody of client keys under the Private Security Industry Act 2001. An SIA licence is required for key holding activity, per SSAIB (2026), and the register is the evidence that licensing condition is being met.

What's the difference between a key register and a key holding register?

A key register is the master inventory of keys and the locks they operate, while a key holding register adds named holders and accountability details. A key log, by contrast, is the transactional record of individual sign-outs, which sits alongside both.

Do I need an SIA licence to be a key holder?

Yes, in most commercial contexts. An SIA licence is required when keeping custody of, or controlling access to, any key or similar device for operating a lock, according to SSAIB (2026), and all SIA licences including non-front-line ones cover this activity.

How much does a Key Holding Licence cost?

The SIA Key Holding Licence, classed as a non-front line licence, costs £220 and is valid for three years, according to Get Licensed (2026). No formal SIA training course is required to obtain it, though performing manned guarding duties on the same licence would breach its conditions.

What is BS 7984 and how does it relate to key holding?

BS 7984 is the British Standard covering the management, staffing, and operation of key holding and response services companies in the UK, as outlined by the IS Certification Service. A maintained key holding register is core evidence used during certification audits against this standard.

How long should key holding records be kept?

There's no single statutory retention period specific to key registers, but records should be kept for as long as the key remains active plus a reasonable period afterwards to support insurance or legal queries. Personal data within the register should follow a GDPR-compliant retention schedule under the Data Protection Act 2018, overseen by the ICO.

Keeping your key holding register audit-ready with Pulse Operations

A key holding register is only as trustworthy as the patrol and incident data sitting next to it — an entry saying "key handed to contractor at 22:10" is only useful if the visit it refers to can itself be proven. Pulse Operations was built by operators inside a working London security and FM business (Aether Agency Ltd) to solve exactly this proof-of-service problem, replacing loose paper trails with a tamper-evident daily occurrence book that captures 18 incident types and links directly to site activity, alongside a compliance runway covering SIA licensing, BS 7858 screening, DBS checks and statutory building compliance.

Every checkpoint on Pulse is completed only by a mandatory watermarked photograph showing the officer, site, GPS location and time — deliberately with no QR or NFC scanning to fake — and across live Pulse operations 96.2% of checkpoints carried that photo evidence over a trailing 90-day period as of July 2026, a figure published openly on the operations benchmark with the remaining gap shown rather than hidden. A key handover or collection recorded during a patrol carries that same verifiable evidence, not just a name scrawled in a logbook — the same standard of proof covered in our guide to integrated security and FM software.

If your business currently manages keyholding through a spreadsheet nobody quite trusts, take the two-minute tour and see how a live control room, tamper-evident occurrence book and client portal turn a key holding register into something you can stand behind during an audit or after an incident — with every plan's pricing published openly and a guided switch that most firms complete within a fortnight.

Related Reading

• Guardhouse Alternative 2026: Best UK Options Compared
• SmartTask Alternative 2026: Best Options Compared
• Security Patrol App: The 2026 UK Buyer's Guide