Last updated: 17 October 2026
Right to work checks for security staff are the legal checks employers must complete before an SIA licence holder starts work, confirming their immigration status permits UK employment. Employers who skip them risk civil penalties of up to £45,000 per illegal worker for a first breach, rising to £60,000 for repeat breaches, per GOV.UK's code of practice.
Key Takeaways
- Right to work checks are an employer duty, not an SIA duty — the Security Industry Authority licenses individuals to work in security roles, but it does not verify a person's immigration status; that responsibility sits with the employer.
- Civil penalties for illegal working now reach £45,000 per worker on a first breach and £60,000 on repeat breaches, up from £15,000 and £20,000 respectively, according to GOV.UK.
- The Home Office issued 525 illegal-working civil penalties worth £26.47 million between October and December 2026, finding 620 illegal workers, according to a Home Office national report cited via ES Consultancy.
- Employers must retain right to work records for the duration of employment plus two years after a worker leaves, per GOV.UK's employer's guide.
- From 1 December 2026, the overseas criminal record check for SIA licence applicants extends from five years to ten years, according to Zems Academy.
What is a right to work check for security staff?
A right to work check is the statutory verification process an employer must carry out before employing anyone in the UK, confirming through prescribed documents or a Home Office online service that the individual is legally permitted to work. For security staff, this check runs in parallel with — but separate from — Security Industry Authority (SIA) licensing and BS 7858 pre-employment screening.
Passing all three doesn't mean the same thing. An SIA licence confirms someone has passed identity, criminality and competency checks to hold a door supervisor, CCTV or security guarding badge under the Private Security Industry Act 2001. It does not confirm immigration status. As the SIA itself has stated: "There is no legal responsibility for the SIA to carry out right to work checks; that is the role of the employer," according to the Security Industry Authority, reported by Professional Security Magazine. Employers who assume an SIA badge covers immigration compliance are exposed.
Why security companies specifically get this wrong
Security is a high-turnover, multi-site, often subcontracted sector. Officers move between agencies, umbrella companies and labour suppliers, sometimes working several sites in a week. That structure creates exactly the conditions the Home Office targets: unclear employer responsibility, thin paperwork trails, and reliance on a labour supplier's assurance rather than the end employer's own check. A guarding firm that treats an agency's word as sufficient has not established a statutory excuse — the legal defence against a civil penalty — in its own right.
Is right to work checking a legal requirement for security companies?
Yes. Right to work checking is a legal requirement under the Immigration, Asylum and Nationality Act 2006 for every UK employer, including security and facilities management companies, regardless of sector-specific licensing like SIA badges. There is no exemption for security guarding, keyholding, mobile patrol or concierge roles.
The legal mechanism is the statutory excuse. An employer that conducts a correctly documented, prescribed check before employment begins establishes a defence against a civil penalty, even if the employee is later found not to have the right to work. Get the check wrong — wrong document type, wrong verification method, missed follow-up on a time-limited status — and that defence evaporates. Between July 2024 and March 2025, more than 1,500 civil penalty notices were issued to UK employers for illegal working, according to CB Screening. Security and FM contractors, who employ large numbers of shift-based, transient staff across multiple client sites, sit squarely in the risk profile Home Office compliance teams look at.
How much is the fine for not doing right to work checks?
The fine for failing to conduct right to work checks correctly is a civil penalty of up to £45,000 per illegal worker for a first breach and up to £60,000 per illegal worker for repeat breaches, replacing the previous £15,000 and £20,000 caps. This increase took effect as employers were put on notice that enforcement would intensify.
The scale of the change matters for anyone budgeting compliance risk. In 2023, civil penalties for illegal working were capped at £20,000 per illegal worker, before the Home Office announced it would treble fines by mid-2026, according to CB Screening. For a security contractor running several sites with dozens of officers, a single lapse across a handful of shifts could theoretically expose the business to six-figure liability — separate from reputational damage with clients who require SIA Approved Contractor Scheme (ACS) status or equivalent assurance in their tender documents.
| Breach type | Old maximum penalty | Current maximum penalty (per illegal worker) |
|---|---|---|
| First breach | £15,000 | £45,000 |
| Repeat breach | £20,000 | £60,000 |
Figures per GOV.UK's code of practice on preventing illegal working.
Does an SIA licence prove someone has the right to work in the UK?
No. An SIA licence does not prove a person's right to work in the UK — it is a separate criminality, competency and identity check administered under the Private Security Industry Act 2001, and it carries no legal weight as evidence of immigration status. Employers who treat a valid SIA badge as sufficient proof of right to work are relying on the wrong document for the wrong purpose.
The distinction has sharpened recently. From 1 December 2026, the overseas criminal record requirement for SIA licence applicants extends from five years to ten years, according to Zems Academy's summary of the SIA licence updates. That change tightens vetting depth for criminal history — it says nothing about whether the applicant is entitled to take up employment in the UK at all. Employers must still run their own, entirely separate right to work check, using the Home Office's prescribed list of acceptable documents or its online checking service, and keep that evidence on file.
This is also the point where Home Secretary Jacqui Smith's original framing of right to work checks still resonates: "It is the responsibility of employers to check that, but it will be manifestly easier to do so if the people who have a right to stay and work in this country have ID cards," she said when the checking regime was first extended, as reported by Professional Security Magazine. The digital equivalent of that ID card today is the Home Office share code system, and it doesn't remove the employer's obligation to check and record it.
How does BS 7858 screening incorporate right to work checks?
BS 7858:2019 is the British Standard code of practice for the pre-employment screening of individuals working in a secure environment, published by BSI Group. Right to work verification sits within a wider BS 7858 vetting sequence that also covers identity checks, employment history verification, unspent criminal convictions, credit checks where relevant, and reference checks going back typically five years.
Sequencing matters. A screening process that verifies employment history before confirming right to work wastes effort if the candidate turns out to be ineligible. Best practice runs right to work verification early — often before other checks begin — because an unresolved immigration status makes every subsequent screening step moot. For SIA-licensed roles, this typically means checking right to work status alongside submitting or confirming the SIA licence application, since both are prerequisites for lawful deployment.
At Pulse, this is exactly why right to work sits on the same compliance runway as BS 7858, SIA licensing, DBS checks, training records and statutory building compliance — one expiries view rather than five separate trackers. The compliance runway exists because security firms told us the same thing repeatedly: the checks aren't hard individually, but tracking their overlapping dates across dozens of officers and multiple sites is where things get missed.
Digital vs manual right to work checks
Employers can conduct right to work checks manually — examining original documents in person — or digitally, using a certified Identity Service Provider (IDSP) via the Home Office's Digital Verification Service (DVS), or by checking a share code through the Home Office online service. A right to work share code is typically valid for 90 days and can be reused during that period, according to DavidsonMorris's guide to right to work share codes.
| Method | How it works | Typical use case |
|---|---|---|
| Manual document check | Physical inspection of original passport, biometric residence permit or other prescribed document | Face-to-face onboarding, smaller firms |
| Home Office online check (share code) | Candidate generates a share code, employer verifies via GOV.UK service | Non-British/Irish nationals with digital status |
| IDSP/DVS digital identity check | Certified provider verifies British/Irish passport holders remotely | Remote or high-volume recruitment |
For multi-site security contractors onboarding officers across several boroughs or regions at once, digital checking reduces friction — but it does not reduce the record-keeping obligation. Whichever method is used, the employer must retain the evidence for the duration of employment and for two years after the worker leaves, per GOV.UK's employer's guide, updated 26 June 2026.
Who is responsible for right to work checks when using agency security staff?
The end employer or the agency supplying the worker is responsible for right to work checks, depending on the specific contractual arrangement — but the statutory excuse belongs to whichever party actually employs the individual, and that must be established in writing before work starts. This is one of the most common points of confusion in security guarding, where labour supply chains often run several links deep.
If a security company supplies officers to a client site under a contract for services, the security company is normally the employer for right to work purposes, and it must conduct its own check — it cannot simply accept an assurance from a sub-agency without documented evidence. If an umbrella company employs the officer and supplies them onward, the umbrella company typically holds the statutory excuse obligation, but the engaging security firm should still confirm this contractually and, in practice, ask for sight of the compliance evidence. Ambiguity here is exactly what Home Office compliance visits probe.
In practice, this is the gap Pulse was built to close inside Priority First, the founding team's own London security and facilities operation. Before the platform existed, expiries — right to work follow-ups, SIA renewals, DBS refreshes — sat in a spreadsheet nobody fully trusted, split across officers employed directly and those supplied through other arrangements. Getting a straight answer to "is everyone on this site legally checked and in date?" meant chasing several people. Moving compliance onto one runway, alongside patrols, incidents and rostering, meant that question had one answer, checked against one record, not five.
Right to work checks vs BS 7858 screening: what's the difference?
Security employers often ask whether right to work checking and BS 7858 screening are the same process. They are not, and treating them as interchangeable is a common compliance gap.
- Right to work checking is a statutory legal obligation under immigration law, mandatory for every UK employer, with fixed civil penalty consequences for getting it wrong.
- BS 7858 screening is a British Standard, not a legal requirement in itself, though many clients — particularly in banking, retail and government-adjacent sites — mandate it contractually as a condition of the security contract.
- Right to work checking has a hard legal deadline: before employment starts.
- BS 7858 screening typically runs over several weeks and covers a longer historical window, including employment references and, where applicable, credit history.
- Both checks generate documents that must be retained and produced on demand — right to work records for the duration of employment plus two years, per GOV.UK, and BS 7858 files typically for the length of the individual's engagement plus a retention period set by client contract.
Where an ACS assessment comes into it, both checks get scrutinised together. Pulse's own guide on the ACS self-assessment notes that the People criterion — one of seven criteria in the SIA's 78-indicator workbook — specifically checks how well contractors apply BS 7858 for security screening and verify licences against the SIA's register. An assessor reviewing that criterion will expect to see right to work evidence sitting alongside it, not filed separately or missing.
What documents are accepted for a right to work check in the security industry?
Acceptable documents fall into categories set out by the Home Office: List A documents (which establish an ongoing statutory excuse, typically for British and Irish citizens or those with permanent status) and List B documents (which require follow-up checks because the individual's permission to work is time-limited). Security employers must record which list applies and, for List B, diarise the follow-up date.
For SIA-licensed roles specifically, this creates an added layer: an officer's SIA licence has its own renewal cycle (typically three years), separate from any time-limited immigration status. A security firm rostering an officer with a List B right to work status and an SIA licence expiring in a different month needs to track two independent expiry dates against one person, on top of any BS 7858 re-screening cycle. Run across dozens of officers and several sites, that's the exact kind of overlapping-date problem that spreadsheets handle badly and that a dedicated compliance runway is designed to surface before it becomes a gap.
What happens if a security company employs someone without the right to work?
A security company that employs someone without the right to work, without having conducted a correctly documented prescribed check, loses its statutory excuse and becomes liable for a civil penalty of up to £45,000 for a first breach or £60,000 for a repeat breach per illegal worker, alongside potential reputational and contractual consequences with clients.
Beyond the civil penalty, security contractors face secondary exposure that generic employers may not. Client contracts — particularly those requiring SIA ACS status, adherence to BS 7858, or compliance with tender conditions — often include termination or step-in rights if illegal working is discovered on a supplied contract. A single enforcement action can therefore cost a contract, not just trigger a fine. The Home Office's own enforcement data illustrates the scale nationally: 525 civil penalties worth £26.47 million were issued between October and December 2026 alone, with 620 illegal workers identified, according to a Home Office national report cited via ES Consultancy.
In-house checking vs outsourced screening: the trade-off
Security firms generally choose between running right to work and BS 7858 checks in-house or outsourcing them to a specialist screening provider.
- In-house checking gives direct control and faster turnaround for smaller operators, but risk concentrates on whoever runs the process — a single trained HR or compliance officer becoming a single point of failure, especially across multiple sites and shift patterns.
- Outsourced screening providers bring dedicated compliance expertise and audit trails built for the purpose, but add cost per candidate and can slow down urgent deployments — a real issue when a client needs an officer on-site within 48 hours.
Neither choice removes the underlying record-keeping obligation. Whichever route a firm takes, the evidence has to live somewhere auditable, cross-referenced against the officer's licence, screening file and shift rota — which is the practical reason compliance tracking increasingly moves onto a single operational platform rather than staying split between an outsourced screening portal and an internal spreadsheet.
Your right to work checks security staff checklist
- Confirm which party — direct employer, agency or umbrella company — holds the statutory excuse for every officer before deployment.
- Conduct the right to work check before the officer's first shift, never retrospectively.
- Record which document list (A or B) applies and diarise follow-up dates for time-limited status.
- Verify the officer's SIA licence separately against the SIA public register — a valid licence is not evidence of right to work.
- Retain right to work evidence for the duration of employment plus two years after the worker leaves, per GOV.UK guidance.
- Cross-reference right to work, BS 7858 screening and SIA licence expiry dates on one tracker, not three.
- Review contractual right to work responsibilities with every labour supplier or umbrella arrangement in writing.
- Prepare right to work and screening evidence together ahead of any SIA ACS assessment or client audit.
FAQ
What is a right to work check for security staff?
A right to work check is the legal verification an employer must complete before employing anyone in the UK, using prescribed documents or the Home Office's online service, to confirm the individual is entitled to work. For security staff this runs alongside, but separately from, SIA licensing and BS 7858 screening.
Is right to work checking a legal requirement for security companies?
Yes, right to work checking is a legal requirement under the Immigration, Asylum and Nationality Act 2006 for every UK employer, including security and facilities management companies. There is no sector exemption for guarding, keyholding or mobile patrol roles.
Does an SIA licence prove someone has the right to work in the UK?
No, an SIA licence does not prove right to work — it is a separate criminality and competency check under the Private Security Industry Act 2001. The SIA has stated it carries no legal responsibility for right to work checks; that duty sits with the employer, per Professional Security Magazine.
How much is the fine for not doing right to work checks?
The maximum civil penalty is £45,000 per illegal worker for a first breach and £60,000 per illegal worker for repeat breaches, up from £15,000 and £20,000 respectively, according to GOV.UK.
Can security companies use digital or online right to work checks?
Yes, employers can use the Home Office's online checking service via a share code, which is typically valid for 90 days and reusable during that period, or a certified IDSP under the Digital Verification Service, according to DavidsonMorris. Manual document checks remain equally valid.
Who is responsible for right to work checks when using agency security staff?
Responsibility depends on the contractual arrangement — either the engaging security firm or the supplying agency/umbrella company holds the statutory excuse, and this should be confirmed in writing before deployment. The employer that actually employs the individual is normally the one obligated to check and retain the evidence.
How long must employers keep right to work check records for security staff?
Employers must retain right to work check records for the duration of the individual's employment and for two years after they leave, according to GOV.UK's employer's guide. This applies regardless of whether the check was manual or digital.
Getting right to work compliance under control with Pulse Operations
Right to work checks fail quietly — not because a security firm doesn't know the rule, but because the expiry sits in a spreadsheet next to an SIA renewal date and a BS 7858 re-screening cycle, and nobody notices the three have drifted out of sync. That's the exact problem Pulse's compliance runway was built to solve: SIA, BS 7858, DBS, right to work, training and statutory building compliance sit on one expiries view, so a List B status due for follow-up doesn't get buried under rostering for next week's shifts.
This wasn't designed on a whiteboard. It was built inside Priority First, the founding team's own London security and FM operation, where compliance tracking once meant chasing paperwork across a spreadsheet, a filing cabinet and whoever last spoke to the agency. Since consolidating onto one platform, Priority First has run 24 sites through a single login, with every checkpoint backed by a photo — the same operational discipline that makes compliance evidence something you can actually produce on demand, not reconstruct under pressure.
If right to work, SIA licensing and BS 7858 tracking currently live in different places across your business, get a demo of Pulse's compliance runway and see what one expiries view looks like against your own headcount.
Related Reading
- Body Worn Camera Rules for UK Security Firms 2026
- Security Guard Handover Template UK | Free Guide 2026
- Security RAMS Template: UK Guide + Free Framework 2026
Add pulse-operations.co.uk as a preferred source on Google
Back to all insights