Which pre-employment checks are mandatory, and which are optional?
Only one check applies to every UK employer: the right to work check. The law does not order you to do it, but done as prescribed before employment starts it gives you a statutory excuse against a civil penalty, and without it you have no excuse. Every other requirement attaches to a role, a sector or a UK nation: regulated activity with children or adults, CQC-registered care, schools and early years settings in England, regulated roles in Scotland and senior roles in FCA-regulated firms. Government work often brings the Baseline Personnel Security Standard (BPSS), which reaches private suppliers through their contracts.
Most other checks are optional. The ICO's draft guidance says you should only vet where you are under a legal obligation or can identify significant and particular risks, and should not routinely vet all candidates unless legally required to. The matrix sorts each check by role, status and nation.
How to read the matrix
This guide goes role by role and uses four labels. Required by law means an Act or regulations make the check a condition, or create an offence or penalty where it is missing. This includes the EYFS requirements and the legal duties that Keeping children safe in education (KCSIE) sets out for schools and colleges. Required by regulator means an FCA rule. The right to work check has its own label: it gives a statutory excuse. Contractual means a standard you take on through a contract. Optional means lawful only where the role passes the ICO's proportionality test.
Available is not the same as required. DBS, in its September 2026 article on GOV.UK about the change to regulated activity with children, says the legislation does not create a new requirement to carry out DBS checks, and that employers remain responsible for deciding whether a check is appropriate and what level is legally available.
The role and sector matrix
| Role or activity | Check | Status | Basis | Where |
|---|---|---|---|---|
| Everyone you employ, or engage under a worker's contract or as an individual sub-contractor | Right to work check before work starts | Statutory excuse (no defence to a civil penalty without it) | Immigration, Asylum and Nationality Act 2006, sections 15 to 25 (civil penalty section 15, offence section 21) | Whole UK |
| Regulated activity with children or adults | Enhanced DBS with the relevant barred list | Available; letting a barred person do it can be an offence | Safeguarding Vulnerable Groups Act 2006, section 9 | England and Wales |
| Schools and colleges | Identity, enhanced DBS (with children's barred list for regulated activity), right to work, fitness, qualifications | Required by law, set out in statutory guidance | KCSIE 2026, paragraphs 311 and 313 | England |
| Group and school-based early years staff | Enhanced criminal records and barred list check for everyone 16 or over, including volunteers, who works directly with children or lives or works on the premises; at least one written reference for all staff, students and volunteers | Required by law (EYFS requirements) | EYFS, paragraphs 3.15 and 3.20 | England |
| Anyone employed for a CQC-regulated activity | Schedule 3 information, including identity, DBS certificate where eligible and full employment history (not required for most volunteers) | Required by law | Regulation 19 and Schedule 3, 2014 Regulations | England |
| Regulated roles with children or protected adults | PVG membership, confirmed by Level 2 disclosure before an unconditional offer | Required by law | Protection of Vulnerable Groups (Scotland) Act 2007, sections 45C and 45D (inserted by Disclosure (Scotland) Act 2020, section 73) | Scotland |
| Regulated activity, or services to or close and regular supervision of children or vulnerable adults | AccessNI enhanced check | Expected by AccessNI guidance; letting a barred person do regulated activity can be an offence | AccessNI guidance; Safeguarding Vulnerable Groups (Northern Ireland) Order 2007, Article 13 | Northern Ireland |
| Candidates for FCA-designated senior management functions | Fullest criminal record information, so far as reasonably able no more than 6 months old when the application is submitted | FCA rule | SUP 10C.10.16R | FCA firms, UK |
| Non-SMF board directors, core and enhanced firms | Fit and proper assessment and criminal record check | FCA rule | SYSC 23.4.1AR, 23.4.2R, 23.4.5R | FCA firms, UK |
| Controlled functions, certification staff, board directors | Regulatory references covering six years | FCA rule | SYSC 22.2.1R | FCA firms, UK |
| Certification staff | Fit and proper assessment; convictions checked where possible | Assessment required; check is guidance | FIT 2.1.1AG | FCA firms, UK |
| People working in or for government | BPSS: identity, right to work, employment history, unspent convictions | Contractual for suppliers | BPSS version 7.0 | Government work |
| Licensable security work | SIA licence check | Required by law | Private Security Industry Act 2001, section 5 | England, Wales and Scotland |
| Any other role | Basic criminal record, credit, social media, adverse media, references, qualifications | Optional | ICO vetting guidance | Whole UK |
Right to work: the one universal check
The Right to Work Scheme applies across the whole UK. To establish a statutory excuse you must do one of three prescribed checks before the worker starts, and you cannot dictate which method the person uses. Strictly, the law gives you a defence rather than an order, but without the check you have no statutory excuse if the person turns out to be working illegally. Our right to work page covers the methods.
Regulated activity and barred lists
In England and Wales, DBS says an enhanced check with barred lists is only available for people carrying out regulated activity and a small number of listed positions. No general rule makes every regulated activity provider obtain one. Section 9 of the Safeguarding Vulnerable Groups Act 2006 makes it an offence to permit someone to engage in regulated activity from which they are barred, where you know or have reason to believe they are barred.
Sector rules turn the check into a requirement, in England through KCSIE, the EYFS framework and Schedule 3 for CQC-registered services. From 1 September 2026 more roles with children can be regulated activity, because the supervision exemption was removed; GOV.UK says the change applies in England, Wales and Northern Ireland.
Schools, early years and care in England
KCSIE says all offers of appointment should be conditional until the mandatory pre-employment checks are satisfactorily completed. If someone will start regulated activity before the DBS certificate is available, schools and colleges must obtain a separate children's barred list check.
The EYFS framework says group and school-based providers must not allow individuals to begin working until they have received the enhanced criminal records and barred list check, and an additional check should be made for anyone who has lived or worked abroad.
CQC, which regulates health and adult social care in England, says Schedule 3 information must be confirmed before people are employed, and that person employed includes volunteers, contractors, and agency or bank staff.
Scotland and Northern Ireland
In Scotland, it is an offence for an individual to carry out a regulated role without PVG scheme membership, and an offence for an organisation to offer one without first receiving a Level 2 disclosure confirming membership. An offer made subject to receiving that disclosure is not treated as an offer, so conditional offers are allowed.
In Northern Ireland, AccessNI says enhanced checks are normally required for roles providing services to, or having close and regular supervision of, children or vulnerable adults. AccessNI says an employer can ask all applicants for a basic check, but the ICO's proportionality test still applies to that choice.
Financial services: rules and guidance
FCA rules, which apply to regulated firms across the UK, set three firm requirements. Under SUP 10C.10.16R a firm must obtain the fullest criminal record information it lawfully can before applying for approval of a senior manager, no older than 6 months so far as reasonably able. Under SYSC 23.4, core and enhanced firms must be satisfied a non-SMF board director is fit and proper and obtain the same information before appointment. Under SYSC 22.2.1R, firms must take reasonable steps to obtain references covering the past six years.
For certification staff the assessment is required but the method is guidance: FIT 2.1.1AG says firms should check for criminal convictions where possible. The FCA says fitness and propriety assessments are only required for certification functions and senior managers, although firms can extend them voluntarily.
Government contracts and BPSS
BPSS applies to people working within and for government, including civil servants, contractors, temporary staff and suppliers, and forms part of the Government Functional Standard GovS 007: Security. In our reading it is not legislation: a private company meets it because its government contract requires it, and the standard says organisations shall determine roles and responsibilities with a supplier, including by creating or updating contracts or signed agreements as necessary.
Its four main checks are identity, right to work, employment history and unspent criminal record, carried out once a provisional offer is accepted. Apply it to the people working on the contract, not your whole workforce by default.
Most other checks are optional
For every other check the ICO's test decides. Its examples of significant and particular risks include unsuitable people working with children or adults at risk of harm, danger to others, theft and disclosure of trade secrets. The check must be proportionate, with no less intrusive alternative. Credit reference checks must not be carried out routinely or without justification, and social media checks need a documented specific risk.
If you are unsure which label a role carries, HRjoy can help you build the matrix for your own roles. We do not run checks ourselves; where you need them run, we can introduce you to our screening partners.
Sources
- Pre-employment vetting of candidates · ICO
- Employer's guide to right to work checks: 1 October 2026 · GOV.UK (Home Office)
- DBS checks guidance for employers, voluntary organisations and third parties · GOV.UK (Disclosure and Barring Service)
- Regulated activity with children: myth busting the September 2026 Supervision Exemption changes · GOV.UK
- Safeguarding Vulnerable Groups Act 2006, section 9 · legislation.gov.uk
- Keeping children safe in education 2026 · GOV.UK (Department for Education)
- Early years foundation stage statutory framework for group and school-based providers (from September 2026) · GOV.UK (Department for Education)
- Regulation 19: Fit and proper persons employed · Care Quality Commission
- Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Schedule 3 · legislation.gov.uk
- About us · Care Quality Commission
- Protecting Vulnerable Groups (PVG) scheme · mygov.scot
- Disclosure (Scotland) Act 2020, section 73 · legislation.gov.uk
- Types of AccessNI checks · nidirect
- SUP 10C.10 Application for approval · FCA Handbook
- SYSC 23 Senior managers and certification regime: Introduction and classification · FCA Handbook
- SYSC 22 Regulatory references · FCA Handbook
- FIT 2 Main assessment criteria · FCA Handbook
- Fitness and propriety (F&P) · FCA
- About the FCA · FCA
- UK Government Baseline Personnel Security Standard, version 7.0, June 2024 · GOV.UK (Cabinet Office)
- Private Security Industry Act 2001, section 5 · legislation.gov.uk
- Safeguarding Vulnerable Groups (Northern Ireland) Order 2007, Article 13 · legislation.gov.uk
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Questions
Something else? Ask us.
Is a DBS check a legal requirement for working with children?
Not as a general rule. In England and Wales the law makes enhanced checks with barred lists available for regulated activity, and letting someone you know or have reason to believe is barred do it is an offence. In England the law, set out in KCSIE and the EYFS framework, makes the check a requirement for schools, colleges and group and school-based early years providers. In Scotland, PVG membership is a legal requirement for regulated roles.
Are references mandatory?
Only in some sectors. FCA rules require reasonable steps to obtain regulatory references for certain roles, the EYFS framework requires at least one written reference in group and school-based settings in England, and CQC Schedule 3 requires satisfactory evidence of conduct in previous work in health or social care or with children or vulnerable adults. Elsewhere a reference is your choice.
Can we run a basic criminal record check on everyone?
A basic check is available for any role, and AccessNI says an employer in Northern Ireland can ask all applicants for one. Availability does not make it proportionate: the ICO says you should not routinely vet all candidates unless legally required to, so record a reason for each role.
Related checks
- Right to work checks: who to check and how from October 2026 Who needs a right to work check from 1 October 2026, including workers and sub-contractors, how each of the three methods works and follow-ups.
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
- Employment references: what employers can ask and when When to ask for references, what to ask, the sector rules for care, schools, early years and FCA firms, and how to treat candidates fairly.
- Credit checks on job candidates When a UK employer can justify a credit check on a candidate, how it differs from insolvency and director searches, and what to tell applicants.
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
- Adverse media checks on job candidates When a UK employer can search the press and online sources for negative coverage of a candidate, and how to handle namesakes and allegations.
- BPSS checks: the Baseline Personnel Security Standard explained Who needs BPSS, the four checks in version 7.0, the three-year employment history and gaps rule, and why BPSS is not SC or DV security clearance.
Sector guides
- Background checks in financial services Which checks SM&CR firms need for senior managers, certification staff and other roles: FIT, financial soundness and SYSC 22 regulatory references.
- Pre-employment checks in health and social care in England What CQC regulation 19 and Schedule 3 require, which DBS check each care role can have, professional registers and agency staff checks in England.
Also covered in our guides for Charities and volunteering, Childcare, Construction and engineering, Education, Hospitality and retail and Logistics and transport.
Guides
- The UK background screening checklist for employers A stage-by-stage background screening checklist for UK employers: who owns each step, what to record, and when to delete it.
- Do employers need candidate consent for background checks? Why consent is rarely the right lawful basis for UK background checks, what candidates must be told, and where their permission is still needed.
Related answers
- How do employers carry out right to work checks? Before someone starts work, employers should carry out one of three prescribed checks: a manual check of original documents, a Home Office online check using a share code, or a check through a registered right to work digital verification service provider. Done correctly, it gives a statutory excuse against a civil penalty of up to £60,000 per illegal worker.
- Can misconduct outside work affect whether someone is fit and proper under FCA rules? Yes. FCA guidance says conduct in someone's private life can be relevant to their fitness and propriety, especially dishonesty, a lack of integrity, violence or sexual misconduct. Firms need not monitor staff's private lives or social media. They need only look into private life where there is a good reason, such as an allegation that would call someone's fitness into question if true.