UK Care Agency Compliance Guide (2026 Checklist & Rules)

Quick Answer:
UK care agency compliance is the statutory and regulatory framework required to supply or deploy healthcare workers lawfully across NHS and adult social care. Enforced by the Care Quality Commission (CQC, England), the Home Office, and statutory bodies (NMC/HCPC), compliance centres on seven core pillars: (1) Enhanced DBS with Barred List checks registered on the Update Service, (2) Home Office online Right-to-Work share-code verification (physical BRPs are obsolete), (3) Live professional registration checks, (4) CSTF/Skills for Care mandatory training, (5) Occupational health fitness clearance, (6) 3-year verified employment references, and (7) Working Time Regulations (11-hour daily rest, 48-hour weekly caps).

Regulatory Update (2026 CQC Assessment Framework):
While CQC's Single Assessment Framework (SAF) is currently in force across England, CQC has piloted sector-specific frameworks where Key Lines of Enquiry (KLOEs) replace quality statements and rigid numerical scoring is removed. Agencies must continue evidencing compliance against CQC's 5 Key Questions and Schedule 3 recruitment standards.

What Is Healthcare Staffing Compliance in the UK?

Healthcare staffing compliance refers to the non-negotiable legal, clinical, and regulatory standards care agencies must satisfy before assigning workers to shifts.

Unlike commercial recruitment, placing healthcare assistants, support workers, and registered nurses in regulated activities is strictly governed by:

• The Care Quality Commission (CQC): Enforcing the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, specifically Regulation 19 (Fit and proper persons employed) and Regulation 18 (Staffing).
• The Home Office: Governing Right to Work checks under the Immigration, Asylum and Nationality Act 2006.
• Professional Regulators: The Nursing and Midwifery Council (NMC) and the Health and Care Professions Council (HCPC).

Failing to maintain watertight compliance results in immediate CQC warning notices, cancellation of NHS framework supplier agreements, and civil penalties of up to £60,000 per worker for immigration breaches.

The 7 Core Compliance Pillars for UK Care Agencies

┌────────────────────────────────────────────────────────────────────────┐
│               7 CORE CARE AGENCY COMPLIANCE PILLARS                    │
├────────────────────────────────────────────────────────────────────────┤
│ 1. Enhanced DBS Checks & Continuous Update Service Validation          │
│ 2. Digital Right to Work Checks (Home Office Share Codes / IDSP)       │
│ 3. Live Professional Registration Verification (NMC / HCPC)            │
│ 4. Mandatory Training (Skills for Care & CSTF Standards)               │
│ 5. Occupational Health & Immunisation Clearance                        │
│ 6. Full Employment History & 2 Verified References (Schedule 3)        │
│ 7. Working Time Regulations & Safe Rostering (11h Rest Rules)          │
└────────────────────────────────────────────────────────────────────────┘

1. Disclosure and Barring Service (DBS) Checks

All staff engaging in regulated activity with vulnerable adults or children must hold an Enhanced DBS check with Adults' and/or Children's Barred List checks.

• DBS Update Service: Agencies must mandate that staff subscribe to the DBS Update Service within 30 days of certificate issue. This enables real-time status checks and eliminates costly renewal delays.
• Annual Status Checks: While traditional certificates were renewed every 3 years, best-practice agencies run automated status re-checks every 30 to 90 days.
• Audit Requirement: Retain the certificate number, issue date, and result of the online status check on the agency's live compliance register.

2. Right to Work Verification

Following Home Office digital immigration reforms, physical Biometric Residence Permits (BRPs) stopped being issued in October 2024, and expired cards are not acceptable evidence of right to work:

• eVisa Online Share Codes: Non-British/Irish nationals must generate a 9-character share code via gov.uk/prove-right-to-work. The agency verifies the record online at gov.uk/view-right-to-work and downloads the official profile PDF.
• British and Irish Citizens: Verified via physical inspection of original passport/birth certificate or through a certified Identity Service Provider (IDSP).
• Overseas Recruitment Rules: Direct overseas recruitment into SOC 6135/6136 care roles closed on 22 July 2025. In-country switching remains permitted until 22 July 2028.
• Read our full Right to Work Checks Guide for Care Staff.

3. Professional Registration (NMC & HCPC Pin Verification)

Every registered nurse placed by an agency must have their active PIN checked directly against the live NMC Online Register.

• Re-check PIN status monthly or integrate automated checking to catch suspensions, fitness to practise conditions, or lapsed registrations.
• Placing an unregistered or suspended nurse is a criminal offence and an automatic CQC breach.

4. Mandatory & Statutory Training

Care workers must complete the mandatory modules outlined in the Skills for Care Core Skills Training Framework (CSTF):

New social care workers must also be enrolled in and supported to complete the Care Certificate within their first 12 weeks of employment.

5. Occupational Health & Fitness to Work

Prior to placement, all workers must complete:

• Pre-placement health questionnaire assessing physical and mental fitness to perform care duties.
• Verification of immunisations: Tuberculosis (TB), Hepatitis B immunity (blood titre test for exposure-prone procedures), MMR, and Varicella.

6. Schedule 3 Vetting: Full History & References

Under CQC Schedule 3:

• Employment History: Complete chronological history from completion of education with all gaps explained in writing.
• References: Minimum of two satisfactory written references, one of which must be from the most recent healthcare employer. Character-only references from personal acquaintances are not compliant.
• Use our step-by-step New Carer Onboarding & Vetting Checklist to standardise this pipeline.

7. Working Time Regulations & Safe Scheduling

Under the UK Working Time Regulations 1998:

• Daily Rest: Workers are entitled to a minimum of 11 consecutive hours of rest between shifts.
• Weekly Rest: Minimum of 24 uninterrupted hours per week (or 48 hours per fortnight).
• Weekly Working Limit: Maximum 48-hour average working week, unless the worker has signed an individual voluntary opt-out agreement.
• For full details, review our Working Time Directive for Care Workers Guide.

How to Conduct an Annual Agency Compliance Audit

To safeguard against sudden CQC inspections, agencies should run structured internal audits using our Annual Compliance Audit Checklist and rehearse inspections with our CQC Mock Inspection Toolkit.

Frequently Asked Questions (FAQ)

What happens if a care worker's DBS lapses during an active placement?

If a worker's DBS expires and they are not registered on the DBS Update Service, the agency is legally liable for deploying an unvetted worker. The worker must be immediately removed from shifts until a renewed Enhanced DBS application is submitted and an adult first check is confirmed.

Can a care agency accept a physical BRP card for Right to Work?

No. Physical Biometric Residence Permits (BRPs) are phased out. Since 2025, employers cannot accept physical BRP cards to obtain a statutory excuse. Workers must provide a Home Office online share code.

Do agency nurses need their own professional indemnity insurance?

Yes. While NHS trusts provide vicarious liability cover for hospital shifts, nursing regulatory bodies and private healthcare frameworks require agency nurses to hold independent professional indemnity cover (typically provided via RCN or trade union membership).

How long must compliance records be retained after a carer leaves?

Under CQC Schedule 3 guidance and statutory limitation rules, personnel vetting and training records should be securely retained for a minimum of 6 to 7 years following the termination of employment.

Regulatory Sources & Guidance

• CQC: Regulation 19: Fit and Proper Persons Employed
• Home Office: Right to Work Checks: An Employer's Guide
• Disclosure and Barring Service: DBS Update Service Guidance
• Skills for Care: Mandatory Training Guidance for Social Care

Automate all 7 compliance pillars with AsanWork. AsanWork prevents non-compliant shift bookings, tracks DBS Update Service renewals, monitors 11-hour rest periods, and generates 1-click audit reports for $20 USD/month for up to 100 staff. Start your 14-day free trial or book a 15-minute live demo.