Compliance – Security Industry Authority Blog

A blended approach to effective compliance and enforcement

In this blog Pete Easterbrook, Executive Director of Inspections and Enforcement explains how the SIA protects the public through a blended approach.

When people hear the word ‘enforcement’, they may immediately think of criminal investigations and prosecutions. These are important parts of our work, but they are only part of a much wider picture. Effective regulation involves a range of interventions and is not measured in single numbers.

The legislation Parliament introduced to tackle criminality and violence within the private security industry is now more than 20 years old. At its heart were a relatively limited set of regulatory tools: individual licensing, a public register and, in the most serious cases, criminal sanctions. Our direct oversight of security businesses was narrower, extending mainly to licensing requirements for non-front line roles and the voluntary Approved Contractor Scheme. Approved Contractors could also supply some individuals before their licences had been granted through Licence Dispensation Notices.

For many years, success was largely measured by the volume of licences issued, levels of licensing compliance and the number of prosecutions brought. Compliance among those inspected (over 5000 last year) is now consistently around 98% to 99%. However, those intent on avoiding the rules or profiting from non-compliance have adapted. Some structure their activities to sit outside direct regulatory oversight, while businesses that do not join the Approved Contractor Scheme are not routinely assessed against its quality standards. There are also a range of harms which take place in the industry which fall outside the scope of the Private Security Industry Act, which nonetheless undermine the integrity of the regime and place the public at risk.

Our role must therefore go beyond checking whether an individual holds a licence. We must understand the risk, identify the potential harm and select the intervention most likely to protect the public. Depending on the circumstances, that may mean giving a person or business an opportunity to put matters right through regulatory advice. It may mean issuing a formal warning or improvement notice, suspending or revoking a licence, attaching special conditions to a licence, removing a business from the Approved Contractor Scheme, disrupting harmful activity—often alongside a partner agency—or prosecuting those responsible.

This reflects the approach taken by regulators more widely. The Regulators’ Code requires regulatory activity to be proportionate and targeted, and like the SIA, organisations such as the Financial Conduct Authority, Information Commissioner’s Office and Environment Agency also use combinations of supervisory, civil and criminal interventions to secure compliance and address harm. The important question is not simply how often a particular power has been used, but whether the regulator has selected the right tool at the right time in order to achieve the best available outcome.

Our new Strategic Plan 2026-29 captures that balance clearly: we will be confident in setting standards, supportive in seeking compliance and uncompromising in our enforcement.

Preventing entry and removing unsuitable people from the industry

One of the most immediate ways we protect the public is through our licensing decisions. We have recently strengthened our licensing criteria to raise standards and make the requirements clearer and more transparent – Get Licensed

During 2025–26, we refused 1,710 licence applications because we were not satisfied that the applicant met the criteria for entry into the private security industry. We also suspended 2,164 licences and permanently revoked a further 8,286.

Many of the decisions to revoke a licence relate to licence holders who no longer hold the right to work in the UK. Others involved individuals who had committed serious offences or displayed behaviour fundamentally incompatible with working in a position of trust. This included cases involving sexual offending, drug supply, and violent or abusive behaviour.

A suspension or revocation is not simply an administrative action. It removes an individual’s ability to lawfully work in a licensable role. Where someone poses a risk, licensing action prevents them from continuing to work at venues, events, businesses and other locations where the public should reasonably expect to be protected.

This work is often fast-paced and often depends on information from the police and other partners. It may never result in a court case or a public announcement, but its effect on public safety is direct and significant.

Acting at the entry point to the industry

Our approach also takes us further upstream where the integrity of the licence is affected by the actions of third parties. It is not enough to check whether someone holds a licence after they have entered the industry. We must also have confidence in the training and qualifications on which that licence is based.

Operation RESOLUTE is our response to serious malpractice and qualification fraud in the SIA licence-linked qualification. Many training providers operate professionally and share a commitment to high standards. However, where training or the assessment is compromised, there is a risk that an individual may obtain a qualification without demonstrating the knowledge and competence required to work safely in the security industry.

Between April and June 2026—the first quarter of 2026-27—we conducted 64 unannounced checks on training providers. These resulted in:

80 actions for improvement issued to training centres
11 instances of blocks being placed on centres to cease registering or certifying new learners while concerns were investigated
2 centres being closed following an SIA referral

Where concerns extend beyond malpractice and indicate possible criminality, we will investigate to determine whether there is sufficient evidence for the SIA or another agency to pursue a criminal investigation.

These outcomes demonstrate why effective enforcement is not synonymous with prosecution alone. Where we identify an immediate risk at a training centre, the relevant awarding organisation—regulated by Ofqual—has a responsibility to act and may block registrations or certification, suspend the centre or withdraw its approval altogether. This can prevent questionable training and qualifications from entering the licensing system immediately, without waiting for the outcome of a potentially lengthy fraud investigation that depends on witnesses and other evidence and is required to meet the criminal standard of proof.

Improvement action makes a meaningful difference in standards cases. It sets clear expectations, corrects poor practice and helps prevent problems escalating and becoming more serious. Where the evidence indicates cheating, deliberate fraud or organised criminality, we have the capability and determination to investigate and prosecute. We have a number of active criminal investigations which have included arrests and property searches to secure and preserve evidence of qualification fraud.

This is a consciously blended model: improve where improvement is possible and appropriate, disrupt where risk is immediate, and pursue criminality where the seriousness of the conduct demands it, the evidence can be sought, and it is clearly in the public interest to do so.

Assessing business compliance

Public protection and the delivery of competent and quality security services also heavily depend on the standards of the businesses recruiting, supplying and supervising security operatives.

Our Approved Contractor Scheme is voluntary, but membership is not automatic. Businesses must demonstrate that they are fit and proper and sign up to required quality standards.

We have taken a more robust approach to regulation of this area over the last few years. During 2025-26, 27% of new ACS applicants were refused. That means more than one in four applicant businesses did not satisfy us that they worked to quality standards and should enter the scheme.

Our scrutiny does not end when a business is approved. During the same year:

27 non-compliant businesses had their ACS accreditation removed
384 improvement needs were issued to approved contractors

Refusing an application or removing an approval protects the integrity of the scheme for the public and helps buyers of security distinguish between businesses that meet quality standards and those that do not. Improvement activity is equally important. It enables us to identify weaknesses, require corrective action and drive better standards before failings become more serious.

Intervening before criminal investigation is necessary

Not every regulatory concern reaches the threshold for a criminal investigation but that does not mean we ignore it.

During 2025-26, we opened and completed 1,030 intervention cases concerning individuals or businesses. These cases allow us to examine potential non-compliance, assess the regulatory risk and decide what action is appropriate and necessary.

The majority of interventions are resolved through non-criminal justice measures. These can include regulatory advice, formal warnings, improvement notices, licensing action, referrals to other bodies or closer regulatory monitoring.

Our involvement does not necessarily end when a sanction is issued. We may continue to monitor the individual or business to ensure compliance is maintained and to assess whether the intervention has worked. If the behaviour continues, or the risk increases, we can escalate the response.

Disruptions and partnerships

Some of the most impactful work we do is conducted jointly with other partners and may not always be visible publicly.

As of 1 July 2026, we had over 10 live intelligence development operations taking place with a wide range of enforcement partners.

These allow each partner to bring its own intelligence, expertise and legal powers to a shared problem. A concern that begins with suspected SIA licensing non-compliance, for example, may also involve organised crime, fraud, immigration offending, tax evasion, labour exploitation or money laundering.

In some cases, the strongest public-safety outcome may be achieved through another agency’s legislation and powers rather than our own. To support this, we may share intelligence and provide operational assistance, enabling partners to recover criminal assets, address immigration offences, investigate tax irregularities or disrupt wider organised crime networks.

These outcomes are not currently reflected in our enforcement statistics, but we are exploring ways to capture them without prejudicing the work of our partners. Nevertheless, our involvement may be central to identifying the links and risks, developing the intelligence and enabling action that more effectively addresses threats to public safety.

Prosecuting where it will make a difference

Criminal investigation and prosecution sit at the most serious end of our enforcement capability. Before bringing a prosecution, there must be sufficient admissible and reliable evidence to provide a realistic prospect of conviction, with the offence capable of being proved beyond reasonable doubt. Prosecution must also be proportionate and in the public interest.

A range of factors informs that decision, including the seriousness of the circumstances, the level of actual or potential harm, any evidence of deliberate or persistent non-compliance, and the strength and reliability of the available evidence. This includes whether witnesses are willing and able to give evidence, and whether other attempts to secure compliance have failed or would clearly be inappropriate.

One recent case demonstrates why it is important that we have both the will and the capability to undertake criminal investigations and prosecute in the right circumstances. We identified intelligence that an individual whose licence had been suspended following arrest for serious sexual offences was continuing to work in the private security industry. We investigated at pace, secured evidence from a range of sources and successfully prosecuted both the individual and others involved in the case.

Criminal investigations and prosecutions must, rightly, be undertaken with care. They require sufficient, reliable and admissible evidence, full compliance with disclosure obligations, and an assessment under the Code for Crown Prosecutors of whether prosecution is in the public interest. As a UK-wide regulator, we must also take account the difference between the legal and judicial systems within which we operate.

Cases involving the supply of unlicensed operatives can be particularly complex, especially where there are lengthy supply chains. Fraud-related offences, and investigations involving multiple suspects or witnesses, can also be resource-intensive and may take considerable time to conclude. Penalties and cost awards available for some offending can be modest.

That does not prevent us from pursuing criminal action where it is appropriate. It means making informed—and sometimes finely balanced—decisions about whether prosecution is both achievable and justified in the public interest. We consider whether it is likely to deliver the strongest public-protection and deterrent effect, or whether another intervention could stop the harm more quickly and effectively.

We have also made the case for stronger and more modern powers and are working with the Home Office to improve our investigative capabilities and ability to respond to emerging harms and the increasingly sophisticated ways in which some individuals and businesses engage in criminal behaviour.

Following the money

Where offending is financially motivated, a fine for the original offence does not usually address the profit made from the criminality. This is why financial investigation is an increasingly important part of our approach, and we have recently strengthened our capacity and capability in this area. Our powers under the Proceeds of Crime Act allow us to identify and recover the proceeds of offending.

As an example, following the conviction of a repeat offender for multiple Private Security Industry Act offences, a subsequent financial investigation earlier this year resulted in confiscation orders totalling £44,518. This year we also worked closely with partners to secure our first confiscation orders in Scotland of over £40,000 of criminal proceeds, and in a separate matter we secured over £53,000 in victim compensation.

Since gaining confiscation and restraint powers, we have recovered more than £1 million, making it harder for offenders to reinvest criminal funds and return to the private security industry.

In 2024, we asked for and were granted powers to strengthen our financial investigation capability, and as a result we can now conduct our own money-laundering investigations. This work is complex and necessarily takes time, but this, combined with our other powers under the Proceeds of Crime Act enables us to address the economic drivers behind offending rather than limiting our response to the initial regulatory breach.

Measuring what matters

Inspections, licensing decisions, warnings, improvement action, removal of approved contractor status, partner referrals, disruption, financial investigation and prosecution are not competing measures of success. Together they make up a range of tools we use in our compliance and enforcement work and should be seen as different but complementary parts of the same regulatory system.

Our investigators work hard to identify and secure evidence of non-compliance or criminality, understand the circumstances and use the most appropriate intervention—or combination of interventions—to secure the right impact and address the non-compliance and harm.

Sometimes that will mean helping a generally compliant business correct a one-off error or area of weakness. Sometimes it will mean acting immediately to stop or prevent harm by suspending or revoking a licence. Sometimes it will involve asking a partner organisation to act using powers we do not have or where they are better placed to address offending and secure the optimum impact. And sometimes it will mean building a criminal case and placing an offender before the courts.

We plan to share more about the breadth of our compliance and enforcement work, and the results it achieves. No single statistic can capture the complexity or impact of effective regulation. Our success is better understood through the risks reduced, harm prevented, criminality disrupted, compliance secured and public confidence strengthened in the services provided by private security operatives and businesses.

Our approach will remain robust but supportive in seeking compliance, and uncompromising where enforcement is necessary. We will be fair and proportionate in our decisions, clear in our expectations and focused throughout on protecting the public.

Our compliance checks this summer- Q&A with Lucia Howland

We spoke with our Regional Investigation Manager & Tactical Events Lead Lucia Howland about our approach to compliance checks this busy summer.

We seem to be visiting lots of festivals lately, what has our approach been for previous years?

We’ve always had an interest in festivals and events. Typically, these tend to be high risk events by nature; there’s a demand for lots of security personnel for a limited time. This can lead to pressures on both the quality of staff provision and the due diligence needed to ensure compliance with regulations. Non-compliance might include unlicensed operatives, the presence of cloned or counterfeit licences or the use of stewards in place of security staff for designated roles. This can introduce risks to protecting the public.

How does the industry cope with demands?

Generally, the primary security provider that holds a contract with an event organiser will enter into contracts with other providers or use labour from others. Whilst this is acceptable if done correctly, it can dilute due diligence. We accept that this method of working must happen, so our interest is in making sure this is working as it should.

How do we get intelligence and how does that inform our compliance and inspections activity?

A lot of the intelligence we get is from the public where someone reports something they’ve seen. This tends to be after an event so the moment has often passed. The challenge is about getting the best intelligence so that it can properly inform our approach. We only have so many investigators so we can’t be present at every event, but we work hard on this and gather as much intelligence as possible. The intelligence team combines this with other information we gather from our own inspections and interactions with those in the industry to form a picture of the threats faced. These are then prioritised and tasked to the Compliance & Inspections teams.

We need to be mindful that where we have rich intelligence on particular events or providers, we don’t place that on a pedestal; it doesn’t tell us what’s happening at other events we’ve not been to – sometimes we don’t know what we don’t know.

How do you mitigate lack of organisers’ awareness?

We start work months before an event happens. We work with organisers and other partners at meetings known as ‘safety advisory groups’. In addition to ensuring security plans are sound, these meetings exist to address any issues in relation to the event for example, health and safety, the environment and logistics and transport issues. At these meetings, a number of partners attend to give opinions and expertise. Sometimes we attend at the request of partners such as the local authority or the event organiser, sometimes we invite ourselves.

We also work with providers of security beforehand to advise on compliance. We build a good relationship and work with them to make sure their own plans meet the standards required.

What’s the main difference for us between big and smaller festivals?

Our processes are the same whether big or small, so it’s a matter of scale really. I think smaller events are easier; there’s less to inspect on the ground and a smaller geography means not trapsing over quite as many fields to inspect security provision and liaise with control stations.

But the challenge with smaller events is there tends to be less wiggle room to deal with any issues. For example, having fewer security personnel means less flexibility to deploy an alternative operative if an issue relating to a licence is found.

Venue size and security provision is not a linear relationship. I was at a festival last week with a capacity of 5,000 with 29 security operatives on duty. However, a recent festival with a capacity of 10,000 required 200 operatives. Numbers vary massively and are dictated by the type of event, location, make-up of the venue, geography, entry/control points, demographics, etc.

What’s the team up to just now?

The season is now underway, and events are happening so we’re moving to an operational phase. We’re out inspecting festivals regularly now.

Even though we’ve had pre-meetings with organisers and security providers already, we still inspect. We don’t leave them to it as we need to ensure the assurances, we’re given are accurate.

What’s the reaction to our presence?

Generally, we are well received. Good quality security providers which are there to do a good job are pleased to see us and work with us. Some event organisers can see us as presenting ‘yet another hoop to jump through’. But when they see how little we disrupt things and appreciate the value we bring to make their events safer they welcome us being on board.

Our compliance checks at the BBC Radio 1 Big Weekend Festival

by Lisa Shaw, Investigations Officer, SIA Southeast

The BBC Radio 1’s Big Weekend Festival took place this year in Luton from 24-26 May. As a popular event with a great line up, the numbers were expected to reach over 100,000 which meant a large security presence. My team at the SIA covers counties in the Southeast including Sussex, Essex, Surrey, Hertfordshire, Hampshire, Kent, Bedfordshire and Thames Valley. As the event was in my patch, my team and I planned a visit to ensure SIA compliance at the event.

Our team checked 155 licences and spent time engaging with licence holders and security suppliers at the BBC Radio 1 Big Weekend Festival in Luton.

We spent three days making checks at the event. The first two days involved us attending the site before the event opened to inspect licences of the security operatives on duty. At the inspection planning stage, all suppliers provided me with a list of documents they had seen to verify identity of the licence holders. We then attended the first day of the event on Friday 24^th May to inspect any licence holders we missed on the first two days. We also observed security procedures and process to ensure that there was no crossover between licensable roles and actions of safety marshals present at the event.

Sarah Runchman, our Head of Intelligence, joined the inspection to observe how an inspection unfolds, what obstacles we may face when out in the field and what improvements can be made in the process. I also spent time walking around the site with local licensing officers working jointly to check security at the venue.

On the day the event opened we were able to observe the security teams carrying out their duties. This included bag searches at the gates and drug detection dogs being used amongst the crowds. We observed how successfully the dogs detected illegal substances with members of the public removed from the queue as a result.

From left to right: SIA Compliance and Inspections team – Ariarna Moore, Lisa Shaw, Alison Hughes and Elise Winnett

The inspection was successful with high levels of compliance found from security officers. We inspected 155 licences over the three days. We issued 13 warnings for failure to update address and a further 5 verbal warnings to security officers for failing to display their SIA licences.

Conducting much of the inspection prior to the opening of the event allowed us to really engage with security officers and marshals and get a feel for how the industry is for them. Our presence at the event was welcomed, with many security officers expressing gladness to see us there. We met a very talented event marshal who is now training to become an SIA licensed security operative. We also witnessed an unprovoked attack by an aggressive member of the public on a door supervisor. The door supervisor handled the situation with restraint and calmness, preventing any escalation. Watching the incident unfold in front of us highlighted just how difficult a door supervisor’s job can be.

Overall, it was a rewarding experience to be part of the event and to ensure levels of compliance were met by the security present. I am grateful for the positive interactions and the opportunity to witness the dedication of everyone involved in ensuring safety of the public and property at the event.