Blog

The agency does the right to work check. You still owe CQC the Regulation 19 evidence.

An inspector asks for the recruitment file on a care worker who covered three shifts on your dementia unit last month. She came through an agency. In many services the answer is that the file sits with the agency, and nobody at the provider has seen what is in it.

That answer is a Regulation 19 problem, and providers reach it by following the right to work rules correctly. Two obligations sit on two different statutes. Most providers satisfy one and assume it covers the other.

Who carries the right to work check for an agency care worker

The employment business is the employer. The Home Office's draft employer's guide, published 16 July 2026, states it in one line: "The employment business is the individual's employer for the purposes of the Right to Work Scheme and is therefore responsible for the right to work check."

For right to work purposes, responsibility for that check sits with the employment business, and the statutory excuse for the placement sits there with it. Sub-contracting the delivery of a care contract is a different arrangement from hiring agency staff into your own rota, and a provider doing the first needs its own advice on its position under section 48.

Section 48 of the Border Security, Asylum and Immigration Act 2025 commences on 1 October 2026 and extends the right to work duty beyond contracts of employment. It does not change who carries the check on a straightforward agency placement.

Regulation 19: agency staff and bank staff are people you employ

Regulation 19 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires recruitment procedures to be "established and operated effectively", and requires that the information specified in Schedule 3 "must be available in relation to each such person employed".

CQC defines that population wider than a payroll. From its Regulation 19 guidance: "'person employed' will include any member of staff who currently works in the service as a volunteer or a contractor, as well as agency or bank staff."

The same guidance addresses checks run by a third party: "Recruitment and/or checks on candidates may be carried out by a party other than the provider. In this case, providers must assure themselves that all checks are complete and satisfactory."

A provider that reads "the agency does the checks" and stops there has not met Regulation 19. Both positions are correct. They sit on different statutes and they ask for different things. The Home Office asks who ran the right to work check. CQC asks whether you can produce Schedule 3 information for that person, and whether you satisfied yourself the checks behind it were complete.

Sizing the exposure from national data is not possible. Skills for Care's 2024/25 figures put 9% of posts in England as filled by indirectly employed staff, and that category combines bank, pool, agency and other contract types, with no published split between them. Your own rota is the only place the real number exists.

The Schedule 3 information you need to be able to produce for every worker

Schedule 3 sets out what has to be available for each person employed. It is a short list.

Proof of identity including a recent photograph.
Where required, the relevant criminal record certificate and, where applicable, barred list information.
Satisfactory evidence of conduct in previous employment concerned with the provision of health or social care services, or with children or vulnerable adults.
Where reasonably practicable, verification of why any previous employment working with children or vulnerable adults ended.
Documentary evidence of relevant qualifications, so far as reasonably practicable.
A full employment history, together with a satisfactory written explanation of any gaps.
Satisfactory information about any relevant physical or mental health conditions.

"So far as reasonably practicable" attaches to qualifications and to verifying why previous employment ended. It does not attach to identity, to the criminal record certificate or to the employment history.

Satisfactory means satisfactory in the opinion of the Commission

Schedule 3 defines "satisfactory" as satisfactory in the opinion of the Commission. So a registered manager who accepted a written explanation of a fourteen-month gap has to expect it to be read by someone with no knowledge of the person.

What inspectors ask to see, and what a Regulation 19 gap does to your rating

CQC's published position on evidence is more workable than the regulation alone suggests.

Inspectors will not routinely ask to see a staff member's hard copy DBS certificate. They expect a record of the information obtained, including whether barred list information was received.

For existing staff, providers are not required to go back and obtain full employment histories retrospectively, and CQC states that inspectors must be proportionate about past recruitment practices. The obligation bites hardest on who is working in your service now and how they got there.

Paper is not required. From CQC's guidance on Regulation 19 employment requirements: "It is not necessary for providers to keep documents in paper format. Electronic or online evidence can also be used."

A failure to evidence safe recruitment practice "is likely to result in a breach of regulation which could affect the rating under Safe, Effective and/or Well-led". One missing file on someone who worked three shifts can therefore reach three key questions.

The DBS Update Service condition care providers breach quietly

Status checks through the DBS Update Service are lawful only where three conditions hold: the employer has the individual's consent, the employer could legally request a new check for that role, and the existing certificate "is for the same workforce, where the same type and level of criminal record check is required".

That third condition is where adult social care comes unstuck. Staff move between domiciliary rounds, residential settings and supported living, and agencies place the same worker across all three. Where the workforce or the level of check differs, the position requires a new application rather than a status check.

DBS publishes no expiry date for a criminal record check, so any re-check interval is a provider decision that has to be defensible on its own terms. The widely repeated claim that DBS checks must be renewed every three years has no basis in DBS or CQC guidance. Update Service subscription costs £16 a year, is free for volunteers, and has to be taken out within 30 days of certificate issue.

Where a status check is not available and a new application is required, DBS reported in its 2025-26 annual accounts that enhanced checks took 12.4 days on average, with 75% completed inside 14 days against an 80% service standard.

One record per person, whoever employs them

The practical position is a single place where the Schedule 3 record for every person working in your services can be produced on request, whether they are on your payroll, on your bank or placed by an agency. Agency assurance belongs inside that record: what the agency confirmed, when, against which role, and who at the provider accepted it.

Credentially holds that record. Onboarding workflows are configurable, so a bank worker and an agency placement can each be routed against the Schedule 3 items. Automated primary source verification, with DBS and NMC integration, confirms the underlying documents at source. Compliance status is visible across services in one view, with real-time monitoring of expiring items. That matters most where a group is registered with CQC as several separate legal entities.

To test your position before an inspector does, take five people who worked a shift last month and are not on your payroll, then time how long it takes to put every Schedule 3 item in front of somebody. Our CQC inspection preparation checklist for workforce compliance sets out what to have ready and in what order.

Further reading: onboarding agency staff safely.

References

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.