The staff you did not recruit are the ones you cannot evidence
Most registered managers can produce a complete recruitment file for everyone on their own payroll. The harder file is the person covering tonight’s shift. An agency recruited and screened them, and you meet them for the first time at the door.
CQC Regulation 19 puts that person inside your duty. It covers everyone who works in the service, and responsibility for checking them does not move to whoever supplied them.
From 1 October 2026 the right to work regime widens beyond employees to other working arrangements, which lands hardest on services running on agency cover.
Regulation 19(3) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires the Schedule 3 information to be available for each person employed. Schedule 3 paragraph 1 is “Proof of identity including a recent photograph.” CQC prescribes no document list and no method, and judges whether what you hold is satisfactory. The rule applies in England.
CQC’s guidance on Regulation 19 is direct about scope. It states that “‘person employed’ will include any member of staff who currently works in the service as a volunteer or a contractor, as well as agency or bank staff”.
Regulation 2(1) defines employment as work under a contract of service, an apprenticeship, a contract for services “or otherwise than under a contract”. Those last words pull in people who never appear on a payroll report.
CQC’s guidance says the full employment history requirement does not apply to volunteers, unless the volunteer is the service provider or holds a director or registered manager post. Nothing exempts a volunteer from paragraph 1. Directors sit under Regulation 5 separately, and Schedule 3 information is required for them.
CQC allows another party to do the work. Its guidance says that “recruitment and/or checks on candidates may be carried out by a party other than the provider. In this case, providers must assure themselves that all checks are complete and satisfactory.”
The load-bearing word is “assure”. Assurance means being able to show what was checked and against what standard. A signed declaration from the supplier saying the checks were done is not enough on its own.
An agency that only supplies staff is generally outside CQC registration altogether. CQC’s scope of registration excepts “nurses’ agencies acting as an employment agency that supplies staff to organisations carrying on regulated activities, but that do not provide any regulated activities themselves”. So the agency that ran the identity check may not answer to CQC at all. The evidence still has to be in your service’s file.
Schedule 3 is usually described as eight items. There are nine paragraphs: eight substantive requirements plus a definitions paragraph that sets the test for all of them. Paragraph 9(b) reads: “‘satisfactory’ means satisfactory in the opinion of the Commission.”
England does not require two references. Paragraph 4 requires satisfactory evidence of conduct in previous employment concerned with health or social care, or with children or vulnerable adults. The two written references formulation comes from the Welsh and Northern Irish rules.
Right to work is not a Schedule 3 item either. That duty is owed to the Home Office under section 15 of the Immigration, Asylum and Nationality Act 2006. A right to work check does not discharge paragraph 1, and a Schedule 3 identity check gives no statutory excuse against a civil penalty. Paragraphs 2 and 3 require a criminal record certificate only where an exempted question applies under the Police Act 1997.
|
# |
Verbatim text |
|---|---|
|
1 |
“Proof of identity including a recent photograph.” |
|
2 |
“Where required for the purposes of an exempted question in accordance with section 113A(2)(b) of the Police Act 1997, a copy of a criminal record certificate issued under section 113A of that Act together with, after the appointed day and where applicable, the information mentioned in section 30A(3) of the Safeguarding Vulnerable Groups Act 2006 (provision of barring information on request).” |
|
3 |
“Where required for the purposes of an exempted question asked for a prescribed purpose under section 113B(2)(b) of the Police Act 1997, a copy of an enhanced criminal record certificate issued under section 113B of that Act together with, where applicable, suitability information relating to children or vulnerable adults.” |
|
4 |
“Satisfactory evidence of conduct in previous employment concerned with the provision of services relating to” “(a) health or social care, or” “(b) children or vulnerable adults.” |
|
5 |
“Where a person (P) has been previously employed in a position whose duties involved work with children or vulnerable adults, satisfactory verification, so far as reasonably practicable, of the reason why P’s employment in that position ended.” |
|
6 |
“In so far as it is reasonably practicable to obtain, satisfactory documentary evidence of any qualification relevant to the duties for which the person is employed or appointed to perform.” |
|
7 |
“A full employment history, together with a satisfactory written explanation of any gaps in employment.” |
|
8 |
“Satisfactory information about any physical or mental health conditions which are relevant to the person’s capability, after reasonable adjustments are made, to properly perform tasks which are intrinsic to their employment or appointment for the purposes of the regulated activity.” |
|
9 |
“For the purposes of this Schedule” “(a) ‘the appointed day’ means the day on which section 30A of the Safeguarding Vulnerable Groups Act 2006 comes into force;” “(b) ‘satisfactory’ means satisfactory in the opinion of the Commission;” “(c) ‘suitability information relating to children or vulnerable adults’ means the information specified in sections 113BA and 113BB respectively of the Police Act 1997.” |
Text from SI 2014/2936, Schedule 3, legislation.gov.uk. Sub-paragraphs are set out as a list. Wording is unchanged.
CQC cannot prosecute a breach of Regulation 19. Its guidance states: “CQC cannot prosecute for a breach of this regulation or any of its parts, but we can take regulatory action.” The offences page, last updated 27 February 2024, lists Regulation 19 among the provisions where regulatory action is the only route.
Regulatory action still bites. It runs from a requirement notice through a warning notice to conditions on registration, with suspension or cancellation at the far end, and a recorded breach travels into the next assessment report. Where the same facts also breach a regulation that does carry an offence, CQC can prosecute that regulation without a warning notice first.
The assessment framework is in transition. CQC published four draft sector-specific frameworks on 24 March 2026, one of them covering adult social care. Regulation 19 itself is untouched and has been in force since 1 April 2015.
Criminal exposure on a recruitment failure sits in the Safeguarding Vulnerable Groups Act 2006. Section 9 makes it an offence to permit an individual to engage in regulated activity from which they are barred, where you know or have reason to believe they are barred and they go on to engage in it. The maximum on indictment is five years, or a fine, or both. Personnel suppliers commit a parallel offence.
Regulated activity with adults is defined at paragraph 7 of Schedule 4 Part 2 of that Act, and it reaches further than most rotas assume: personal care, health care given under the direction of a health care professional, relevant social work, and conveying adults to the places where they receive that care. The Protection of Freedoms Act 2012 removed the frequency condition for adults, so a single occasion is enough.
Section 48 of the Border Security, Asylum and Immigration Act 2025 comes into force on 1 October 2026, commenced by SI 2026/683. It extends the prohibition on employment beyond employees to other working arrangements. The Home Office published a draft revised code of practice on 30 June 2026 and a draft employer’s guide on 16 July 2026, both due to take effect on the same date, so read the final versions when they are published.
Adult social care is heavily exposed, because so much of the work is covered by agency staff and subcontractors. Skills for Care reported around 96,000 vacancies on any given day in England in 2025/26. Entry clearance applications in the care worker and senior care worker occupation codes closed on 22 July 2025 under Statement of Changes HC 997. Transitional arrangements allow in-country sponsorship in those codes to continue until 22 July 2028, subject to conditions.
The statutory maximum civil penalty is £60,000 per worker, in force since 22 January 2024. The Home Office code of practice starts at £45,000 for a first breach and £60,000 for a repeat breach within three years, before reductions are applied.
CQC is the independent regulator of health and adult social care in England. Regulation 19 and Schedule 3 have no application in Scotland, Wales or Northern Ireland, and the differences are material. Scotland has no schedule of required information at all, only a general fitness duty on the provider. The Welsh regulations set out ten items, and the Northern Irish rules run to seven for residential care homes and twelve for domiciliary care agencies.
|
Nation |
Regulator |
Recruitment requirement |
Identity item in the rules |
Disclosure body |
Workforce register |
|---|---|---|---|---|---|
|
England |
Care Quality Commission |
HSCA 2008 (Regulated Activities) Regs 2014, SI 2014/2936, reg 19 with Sch 3 (8 items plus definitions), in force 1 April 2015 |
Yes. Sch 3 para 1: “Proof of identity including a recent photograph.” |
Disclosure and Barring Service |
None for care workers |
|
Scotland |
Care Inspectorate, under the Public Services Reform (Scotland) Act 2010 |
SSI 2011/210, reg 9 (fitness of employees), reg 13 (PVG listings) |
No. General fitness duty, no prescribed information schedule |
Disclosure Scotland, PVG scheme. Membership mandatory from 1 April 2025; five-year membership from 1 April 2026 |
SSSC, registration within 6 months of starting |
|
Wales |
Care Inspectorate Wales, under the Regulation and Inspection of Social Care (Wales) Act 2016 |
SI 2017/1264 (W.295), reg 35 with Sch 1 Pt 1 (10 items) |
Yes. Sch 1 Pt 1 item 1: “Proof of identity including a recent photograph.” |
Disclosure and Barring Service |
Social Care Wales. Domiciliary mandatory April 2020; adult care home mandatory 1 October 2022 |
|
Northern Ireland |
RQIA |
Residential Care Homes Regs (NI) 2005, SR 2005/161, reg 21 with Sch 2 (7 items). Domiciliary Care Agencies Regs (NI) 2007, SR 2007/235, reg 13 with Sch 3 (12 items) |
Yes. Sch 2 item 1: “Proof of the person’s identity, including a recent photograph.” Sch 3 item 3: “Proof of identity, including a recent photograph.” |
AccessNI issues disclosures. DBS makes barring decisions for Northern Ireland |
NISCC. Offence to employ in a listed role without registration, SR 2013/225 |
CQC prescribes no method for Schedule 3 paragraph 1. No product satisfies Regulation 19 on its own, and none is required. What gets judged is whether your evidence is satisfactory in the opinion of the Commission, and whether you can produce it for everyone who works in the service.
Digital identity checking for a DBS application is the one part of care recruitment where a certified provider is legally required. Government guidance on DBS digital identity verification, updated 10 July 2026, says that registered bodies and responsible organisations “must use a DVS certified by an approved conformity assessment body (or ‘CAB’) against a current publication of both the trust framework and the supplementary code”. The guidance sets medium as the minimum level of confidence for a Basic check. Standard and Enhanced checks, including Enhanced with Barred Lists, require high. That route is optional; document checking remains open.
Right to work has its own limit. Identity document validation covers British and Irish passport holders, and the code of practice requires that people without one are not treated less favourably, so a service running on agency cover needs more than one route to the same outcome.
For the worker, the difference shows up before the shift starts. The identity step can be done on a phone in seconds, at home, instead of carrying original documents to an office and waiting while somebody photocopies a passport at handover.
OneID is listed on the UK Digital Verification Services register as service ID 286, certified on 12 June 2026, with supplementary codes recorded for right to work and for Disclosure and Barring Service checking. It supplies the verified identity component. It does not issue a DBS certificate or check a professional register.
The practical next step is a reconciliation. Pull everyone who has worked a shift in the last three months and mark the people your service did not recruit. For each of those people, check what identity evidence you hold. That group is where a CQC Regulation 19 gap usually sits, and 1 October is the date to work back from.
Do agency and bank staff need Schedule 3 information held on them?
Yes. CQC’s guidance states that “person employed” includes any member of staff currently working in the service as a volunteer or a contractor, as well as agency or bank staff. Where another party did the checking, CQC says providers must assure themselves that all checks are complete and satisfactory.
Does CQC require two references for care staff in England?
No. Paragraph 4 of Schedule 3 requires satisfactory evidence of conduct in previous employment concerned with health or social care, or with children or vulnerable adults. The requirement for two written references, one from the most recent employer, belongs to the Welsh and Northern Irish regulations.
Is a right to work check enough to meet Regulation 19?
No. Schedule 3 says nothing about immigration status or share codes. Right to work is a separate duty owed to the Home Office under section 15 of the Immigration, Asylum and Nationality Act 2006, with a statutory maximum civil penalty of £60,000 per worker. A Schedule 3 check gives no excuse against that penalty.
Can CQC prosecute a care provider for a Regulation 19 breach?
No. CQC’s guidance states that it cannot prosecute for a breach of this regulation or any of its parts, though it can take regulatory action. That covers requirement notices, warning notices, conditions on registration, and suspension or cancellation. Where the same facts breach a regulation carrying an offence, CQC can prosecute that one.
Can someone start work before the DBS certificate arrives?
DBS Adult First checks whether an individual is on the adults’ barred list ahead of the full certificate. It is open to eligible care homes and domiciliary care agencies, and to adult placement schemes, at an extra £6. Use is intended for exceptional circumstances only, to maintain minimum statutory staffing levels, and the person works under supervision.
Which age check are you actually asking your users to do?
Can you prove your age without handing over your ID?
Your check says a 19-year-old might be 16. Here is why, and what to do about it
