Why recruitment compliance is the same job at 3 people as it is at 30

Compliance obligations attach to the placement, not to the agency. A three-person team supplying scaffolders onto a construction site carries the same per-placement record duties as a thirty-person team supplying onto the same site. The regulations make no allowance for headcount, turnover or how long you have been trading.

What changes with size is the resource behind the obligation and the number of places a record can hide.

This covers what agencies are accountable for around a placement, where records tend to slip, and what a defensible audit trail looks like in practice.

What is a recruitment agency accountable for around a placement?

You are accountable for holding enough evidence to show, for any individual placement, that you did what the Conduct of Employment Agencies and Employment Businesses Regulations 2003 require before the worker started.

Two terms decide which obligations apply to you. An employment agency introduces workers who are then employed by the hirer. An employment business supplies workers who remain under its own engagement. Most of what follows sits with employment businesses, which is where temp and contract supply lives. If you run both, you are operating as both, and each placement file needs to reflect which one applied.

In the order it happens:

Before you introduce or supply anyone, you need enough information from the hirer to select a suitable worker. That means the identity of the hirer and nature of their business, the start date and expected duration, the position and type of work, location, days and hours, any known health and safety risks and what is being done to control them, and the experience, training, qualifications or authorisations the role requires.

You then confirm the worker's identity against a document, and confirm they hold what the role needs, whether that is required by the hirer, by a professional body or by law. Right to work is an authorisation required by law. Evidence must be kept showing those checks were done.

When you put the worker forward, the information you hold about them goes to the hirer. That can be given verbally, but it has to be confirmed in writing within three business days. Where the role legally requires a qualification or authorisation, you need copies, and you need to be able to show you offered those copies to the hirer.

Temporary workers also receive a Key Information Document before terms are agreed.

Regulation 29 ties it together. Records sufficient to show compliance with the Act and the Regulations, kept for at least twelve months after creation and at least twelve months after you last provided work-finding services to that worker or that hirer.

Does compliance get easier when you place fewer people?

No. Volume changes the total workload. It does not change the standard applied to any individual file.

The clearest illustration is a production rule most leaders have never had tested. Records can be kept away from the premises they relate to, but if a Fair Work Agency compliance inspector asks for them, they must be delivered to the relevant trading premises by the end of the second business day after the request. Two working days is two working days whether you place forty workers a week or four.

Being small does not make attention unlikely either. The regulator runs targeted operations by occupation and geography based on risk profiling, so what matters is what you supply and where, not how many people you employ. Agencies supplying into construction, logistics, warehousing and care have all seen concentrated attention.

Where non-compliance is found, the enforcement route runs from warning letters through Labour Market Enforcement Undertakings and Orders, and at the far end to prohibition orders barring someone from running an agency for up to ten years. (could remove as the two-business-day production rule is the sharper point)

Where do compliance records slip in practice?

Four patterns come up repeatedly, and none of them are the result of anyone cutting corners.

Ownership is assumed rather than agreed

Home Office research found that 81% of employers using agency workers said the recruitment agency was responsible for conducting right to work checks. Whether that matches what your terms of business say is worth knowing.

Where more than one party engages the same worker, three things need writing down: who completes the check, who retains the evidence, and who refreshes it when a time-limited right to work expires. A shared understanding is not a record.

Documents expire rather than go missing

The common failure is not an absent document. It is one that was collected correctly and quietly went out of date.

The renewal cycles do not line up. Most CSCS cards run five years, though since February 2025 a first Labourer card runs two before moving to a five-year cycle. Driver CPC requires 35 hours of periodic training every five years, and driving professionally past the deadline is illegal, not merely non-compliant. Offshore, BOSIET is valid for four years and renewed through FOET, and letting it lapse closes the one-day refresher route entirely, sending the worker back through the full course.

That last point generalises. Expiry usually costs more than absence, because the cheap remedy has a deadline of its own.

Construction carries an additional risk around what gets accepted in the first place. In the same Home Office research, 70% of construction employers said they accepted a driving licence as part of a right to work check, and 41% believed illegal working was common in their sector, the highest of any sector surveyed.

Which makes the useful question not what is missing today, but what falls due next month. That is closer to a scheduling problem than a filing one, which is why expiry dates tend to work better held against the worker record than in a folder of scanned documents. In Firefish, that record also gates availability, so a worker with an outstanding mandatory item can be stopped from being put forward before anyone books them onto a shift.

Records split across systems by design

Most agencies hold the same document in more than one place. The CRM has a copy, the client's onboarding portal has a copy, and the original arrived as an email attachment to whoever registered the worker.

Nobody designed this. It follows from clients requiring their own systems. In engineering and energy, where one worker may be onboarded onto three client portals in a year, the same file can exist in several places at slightly different versions.

The audit question is not where the document is. It is which copy answers the request, and whether the version sitting in a client portal has since been superseded.

Retention pulls in two directions

Regulation 29 sets a floor. Data protection sets a ceiling. Keeping everything indefinitely satisfies neither.

The ICO's guidance on recruitment and selection applies to agencies, not only to employers, and covers temporary workers, contractors and platform workers. Its audits of recruitment technology providers found personal information being retained indefinitely to build candidate databases without candidates' knowledge. A retention position that exists in a policy document but not in the system is a position you cannot evidence.

What does a defensible audit trail look like?

The useful reframe is from storage to production. A defensible trail lets you answer, for a named placement, without asking a colleague to search their sent items:

• what was checked, and against what evidence

• when it was checked, and by whom

• what was sent to the hirer, and on what date

• what the worker was told about the assignment before it started

• where the evidence sits now, and when it expires

In shape, that means one record per placement, dated entries, evidence attached rather than referenced, and a retention clock that starts without anyone remembering to start it.

One caveat worth carrying. Documented diligence improves your position. It is not a legal shield. The point most often made about umbrella supply chain checks generalises across compliance: a tidy checklist reduces exposure, it does not remove the underlying obligation.

In shape, that means one record per placement, dated entries, evidence attached rather than referenced, and a retention clock that starts without anyone remembering to start it. Whether that sits in a CRM, a shared drive with real discipline behind it, or something built in-house matters less than whether the pieces connect. In Firefish, candidate, client, job, placement and communication history sit against the same records, so producing the trail for one placement does not mean assembling it from four places.

What changed in 2026, and what is still coming?

Correct as of 25 August 2026.

The regulator changed. On 7 April 2026 the Fair Work Agency took over from the Employment Agency Standards Inspectorate, alongside the Gangmasters and Labour Abuse Authority and the Director of Labour Market Enforcement. Inspection and enforcement work broadly as before. Key Information Documents still naming EAS need updating.

PAYE liability moved up the chain. Since 6 April 2026, where an umbrella company sits in the supply chain, the agency holding the contract with the end client can be liable for unpaid PAYE and National Insurance. HMRC publishes guidance on what this means for employment businesses and on the new PAYE rules.

Right to work checks widen from 1 October 2026. Section 48 of the Border Security, Asylum and Immigration Act 2025 extends the illegal working regime beyond employees to agency workers, individual subcontractors and gig economy workers, with liability that can reach businesses further up a subcontracting chain.

2027 is still being written. Guaranteed hours and shift notice rights for agency workers under the Employment Rights Act 2025 remain subject to consultation, and the Conduct Regulations themselves are under review to account for umbrella companies.

Questions worth asking of your own process

• Pick a placement from three months ago. How long does it take to produce the complete file?

• Who owns the right to work check on your highest volume client, and where is that written down?

• What expires in the next sixty days, and how would you find out?

• If a candidate asked to be deleted tomorrow, how many places would you have to look?

• Does your Key Information Document still name the right regulator?

• If your longest serving administrator left next week, what would stop working?

This is operational practice rather than legal guidance. The Fair Work Agency publishes guidance on the Conduct Regulations on GOV.UK, and anything touching liability, contracts or supply chain risk is worth putting to your own advisers.