Which criminal record check do we need?

Applies in: England and Wales · Scotland · Northern Ireland

Which regime applies to you

Where the work is done decides which criminal record check regime applies. Where your charity is registered, or where your head office is, does not.

A charity registered in England that runs a project in Glasgow needs the Scottish system for that project. A Belfast branch of a London charity needs the Northern Irish one. The trustees and the safeguarding lead need to know which applies before they choose a form.

• England and Wales — the Disclosure and Barring Service issues certificates at four levels.
• Scotland — the Protecting Vulnerable Groups (PVG) scheme. Not a certificate: continuous membership, with criminal offences attached to getting it wrong.
• Northern Ireland — AccessNI issues certificates at three levels, and one of them is a trap.

The differences between them are differences in kind. England has no offence of doing a regulated role without a check; Scotland does, for the individual and separately for the organisation. Scotland has no supervision exemption; England and Wales lost theirs on 1 September 2026. The three regimes do not use the same vocabulary and the same word does not mean the same thing in two of them.

The same question comes first, whichever regime applies. The question is whether the law says this role may be checked at all, and at what level. That is the subject of the next section, and it is where most charities go wrong before they have even chosen a form.

The level is set by law, not by how cautious you want to be

Charities habitually treat the highest level of check as the responsible default. It is not available as a default. Each level has a legal eligibility test attached to the role, and a role either meets it or does not.

In England and Wales the highest level — an enhanced check with barred lists — is available only where the role is in regulated activity. Regulated activity is a statutory definition with two independent limbs and a frequency gate. It is not a description of how risky a role feels.

Barred-list information is disclosable only “in such cases as are prescribed”. The prescribing instrument, not the charity’s judgement, decides which those are.

Two consequences that ought to change behaviour:

• Asking for a level the role does not permit is not caution. It is a request the DBS should refuse. GOV.UK’s own framing is that a more detailed check may be requested “for certain roles” — a permission conditioned on the role, not a menu.
• It is a data protection problem as well as a DBS one. Criminal offence data is among the most tightly controlled categories of personal data. Processing it without a lawful basis and condition is a breach, whether or not the DBS spotted the ineligibility. The policy that sets out that basis belongs with the rest of your data protection policy. The Charity Commission puts it directly: “If you ask applicants about their criminal records you must have a policy in place that sets out a lawful basis and condition of processing this information.”

This page will not tell you which level you need

That is deliberate, and it is not modesty. Getting the level wrong is a legal error in both directions. Too low leaves a role unchecked that the law says must be checkable. Too high is an unlawful request and an unlawful piece of data processing.

The determination turns on a statutory list of activities that this project has not read verbatim. A wrong leaf on a decision tree would be worse than no tree at all.

The DBS publishes an official eligibility tool. Use it, and record the answer it gives you and the date you used it. The link is in “Where this page stops”, below.

This page can do something the official tool does not. It tells you what kind of question you are answering. It also warns you about the two things that will change your answer without any change in the law.

England and Wales: DBS

Four levels, each disclosing more than the last, each with its own eligibility test:

Level	What it discloses	Who may be checked
Basic	Unspent convictions and conditional cautions	Anyone. The individual can apply for themselves.
Standard	Spent and unspent convictions and cautions	Only a position exempted from the Rehabilitation of Offenders Act 1974 by the 1975 Exceptions Order.
Enhanced	As Standard, plus information held by local police considered relevant to the role	Prescribed roles only.
Enhanced with barred lists	As Enhanced, plus whether the person is on the children’s and/or adults’ barred list	Regulated activity only. Not a matter of choice or caution.

The statutory gate: what “regulated activity” turns on

Two things about the test are worth knowing before you use the official tool, because both are routinely got wrong:

• The frequency gate is a number, and it is not the number people quote. The statutory period condition is More than three days in any period of 30 days. Certain activities have a second limb: For activities within para. 2(1)(a), (b) or (c), the period condition is also satisfied if the person carries out the activity at any time between 2 a.m. and 6 a.m. and the activity gives the opportunity to have face-to-face contact with children.. The word “frequently” also appears in the test, and it is not defined anywhere in the Act. The widely repeated “once a week or more” comes from guidance, not statute. It should not be treated as a legal test.
• Some activities have no frequency test at all. Relevant personal care, and health care provided by or under the direction of a health care professional, are regulated activity the first time they happen. Once is enough. The same applies to first aid given by someone acting for an organisation established to provide first aid. Most guidance buries this, and a charity that applies a frequency test to personal care will reach the wrong answer.

Two things most charities believe that are not so

1. A DBS certificate has no expiry date. GOV.UK, verbatim: “A DBS check has no official expiry date. Any information included will be accurate at the time the check was carried out. It’s up to you to decide when a new check is needed.”

The three-year renewal cycle that so many charities and funders operate is policy, not law. No statute and no guidance sets an interval.

A charity may adopt its own re-check policy, and should. But it should minute the policy as its own decision. It should not describe it as a legal requirement, because a funder repeating the myth back at you is not authority.

Where a candidate brings a certificate from a previous role, the organisation must check:

• that the identity matches
• that the certificate is the right level and type for the role applied for
• whether anything has changed, by checking online — if the person is on the Update Service

2. The supervision exemption ran until 31 August 2026, and ended on 1 September 2026. Both halves matter, because determinations made before that date may rest on it.

• Until 31 August 2026: one kind of unpaid work was not regulated activity. That was work that was, on a regular basis, subject to reasonable day-to-day supervision by someone who was themselves in regulated activity. A supervised volunteer therefore could not lawfully be given a barred-list check on that basis alone. Note the limit of it: the exemption applied to work not for gain. There was no supervision carve-out for paid staff. A charity could not supervise its way out of a check for an employee.
• In force since 1 September 2026 (S.I. 2026/939): s.139 deleted the supervision exemption and the supervision-guidance duty.

What that means in practice. When s.139 came into force on 1 September 2026, more roles fell into regulated activity. The definition of regulated activity did not change a word.

Every “supervised, therefore not in regulated activity” determination flipped on that date. The duty to refer someone to the DBS attaches to regulated activity providers. So charities using supervised volunteers acquired a referral duty they did not have before.

So: redo every determination made before 1 September 2026 that relied on supervision. That single administrative habit is the most useful thing here for an England-and-Wales charity.

Scotland: PVG is a membership scheme, and it has criminal offences attached

The PVG scheme is Scotland’s membership scheme for people in regulated roles, and it is where reading across from England does the most damage. Scotland does not issue a check for a role. A person joins a scheme, and Disclosure Scotland keeps checking their suitability until they leave it.

Disclosure Scotland’s own words: “It’s a legal requirement to join the PVG scheme if you’re going to do a regulated role”. It also says: “Disclosure Scotland will keep checking your suitability to work with children and protected adults, until you leave the scheme.”

The concept is a “regulated role”, not “regulated activity” — a different statute, a different definition, no frequency gate, and no supervision exemption. Supervision does not take a Scottish role out of the scheme.

The offences

Scotland has 4 membership offences, not two. England and Wales has no equivalent of them: there is no offence of working without a DBS check.

• The individual commits an offence by carrying out, or agreeing to carry out, a regulated role without participating in the scheme for that type of role.
• The organisation commits an offence by offering a regulated role without having received a disclosure confirming scheme membership. Note the verb: it is an offence of offering, not of letting someone carry the role out.
• A further organisational offence covers the “permit and remove” limb, and bites only once Scottish Ministers make the regulations that support it.
• A fourth covers personnel suppliers.

All four carry the same penalty:

• on summary conviction, up to 12 months’ imprisonment or a fine not exceeding the statutory maximum, or both
• on conviction on indictment, up to 5 years’ imprisonment or a fine, or both

Most prosecutions of a small charity would be summary, so the summary limb is the realistic one. But the indictment figure is what the offence is.

The defences are asymmetric, and the asymmetry runs against the charity. The individual has a two-limb defence. The first limb is that they did not know, and could not reasonably have been expected to know, that the role was a regulated role. The second is that their membership had not been renewed.

The organisation has none on the face of the offering offence. A Scottish charity has no statutory ignorance defence to the offering offence. It should be told so plainly, rather than allowed to assume it stands where the individual does.

And the membership offences are not the whole of the risk

A separate and older group of offences covers barred people, and it is the higher-consequence one. It is an offence for an organisation to offer a regulated role to an individual barred from that role, with the identical penalty. The organisation has a due-diligence defence: that it did not know, and could not reasonably have been expected to know, that the individual was barred. A safe harbour also applies where the offer is made subject to the organisation satisfying itself that the individual is suitable.

The membership offences do not cover this ground: they are disapplied to individuals who are barred, and to anyone under 16. So a charity that has read only about ss.45C and 45D has read about the lesser risk.

Three more things a Scottish charity needs

• Trustees can be convicted personally. Take an offence under the Act committed by a body corporate, a Scottish partnership or an unincorporated association. Suppose it was committed with the consent or connivance of, or was attributable to neglect on the part of, a director, manager, officer, or “a person who is concerned in the management or control of the association”. Then that individual is guilty of the offence as well. Unincorporated association is how most small Scottish charities are constituted, and trustees commonly assume it puts them out of reach. It does not. The wider picture is on what trustees are personally liable for.
• Failing to refer harmful behaviour to Disclosure Scotland is itself a criminal offence. The referral has a statutory clock of 3 months. The offence carries up to 5 years’ imprisonment on indictment. The Scottish referral duty is also wider than the English one. It applies whether or not the person is a scheme member. It also applies whether the behaviour happened outside work or came to light after the person left.
• Two things are true about membership duration at once. Membership is now time-limited, at 5 years, for anyone joining — and Disclosure Scotland is moving existing members off lifetime membership “in phases”. So many current members are still on lifetime terms and need do nothing. Guidance written before mid-2026 calling PVG lifetime membership was correct when written and is wrong now for new members. Say both.

One cost point, because it contradicts what most of the sector believes: PVG is not free for volunteers by default. Free volunteer disclosures are available only where the organisation registers as a Qualifying Voluntary Organisation. That is the opposite of the English position, where the fee waiver is automatic.

Northern Ireland: AccessNI, and the Standard-check trap

AccessNI issues three levels of certificate: Basic, Standard and Enhanced. The DBS holds the barred lists themselves, not AccessNI. The Protection of Freedoms Act 2012 transferred those functions. AccessNI provides the disclosure and certificate service.

“Standard” sounds like the sensible middle option and AccessNI says in terms that it is not. Verbatim: “Standard checks are only available where the position or role in question is exempt from the Rehabilitation of Offenders (NI) Order 1978. They are not suitable for roles working with children or vulnerable adults.“

For a Northern Irish charity, that sentence is the single most useful thing in this explainer. Choosing Standard is exactly what a well-meaning trustee does when trying to be proportionate. The Enhanced check is the level AccessNI describes as “normally required where the applicant will work or volunteer in a role providing services to or having close and regular supervision of children or vulnerable adults”.

Two further NI points:

• The volunteer fee waiver is narrower than it reads. Standard and Enhanced checks are free for a volunteer who meets AccessNI’s definition. But AccessNI charges even for a volunteer where the volunteering is for a statutory organisation. It also charges where the volunteering is for a non-profit providing statutory services under a government-funded contract. A charity running a council-commissioned service is in scope of the charge for its volunteers on that service. Basic checks are not waived at all.
• The NI regulated activity definition follows England’s 2012 narrowing, confirmed rather than merely repeated. Northern Ireland adopted the same Protection of Freedoms Act 2012 reform that narrowed “regulated activity” in England. That reform also abolished the separate “controlled activity” category. It applied directly to the NI Order and has been in force since 10 September 2012. AccessNI’s own formulation — that the definition “is largely the same as in England, however there are some additional roles that aren’t included in the English definition” — holds up. The duty to refer sits at Articles 37 and 38 of the NI Order. It does not sit at Articles 35–36, an earlier working assumption this project has now corrected. The barred-person offences sit at Articles 11 and 13. They have the same five-years-on-indictment penalty pattern as Scotland’s barred-person offences. Failing to make an Article 37 or 38 referral is itself an offence in Northern Ireland, under Article 40. It is summary only, with a fine capped at level 5.

Northern Ireland and England and Wales moved on the same day. Section 140 of the same Crime and Policing Act 2026 abolishes Northern Ireland’s own day-to-day supervision exemption. Like England and Wales’s parallel s.139, it has been in force since 1 September 2026. A supervised NI volunteer who previously fell outside regulated activity because of that exemption is now inside it.

legislation.gov.uk’s own “changes to legislation” list for the underlying NI Order still shows the old exemption text as though it were current. The change is in force regardless of the display lag, so do not be misled by it.

Redo every NI determination made before 1 September 2026 that relied on supervision, exactly as recommended for England and Wales. The population of NI roles in regulated activity grew on 1 September 2026 without the definition itself changing a word.

The three regimes side by side

Each column comes from that jurisdiction’s own regulator, read separately.

	England and Wales	Scotland	Northern Ireland
Name	DBS check	PVG scheme	AccessNI check
Check or membership	Point-in-time certificate. Optional paid Update Service gives ongoing status.	Membership, with continuous monitoring by Disclosure Scotland.	Point-in-time certificate.
Levels	Basic / Standard / Enhanced / Enhanced with barred lists	One scheme, entered for children, adults, or both	Basic / Standard / Enhanced
Mandatory for the role?	No offence for doing regulated activity without a check.	Yes — criminal offence for the individual and, separately, for the organisation.	No equivalent standalone offence found.
Supervision exemption?	No — abolished by the Crime and Policing Act 2026 s.139, in force from 1 September 2026.	None. Supervision does not remove a role from the scheme.	No — abolished by the same Act’s s.140, in force from 1 September 2026, the same day as England and Wales.
Free for volunteers?	Yes for Standard and Enhanced, automatically. Basic not waived.	Only through Qualifying Voluntary Organisation registration. Not automatic.	Yes for Standard and Enhanced if AccessNI’s volunteer definition is met. Basic not waived.
Barred lists held by	DBS	Disclosure Scotland	DBS
Referral duty	To the DBS, where both conditions are met. Summary offence to fail it: an unlimited fine, not imprisonable. See note below.	To Disclosure Scotland. Wider: applies whether or not the person is a scheme member. Imprisonable.	To the DBS, at Articles 37–38 of the NI Order. Failing to do so is an offence under Article 40: summary only, a fine capped at level 5.

Note on the England and Wales referral penalty. The fine figure widely quoted for failing to refer to the DBS is the regulator’s plain-English gloss, and it is wrong.

The statute sets the penalty by reference to the standard scale. A 2012 Act converted every such offence into one punishable by a fine of any amount, with effect from March 2015. The offence is not in the schedule of exceptions.

The exposure in England and Wales is therefore an unlimited fine, and the offence is summary-only and not imprisonable. No fixed figure applies, so this page states none. See the drafting note at the end.

The most important row is “mandatory for the role”. Scotland criminalises what England merely permits. A UK-wide charity cannot run one policy. An English charity that opens a Scottish branch and applies its DBS procedure there may be committing an offence. It may commit it as an organisation, and its trustees potentially as individuals.

Where this page stops, and what to do next

This page tells you which regime applies, what each one is, and what the law says about eligibility. It does not tell you which level of check your role needs, and it will not.

That determination has legal consequences in both directions. It turns on a statutory list of activities this project has not read verbatim. And an official free tool does it properly.

Use the official tool

• The DBS eligibility tool on GOV.UK — the official checker for England and Wales, free. gov.uk/find-out-dbs-check. Record the answer and the date you got it, and re-run it if the role changes.
• Scotland — Disclosure Scotland, on whether a role is a regulated role: mygov.scot/pvg-scheme.
• Northern Ireland — AccessNI, on which level a position is eligible for: nidirect.gov.uk.

Free help, before any paid route

• The check concerns work with children, or you have a live safeguarding concern about a person → NSPCC Helpline, 0808 800 5000, free. Also call your local authority designated officer (LADO), who is the right first call about a specific adult in a position of trust. Do not wait for the check to come back.
• You cannot tell whether the role is in regulated activity even after using the tool → the DBS’s own contact route, and the Charity Commission’s safeguarding guidance for trustees. Both free.
• You have been running checks at the wrong level, or holding certificate data without a policy → the ICO helpline for small organisations, and their self-assessment. This is a data protection question before it is a DBS one.
• You operate in Scotland and are unsure whether a role is a regulated role → Disclosure Scotland; and OSCR, which answers charity questions free of charge. Scotland is the only one of the three regimes where getting it wrong is a criminal offence for the organisation. So take the free advice before you make the offer, not after.
• You operate in Northern Ireland → CCNI and NICVA, both free.
• You are told you have committed an offence → LawWorks or Advocate, which arrange free legal help for charities. In Scotland, take advice before responding to anything.

The steps that record the decision

A decision is only worth making if it is written down. What makes it defensible later is the record of the reasoning and the date.

• Work out whether a role is in regulated activity. Produces a written determination per role, stating each limb, any exemption relied on, and a review trigger. Start here: everything else depends on it.
• Choose the right level of check. Produces a role-by-role record of the level applied for and the legal basis for it.
• Run the check in England and Wales. Including the umbrella-body point, which is why “free for volunteers” is not the real cost.
• Run the check in Scotland or Northern Ireland. A separate procedure, not a copy of the English one. This step carries criminal risk and should be reviewed by a Scottish adviser before your procedure goes live.

Do one thing before any of them. If you run any criminal record checks at all, you must have a policy on employing ex-offenders. You must show it to any applicant who asks. On GOV.UK’s wording, the trigger is running checks, so a single basic check creates the duty.

This page carries the people hub’s expert-review flag. It is drafted from primary sources and each regulator’s own current guidance. It has not been reviewed by a safeguarding specialist or by a Scottish adviser.