Who must I report a safeguarding concern to, and in what order?

England and Wales: This page sets out the position in full, including a new reporting duty that has been passed but is not yet in force. Scotland: covered, and harder — the referral to Disclosure Scotland reaches further than the DBS duty, runs on a fixed statutory time limit and can lead to prison; there is no general law requiring a charity to report abuse. Northern Ireland: covered, and different again — a general criminal duty to tell the police about certain offences binds everyone, with no equivalent elsewhere in the UK; failing the Northern Ireland barring referral is itself an offence, under Article 40 of the 2007 Order.

There is no official order, and the referral benchmark is not law

No official source sets an order for reporting a safeguarding concern. None ranks the Charity Commission against the police, or either against the local safeguarding board. They are parallel, not a queue. The Commission says to report a serious incident to it “even if you have also reported it to the police, donors or another regulator”.

An order that no source supports is worse than no order, because someone will wait for step two before starting step three. This step is for the trustees, the chair and the safeguarding lead. It picks up once the concern has been received and recorded. It covers England and Wales first, then Scotland and Northern Ireland.

The one real sequence is this. In England and Wales, the duty to refer to the DBS is triggered by something the charity does — removing the person from their role. So the charity’s own decision comes before that referral.

Everything else runs on its own clock. And the benchmark for referring to the local safeguarding board — the guidance’s figure, quoted on the previous step — comes from guidance. No statute behind it has been found.

The reports, and which of them are legal duties

For England and Wales. Scotland and Northern Ireland follow below.

Report to	When	Is it a legal duty?
Police, emergency	Anyone at immediate risk	It displaces everything else. Situational.
Local safeguarding adults board or children partnership	The guidance benchmark	No. Guidance says “must”; no statutory hook found.
Police, non-emergency	Actual or alleged crime	Generally no. The exception is terrorism, below, where the duty is criminal.
Charity Commission, serious incident report	promptly — as soon as is reasonably possible after it happens, or immediately after the charity becomes aware of it	No, but concealing it at annual return time can be an offence. See the section on the Commission report.
DBS, barring referral	Once both conditions below are met	Yes. Failing to refer is a criminal offence.
Funders and insurers	Under the agreement or policy	Only if the contract says so.

Two further duties sit outside that table. They bind particular people, not every charity. One is the duty to report female genital mutilation. The other is the new child sexual abuse reporting duty, which is not in force.

The DBS duty: separate, conditional, and committed by the charity

The DBS referral duty is a regulated activity provider’s legal duty to refer a person to the DBS. Whether your people are in regulated activity at all is worked out on is this role in regulated activity? It arises once both of the conditions below are met.

It is separate. A report to the council or the police does not discharge it. The DBS guidance says, verbatim: “The duty to refer applies even when a report has been made to another body such as a local authority safeguarding team”. It applies “irrespective of whether another body has made a referral”.

It needs both conditions. The duty does not arise on an allegation. It arises when both of these are true:

1. You have removed the person from regulated activity. "You withdraw permission for a person to engage in regulated activity with children and/or vulnerable adults. Or you move the person to another area of work that isn't regulated activity." Includes cases where the organisation "would have taken the above action, but the person was re-deployed, resigned, retired, or left."
2. There is a reason of the right kind. The person has engaged in relevant conduct, or satisfies the harm test, or has been cautioned or convicted of a relevant (automatic barring) offence.

Two things follow. A dismissal for harming someone the charity serves is the typical case the two conditions describe; whether they are met in a particular case is judged against the DBS guidance. And the duty does not end because the person resigned before the charity’s process finished: the DBS guidance covers that case expressly.

Who it binds. In the DBS’s words: "Regulated activity providers (employers or volunteer managers of people working in regulated activity in England, Wales and Northern Ireland) and personnel suppliers."

The offence. It is in section 38(1) of the Safeguarding Vulnerable Groups Act 2006.

A person commits an offence if— (a) he is required under section 35 or 36 or in pursuance of section 37 to provide information to [DBS], and (b) he fails, without reasonable excuse, to provide the information.

So there are three ways into the offence, not one:

• s.35 — regulated activity providers
• s.36 — personnel suppliers
• s.37 — failure to provide information in pursuance of a DBS information request

The statutory words are “without reasonable excuse”. Some summaries say “reasonable justification”. The Act does not.

The penalty. Section 38(2) sets it.

A person guilty of an offence under subsection (1) is liable on summary conviction to a fine not exceeding level 5 on the standard scale.

That is not the end of it. Since 12 March 2015, section 85(1) of the Legal Aid, Sentencing and Punishment of Offenders Act 2012 has applied to fines like this. It turned them into “a fine of any amount”. This offence is not on the list of exceptions.

So in England and Wales the fine is unlimited. The fixed figure in the DBS’s own summary is out of date and understates the risk.

The reassuring half, which is also true. The offence is summary only, so it is tried in the magistrates’ court. And the only penalty is a fine. It cannot lead to prison.

Who commits it. The regulated activity provider — the charity — or a personnel supplier. Individuals can be caught too. Section 18(1) of the 2006 Act says that if a section 38 offence is committed by a body corporate with the consent or connivance of, or through neglect by, “a director, manager, secretary or other similar officer of the body”, that person “(as well as the body) commits the offence”. A charitable company or CIO is a body corporate, so its trustees can be within it. In an unincorporated charity, who counts as the regulated activity provider under section 6 is a question for a solicitor. The penalty for an individual is the same fine.

Northern Ireland is different law. Section 35 of the 2006 Act extends to England and Wales only. The Northern Ireland duty to refer is in Articles 37 and 38 of the Safeguarding Vulnerable Groups (Northern Ireland) Order 2007. See the Northern Ireland section of this page.

Reporting duties that bind individuals: child sexual abuse, FGM, terrorism

Three reporting duties bind particular people rather than every charity. Only the terrorism duty is both in force and backed by a criminal offence.

Mandatory reporting of child sexual abuse: passed, not in force

Mandatory reporting, in this guide, means the duty to report child sexual abuse created by section 85 of the Crime and Policing Act 2026. This is the point most likely to be wrong in whatever else you read, in either direction. Hold all four parts together:

1. It is law. Section 85 of the Crime and Policing Act 2026 received Royal Assent on 29 April 2026.
2. It is not in force. The section is marked “Prospective”. No date has been set to bring it in.
3. It will apply to activity in England only. It bites on someone “engaging in a relevant activity in England”. A charity working only in Wales will not be caught, even once it starts.
4. There is no criminal penalty for failing to report. The consequence will be a DBS referral and, where relevant, a referral to a professional regulator. The Act does create a separate criminal offence, also not in force, in section 92: engaging in conduct intended to prevent or deter someone from complying with the duty, knowing they are under it.

So “charities must now report child sexual abuse” is wrong today. But “there is no mandatory reporting” is wrong too. It will be wrong once section 85 starts, and it already ignores the narrower female genital mutilation duty.

Female genital mutilation: a duty on certain professionals, not on the charity

Section 5B of the Female Genital Mutilation Act 2003 has required certain professionals to report known cases of FGM in girls since 31 October 2015. It is not a duty of the same kind as the terrorism duty. It should not be listed beside it:

• It creates no criminal offence. There is no penalty provision.
• It binds the individual professional, not the charity.
• The deadline is not a day. Section 5B says, verbatim, the notification “must be made before the end of one month”.
• It covers only, verbatim, “a healthcare professional, a teacher, or a social care worker in Wales”. A social care worker in England is not covered.

Most charities will have nobody in scope. Note the two opposite gaps. The FGM duty reaches a social care worker in Wales but not in England. The new child sexual abuse duty will reach England but not Wales.

Terrorism: a criminal duty with a low threshold

Section 19 of the Terrorism Act 2000 creates a reporting duty backed by a criminal offence. It works like this:

• The trigger is that a person “believes or suspects” that someone has committed a terrorist financing or property offence under sections 15 to 18. Suspicion is enough.
• The gateway is that the information came to them “in the course of a trade, profession or business” or “in the course of his employment”.
• The duty is to tell a constable “as soon as is reasonably practicable”.
• The penalty on conviction on indictment includes imprisonment.

Section 19 has two defences. One is reasonable excuse. The other is using an employer’s own procedure for making such disclosures. That second defence turns on the employer having established such a procedure.

The regulated financial sector has its own regime and is excluded.

An open point. A purely unpaid volunteer arguably falls outside section 19 altogether, because neither gateway is met. This guide does not decide that either way. Whether it applies to a particular volunteer is a question for a solicitor.

The Commission report, and where concealment becomes an offence

Reporting a serious incident to the Charity Commission is expected, not required by statute. The trip-wire comes later. A charity with income over £25,000 signs a declaration with its annual return. The declaration confirms there were no serious incidents it should have reported and did not.

Signing that falsely engages section 60 of the Charities Act 2011. The section contains two offences, with different mental elements:

• Section 60(1) — “knowingly or recklessly” giving the Commission false or misleading information. This is where concealment at annual return time falls.
• Section 60(2) — “wilfully” altering, suppressing, concealing or destroying a document.

On conviction on indictment the maximum is 2 years’ imprisonment. The offence is committed by “a person” — whoever provides the information. Section 60 gives no defence beyond its mental element. Whether a particular judgement was reckless is a question for a solicitor.

How and when to make the report itself is covered on make a serious incident report.

Scotland: wider, harder, and no general duty to report

The referral goes to Disclosure Scotland, and it reaches further. It is a legal duty for any organisation with staff or volunteers doing a regulated role. It applies whether or not the person is a member of the PVG scheme. In Disclosure Scotland’s words, organisations “must report harmful behaviour even if it takes place outside of work, or if the organisation only finds out about it after the person has left.”

Failing to refer is an imprisonable offence. The offence is in section 9 of the Protection of Vulnerable Groups (Scotland) Act 2007.

An organisation which fails, without reasonable excuse, to comply with a duty imposed by any of sections 3 to 5 within 3 months of the date on which the duty arose is guilty of an offence and liable— (a) on summary conviction, to imprisonment for a term not exceeding 12 months or to a fine not exceeding the statutory maximum, or to both, (b) on a conviction on indictment, to imprisonment for a term not exceeding 5 years or to a fine, or to both.

Three things set this apart from England and Wales. The referral has a fixed statutory time limit. The offence has a summary route and an indictment route, both carrying prison. And individuals can be caught as well as the organisation.

Section 89 makes a person concerned in the management of an organisation guilty too. That applies where the organisation’s offence was committed with their consent or connivance, or was down to their neglect. It expressly covers unincorporated associations, which is how many small Scottish charities are set up. A Scottish charity trustee can be convicted personally where the organisation’s offence is proved to involve their consent, connivance or neglect.

There is no general law requiring a charity to report abuse. For adults, section 5 of the Adult Support and Protection (Scotland) Act 2007 sets a duty to report to the council. That duty falls on a list of public bodies and office-holders. Ministers can add “any other public body or office-holder” by order; the power does not reach charities as such.

For children, there is no statutory duty on a charity at all. A Scottish Government group is considering one and had not reported as at September 2026. Referring is still good practice. It is how the statutory system hears about a concern. It is not a legal duty.

OSCR. Scotland abolished its notifiable events regime on 1 April 2024. There is no safeguarding-specific report to OSCR. Concerns go through its general “Raise a Concern” route.

Northern Ireland: a duty that binds everyone

Northern Ireland has a general criminal duty to report that exists nowhere else in the UK. The duty is in section 5 of the Criminal Law Act (Northern Ireland) 1967.

"(1) Subject to the succeeding provisions of this section, where a person has committed a relevant offence, it shall be the duty of every other person, who knows or believes— (a) that the offence or some other relevant offence has been committed; and (b) that he has information which is likely to secure, or to be of material assistance in securing, the apprehension, prosecution or conviction of any person for that offence; to give that information, within a reasonable time, to a constable and if, without reasonable excuse, he fails to do so he shall be guilty of an offence..."

It binds every person, not a professional class. It reaches staff and volunteers of a charity like anyone else. The test is “knows or believes”, not mere suspicion. Failing to report is triable on indictment only. The maximum depends on how serious the unreported offence is.

"he shall be liable on conviction on indictment to imprisonment according to the gravity of the offence about which he does not give that information, as follows:— (i) if that offence is one for which the court is required by law to sentence an offender to death or to imprisonment for life or to detention during the pleasure of the Governor of Northern Ireland, he shall be liable to imprisonment for not more than ten years; (ii) if it is one for which a person (of full age and capacity and not previously convicted) may be sentenced to imprisonment for a term of fourteen years, he shall be liable to imprisonment for not more than seven years; (iii) if it is not one included above but is one for which a person (of full age and capacity and not previously convicted) may be sentenced to imprisonment for a term of ten years, he shall be liable to imprisonment for not more than five years; (iv) in any other case, he shall be liable to imprisonment for not more than three years."

Section 5 has two limits. First, a victim, or someone acting for them, does not commit the offence by not reporting. That is so as long as nothing beyond fair recompense is taken for staying silent (section 5(2)). And no prosecution can start without the consent of the Attorney General for Northern Ireland (section 5(4)).

No Northern Ireland safeguarding guidance found by this guide mentions section 5 by name. Which offences count as “relevant offences” for it is not set out here. Whether a particular matter is one is a question for a solicitor.

The barring referral. The duty to refer to the DBS in Northern Ireland is in Articles 37 and 38 of the 2007 Order. Failing, without reasonable excuse, to refer is an offence under Article 40 — summary only, a fine capped at level 5 (£5,000). Unlike England and Wales, the cap still applies.

CCNI. Safeguarding incidents fall within CCNI’s serious incident reporting. Its guidance adds this for incidents involving safeguarding.

"Serious incidents and safeguarding issues — Safeguarding means protecting someone's health, wellbeing and human rights; enabling them to live free from harm, abuse and neglect. If a serious incident involves a safeguarding issue (or it could lead to one), you must follow the relevant safeguarding law and regulations as well as your charity's own safeguarding policies and processes. It's important that you: tell us that an incident has happened; tell us what (if anything) you have done to deal with it (for example, whether you have done an internal investigation, contacted your local Health and Social Care Trust Gateway team or reported the incident to the Police Service of Northern Ireland); assure us that, if needed, you are improving your charity's governance and controls."

Keep a reporting log

The reports run in parallel. So the risk is not doing them in the wrong order. It is missing one.

Keep a single log for each concern. For each report, record who it went to, when, and what was said. Also record whether it was a legal duty, a guidance expectation or a contractual term. Review the log at the next board meeting.

Template: Safeguarding reporting log (planned). Template: Serious incident assessment (planned). Tool: Is this a serious incident? (planned).

Whether a written safeguarding policy is required at all, and what it should say about reporting, is on adopt a safeguarding policy. The last safeguarding step is the policy any charity running criminal record checks needs: write a recruitment-of-ex-offenders policy.

Common mistake: publishing the figure in the DBS’s summary as the penalty

A regulator’s plain-English summary can be mistaken for the statute. The DBS’s own guidance gives a fixed maximum fine for failing to refer. That figure is out of date and understates the risk.

Since 12 March 2015 the fine in England and Wales has been unlimited. That is because section 85(1) of the 2012 Act applies and this offence is not excluded. The offence is still tried only in the magistrates’ court and cannot lead to prison. In Northern Ireland, section 85 does not apply.

Common mistake: assuming a report to the council or the police discharges the DBS duty

One report to “the authorities” feels like the job done. It is not. The duty applies “even when a report has been made to another body”, and the offence has three separate triggers. The statutory words are “without reasonable excuse”.

Common mistake: referring to the DBS on allegation — or never, because the person resigned

The duty is read as “report anything serious”, or as ending when the person leaves. Neither is right.

It needs both conditions. First, the person was removed from regulated activity, or would have been but resigned, retired or left. Second, there is relevant conduct, the harm test or a relevant caution or conviction. Dismissal is the typical case, but whether both conditions are met is judged case by case.

Common mistake: treating the FGM duty as a charity reporting duty like the terrorism duty

The two are often listed side by side as “hard legal duties”. They are not alike. The terrorism duty is criminal, has a low “believes or suspects” threshold, and has two defences. The FGM duty creates no offence, binds the individual professional, gives a month, and does not reach social care workers in England.

Common mistake: inventing a hierarchy between the Charity Commission and the police

Readers want a numbered list. No official source gives one. The Commission asks for a report “even if you have also reported it to the police, donors or another regulator”. In England and Wales, the one real sequence is that the DBS duty only arises after the charity has acted.

Common mistake: “charities must now report child sexual abuse” — or “there is no mandatory reporting”

The new duty was widely reported when it passed. It is law, not in force, England-only in operation, and carries no criminal penalty for failing to report. Meanwhile a narrower FGM duty on named professionals has existed since 2015. Both sentences are wrong.

Worked example

Saltmarsh Trust dismisses a support worker after its own process finds relevant conduct towards a service user. The police and the council were told at the start.

The trustees open a reporting log. The police and council reports are already in it. The serious incident report to the Commission runs alongside them, not after. No source puts one before the other.

Then the DBS. The worker has been removed from regulated activity, and the reason is relevant conduct, so both conditions are met. The referral is now a legal duty, and the earlier reports do not count towards it. Saltmarsh makes it and logs it. The funder and the insurer are told under their agreements, and logged as contractual.

If the same thing had happened in Scotland, the referral would go to Disclosure Scotland instead. The duty would be wider and the time limit fixed by statute. A failure could lead to prison, for the organisation and possibly for the people running it.