Everything You Need to Know About Recruitment Agency Compliance

Launching a recruitment agency involves far more than finding candidates and winning clients. From company registration and data protection to employment law and insurance, the regulatory landscape for new recruitment businesses is layered and detailed. Getting compliance right from the outset protects your reputation, your finances, and the candidates and clients you serve.

This guide walks you through every licensing and compliance obligation that recruitment entrepreneurs face when starting a recruitment agency in the UK. At SSG Recruitment Partnerships, we've supported over 500 founders through this exact process, and our legal and compliance team handles the regulatory groundwork so you can focus on billing.

Key Takeaways: Agency Compliance for New Founders

The Conduct of Employment Agencies and Employment Businesses Regulations 2003 set the legal framework for all UK recruitment agencies.
Data protection compliance under UK GDPR requires a lawful basis for processing candidate personal data, documented retention policies, and transparent privacy notices.
Employers' Liability insurance is a legal requirement as soon as you hire your first employee, with a minimum cover of £5 million.
SSG Recruitment Partnerships handles company formation, contracts, and compliance setup so founders can launch in as little as four weeks.
IR35 off-payroll working rules place specific obligations on agencies supplying contractors to medium and large end clients.

What Laws Govern UK Recruitment Agencies?

Two pieces of legislation form the backbone of recruitment agency regulation in England, Scotland, and Wales. The Employment Agencies Act 1973 (as amended) establishes the core legal duties for anyone operating an employment agency or employment business. The Conduct of Employment Agencies and Employment Businesses Regulations 2003 (the Conduct Regulations) then set detailed standards of conduct.

Since April 2026, enforcement sits with the Fair Work Agency (FWA), which brought together several state enforcement bodies including the former Employment Agency Standards Inspectorate. The FWA investigates complaints, carries out targeted operations, and can issue Labour Market Enforcement Undertakings, orders, prosecutions, or prohibition orders lasting up to ten years.

Breaching the Act or the Conduct Regulations is a criminal offence. Fines are uncapped on conviction, and prohibition orders can permanently bar an individual from running a recruitment business.

How to Register and Structure Your Recruitment Agency

Most recruitment founders register a limited company with Companies House. You'll need a registered office address, at least one director, and articles of association. You must also register with HMRC for Corporation Tax, PAYE (if you plan to employ staff or pay temporary workers), and VAT if your taxable turnover exceeds the current threshold.

At SSG Recruitment Partnerships, our Business Launch service handles all of this for you. From Companies House registration and your Certificate of Incorporation to first board minutes and Memorandum and Articles of Association, the entire process is managed by our dedicated launch team.

If you supply temporary workers in agriculture, horticulture, shellfish gathering, or associated food processing, you must also hold a gangmaster licence from the FWA under the Gangmasters (Licensing) Act 2004. Operating without one is a criminal offence.

What Are the Conduct Regulations and Why Do They Matter?

The Conduct Regulations set minimum standards that every employment agency and employment business must meet. They cover the entire lifecycle of a recruitment engagement, from advertising roles and agreeing terms with work-seekers through to supplying workers and keeping records.

Terms of Engagement with Work-Seekers

Before offering any work-finding services, an employment business must agree written terms with each work-seeker (Regulations 14 and 15). These terms must include the type of work to be sought, how the work-seeker will be engaged, an undertaking to pay them for all hours worked (even if the hirer has not paid you), the rate and intervals of pay, notice periods, and holiday entitlement.

Employment agencies placing permanent candidates have a parallel requirement under Regulation 16. The terms must be agreed before services begin. There's no legal requirement for a physical signature, but you must be able to demonstrate agreement.

Obtaining Information from Hirers

Regulation 18 prohibits you from introducing or supplying a work-seeker to a hirer unless you hold sufficient information about the role. That includes the hirer's identity, nature of business, start date, duration, job title, duties, location, working hours, health and safety risks, required qualifications, and any expenses payable.

Failure to collect and share this information can expose your business to enforcement action and civil liability.

Verifying Work-Seekers

Under Regulation 19, you must confirm the identity of every work-seeker before introduction or supply. This means checking a valid identity document such as a passport, driving licence, or birth certificate. You must also confirm they hold the experience, training, qualifications, and right to work authorisation required for the role.

For roles involving vulnerable people (defined as anyone under 18 or in need of care by reason of age, infirmity, illness, or disability), additional checks apply. You must obtain two written references from non-relatives and copies of all required qualifications and DBS certificates.

Record-Keeping Obligations

Regulation 29 requires you to maintain records sufficient to demonstrate compliance with every provision of the Act and the Conduct Regulations. Records must be retained for at least 12 months after creation and for at least 12 months after you last offered work-finding services to the relevant work-seeker or hirer.

Records can be stored offsite, but must be deliverable to your trading premises by the end of the second business day if requested by an FWA compliance inspector.

Understanding the Difference Between an Employment Agency and an Employment Business

The Act distinguishes between two types of recruitment operation, and the compliance obligations differ for each.

An employment agency introduces work-seekers to hirers for permanent roles. The candidate is employed directly by the hirer. An employment business supplies temporary or contract workers who remain employed by the business itself while working under the direction and control of the hirer.

Many recruitment firms operate as both, which means meeting the requirements of each model. If you're unsure which category applies to your planned operation, it's worth getting this right early. Misclassifying your business can lead to non-compliance with the wrong set of regulations.

Data Protection and UK GDPR Compliance for Recruitment Agencies

Recruitment agencies process large volumes of personal data, from CVs and interview notes to references and diversity monitoring forms. The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 set strict rules on how this data must be handled.

Establishing a Lawful Basis for Processing

You must identify a lawful basis for every type of personal data processing you carry out. For most recruitment activities, "legitimate interests" is the likely basis, but you'll need to complete a Legitimate Interests Assessment (LIA) and document it. Where you process special category data (such as health information or diversity data), you'll need an additional condition under Article 9 of UK GDPR.

Privacy Notices and Candidate Rights

Every candidate whose data you hold must receive a clear, accessible privacy notice explaining what data you collect, why, how long you'll keep it, and who you share it with. Candidates have rights under UK GDPR including the right to access their data, request correction, request deletion, and object to processing.

As a recruitment founder, building these processes into your operations from day one is far more efficient than retrofitting them later.

Data Retention and Deletion Policies

You should not keep candidate data indefinitely. Set clear retention periods tied to business need and delete data once the purpose for holding it has expired. The ICO's guidance on employment practices and recruitment offers detailed advice on building retention schedules that meet regulatory expectations.

Registering with the ICO

If you process personal data (and as a recruitment agency, you will), you must register with the Information Commissioner's Office (ICO) and pay a data protection fee. The fee amount depends on your organisation's size and turnover. Failure to register is a criminal offence.

What Insurance Do Recruitment Agencies Need?

Insurance is a non-negotiable part of running a compliant recruitment agency. The exact policies you'll need depend on whether you supply temporary workers, employ staff, or both.

Employers' Liability Insurance

As soon as you employ anyone (including temporary workers on your payroll), you are legally required to hold Employers' Liability (EL) insurance with a minimum cover of £5 million from an authorised insurer. You must display your EL certificate where employees can access it. Fines for non-compliance run at £2,500 per day without proper cover.

Professional Indemnity Insurance

Professional Indemnity (PI) insurance protects your business against claims arising from negligent advice or a failure to perform professional duties. While not legally required for all recruitment agencies, many clients will insist on it as a condition of doing business. PI cover is considered standard practice across the sector.

Public Liability Insurance

Public Liability insurance covers claims from third parties for injury or property damage that occurs during your business operations. If clients or candidates visit your premises (or you visit theirs), this cover reduces your exposure.

Cyber Insurance

Given the volume of personal data recruitment agencies handle, cyber insurance is increasingly important. A data breach can trigger regulatory fines, notification costs, and reputational damage. Cyber cover helps absorb those costs.

How IR35 and Off-Payroll Working Rules Affect Recruitment Agencies

The off-payroll working rules (commonly called IR35) determine whether a contractor working through their own limited company should be treated as employed for tax purposes. Since April 2021, the responsibility for determining employment status sits with the end client (for medium and large organisations), not the contractor.

As a recruitment agency sitting in the supply chain, you have specific obligations. If the end client determines that IR35 applies, your agency (as the fee-payer) is responsible for deducting income tax, National Insurance contributions (NICs), and Apprenticeship Levy before paying the contractor's company.

Getting IR35 wrong carries significant financial risk. HMRC can pursue the agency for unpaid tax, NICs, and penalties. Building robust status determination processes and keeping records of every determination is essential.

Employment Rights and Anti-Discrimination Obligations

Recruitment agencies have direct responsibilities under employment and equality law.

The Equality Act 2010

The Equality Act 2010 makes it unlawful to discriminate against candidates on the basis of protected characteristics, including age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, and sexual orientation. This applies to every stage of the recruitment process, from job advertising through to shortlisting, interviewing, and placement.

Advertising a role as appropriate only for a specific age group, or filtering out candidates based on gender, exposes your business to tribunal claims and reputational harm.

Right to Work Checks

Before supplying or introducing a work-seeker, you must verify their right to work in the UK. For most individuals, this involves checking an original passport or biometric residence permit. Since April 2022, right to work checks for individuals with a biometric immigration document must be carried out using the Home Office online checking service.

Failure to conduct proper right to work checks can result in civil penalties of up to £60,000 per illegal worker (from early 2024 rates).

National Minimum Wage and Holiday Pay

If you operate as an employment business and employ temporary workers, you must pay at least the National Minimum Wage (or National Living Wage, depending on age). You must also give holiday pay entitlement. The Conduct Regulations explicitly prohibit withholding pay from a worker because a hirer has not paid you.

Health and Safety Responsibilities for Recruitment Agencies

Under the Health and Safety at Work Act 1974 and the Management of Health and Safety at Work Regulations 1999, recruitment agencies that supply temporary workers have a duty of care towards those workers.

Before supplying a worker to a hirer, you must obtain information about any known health and safety risks at the workplace and confirm what steps the hirer is taking to control those risks. For certain roles, you may need to confirm that the worker has received adequate training or holds relevant safety qualifications.

Where you employ temporary workers directly, your obligations extend to ensuring they have appropriate PPE and are not placed in roles where their safety cannot be reasonably assured.

Advertising Compliance for Recruitment Agencies

Regulation 27 of the Conduct Regulations imposes specific rules on how recruitment agencies advertise roles.

Every advertisement must display your full business name and state whether the role is temporary or permanent. You must not advertise a role unless you hold written authority from the hirer and sufficient information about the position. If you reference a rate of pay, you must also state the nature of the work, the location, and the minimum experience or qualifications required to receive that rate.

Beyond the Conduct Regulations, the Advertising Standards Authority (ASA) Code applies to recruitment advertising. Misleading job adverts can result in complaints, investigations, and reputational damage.

How SSG Recruitment Partnerships Handles Compliance for New Founders

We understand that navigating licensing and compliance can feel overwhelming when you're focused on building a pipeline and winning clients. That's why SSG Recruitment Partnerships handles the regulatory groundwork for every new recruitment business we launch.

Our dedicated launch team takes care of company formation, including Companies House registration, your Certificate of Incorporation, HMRC registration, and articles of association. Our back-office operations team manages ongoing compliance obligations including payroll, invoicing, credit control, and financial reporting.

Our legal and HR team offers guidance on contracts, IR35 status determinations, employment law, and data protection. We've launched and invested in over 500 recruitment businesses, which means we've already solved the compliance challenges you're about to face.

A Step-by-Step Compliance Checklist for New Recruitment Agencies

Use this checklist to track your progress through the core compliance requirements before you go live.

Register your limited company with Companies House and obtain your Certificate of Incorporation.
Register with HMRC for Corporation Tax, PAYE, and VAT (if applicable).
Register with the Information Commissioner's Office (ICO) and pay the data protection fee.
Draft and publish a candidate-facing privacy notice that meets UK GDPR requirements.
Set up data retention and deletion policies with clear timeframes for each data category.
Obtain Employers' Liability insurance (minimum £5 million cover) and display the certificate.
Obtain Professional Indemnity insurance at a level appropriate for your sector and client expectations.
Prepare standard terms of engagement for temporary work-seekers (Regulations 14 and 15) and permanent candidates (Regulation 16).
Create a Key Information Document (KID) template for temporary workers.
Build a right to work verification process and keep auditable records of every check.
Set up a process for obtaining and sharing hirer information (Regulation 18) before every introduction or supply.
Implement a record-keeping system that meets the 12-month retention requirements of Regulation 29.
If supplying contractors via limited companies, establish an IR35 status determination workflow.
Review advertising templates to confirm they include your business name, role type (temp or perm), and all required details when pay rates are referenced.
If supplying workers to vulnerable persons, set up enhanced vetting procedures including DBS checks and two written references.

Common Compliance Mistakes New Recruitment Agencies Make

Knowing where founders typically slip up can help you avoid the same pitfalls.

One frequent error is failing to agree written terms with work-seekers before starting work-finding services. The Conduct Regulations require terms to be in place before you send a single CV or arrange an interview. Retrospective agreements are not compliant.

Another common oversight is holding candidate data without a documented lawful basis or retention policy. The ICO has the power to issue fines and enforcement notices for data protection breaches, and recruitment agencies are a frequent focus of audits.

Founders also sometimes underestimate the record-keeping burden. Maintaining organised, accessible records from day one is far less costly than reconstructing them under the pressure of an FWA inspection. SSG Recruitment Partnerships builds these systems into every business plan we develop with our partners, so nothing slips through the cracks.

In Conclusion: Building a Compliant Recruitment Agency from Day One

Compliance is not a one-off checkbox exercise. It's an ongoing operational commitment that protects your business, your candidates, and your clients. From the Conduct Regulations and UK GDPR through to insurance, IR35, and employment law, the regulatory requirements for recruitment agencies are detailed but manageable when you build the right foundations early.

At SSG Recruitment Partnerships, we're committed to your success. Our team of experts handles company formation, legal setup, ongoing compliance, and every operational detail so recruitment entrepreneurs like you can focus on what you do best: recruiting and billing. Let us help you launch a compliant, thriving recruitment business from day one.

FAQs About Recruitment Agency Compliance

Do I need a licence to operate a recruitment agency in the UK?

Most UK recruitment agencies do not need a specific licence to operate. You must comply with the Employment Agencies Act 1973 and the Conduct Regulations 2003. The exception is agencies supplying workers to agriculture, horticulture, shellfish gathering, or food processing, which need a gangmaster licence from the Fair Work Agency.

What is a Key Information Document and when must I issue one?

A Key Information Document (KID) is a mandatory document that employment businesses must give to every temporary work-seeker before agreeing terms. It sets out pay-related facts including how they will be engaged and what deductions will apply. SSG Recruitment Partnerships prepares KID templates as part of our Business Launch service, so your documentation is compliant before you go live.

How long must a recruitment agency keep candidate records?

Under Regulation 29 of the Conduct Regulations, records must be kept for at least 12 months after creation and for at least 12 months after you last offered work-finding services to the relevant individual. Separate UK GDPR retention rules may also apply. SSG Recruitment Partnerships helps partners build record-keeping systems that satisfy both requirements.

What happens if a recruitment agency breaches the Conduct Regulations?

Breaching the Conduct Regulations is a criminal offence. The Fair Work Agency can issue Labour Market Enforcement Undertakings, seek court orders, prosecute, or apply for prohibition orders barring individuals from running a recruitment business for up to ten years. Fines on conviction are uncapped.

Is Professional Indemnity insurance required for recruitment agencies?

Professional Indemnity insurance is not a legal requirement for all recruitment agencies, but it is considered standard industry practice. Many clients require it before signing terms of business. At SSG Recruitment Partnerships, our team guides you on the right level of cover for your sector and client base.

How does IR35 affect my recruitment agency?

If you supply contractors working through their own limited companies to medium or large end clients, the IR35 off-payroll working rules apply. The end client determines the contractor's employment status, and your agency (as the fee-payer) must deduct tax and NICs if IR35 applies. SSG Recruitment Partnerships offers guidance on building compliant status determination processes.