Key holder screening for FM and cleaning contractors in 2026

A client's facilities manager emails on a Monday: before the new cleaning contract starts, can you confirm that everyone who will hold a key or an alarm code has been screened? You have 14 people on that site across two shifts, and three of them started before anyone wrote down a standard. That is the usual shape of key holder screening in facilities management, and it is rarely a regulatory problem. It's a contract and evidence problem.

Does a key holder need an SIA licence?

Usually not, if the keys are only a means of getting into the building to do other work. Schedule 2 of the Private Security Industry Act 2001 defines key holding as keeping custody of, or controlling access to, a key or similar device for operating a lock that protects premises against unauthorised entry. It then excludes keys held for access "for purposes incidental" to services that don't involve security operative activities.

The SIA's own guidance points the same way. Key holding needs a licence where it's security work done under a contract for services, and the SIA says you do not usually need a licence for in-house work. The page doesn't mention cleaners or FM contractors by name, so the application to them is our reading, not an SIA statement. If a contractor's job is to hold keys and respond to alarms for several clients, that is keyholding as a service and a licence conversation. Ask the SIA about anything that sits near the line.

That has a consequence. With no licence, there's no regulator's register to check and no ready-made standard. Whatever vetting a cleaner or engineer gets is what you and the client agree.

What do clients expect instead?

In practice, clients with sensitive buildings write screening into the contract. Law firms, banks, data centres and corporate landlords tend to ask for BS7858:2019, the British Standard for screening people working in secure environments, or for something narrower such as ID, right to work and a criminal record check. Which one you're held to is a question for the tender documents, not for us. What BS7858 screening involves is covered in our guide if the contract wording is new to you.

Two things catch FM providers out. First, the standard goes back five years in history, and gaps over 31 days need evidence, which is slow for agency cleaners with patchy work histories (how the 31-day rule works). Second, nobody asked for the screening file until the client's security manager did.

What does a basic DBS check show?

A basic check discloses unspent convictions and conditional cautions, and nothing spent. The DBS guide says anyone over 16 living or looking to live and work in England and Wales can have one, that there are no legislative or eligibility requirements, and that an employer can request one during recruitment. If you apply on someone's behalf through a Responsible Organisation, you need their consent.

Standard and enhanced checks are different. The DBS eligibility guidance ties them to the activities of the role rather than the job title, and a cleaner holding keys doesn't normally fall into those categories. The DBS has also said its standard-check eligibility guidance is being replaced from 1 September 2026, so check the current version before you ask for anything beyond basic.

Self-declaration matters as much as the certificate. For the full BS7858 picture on criminal records, see the screening checklist.

How do you evidence it across 40 sites?

Start from the keys, not the staff. List every key set, access card and alarm code you've issued, and who holds each one. The list is almost always longer than the headcount you thought you had, because of relief cleaners, agency cover and engineers who inherited a set.

Then work through it in this order:

1. Remove access from anyone you can't evidence. Cards and codes can be switched off today.
2. Screen the people who hold the most sensitive access first: out-of-hours alarm codes and master keys before day-shift cleaning keys.
3. Keep one record per person that ties the screening outcome to the client or contract it covers.
4. Decide who signs off. Many FM providers use two people, one to review and one to approve, so a single supervisor never clears their own friend.

For subcontracted cleaning teams, put the standard and the evidence into the subcontract. The question of who bears the immigration-status risk when work is subcontracted was covered in our right to work post, and the logic is the same here: you can't outsource the answer to the client.

A worked example: the relief cleaner with the alarm code

Take a relief cleaner who covers four of your sites across a fortnight. She worked for a competitor until August 2024, spent two months not working, then joined an agency in October. On a site with a screening clause, that two-month break is a gap of more than 31 days and needs evidence: a benefits letter, a college enrolment, anything that accounts for the time.

Most FM firms never ask, because she's "only cleaning". Then the client's audit samples five names from the keyholder list, hers is one, and the file is empty. The fix isn't clever. Screen her once, record the outcome against all four sites, and keep the evidence where an auditor can see it.

If she'd been hired on a conditional basis while the file was completed, the conditional employment rules set how long that can run and what has to be tracked in the meantime.

Where software helps

Not in deciding the standard, which is yours and the client's. It helps once you've decided: an in-house screening workflow with consent, ID check, history gaps and references chased for you, a certificate a client can verify at yezda.co.uk/verify, and an audit trail per person. See pricing for how checks are counted. Your team still reviews and signs off every case.

Next step: pull the key and card register this week and compare it with your list of screened staff. The gap between the two is your backlog.