Every morning at 5:30am, before the first employee arrives, a team of cleaners enters your office. They have keys, alarm codes, and unrestricted access to every room, desk, filing cabinet, and computer screen in the building. They clean around sensitive documents, executive offices, server rooms, and reception areas where visitor logs and security badges are stored.
You have never met these people. You do not know their names. You have never seen their identification. You have no idea whether they have the right to work in the UK, whether they have criminal records, or whether the person who arrived this morning is the same person who was there last week.
You contracted a cleaning company. The cleaning company may have subcontracted to another company. That company hired the individuals. Between your business and the people who have physical access to your premises at the most unsupervised hours of the day, there are two or three layers of abstraction — and no verification at the point of service.
This is the norm across UK commercial and institutional cleaning. And it represents one of the largest unaddressed compliance and security gaps in the economy.
The scale of the invisible workforce
The cleaning sector in the UK employs approximately 700,000 people, according to the British Cleaning Council. It is one of the largest sectors of the economy by headcount, and one of the least visible. Cleaning work happens early in the morning, late at night, or at weekends — by design, outside normal business hours.
The sector is dominated by outsourcing. The majority of businesses do not employ their own cleaning staff. They contract with cleaning companies, which in turn may employ cleaners directly or, increasingly, subcontract to smaller operators or engage individuals as self-employed contractors.
This multi-layered supply chain model creates what immigration enforcement experts call a "compliance chain" — a sequence of contractual relationships where responsibility for worker verification is assumed to sit with someone else at every level.
The business assumes the cleaning company verified its workers.
The cleaning company assumes the subcontractor verified the workers it deployed.
The subcontractor assumes the workers are self-employed and responsible for their own documentation.
The result is that nobody verifies. Or if verification happens, it happens once at the point of initial hiring and is never checked again, even as individuals rotate between sites, leave and rejoin, or change their employment status.
What the law says about who is responsible
The legal position is clearer than the operational reality suggests. Under Home Office employer guidance, the obligation to conduct right-to-work checks sits with the employer — the entity that engages the individual under a contract of employment or a contract to do work personally.
For directly employed cleaners, the employer is the cleaning company. For self-employed contractors, the picture is murkier — but the Home Office has consistently taken a broad view of who constitutes an employer for the purposes of civil penalties.
More importantly for the business that occupies the premises: even if you are not the direct employer of the cleaning staff, you have exposure. The Fair Work Agency has powers to investigate the entire supply chain, and the Modern Slavery Act 2015 creates due diligence obligations for businesses above the reporting threshold regarding labour practices in their supply chains.
If a cleaning worker on your premises is found to be working illegally, the immediate civil penalty attaches to the employer. But the reputational, operational, and potential legal consequences extend up the chain to your business — particularly if it becomes apparent that you exercised no oversight over who was entering your premises.
The security dimension
The compliance exposure is significant. The security exposure may be greater.
Cleaning staff have physical access that most of your employees do not. They are present when the building is empty. They have keys, codes, and familiarity with the layout. In many organisations, the cleaning team has more unsupervised physical access than anyone in the company except the facilities manager.
Consider what a malicious actor could do with unrestricted, unsupervised access to your premises during off-hours:
- Access unlocked computers and open files
- Photograph documents left on desks
- Plant recording devices
- Access server rooms or network equipment
- Steal physical assets
- Copy keys or security badges
- Install malware on unattended machines
This is not hypothetical. Published case studies in corporate espionage and industrial sabotage frequently identify cleaning and maintenance contractors as an access vector. The cleaning company role provides a plausible reason for being on the premises, at unusual hours, in all areas of the building.
The overwhelming majority of cleaning workers are honest people doing essential work. The problem is not that cleaners are untrustworthy. The problem is that businesses have no mechanism to distinguish between a verified, legitimate worker and someone who should not be there — because they never verified anyone in the first place.
The subcontractor chain problem
The cleaning industry's subcontracting model deserves particular scrutiny because it is where compliance most consistently breaks down.
A typical chain looks like this:
- Your business contracts with Cleaning Company A (the main contractor)
- Cleaning Company A wins the contract but does not have sufficient staff in your region
- Cleaning Company A subcontracts to Cleaning Company B (a smaller, local operator)
- Cleaning Company B engages individuals, some as employees, some as self-employed contractors
- Individuals arrive at your premises wearing Cleaning Company A's uniform
At each stage of this chain, a small erosion of due diligence occurs. Cleaning Company A conducted checks on its direct employees but relies on contractual assurances from Cleaning Company B. Cleaning Company B may or may not have conducted rigorous checks on the individuals it deployed. The self-employed contractors may never have been checked by anyone.
Your business contracted with Company A and reviewed its compliance processes during the procurement stage. You have never heard of Company B. You have no visibility into who Company B deploys, what checks it conducted, or whether the individuals who arrive at your building every morning are the same people who were vetted — if anyone was vetted at all.
This is the same supply chain opacity that the Gangmasters and Labour Abuse Authority has identified as a risk factor for labour exploitation across multiple sectors.
Modern Slavery Act implications
For businesses above the £36 million turnover threshold, the Modern Slavery Act 2015 requires annual statements on the steps taken to ensure modern slavery and human trafficking are not taking place in the business or its supply chains.
The cleaning sector has been identified by the Independent Anti-Slavery Commissioner as one of the sectors most vulnerable to labour exploitation. The combination of low pay, precarious employment arrangements, multiple layers of subcontracting, and a workforce that includes many migrant workers creates conditions where exploitation can occur and remain undetected.
A business that makes a Modern Slavery Act statement claiming to conduct supply chain due diligence but has no visibility into who is actually cleaning its premises has a credibility problem — both legally and reputationally.
What good practice looks like
Closing the verification gap in cleaning does not require eliminating outsourcing. It requires building visibility into the supply chain and verification at the point of service.
1. Know your supply chain
Contractually require your cleaning provider to disclose all subcontracting arrangements. Insist on the right to audit subcontractors' compliance records. If your cleaning company cannot tell you who is actually providing the service, that is information you need before a regulator discovers the gap.
2. Require worker-level compliance data
Move beyond contract-level assurances ("we conduct checks on all our staff") to worker-level evidence. For every individual who will have access to your premises, require confirmation of identity verification, right-to-work status, and any relevant criminal record checks. This should be provided before the individual's first shift, not retrospectively.
3. Verify at the point of access
A compliance pack confirmed six months ago does not verify who walks through the door this morning. Implement an arrival verification process — even a basic one — that confirms the person entering the building is a known, verified individual. This could be badge-based, QR-code-based, or biometric, depending on the security requirements of the premises.
4. Monitor for substitution
One of the most common compliance failures in cleaning is unannounced substitution — a verified worker cannot make a shift, so the subcontractor sends a replacement without notification. That replacement may never have been checked. Build contractual requirements and practical processes that catch substitutions and require verification of replacement workers before they enter the premises.
5. Include cleaning in your security risk assessment
If your organisation conducts security risk assessments, cleaning contractors should be explicitly included. Their access profile — unsupervised, out-of-hours, all areas — represents one of the highest physical access risks in the organisation. Treating cleaning as a facilities issue rather than a security issue is a gap that sophisticated threat actors routinely exploit.
The regulatory direction
The regulatory environment is moving toward greater supply chain accountability. The Fair Work Agency's expanded powers, the Modern Slavery Act's reporting requirements, and the broader political emphasis on tackling illegal working all point in the same direction: businesses will increasingly be expected to demonstrate that they know who is working on their premises and in their supply chains — not just at the contract level, but at the individual level.
For cleaning, this represents a significant shift from current practice. The sector has operated for decades on a model of contract-level trust and individual-level invisibility. That model is becoming untenable as enforcement, regulation, and stakeholder expectations converge on the principle that every worker should be verified, regardless of how many contractual layers separate them from the business they serve.
Certifyd enables businesses to verify the identity and compliance status of every individual who accesses their premises — including contractors, agency workers, and cleaning staff — through a simple, auditable verification process that works at the point of arrival. See how Certifyd works for workforce verification.