Every contract for security personnel states that the guards are background-verified. Very few state what that expression means, which documents evidence it, who performed each check, or how the client can confirm the claim independently. This guide sets out the contents of a complete verification file for a security guard deployed in Maharashtra, the order in which the checks are normally run, the dependencies that govern how long each takes, and a procedure a facility head or managing committee can follow to audit the file instead of accepting the agency’s assurance.
It is written for the person who signs the vendor contract and carries the occupier’s exposure if the deployed staff turn out to be unverified: a facility manager, a housing society secretary, a procurement lead or an administration head. The legal baseline is covered in our compliance and licences reference; this document concentrates on the individual guard file.
What the law requires before a guard can be deployed
The Private Security Agencies (Regulation) Act, 2005 (PSARA) is the controlling statute. Section 10 sets out the eligibility conditions a licensed agency must satisfy before it employs or engages any person as a private security guard. As summarised from the Act and the Central Model Rules, 2020, the agency must establish that the individual:
- is a citizen of India, or of another country the Central Government may notify;
- has completed eighteen years of age and has not attained sixty-five years;
- satisfies the agency as to character and antecedents, in the manner prescribed;
- has successfully completed the prescribed security training;
- meets the prescribed physical standards; and
- satisfies any other conditions prescribed.
The Model Rules prescribe an entry-level training of a minimum of 100 hours of classroom instruction and 60 hours of field training, spread over at least twenty working days, with a shorter condensed course for ex-servicemen. They also provide for electronic databases of crime and criminals to be used when verifying an applicant’s antecedents, and for the agency to issue a photo identity card in the prescribed form. Individual States apply these through their own rules and controlling authorities, so the Maharashtra controlling authority’s current requirements, and not a summary, are the document of record.
Verification is a condition of lawful deployment and not an optional service level. The obligation rests on the agency, but the occupier who engages an agency that has not discharged it is the party exposed when an incident occurs on the premises, so the verification file should be inspected as a deliverable.
The anatomy of a complete verification file
A verification file is a single folder, physical or electronic, per guard. It should be retrievable by name and employee code within a working day. The table below lists the components a complete file contains, the evidence that supports each, and the point a reviewer should test. It is intended to be used as an audit checklist and may be attached to the vendor contract as a schedule.
| Component | Evidence in the file | What the reviewer tests |
|---|---|---|
| 1. Identity | Government-issued photo identity document, self-attested copy, and the original sighted and endorsed by the agency officer | Name, date of birth and photograph agree across every other document in the file |
| 2. Age and eligibility | Date of birth proof; recorded age at date of appointment | Guard was at least 18 and under 65 on the date of appointment, as Section 10 requires |
| 3. Residential address | Address proof plus a recorded address verification (field visit or equivalent) with date and verifier name | Address verified is the current residence, not only the address printed on the identity document |
| 4. Character and antecedents | Antecedent verification obtained through the channel the controlling authority prescribes, with the issued certificate or acknowledgement | Certificate bears the guard’s name, is dated before the first deployment, and is issued by the competent authority, not self-generated by the agency |
| 5. Previous employment | Last employer details, relieving letter or reference, and a recorded reference call or written confirmation | Reason for leaving is recorded, and any gap in service is explained |
| 6. Security training | Training certificate for the prescribed course, naming the training institute and the dates attended | Course hours match the Model Rules for the guard’s category, and the institute is identifiable |
| 7. Medical fitness | Medical fitness certificate from a registered practitioner | Certificate predates deployment and is within the validity the agency’s own policy states |
| 8. Agency identity card | Copy of the photo identity card issued in the prescribed form, with card number | The card the guard wears at the gate carries the same number and photograph as the file |
| 9. Statutory enrolment | Provident fund and employee insurance enrolment references, where applicable to the guard’s wages | Enrolment is in the guard’s own name, with a date consistent with the deployment date |
| 10. Consent and data record | Signed consent for the verification and for retention of the documents | Retention period and the persons with access are stated |
A file that contains all ten components, internally consistent and dated in a logical sequence, is a complete file. A file in which several items carry the same date, in particular where the antecedent certificate postdates the first day on the roster, indicates that deployment preceded verification.
The sequence of checks and what determines how long each takes
The checks are not executed in parallel. Some depend on documents produced by earlier ones, and two are performed by parties outside the agency. For that reason the agency’s onboarding timeline is a sum of dependencies and not a single figure. The table below separates the stages by who controls the clock; the durations are deliberately left for the agency to state in writing, because they vary by district, by the completeness of the guard’s documents and by the controlling authority’s workload, and a client should hold the agency to its own stated commitments.
| Stage | Performed by | What governs the duration | Contract field to request |
|---|---|---|---|
| Document collection and identity sighting | Agency | Completeness of the guard’s documents at the first interview | Maximum days from interview to a complete document set |
| Address verification | Agency or its verification partner | Whether the guard resides in the same city as the interview; whether a field visit is required | Maximum days to a recorded address verification |
| Previous-employer reference | Agency | Responsiveness of the former employer; availability of a relieving letter | Number of reference attempts and the fallback if the employer does not respond |
| Antecedent verification | Competent authority, through the channel the agency uses | Authority processing time; accuracy of the name, parentage and address submitted | Whether guards may be deployed pending the result, and if so under what supervision |
| Training | Training institute | Course length of 20 working days for the entry-level course under the Model Rules, or the shorter condensed course for eligible ex-servicemen | Date of training completion for each guard, not only the institute’s batch date |
| Medical fitness | Registered practitioner | Appointment availability | Certificate date and validity period |
| Identity card issue | Agency | Completion of all earlier stages | Card issued before first duty, as a condition of posting |
The antecedent verification stage is the one that most often determines whether a guard is on duty on the first day. An agency under pressure to fill a post will sometimes deploy a guard whose certificate is pending. The contract should say whether this is permitted. Where it is permitted, a defensible position is a written exception recording the guard’s name, the date of application, the supervisor accountable, and a restriction from sensitive posts such as cash handling, key custody and access to residential floors until the certificate is received.
Auditing the file instead of accepting the agency’s word
An audit does not require access to the agency’s whole personnel system. It requires a sample, a defined procedure and a written result. The following procedure is proportionate for a single site and scales to a portfolio.
Step 1. Obtain the deployment list and select the sample
Ask the agency for the list of guards deployed at the site, with employee code, post and date of first duty. Select a sample using a rule you record in advance: for a site of up to ten guards, review all of them; for larger sites, review every supervisor and officer plus a random selection of the remainder. Selecting only the guards the agency volunteers defeats the purpose.
Step 2. Test the file against the ten components
For each sampled guard, record whether each component in the table above is present, legible and consistent. A discrepancy is any mismatch of name spelling, date of birth, parentage or address between documents, or any certificate whose date postdates the first duty date.
Step 3. Match the person at the gate to the file
The file proves nothing about the individual standing at the post unless the two are linked. Check the identity card the guard wears against the card number and photograph in the file, and confirm that the name on the duty register matches. A substitution, in which a verified guard’s identity is used for a different person on shift, is the principal way an immaculate file coexists with an unverified deployment.
Step 4. Confirm the third-party documents at source
Choose a small number of documents that were issued by a party other than the agency, typically the training certificate and the antecedent certificate, and confirm them with the issuer. A training institute can confirm that a named person attended the course on the stated dates. The channel for confirming an antecedent certificate depends on how it was issued; ask the agency to state the channel in writing and to give you the certificate or acknowledgement number so that the check can be run.
Step 5. Reconcile the file against the payroll and statutory records
A guard who is genuinely on the roster appears in the wage records and in the provident fund and insurance enrolments. A guard who appears in the file but not in the payroll, or the reverse, signals a paper deployment. Match the sampled names against the most recent wage register and the statutory contribution statements the agency is already obliged to provide.
Step 6. Record the outcome and set the remedy period
Write the result as a short audit note: the sample, the date, the discrepancies found and the remedy period the agency has agreed. Fifteen days is a common contractual period for remedying a documentary gap, though the figure is a matter for the contract and is not prescribed by the statute. Repeat the audit at a fixed interval.
Red flags in a verification file
The following patterns recur in files that do not withstand scrutiny. None is conclusive on its own; two or more in the same file warrant a request for the original documents.
- The antecedent certificate, medical certificate and training certificate all carry the same date, or the same date as the guard’s joining.
- Photocopies only, with no indication that the originals were sighted and by whom.
- The address verification records only that the address was “confirmed”, with no verifier name, date or method.
- A training certificate whose stated duration is shorter than the entry-level minimum, with no record of the guard’s eligibility for the condensed course.
- A previous-employer reference supplied entirely by the guard, with no independent contact recorded.
Retention, access and the Digital Personal Data Protection regime
A verification file is a concentrated store of personal data: identity numbers, home addresses, family details and medical information. Both the agency and, in respect of the copies it holds, the client are responsible for handling it properly. The Digital Personal Data Protection Act, 2023 is now supported by the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025 and brought into force in phases. The rules governing the Data Protection Board took effect on notification; the rule on consent managers follows on 13 November 2026; and the core obligations on data fiduciaries, including consent, security safeguards, breach reporting, retention and erasure, apply from 13 May 2027.
The staggered dates are not a reason to defer. A contract signed now will usually run past May 2027, and a verification file created now will still be in the agency’s possession then. The following terms are sensible to settle at contract stage:
- The purpose for which the documents are held, limited to verification and deployment.
- The persons within the agency and the client who may view the file, and the form in which the client receives copies.
- A retention period, and the point at which the file is erased or returned after a guard leaves the contract.
- The agency’s obligation to notify the client if the file is lost, disclosed or accessed without authority.
- A prohibition on the client retaining copies beyond what the audit procedure requires; an audit note recording that a document was seen is generally sufficient.
Verifying the agency before verifying the guards
The file audit assumes the agency itself is licensed. Confirm that first. The licence should be current, issued under PSARA, and cover the district in which the guards will be deployed. Our guide to verifying that a security agency is legal under PSARA sets out the licence fields to read and the documents that should accompany it. For the wider selection criteria, including supervision, training and escalation, see the ten-point checklist for choosing a security agency in Maharashtra.
Verification also has a cost dimension. Antecedent checks, training, medical certification and enrolment are costs the agency incurs for every guard, and an unusually low quoted rate is frequently achieved by omitting some of them. The security cost calculator allows a client to compare a quote against the statutory wage and levy components, and so to identify a price that cannot accommodate full compliance. Rates set by the Security Guards Board are revised each January and July, so the order in force for the contract period should be read directly.
Frequently asked questions
What does background verification of a security guard include?
A complete file contains identity and age proof, residential address verification, character and antecedent verification through the prescribed channel, previous-employment confirmation, the prescribed training certificate, a medical fitness certificate, the agency-issued photo identity card and the statutory enrolment references. Section 10 of PSARA makes character and antecedents, age, training and physical standards conditions of employment as a private security guard.
Can a guard be deployed before the antecedent verification is complete?
The statute treats satisfying the agency about character and antecedents as a condition of employment, so the safest position is that deployment follows verification. Where a client agrees to an interim arrangement, it should be a documented exception limited to named posts with a supervisor accountable and a fixed date for the certificate or the guard’s withdrawal.
How can a client check that a verification certificate is genuine?
Ask the agency which channel issued the certificate and for its reference number, then confirm it through that channel. Check that the name, parentage and address match the identity document, that the date precedes the guard’s first duty, and that the issuing authority is a competent one rather than the agency itself.
How many hours of training must a security guard complete?
Under the Private Security Agencies Central Model Rules, 2020, entry-level training is a minimum of 100 hours of classroom instruction and 60 hours of field training, spread over at least twenty working days. Ex-servicemen may attend a shorter condensed course. The Maharashtra controlling authority’s current rules should be consulted for the requirement applying to a specific deployment.
Is the client responsible if the agency deployed unverified guards?
The statutory duty to verify rests on the agency, but the occupier who engaged it is the party that bears the consequences on its own premises. Contracting for inspection rights, sampling the files and recording the results are the means by which a client shows it exercised reasonable care.
How long should a client keep copies of guard verification documents?
Only as long as the audit purpose requires. The DPDP Rules, 2025 make retention and erasure core data fiduciary obligations from 13 May 2027, so the contract should fix a retention period and the point of return or erasure now, and the client should hold audit notes with reference numbers instead of copies of identity documents.
Requesting a verification review for your site
Bryte Guard Force is a PSARA-licensed, ex-servicemen-led security provider operating across Mumbai, Navi Mumbai, Thane, Pune, Nashik and Nagpur. A free site risk assessment can include a review of the verification file format described above, and a written proposal follows within 48 hours. To arrange one, use the quote request form.