Security Licensing in Victoria: What Every Business Should Verify

Security is a licensed occupation in Victoria, and the obligations do not sit solely with the provider. If you engage a security company, it is worth understanding what they must hold, because an unlicensed deployment on your site can affect your insurance position and, for licensed venues, your liquor licence.

The legislation

Private security in Victoria is regulated under the Private Security Act 2004 (Vic), administered by the Licensing and Regulation Division of Victoria Police. It covers both businesses providing security services and the individuals performing them.

Two licences, both required

The business licence

The company supplying officers must hold a private security business licence or registration covering the activities it provides. A company licensed for one activity is not automatically permitted to supply another.

The individual licence

Every officer must separately hold a private security individual licence. The licence specifies which activities that person may perform, and it carries an expiry date. An expired licence is an unlicensed officer.

Guard work and crowd control are different endorsements

This catches out venues regularly. A licence endorsed for security guard does not authorise crowd control. If your premises are licensed and officers are managing patron entry, intoxication and removal, they need the crowd control activity on their licence specifically. Ask for it explicitly rather than assuming.

What to verify before the first shift

• The company's business licence number and expiry date
• Confirmation that officers are employees rather than subcontractors
• Individual licence numbers and expiry dates for officers assigned to your site
• The specific activities endorsed on those licences
• Certificates of currency for public liability and workers compensation
• Evidence of national police checks

A reputable provider will supply all of this without friction. Reluctance is itself the answer.

Keep the records

Retain copies of the licences and insurance certificates on file, and diarise the expiry dates. If an incident occurs and an insurer or regulator asks what verification you performed, "the provider told us they were licensed" is a much weaker position than a dated file.

Training standards worth knowing

The minimum qualification for licensing is a Certificate II in Security Operations, with Certificate III common for more senior roles. Beyond the licence itself, ask about first aid currency, de-escalation training and any sector-specific training relevant to your environment.

All Fortress officers are licence-verified at onboarding and re-verified at renewal. Read more about how we operate, or contact us with any compliance questions.

How to verify a licence, step by step

This takes minutes and almost nobody does it. Here is the whole process.

1. Ask for the business licence number in writing. Not a claim of being licensed — the number. A licensed business gives it up without hesitation because it costs them nothing.
2. Ask for the individual licence details of the officers assigned to your site. These are separate from the business licence and they belong to the officer, not the company.
3. Check the activity on the individual licence. This is the step that is almost universally skipped. A licence is endorsed for particular activities, and guarding and crowd control are not the same one.
4. Verify with Victoria Police Licensing and Regulation Division. They maintain the register. Confirm the numbers are current and the expiry dates have not passed.
5. Ask for a certificate of currency. Public liability and workers compensation, current, issued in the provider's own name.
6. Record what you checked and when. A dated note is enough. It is the difference between having verified and believing you did.

The two-licence problem

Victoria licenses the business and the individual separately, and the most common failure in this whole area is checking one and assuming the other.

The business licence permits the company to supply security services and to employ or engage officers. The individual licence permits a person to perform security work at all. A properly licensed business can still place an officer whose individual licence has lapsed, and an individually licensed officer can be supplied by a business that holds no licence to supply them.

Both failure modes are live risks for you rather than abstractions. Engaging an unlicensed provider exposes your business, not only theirs, and "we checked their company licence" is a partial defence at best.

Endorsements, and the scenario where it goes wrong

The distinction that catches most buyers is between guarding and crowd control.

Guarding covers protecting property and people at a site — the officer in a warehouse, at a gatehouse, on a retail floor, patrolling a building.

Crowd control covers licensed venues and events: managing entry, assessing intoxication, refusing entry and removing people. It is a separate endorsement because it is a different job with different legal exposure.

Here is how it goes wrong. A venue engages a provider for "security" on a busy Friday. The provider supplies officers who hold current licences — genuinely current — endorsed for guarding. Those officers work the door, refuse entry to an intoxicated patron, and an incident follows. Every licence involved is valid. None of them permitted the work being done, and the venue is the one holding a liquor licence.

If your site is a pub, a club, a bar or a ticketed event, ask for the endorsement by name. Not the licence. The endorsement.

What to keep on file, and for how long

Your own compliance position depends on being able to show what you verified, not on having verified it.

• The business licence number and expiry, with the date you checked it.
• Individual licence details for officers regularly on your site, refreshed when the roster changes.
• The certificate of currency, replaced each time it renews.
• Any endorsement confirmation relevant to the work — particularly for licensed premises.
• Your engagement terms, which should state what licensing the provider warrants they hold.

Keep these for as long as you would keep any other contractor compliance record, and at minimum for the life of the engagement plus the limitation period that applies to your industry. Confirm that period with your own adviser — it varies.

Red flags

Any one of these is reason enough to stop.

• A licence number that does not arrive. Asked once, promised, never sent. This is the clearest signal available and it costs nothing to test.
• "All our guards are licensed" with no numbers. A statement, not evidence.
• Reluctance about the endorsement. A provider who has not thought about whether their officers can lawfully work your door has not thought about your site.
• An expired certificate of currency. Or one in a different entity's name to the one on your contract.
• A rate that is materially below everyone else. The obligations are fixed — licensing, insurance, superannuation, penalty rates. A quote well under the market usually means one of them is not being met, and the exposure lands on the site owner.

Ask us the same questions you would ask anyone else. A provider who will not put their licence details in writing, on request, has told you what you need to know — and that test should apply to us too.

What a current licence does not tell you

Verifying a licence establishes that a provider is permitted to do the work. It does not establish that they will do it well, and it is worth being clear about the gap.

A licence says nothing about supervision. An officer can hold a perfectly valid licence and be entirely unsupervised at 3am, which is where most of this industry's reputation was earned. Ask how a supervisor checks an active shift and what happens when nobody answers.

It says nothing about whether they are employed or subcontracted. Both can be lawful. But it determines who is accountable for vetting and insurance, and a labour-hire chain means the company you contracted with may never have met the person on your site.

It says nothing about training beyond the minimum. The licence is a floor. Whether officers hold first aid, whether they have been briefed on de-escalation, whether anyone has trained them for your particular setting — none of that is on the licence.

And it says nothing about capacity. A licensed provider who is already overcommitted will fill your shift with whoever is free, which is how sites end up with a different officer every night and no one who knows the site.

So verify the licence first, because a provider who fails that test fails everything. Then ask the questions the licence cannot answer.

Licensing is state-wide, so the same two checks apply whether your site is in Melbourne or Bendigo. What changes regionally is supply: fewer endorsed crowd controllers are available outside the metropolitan area, which is why a provider who cannot produce licence details quickly for a regional booking is usually telling you something about their roster.