Start with the service, not the business structure

Before choosing a business structure, describe the service: who it is for, what assessment, consultation, support, training or supervision it includes, where it is delivered, what is outside scope, and who holds clinical responsibility. Include how work outside competence is referred or supervised.

For UK-SBA registrants, the Code requires work within competence, training and experience, accurate representation of credentials and appropriate referral or supervision. A lead practitioner may hold UKBA(cert), an active BCBA or BCBA-D, or another relevant qualification; the practice must still state the person’s actual role, competence and accountability. A BCaBA or another supervised role should not be described as independently accountable for the service. See our guide to credentials and independent practice for clear client-facing wording and the current UK context.

This guide is for an independent practitioner as well as a company or partnership. A sole trader can contract and practise in their own name; a limited company or partnership may contract as the provider while named practitioners deliver the work. The structure does not remove the need to define who is responsible for the service, information, money, records and continuity.

Check standing, insurance and safeguarding as a system

Keep a pre-launch file with qualification and registration evidence where applicable, insurance, safeguarding training, criminal-records disclosure, supervision and continuing professional development. UK-SBA safety-to-practise material includes liability insurance, a UK criminal-records disclosure and safeguarding training relevant to the population served.

Do not assume an Enhanced DBS check is available simply because clients would find it reassuring. Eligible self-employed people can apply through a DBS Umbrella Body, but role eligibility still applies. Basic checks are more widely available, and Scotland and Northern Ireland use separate systems.

Insurance should match the actual work, including professional and public liability, associates, home, school and remote delivery, cyber risks where appropriate, and exclusions. Employers' liability may be required when a practice becomes an employer. Safeguarding needs a lead, escalation route, recording and access controls, and arrangements for concerns involving the owner.

Practical checklist

Establish the UK baseline before accepting work

This is a planning checklist, not a statement that every item is legally required in every case. The answer changes with your UK nation, client group, actual activities, workforce, premises, commissioner and contracts. Record the decision and source behind each item rather than treating a completed list as proof of compliance.

  • Service and accountability. Write what you offer, who may receive it, delivery settings, exclusions, emergency arrangements, clinical responsibility and referral or supervision boundaries.
  • Provider identity and money. Choose and register the operating structure that fits the practice—sole trader, company or partnership—then set up tax, invoicing, business records and, where relevant, VAT and employer obligations.
  • Professional standing and insurance. Keep qualifications, scope of competence, registration where held, CPD/supervision and insurance that matches the actual work, people, settings and workforce. UK-SBA registrants must meet its own safety-to-practise requirements.
  • Safeguarding and safer practice. Set a safeguarding lead or route, escalation and recording process, training appropriate to the population, and check the appropriate disclosure route rather than assuming a particular DBS level is available.
  • Contracts, consent and fairness. Make the provider, client, payer, scope, fees, cancellations, complaints and closure clear. Keep the client agreement, informed consent or assent processes, recording permissions and privacy information distinct.
  • Information governance. Map personal data; identify lawful bases and special-category conditions where needed; give privacy information; assess the ICO fee; secure suppliers, access, retention, requests and incidents.
  • Records and continuity. Define the authoritative case record, version history, retention review, access, handover, complaint and closure processes before casework begins.
  • Accessible and equitable delivery. Plan how people can access and understand the service, request reasonable adjustments and raise concerns. This includes digital, communication, venue and remote-delivery arrangements.
  • Regulatory and commissioning checks. Test the actual activities against the relevant regulator and commissioning requirements. In England, CQC registration is activity-based; different systems apply in Scotland, Wales and Northern Ireland.

Service model check

ABA, PBS, or a combined practice?

ABA and PBS are not mutually exclusive. A practice may provide behaviour-analytic assessment and intervention, PBS consultation or delivery, or both. Do not market one as a shortcut for the other: describe the actual model, competence, outcomes and responsibilities.

Every model

Apply the baseline above: competence, consent and assent, safeguarding, information governance, clear records, accessible service design, complaints and continuity.

When delivering ABA

Be explicit about the behaviour-analytic assessment, measures, intervention decision-making, plan ownership, data review, practitioner competence and any supervision or implementer training. Record informed consent before assessment and behaviour-change procedures, and keep the data-to-decision trail visible.

When delivering PBS

Design around quality of life and person-centred support: understand communication, health, life history, environment and the reasons for distress; work with the person, family and relevant multidisciplinary team; prioritise proactive support. Where restrictive interventions are in scope, obtain specialist legal, policy and commissioning advice—PBS standards are not a substitute for it.

Important: PBS Academy standards and competence frameworks are valuable practice benchmarks; they are not, by themselves, a statutory licence or universal accreditation. If your work triggers CQC, another UK regulator, a commissioner’s specification or a restrictive-intervention framework, those requirements sit alongside this checklist.

Choose the operating structure and check registration triggers

Most small practices begin as a sole trader or private limited company. A sole trader is personally responsible for business debts; a company is a separate legal entity, but directors remain responsible for records and filings. Take individual tax advice rather than relying on a claim that one model is always cheaper.

There is no rule that every behaviour analysis practice must register with a health or social care regulator. In England, CQC registration is activity-based. Behaviour analyst is not, by itself, one of the listed healthcare professions in CQC's definition for treatment of disease, disorder or injury. Similar services can therefore have different positions depending on activity and staffing. Check the exact regulated activities, and the separate systems in Scotland, Wales and Northern Ireland.

Build privacy, consent and the record system before accepting cases

An independent practice will commonly be a controller for information it decides to collect and use in delivering its service. Health information is special category data. The practice needs an Article 6 lawful basis and a separate Article 9 condition where special category data is processed, plus documentation appropriate to the circumstances. The Data (Use and Access) Act 2025 amended, rather than replaced, the UK GDPR, Data Protection Act 2018 and PECR.

Map information flows, check the ICO fee position, define access roles, processor contracts, transfers, retention, subject-access and breach processes. Keep a separate UK GDPR guide and do not treat a software supplier as the whole compliance programme.

A client agreement, informed consent and privacy information are related but not interchangeable. The agreement establishes the commercial relationship. Consent concerns assessment, procedures, sharing and recordings where relevant. A privacy notice explains information use. For UK-SBA registrants, written informed consent is required before assessment, behaviour-change procedures and programme component changes, with continuing attention to consent or assent.

Design the operating system of the practice

Define the case file before the diary fills up: referral, authority, agreement, consent, assessments, plans and revisions, session notes and data, decisions, material communications, restricted safeguarding or complaint records, finances, handover and closure. Do not allow messaging threads, personal email and spreadsheets to become parallel records. See the guides on record keeping and retention and organising session notes.

Make fees and foreseeable charges clear. Consumer contracts have statutory protections, including reasonable care and skill, and distance contracts can have additional information and cancellation rules. Do not make outcome guarantees.

Tax records and client records have different purposes. Sole traders must generally retain business records for at least five years after the relevant 31 January submission deadline. VAT treatment depends on the service and supplier status: behaviour analysis services are not categorically exempt or categorically taxable. Take advice on the exact supply.

Plan continuity and closure

Plan for illness, unavailable systems, departure, complaint and closure. Decide how clients are contacted, who can access essential records under what authority, how safeguarding is handled, how records are transferred or exported, and how access for former staff is removed. A credible practice is not one with the most policies. It is one whose written arrangements match day-to-day work.

References and further reading

  1. UK Society for Behaviour Analysis, Code of Ethical and Professional Conduct, June 2026Principles 6 to 11: consent, fees, contracts, records, confidentiality, complaints, competence and credentials.
  2. UK Society for Behaviour Analysis, UKBA(cert)Independent practice, registration and supervision.
  3. UK Society for Behaviour Analysis, Membership CategoriesSafety to Practise requirements.
  4. DBS, checks for self-employed people and personal employeesEligibility and application routes.
  5. GOV.UK, Set up a business; Register as a sole trader; Set up a private limited companyBusiness structure, registration, records and tax responsibilities.
  6. Companies House identity verificationWho must verify and implementation timing.
  7. UK-SBA, UKBA(cert) Manual; GOV.UK, Employers' liability insuranceInsurance expectations and employer obligations.
  8. Care Quality Commission, Treatment of disease, disorder or injuryScope of registration and multidisciplinary teams.
  9. Care Quality Commission, Scope of registration; Register as a providerEngland only: activity-based registration, provider type and application requirements.
  10. ICO, Controllers and processors; Special category data; DUAA 2025Controller role, special category data and the current legal framework.
  11. ICO, What privacy information should we provide?Privacy information requirements.
  12. ICO, data protection fee self assessmentUse the current assessment rather than assuming an exemption.
  13. GOV.UK, implied rights; Online and distance sellingConsumer services and distance-contract information.
  14. GOV.UK, self-employed business records; VAT thresholds; Running a business from homeTax records, VAT threshold and home-business practicalities.
  15. GOV.UK, disability quick start guide for service providersReasonable adjustments and anticipatory service access.
  16. Skills for Care, Positive behavioural support; PBS Academy, Standards for ServicesPBS competence and service-quality benchmarks; these are not a universal statutory accreditation scheme.

Related resources