Vincent Chan, 45, has pleaded guilty at Wood Green Crown Court to 26 offences, including five counts of sexual assault by penetration, four counts of sexual assault by touching and 17 offences related to indecent images of children. Some abuse was recorded on nursery iPads at Bright Horizons’ West Hampstead setting, which has since closed. Sentencing is listed for 23 January 2026.
The Metropolitan Police said the investigation began after a staff member raised a safeguarding concern in 2024. Officers arrested Chan in June 2024, submitted devices for forensic analysis later that year, and made a further arrest in September 2025 when digital evidence of contact abuse was identified. Detectives have seized 69 devices in total from his home and the nursery; the force described the inquiry as one of its most harrowing and complex.
Media statements indicate at least four girls, aged two to four, were identified as victims. Families are receiving specialist support, with the NSPCC operating a dedicated helpline, and nearly 700 families whose children attended the setting are being contacted. Several parents, represented by Leigh Day, have signalled potential civil action.
Bright Horizons said it was shocked and appalled, acknowledged that the perpetrator was able to offend despite its measures, and commissioned an external expert review of safeguarding practices. The provider credited a colleague for following whistleblowing procedures, while accepting that existing controls did not prevent the abuse.
For early years providers, the statutory framework is clear. Under the EYFS (September 2025), every setting must have a designated safeguarding lead, maintain written safeguarding policies that specify how mobile phones, cameras and other devices are used, set out the action to take if an allegation is made against staff, and maintain whistleblowing arrangements for all staff and volunteers.
EYFS paragraph 3.7 requires appropriate whistleblowing procedures so staff can raise concerns about poor or unsafe practice in the setting’s safeguarding provision. Where an allegation is made, registered providers must notify Ofsted of the action taken as soon as reasonably practicable and within 14 days; failure without reasonable excuse is an offence.
Managing allegations also engages local multi‑agency child protection duties. Working Together to Safeguard Children (updated 2023, page references as applicable) sets the expectations for decisive multi‑agency action and oversight by local safeguarding partners. In practice, providers should consult the Local Authority Designated Officer (LADO) within one working day where a person who works with children may pose a risk of harm. Ofsted is not the statutory child protection authority but liaises with police and local authorities and will assess a provider’s continued suitability to remain registered.
DBS vetting is necessary but not sufficient. Paid roles in specified establishments such as nurseries are regulated activity with children and normally require an enhanced DBS check with a children’s barred list check. Enhanced checks disclose relevant convictions, cautions and, where appropriate, police‑held information, but absence of history is not proof of suitability. Individuals cannot request enhanced checks on themselves; employers must do so.
There is a legal duty to refer. If a provider removes an individual from regulated activity (or would have done so had the person not left) because they harmed a child, pose a risk of harm or meet the harm test, the provider must refer to the Disclosure and Barring Service under section 35 of the Safeguarding Vulnerable Groups Act 2006. Ofsted also has a statutory power to refer and may treat failure to refer as relevant to a provider’s suitability.
Ofsted will risk‑assess any significant event notifications and can take regulatory action ranging from a welfare requirements notice to imposing conditions, suspension or cancellation of registration where thresholds are met. Providers must notify Ofsted of significant events likely to affect the suitability of any person in regular contact with children.
Policy change is in train. Following the Department for Education’s 2024 consultation, the government confirmed strengthened EYFS safeguarding measures, including whistleblowing and employment references; the 2025 EYFS now includes new requirements on references and provides a template for employers. Separately, the Home Office has announced stronger security checks for adults working with children and proposals on mandatory reporting of child sexual abuse, with legislative changes due to take effect from January 2026.
Immediate governance actions for providers include re‑testing whistleblowing routes, auditing the policy governing image capture and device use, verifying DSL coverage and escalation to the LADO, confirming Ofsted notifications are timely and evidenced, reviewing safer recruitment and references against current EYFS expectations, and checking that DBS referral criteria and decision logs are understood by leaders. Parents can reasonably ask their provider to explain these controls and confirm whether Ofsted has been notified, what multi‑agency liaison has occurred, and how the setting restricts staff access to cameras and iPads.
The criminal case continues alongside parallel safeguarding processes. The Met’s review of digital material remains ongoing. Sentencing is scheduled for 23 January 2026 at Wood Green Crown Court. Policy Wire will track any regulatory findings, including Ofsted outcomes or any local child safeguarding practice review, once formally announced by the relevant authorities.