No drone operator can fly without permission from the Civil Aviation Authority (CAA).
You’ll sometimes see the CAA permission referred to as "PfCO" (Permissions for Commercial Operation) and it’s an actual piece of paper issued by the CAA to grant the pilot the right to fly. This isn’t a case of a pilot simply filling in a form and sending a cheque. It’s a rigorous process involving theoretical exams and practical flight assessments by one of a set of specially accredited providers (NQE - National Qualified Entity) and creation of a detailed manual of operations. Then this permission must be reapplied for every year to ensure that safe and legal practices are still being followed, and changes in the law are accommodated.
You absolutely MUST ask your pilot to show their PfCO to you and you should then check that it is current on the CAA website. All DSR pilots have one of these certifications (DSR only offer legally qualified pilots) and they will never mind showing it to you – in fact, they will probably offer it to you and insist you take a look. They are all slightly different in the wording but here’s an idea of what it will look like.
You can also check it against the CAA register of Pilots with permission here (this list is updated monthly). The permission might be in the name of a company or, in the case of a sole trader, in their individual name but this is a great way to check that their permissions are current and legitimate if you have any doubts. If a pilot say they don't have one or refuse to show you, then do not hire them!
Every commercial drone pilot, in addition to holding CAA Permission, must also hold valid commercial insurance that is compliant with the CAA requirements.
There are a number of drone specific insurers out there so there will be a slight difference in the appearance of the certificate but you should also ask to see it and check that it is in date and covers the appropriate public liability for the job/project in mind. Cover should start at a minimum of £1m.