Doesn't have to be challenge 25, but there does have to be an age challenge policy as a condition of the licence, 25 is considered best practice by licencing though I believe. And you have to be able to prove you use it.
The licencee and the person serving stand to be prosecuted if someone under 18 was sold alcohol, and the licence reviewed and more conditions applied or revoked all together.
The lad also broke the law by buying it, so there's that to consider when doing any reporting, there's also the possibility that someone else bought it for him, and they've broken the law too.
So they could face prosecution as well.
The pub may be able to defend to a certain degree if someone else bought it for him, though bar staff should remain vigilant to that being done, however that can be difficult to prove because people who are underage obviously know they are and risk being caught, the drink removed and asked to leave, so they're very careful about it.
Obviously any CCTV will show who was served and how the group behaved (as in deliberately concealing from staff he was drinking).
I don't understand bar staff that don't ID people who look young (even though if you ID anyone 30 seconds over the age of 18 you're a jobsworth on here) or they even slightly doubt, you're not just risking your job, but a fine and the pubs licence as well.
They're quite tough on this sort of thing, depending on the area, and if the pub has had other issues around under age drinking or other stuff they could face quite stiff penalties for it.