The Compliance Officer for Legal Practice is one of the most demanding roles in a modern UK law firm. The COLP is not simply a regulatory box to tick — it is a substantive position that carries personal accountability for the firm’s compliance with the SRA Standards and Regulations, and real exposure to enforcement action if that accountability is not discharged properly.

Since the SRA Standards and Regulations came into force in 2019, the COLP role has evolved. The move away from prescriptive rules and towards principles-based regulation has given COLPs more flexibility in how they achieve compliance — but it has also removed the comfort of being able to say “we followed the rulebook.” The COLP must now exercise judgement, and be able to explain and defend that judgement to the SRA.

This guide sets out everything a COLP needs to know: the regulatory basis for the role, the core duties, common challenges, and the practical tools that effective COLPs use.

The Regulatory Basis for the COLP Role

The requirement to designate a COLP is set out in the SRA Authorisation of Firms Rules. Every SRA-authorised firm must have a COLP who is a manager or employee of the firm, is an authorised person (a solicitor or other authorised individual), and has been approved by the SRA.

The COLP’s core obligation is set out in Rule 8.5 of the Code of Conduct for Firms: the firm must ensure that its COLP takes all reasonable steps to record and report to the SRA any failure to comply with the SRA’s regulatory arrangements.

The phrase “all reasonable steps” does a lot of work here. It means that the COLP’s duty is not merely to avoid active wrongdoing, but to take a proactive approach to identifying, recording, and (where required) reporting compliance failures.

Who Can Be a COLP?

Eligibility Requirements

The COLP must be:

A manager or employee of the firm (not an external consultant)
An authorised person — typically a solicitor with a current practising certificate, but also a registered European or foreign lawyer, a licensed conveyancer, or another Category 1 authorised person as defined by the SRA
Approved by the SRA — firms must apply to the SRA to have their nominated COLP approved, providing information about the individual’s experience and suitability

The SRA will not approve a COLP who is subject to conditions on their practising certificate that would be incompatible with the role, or who has a recent history of disciplinary findings.

Suitability in Practice

Beyond the formal eligibility requirements, the effective COLP needs a broader set of attributes:

Authority within the firm: a COLP who lacks the standing to challenge a partner’s conduct, or who is overruled when they raise compliance concerns, cannot do the job properly. The SRA expects COLPs to have real authority, not just a title.
Access to information: the COLP needs to be able to review matter files, financial records, and complaints data without restriction. A COLP who is denied access to information they have requested is in an impossible position.
Time and resource: the COLP role cannot be discharged in an hour a week. In a firm of any size, the COLP needs dedicated time and, in larger firms, a compliance team.

Core Duties of the COLP

Identifying and Recording Compliance Failures

The COLP’s first obligation is to identify breaches of the SRA’s regulatory arrangements and record them. The “regulatory arrangements” is defined broadly to include not just the SRA Standards and Regulations, but also the Legal Services Act 2007, the firm’s conditions of authorisation, and any undertakings given to the SRA.

Recording compliance failures does not mean that every minor procedural hiccup must be documented. The test is whether the failure is material — whether it is significant enough that the SRA would want to know about it. This requires judgement, informed by the SRA’s guidance on what kinds of breaches must be reported.

A practical approach is to maintain a compliance issues log — a central register of every compliance matter that comes to the COLP’s attention, with a record of the nature of the issue, when it was identified, what steps were taken, and whether it was reported to the SRA. This log serves two purposes: it helps the COLP track and manage open issues, and it provides evidence of a proactive compliance approach if the SRA ever reviews the firm.

Reporting to the SRA

Some compliance failures must be reported to the SRA promptly. Rule 8.5 of the Code of Conduct for Firms requires the COLP to report to the SRA any failure (by the firm or any person in the firm) to comply with the regulatory arrangements, where the failure is of a kind that the SRA has indicated must be reported.

Matters that typically require prompt reporting include:

Serious misuse of client funds
A conviction or adverse civil finding against a manager or owner
Significant financial instability that threatens the firm’s ability to meet its obligations
Discovery of a fraud or dishonesty involving a fee earner
A data breach that engages reporting obligations to the ICO under GDPR/UK GDPR
Regulatory action by another body (for example, HMRC enforcement related to AML)

The obligation to report promptly is not contingent on having full information. If the COLP becomes aware of a potential serious breach, they should report what they know and update the SRA as more information becomes available, rather than waiting until the picture is complete.

Overseeing Compliance Systems

Beyond the reactive function of recording and reporting failures, the COLP is responsible for ensuring that the firm has adequate systems and controls to comply with all applicable obligations. This proactive function is, in many ways, the more important one — because good systems prevent failures from occurring in the first place.

Key systems that the COLP should oversee include:

Anti-money laundering: the AML policy, risk assessment, client due diligence procedures, and training programme
Conflicts of interest: the conflict-checking procedure and the records of checks conducted
Client care: the client care letter template and the process for ensuring letters are issued promptly
Supervision: the supervision policy and the evidence that it is being applied
Complaints handling: the complaints procedure and the log of complaints received and resolved
Data protection: in most firms, the COLP and the data protection lead will work closely together, and in smaller firms they may be the same person

Engaging with the SRA

The COLP is the firm’s primary point of contact with the SRA for regulatory matters. When the SRA sends a request for information, conducts a visit, or issues a formal notice, it is typically the COLP who manages the response. This requires the COLP to have a thorough understanding of the firm’s compliance position and to be able to present it clearly and accurately to the SRA.

The COLP and AML Compliance

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017) require firms in the legal sector to appoint a Money Laundering Compliance Principal (MLCP) and a Money Laundering Reporting Officer (MLRO). In many firms — particularly smaller ones — the COLP also serves as the MLCP or the MLRO (or both).

The MLCP is responsible for the firm’s overall AML compliance programme: the policies, procedures, and controls that satisfy the MLR 2017. The MLRO receives internal suspicious activity reports from fee earners, decides whether to make an external report to the National Crime Agency, and maintains the records required by POCA 2002.

The 2023 OPBAS report on the legal sector’s AML compliance found persistent weaknesses in client risk assessment, ongoing monitoring, and training. The SRA has followed up with targeted firm visits in this area and has brought enforcement cases against firms with inadequate AML controls. The COLP/MLCP must ensure the firm’s AML programme is genuinely effective — not simply a policy document that sits in a folder.

Managing Difficult Situations

Challenging a Senior Partner

One of the most difficult situations a COLP faces is identifying a potential compliance issue involving a senior partner or the firm’s founder. The COLP has a legal obligation to record and report material breaches regardless of who is involved. No partnership agreement or employment relationship can override this obligation.

In practice, COLPs in this situation should:

Document the concern carefully before raising it
Consider seeking independent legal advice before acting
Raise the concern formally, in writing, and keep a record of the response
If the concern is not addressed, consider whether the situation requires a self-report to the SRA

A COLP who fails to report a material breach because a senior partner instructed them not to remains personally liable for that failure. The SRA has taken enforcement action against COLPs who deferred to senior partners at the expense of their regulatory obligations.

Whistleblowing Protections

If the COLP (or any member of staff) faces detriment as a result of raising a compliance concern, they may have protections under the Public Interest Disclosure Act 1998 (PIDA). The SRA also has a whistleblowing policy that protects individuals who report concerns about regulatory non-compliance. COLPs should be familiar with these protections and ensure that the firm’s staff know about them.

Personal Liability

The COLP can face personal enforcement action from the SRA — including conditions on their practising certificate, fines, or referral to the Solicitors Disciplinary Tribunal — if they fail to discharge their obligations under Rule 8.5. This personal exposure means that the COLP must be genuinely empowered to do the role, rather than appointed as a convenient nominee who exercises no real compliance function.

Practical Tools for COLPs

The Compliance Issues Log

The compliance issues log is the COLP’s most important operational tool. It should record:

The date the issue was identified
The nature of the issue (Accounts Rules, conflicts, AML, etc.)
The matter and fee earner involved (where applicable)
The steps taken to investigate and address the issue
Whether the issue was reported to the SRA, and when
The date the issue was closed, and why

The log should be reviewed regularly — monthly at minimum — by the COLP and, for significant items, by the firm’s management committee.

Annual Compliance Reviews

Best practice is to conduct an annual structured compliance review against all relevant obligations. This review should assess:

Whether the firm’s policies and procedures are up to date
Whether training is current across the fee-earning team
Whether the past year’s compliance issues log reveals any patterns
Whether the firm’s risk profile has changed in ways that require updated policies

The annual review findings should be reported to the firm’s management and the board (if there is one), and the resulting action plan should have nominated owners and deadlines.

Relationship with External Advisers

Many COLPs — particularly in smaller firms — supplement their internal expertise with external compliance consultants, specialist AML advisers, or regulatory law barristers. There is no shame in not being an expert in every aspect of legal regulation; the key is knowing when you need external help and being willing to seek it.

Obiter takes the administrative load off compliance officers by automating the documentation and tracking that underpins a good compliance programme — recording time, flagging matter deadlines, and maintaining accurate file records. When the COLP needs to review a matter for the compliance log or prepare for an SRA visit, the information is already there. Learn more at obiteros.com, where a 14-day free trial is available.

Compliance Officer for Legal Practice COLP: Complete Role Guide