COLP and COFA

COLP and COFA

The role of compliance officers in law firms under the SRA Standards and Regulations, ie the Compliance Officer for Legal Practice (COLP) and Compliance Officer for Finance and Administration (COFA) have specific regulatory obligations.

Requirement to have compliance officers

An authorised body must at all times have an individual who is designated as its COLP and an individual who is designated as its COFA, and whose designations the SRA has approved. An authorised body is:

•
a recognised body (ie lawyer-owned firm)
•
an alternative business structure (ABS), or
•
a recognised sole practice

regulated by the SRA.

Qualification and approval

The individual or individuals who are designated as COLP and COFA must:

•
be a manager or employee of the firm (unless they are already approved as compliance officer for a related firm and they are a manager or employee of that related firm)
•
consent to the designation
•
not be disqualified from acting as a compliance officer under section

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Practice Compliance News

House of Commons rejects latest House of Lords amendments to the ERB

On 15 September, the House of Commons overturned the amendments made by the House of Lords to the Employment Rights Bill (ERB) during the Third Reading. The Lords proposed a number of amendments, including: a six-month qualifying period to claim unfair dismissal, an right to request guaranteed hours, and a weakening of the provisions on fire and rehire. The House of Commons instead chose to reinstate the government’s original provisions.

UK government faces fresh pressure to introduce cyber regulation reform

MLex: UK companies are still awaiting the Cyber Security and Resilience Bill, as lawmakers this week renewed pressure on the government to introduce the legislation as soon as possible. The Bill is expected to align with Directive (EU) 2022/2555 (NIS 2 Directive) and to expand regulatory duties across critical sectors. But following a cabinet reshuffle, the government refused to give a timeline when questioned on 10 September 2025, saying only that it would be introduced ‘when parliamentary time allows’.

ICO clarifies myths on storage and access technologies

The Information Commissioner’s Office (ICO) has clarified common misconceptions about how the Privacy and Electronic Communications Regulations (PECR) apply to storage and access technologies such as cookies, tracking pixels and device fingerprinting. It confirmed that PECR is not limited to personal data, that ‘strictly necessary’ must be judged from the user’s perspective, and that consent is required for non-exempt purposes. The ICO also noted that a draft impact assessment has been published and will be finalised following consultation.

OFSI publishes annual frozen assets reporting notice for 2025

The Office of Financial Sanctions Implementation (OFSI) has published its annual frozen assets reporting notice for 2025. The notice outlines the annual reporting obligations under UK financial sanctions legislation. All individuals and entities holding or controlling funds or economic resources belonging to designated persons must provide the required report to OFSI by 30 November 2025. This includes assets both within the UK and overseas, provided they fall under UK jurisdiction. Reports must reflect the status of these assets as of 30 September 2025.

View Practice Compliance by content type :

News