COLP and COFA: what the roles involve and who can hold them

Which firms need a COLP and COFA

Every firm the SRA authorises, whether a recognised sole practice, a recognised body or a licensed body, must at all times have an individual designated as its COLP and an individual designated as its COFA, and the SRA must have approved both designations (rule 8.1 of the SRA Authorisation of Firms Rules). In a licensed body (an ABS), the COLP and COFA are also the head of legal practice and head of finance and administration that the Legal Services Act 2007 requires.

A freelance solicitor practising in their own name isn’t an authorised firm and doesn’t need either role. A consultant working through a platform firm relies on that firm’s compliance officers. If you are still choosing between these models, see freelance, sole practice and consultancy compared.

What the COLP does

The COLP looks after the firm’s compliance in general, leaving the Accounts Rules to the COFA. Under paragraph 9.1 of the SRA Code of Conduct for Firms, the COLP must take all reasonable steps to:

• ensure the firm complies with the terms and conditions of its authorisation
• ensure the firm and its managers, employees and interest holders comply with the SRA’s regulatory arrangements that apply to them
• ensure that managers, interest holders and the people they employ or contract with don’t cause or substantially contribute to a breach
• make sure a prompt report goes to the SRA of anything they reasonably believe is capable of amounting to a serious breach
• make sure the SRA is told promptly of anything else it should know so that it can investigate or use its powers

The duty is to take all reasonable steps, not to guarantee compliance, and it doesn’t take responsibility away from anyone else. Paragraph 2.1 of the same Code requires the firm itself to have governance, systems and controls that ensure compliance and that let its compliance officers do their job.

What the COFA does

The COFA’s job is narrower: compliance with the SRA Accounts Rules. Under paragraph 9.2 of the Code for Firms, the COFA must take all reasonable steps to ensure the firm, its managers and employees comply with the Accounts Rules, to make sure a prompt report goes to the SRA of anything they reasonably believe is capable of amounting to a serious breach of those rules, and to make sure the SRA is told promptly of anything else it should know.

In a firm that holds client money, the Accounts Rules give the COFA regular work to oversee:

• Reconciliations. At least every five weeks, for every client account, the bank statement balance must be reconciled with the cash book and the client ledger total, and the record signed off by the COFA or a manager (rule 8.3). Differences should be investigated and resolved promptly.
• Putting breaches right. Breaches must be corrected promptly once found, and money improperly withheld or withdrawn from a client account must be replaced immediately (rule 6.1).
• The accountant’s report. A firm that held client money during an accounting period must obtain an accountant’s report within six months of the period end, and send it to the SRA if it is qualified to show client money has been or is likely to be put at risk (rule 12.1). Firms are exempt if their client account balance averaged no more than £10,000 and never went above £250,000 in the period, or if they held only Legal Aid Agency money (rule 12.2).

The COFA doesn’t carry this alone. Rule 1.2 of the Accounts Rules makes the firm’s managers jointly and severally responsible for compliance. A firm that holds no client money still needs a COFA under rule 8.1, but has far less for them to oversee.

Changes to accountants’ reports were approved by the Legal Services Board (LSB) on 31 July 2026, planned for April 2027: every non-exempt firm that holds client money would send its report to the SRA whether qualified or not, exempt firms would declare their exemption, and fixed penalties would apply to late or missing reports. The SRA’s September pause was reported as covering the compliance officer rules, but check its current position before relying on that date.

Who can hold the roles

Under rule 8.2 of the Authorisation of Firms Rules, each compliance officer must:

• be a manager or employee of the firm
• consent to the designation
• not be disqualified from acting as a head of legal practice or head of finance and administration under section 99 of the Legal Services Act 2007
• not be a registered Swiss lawyer (RSL)

The COLP must also be authorised by an approved regulator to carry on reserved legal activities: a solicitor, or a lawyer authorised by another approved regulator. There is no such requirement for the COFA, who doesn’t need to be a lawyer. The SRA’s guidance works through an example of a non-lawyer employee applying to be a small firm’s COFA.

“Employee” is defined widely in the SRA Glossary. It includes someone engaged under a contract for services, whether directly, through an employment agency or through their own company that doesn’t offer legal services to the public. That lets a firm bring in an outside individual as its COLP or COFA. The role still belongs to a named individual, who needs SRA approval and carries the duties personally. There is also a narrow exception for someone already approved as compliance officer of a related firm with a manager or owner in common (rule 8.3).

Beyond eligibility, the SRA must be satisfied the person is fit and proper under the SRA Assessment of Character and Suitability Rules (rule 13.1). Its guidance says it also needs to see that the compliance officer can do the job: the application asks about their position in the firm, their work history and how they have enough seniority and responsibility. If that doesn’t show they will have the unfettered ability to report breaches, the SRA may ask for your compliance reporting procedure and question the managers about their support for the role.

Can one person be both COLP and COFA?

Yes, under the rules in force on 3 October 2026. Rule 8.1 requires an individual designated as COLP and an individual designated as COFA, and nothing in the current rules says they must be different people. A solicitor who is a manager of the firm can hold both, provided they meet the eligibility rules for each.

The 2026 separation rules don’t change that as such. What they restrict is who the compliance officer can be: in firms over a turnover or client money threshold, someone who can make significant management decisions on their own couldn’t hold either role. Those rules have been approved but are paused and not in force; see the 2026 separation rules below.

Sole practitioners and small firms

In a recognised sole practice the sole principal, who must be a solicitor or a registered European lawyer, is the only manager. The SRA approves them as manager when it authorises the practice, but the compliance officer designations still need approval. Because compliance officers must be managers or employees, the choice is between you and someone you employ or engage.

For most small firms, approving a manager as compliance officer is a formality. Under rule 13.5, the SRA deems an individual fit and proper to be a compliance officer if:

• they are a lawyer and a manager of the firm
• the firm’s annual turnover is no more than £600,000
• they aren’t a compliance officer of any other authorised firm
• they aren’t an RSL
• they aren’t subject to a regulatory or disciplinary investigation, or an adverse finding or decision of the SRA, the Solicitors Disciplinary Tribunal or another regulator

The firm must still notify the SRA, which then approves the designation (rule 13.6); its guidance calls this a very short and simple form. Being COLP and COFA of your own firm is fine, but being a compliance officer of another authorised firm as well takes you out of the deemed route. A compliance officer who isn’t a manager, such as an employed COFA, goes through the full approval process, as does anyone in a firm with turnover over £600,000.

Getting SRA approval

For a new firm, the compliance officers are approved as part of the authorisation process. The SRA asks for a separate mySRA application for each individual who needs approval as a manager, owner or compliance officer; older guidance calls this form FA2. Anyone not already authorised by the SRA must create a mySRA account first, and anyone who belongs to another professional body or regulator may need a certificate of good standing from it.

Where the full process applies, the SRA runs screening checks against its own records and, depending on the person’s regulatory status, may run external checks on identity, adverse financial history and criminal record. The declarations and suitability section must be completed in full: the SRA rejects applications where they aren’t. An issue that wasn’t disclosed but turns up in screening counts against the candidate.

On timing, the SRA says there is no statutory deadline for most role holder decisions, but it applies the same six-month period it uses for firm authorisation and aims to decide most within three months, or 30 days for a low-risk application. Approval takes effect from the date of the decision and lapses if the person doesn’t take up the role within the period set in the approval, or within a year if none is set (rule 13.7).

The firm can’t provide reserved legal services until it is authorised, and from then on it must have an approved COLP and COFA at all times, so build the approvals into your timeline from the start. The guide to SRA firm authorisation covers the rest of the application.

Recording and reporting breaches

Reporting is the core of both roles. The test in paragraphs 9.1(d) and 9.2(b) of the Code for Firms is whether you reasonably believe the facts are capable of amounting to a serious breach; if so, the report must be prompt. Separately, the SRA must be told promptly of anything you reasonably believe it should know so that it can investigate or use its powers (paragraphs 9.1(e) and 9.2(c)).

The SRA doesn’t want every allegation passed on. Its reporting guidance says you may look into a concern to understand whether it is serious, but you must be able to justify your decision. The factors it uses to judge seriousness are in the SRA Enforcement Strategy, which also says that where a serious breach is indicated, it wants firms to engage with it early in their own investigation.

Recording matters as much as reporting. The SRA’s guidance on role holders says compliance officers are responsible for recording breaches and reporting them where necessary, and paragraph 2.2 of the Code requires the firm to keep records that demonstrate compliance. A simple breach register covers both: what happened, how it was put right, and why it was or wasn’t reported.

Three other rules shape how this works inside a firm:

• A solicitor in the firm meets their own duty to report by telling the COLP or COFA, on the understanding that they will pass it on (paragraph 7.12 of the Code of Conduct for Solicitors). The Enforcement Strategy says that if they don’t think the compliance officer will take the same view, they should be prepared to report it themselves.
• The firm must not try to stop anyone giving information to the SRA, or treat anyone detrimentally for reporting (paragraphs 3.11 and 3.12 of the Code for Firms).
• The firm must have systems that let its compliance officers carry out their duties (paragraph 2.1(d)).

When a compliance officer leaves

Approval ends when the person stops doing the role (rule 13.7). The firm must notify the SRA promptly of material changes to the information it has given about its compliance officers (paragraph 3.8 of the Code for Firms), and because rule 8.1 applies at all times, it needs an approved replacement.

A planned change. Apply for your successor’s approval before the outgoing officer leaves: approval must be granted before the new person takes up the role. If the successor qualifies for deemed approval, you can make the change through mySRA.

A sudden loss. If the firm unexpectedly loses its COLP or COFA, or they can’t carry out the role, it can apply for temporary emergency approval of a replacement (rule 15.2). The conditions are strict:

• the application must be made within seven days of the firm ceasing to have an approved COLP or COFA, and the SRA says it can’t accept one outside that window
• the SRA must be satisfied the firm couldn’t reasonably have applied in advance, and have no reason to believe the replacement isn’t fit and proper
• approval lasts for an initial 28 days, and is extended while a full application made in that period is decided

The SRA aims to decide emergency applications within seven days, or up to 15 if it needs more information or background checks. A resignation with notice will usually leave time to apply in the normal way.

If you are a sole practitioner holding both roles, whatever stops you acting as compliance officer may also stop you running the firm. If a sole practitioner dies or loses capacity, a solicitor who is their executor, attorney or deputy, a practice manager appointed by one of those people, or an employee of the practice can apply for temporary emergency authorisation within 28 days (rule 15.1). Decide who that would be, and put it in your business continuity plan.

The 2026 separation rules: approved, then paused

The SRA found firms where one person with unilateral decision-making power was also the COLP or COFA, effectively overseeing and reporting on their own decisions, and told the LSB this had in some cases led to consumer harm. Its answer was to separate running the firm from overseeing its compliance in higher-risk firms. Here is how that has unfolded:

• December 2025 to February 2026: the SRA consulted.
• 2 June 2026: it announced its decision and sent the rules to the LSB, having raised the client money threshold after consultation feedback.
• 31 July 2026: the LSB approved new rules 8.4 to 8.7 of the Authorisation of Firms Rules.
• 4 September 2026: the SRA explained that the rules catch only someone who can make significant management decisions unilaterally, not every senior manager or owner, and said guidance would follow in the autumn.
• 30 September 2026: the SRA paused implementation “to take stock”, saying it would consult stakeholders on options over the coming weeks with a view to making necessary changes. No new timetable was given.

As approved, the rules look at the firm’s most recently completed accounting period. Turnover means annual turnover; the client money test is the maximum client account balance.

Rule 8.7 would let a firm with turnover of £600,000 or less ignore a one-off breach of the client money threshold, if it reasonably concluded the excess came solely from transactions outside its usual business, hadn’t exceeded £2 million in either of the two previous accounting periods, notified the SRA promptly and kept a written record of its reasoning.

According to the LSB’s decision notice, the SRA planned to phase the rules in from January 2027, larger firms first, with smaller firms complying in a second year. It estimated that around 1,660 firms, 18% of all firms, including 431 sole owner-manager firms, might need to act.

For now, nothing has changed. The Authorisation of Firms Rules in force, the version in effect since 1 December 2023, contain no separation requirement, and the SRA hasn’t said when, or in what form, the paused rules will return. If you are setting up now, you can be both COLP and COFA. If your plans would take the firm past £600,000 turnover or £2 million of client money, think early about who else could hold the roles. The options the SRA has put forward are sharing significant decisions so no one makes them alone, giving the roles to another eligible person, or not holding client money, for example by using a third-party managed account.

Money laundering officers are separate roles

If your work is in scope of the Money Laundering Regulations 2017, as conveyancing is, regulation 21 also requires a money laundering compliance officer (MLCO) and a money laundering reporting officer (MLRO). These are separate from the COLP and COFA. The SRA says around 90% of firms have one person hold both money laundering roles, and that a sole practice which doesn’t employ, and isn’t in association with, anyone other than the principal doesn’t need to appoint either. Its guidance says the SRA must be told within 14 days of a new MLRO’s appointment.

The guide to starting a law firm covers the other policies and registrations a new firm needs.