COLP and COFA: What the SRA Requires of Each Role

Every firm the Solicitors Regulation Authority authorises must have a Compliance Officer for Legal Practice and a Compliance Officer for Finance and Administration. Most firms appoint them because they have to. Far fewer are clear on what the two roles are actually obliged to do, where the line between them sits, and what "serious" means when the duty is to report a serious breach promptly.

This guide sets out what the SRA requires of each role, how the two differ, and the practical systems a firm needs behind them.

Where the duties come from

The responsibilities sit in the SRA Code of Conduct for Firms. Paragraph 9.1 covers the COLP; paragraph 9.2 covers the COFA. Both are framed the same way: the officer must take all reasonable steps to achieve a set of outcomes. That phrasing matters. It is not a guarantee of compliance, and an officer is not automatically in breach because something went wrong in the firm. The question a regulator asks is whether reasonable steps were taken.

What the COLP is responsible for

Under paragraph 9.1, the COLP must take all reasonable steps to ensure:

• the firm complies with the terms and conditions of its authorisation;
• the firm, its managers, employees and interest holders comply with the SRA's regulatory arrangements — with one explicit carve-out, the Accounts Rules, which belong to the COFA;
• managers, interest holders and those the firm employs or contracts with do not cause or substantially contribute to a breach;
• a prompt report is made to the SRA of any serious breach.

The scope is broad. Everything in the regulatory arrangements that is not an Accounts Rules matter falls to the COLP: conduct, competence, conflicts, confidentiality, supervision, and the firm's authorisation conditions.

What the COFA is responsible for

Paragraph 9.2 is narrower and sharper. The COFA must take all reasonable steps to ensure that the firm, its managers and its employees comply with the Accounts Rules, and that a prompt report is made to the SRA of any serious breach of those rules.

In practice that means client money: how it is held, reconciled, withdrawn and accounted for. If you want the detail of what sits underneath this role, our guide to the SRA Accounts Rules and client money controls covers the specific obligations.

The division of responsibility, and where firms get it wrong

The split is cleaner on paper than in practice. A single incident often touches both: a client money shortfall is an Accounts Rules matter for the COFA, but if it arose because supervision failed or a member of staff acted dishonestly, the conduct dimension is the COLP's.

The common failure is assuming the other officer has it. Firms that handle this well agree in advance how overlapping issues are triaged, and record the decision rather than leaving it to a conversation nobody wrote down.

Reporting: what "serious" and "prompt" mean in practice

Both roles carry an obligation to make a prompt report to the SRA of any serious breach. The SRA does not reduce "serious" to a checklist, and that is deliberate — materiality depends on the facts, the harm, and whether it is isolated or systemic.

Two things help. First, some matters are mandatory notifications rather than judgement calls; these are set out in the SRA's reporting and notification guidance, and an officer should know which category a matter falls into before deciding. Second, the SRA expects compliance officers to keep a record of all breaches, not only the ones reported. It does not prescribe how. A breach register that captures what happened, when it was identified, what was done and what was decided about reporting is the usual answer, and it is also the evidence that reasonable steps were taken.

Structuring the roles inside the firm

The SRA leaves firms to decide how the roles fit their structure, but it is explicit about two conditions.

In larger firms, and wherever a compliance officer is an employee rather than a manager or owner, there must be clear reporting lines. An officer who cannot escalate above the person whose conduct is in question cannot take reasonable steps.

And firm management must review the effectiveness of the COLP and COFA. This is not optional. Where a sole practitioner holds both roles, the same review obligation applies to themselves — which is uncomfortable, and is meant to be.

What a compliance officer needs in place

• A breach register, used consistently, covering reported and unreported breaches.
• A documented triage route for matters that straddle both roles.
• Escalation lines that work when the subject of the concern is senior.
• A scheduled review of the officer's own effectiveness, with a record of it.
• Current knowledge of the regulatory arrangements, which change — anti-money laundering obligations in particular have moved repeatedly, and our guide to AML essentials for solicitors covers where those duties now sit.

Frequently asked questions

Can one person be both COLP and COFA?

Yes, and in smaller firms it is common. The SRA's expectation is that the firm reviews how well both roles are being performed — and a sole practitioner holding both must review their own performance in each.

Does the COLP have to be a solicitor?

The SRA's guidance on the responsibilities of the roles addresses how they should be structured rather than who may hold them. Firms should check the current eligibility and approval requirements directly with the SRA rather than relying on summaries, including this one.

Is a compliance officer personally liable if the firm breaches a rule?

The duty is to take all reasonable steps, not to guarantee compliance. What an officer is answerable for is whether those steps were taken — which is why the record matters as much as the outcome.

What is the difference between a breach and a serious breach?

Only a serious breach triggers the prompt reporting duty, but the expectation is that all breaches are recorded. Seriousness turns on materiality, harm and whether the issue is isolated or systemic, and some matters are mandatory notifications regardless.

Keeping the knowledge current

Compliance officer duties do not sit still. The regulatory arrangements change, the SRA's expectations are refined through thematic reviews and enforcement, and the officer carrying the duty is expected to keep pace. Structured CPD is how most firms evidence that their compliance officers remain competent in the role — and, where the firm is reviewing effectiveness, it is part of what that review looks at.

This article summarises the SRA's published guidance on the responsibilities of COLPs and COFAs. It is not legal advice. Firms should check the current SRA Code of Conduct for Firms and reporting guidance before acting.