Solicitors Regulation Authority Shifts Accountability from COLPs to Firm Governance

The traditional understanding of accountability for anti-money laundering (AML) breaches in UK legal practices has often placed a disproportionate burden on the Compliance Officer for Legal Practice (COLP) and Compliance Officer for Finance and Administration (COFA). However, the Solicitors Regulation Authority (SRA) is increasingly signalling a shift towards embedding this accountability within the firm's broader governance framework, rather than solely with designated individuals. This article explores the statutory and regulatory landscape, the historical interpretation of individual liability, and the SRA's evolving expectations, arguing that effective AML compliance necessitates a robust, firm-wide governance approach to mitigate risks and ensure regulatory adherence.

For many years, the legal profession in the UK has operated under the assumption that the Compliance Officer for Legal Practice (COLP) and Compliance Officer for Finance and Administration (COFA) bear significant personal exposure to the consequences of anti-money laundering (AML) breaches. This perception has often led to these individuals feeling isolated in their crucial roles, facing potential regulatory action and reputational damage for failures within their firms. The Solicitors Regulation Authority (SRA) initially sought to reassure the profession that COLPs and COFAs would not be treated as "sacrificial lambs," yet the inherent personal responsibility of these positions has remained a prominent concern.

However, there is a discernible shift in the SRA's rhetoric and enforcement focus, moving towards a more holistic view of accountability. The emerging perspective emphasises that compliance, particularly concerning AML, must be an integral part of a firm's overall governance structure and culture, rather than solely residing with one or two designated individuals. This article will delve into the legal and regulatory foundations underpinning the roles of COLPs and COFAs, examine the historical and evolving interpretations of their personal liability, and analyse the SRA's increasing emphasis on firm-wide governance as the cornerstone of effective AML compliance.

The roles of COLP and COFA were introduced into the UK legal sector to bolster regulatory compliance and client protection. Under the SRA Standards and Regulations, every SRA-authorised firm must appoint a COLP and a COFA. The COLP is primarily responsible for overseeing the firm's compliance with the SRA Principles and the SRA Code of Conduct for Firms, ensuring adherence to legal and regulatory obligations, excluding financial matters. Conversely, the COFA's main duty is to ensure the firm's compliance with the SRA Accounts Rules and to manage financial risks, including the proper handling of client money.

Central to AML compliance in the UK are the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017), which replaced earlier legislation and implemented the EU Fourth Money Laundering Directive. These regulations impose stringent requirements on legal firms, including the obligation to conduct firm-wide money laundering and terrorist financing risk assessments, implement robust policies, controls, and procedures, and provide ongoing training to staff. Firms are also required to appoint a Money Laundering Reporting Officer (MLRO) and a Compliance Officer (CO) under the MLR 2017, roles that often overlap with or are held by the COLP or COFA, particularly in smaller practices. While the SRA initially sought to alleviate concerns about COLPs and COFAs becoming "sacrificial lambs," their statutory duties to take "all reasonable steps" to ensure compliance and report serious breaches inherently carry a degree of personal responsibility.

The SRA's regulatory framework explicitly outlines the responsibilities of COLPs and COFAs, requiring them to take "all reasonable steps" to ensure compliance within their respective domains. This duty has historically been interpreted as carrying significant personal liability, leading to individual enforcement actions. For instance, the Solicitors Disciplinary Tribunal (SDT) has considered cases where COLPs faced charges linked to AML failings of other fee-earners within their firm, particularly where the COLP was deemed to have failed in adequately considering concerns or red flags. Such cases underscore that while direct involvement in wrongdoing is a factor, a failure to ensure adequate systems and oversight can also lead to personal regulatory consequences for compliance officers.

However, the SRA's discourse is evolving, with a growing emphasis on the firm's collective responsibility. Paul Philip, the SRA's Chief Executive, has articulated that managers of firms must take responsibility for "self-regulation" and that the SRA will scrutinise the underlying structures that permitted wrongdoing, even if the immediate breach was committed by an individual. This perspective aligns with the SRA Code of Conduct for Firms, which mandates robust compliance and business systems, highlighting that a serious failure to meet standards may result in regulatory action against the firm itself, its managers, or compliance officers. The SRA's thematic reviews have further revealed concerns that compliance roles are not always prioritised, and there is an over-reliance on single individuals, often without sufficient time or support.

Effective AML compliance, therefore, transcends the mere appointment of a COLP and COFA. It demands that firms implement comprehensive, well-documented AML policies, controls, and procedures that are not only written but actively practised and embedded within the firm's operations. The SRA is increasingly focusing on the "gap between firms' written policies and actual practice." This necessitates clear reporting lines, adequate resourcing for compliance functions, and empowering COLPs and COFAs to implement necessary changes and risk management procedures. Furthermore, the SRA's recent focus on workplace culture underscores that a healthy, ethical environment is foundational to effective compliance, requiring firms to have systems in place to supervise work, support staff wellbeing, and respond to concerns, thereby fostering a culture where compliance is a shared responsibility.

The evolving regulatory landscape in the UK legal sector clearly indicates a move away from viewing AML accountability as solely the burden of the COLP or COFA. While these roles retain inherent personal responsibilities, the SRA is increasingly demanding that accountability be firmly embedded within the firm's overarching governance, systems, and culture. This shift reflects a recognition that effective compliance is a collective endeavour, requiring robust institutional frameworks to support individual compliance officers.

For practitioners, the implications are significant. Firms must proactively review and strengthen their internal governance structures, ensuring that AML policies and procedures are not only comprehensive and up-to-date but also practically implemented and regularly audited. This includes providing adequate resources, training, and empowerment to COLPs, COFAs, and MLROs, fostering a culture where compliance is understood and embraced by all staff. Firms should conduct regular risk assessments, implement independent internal audits, and establish clear lines of communication to identify and address potential compliance failings promptly. Looking ahead, firms should closely monitor future SRA guidance and enforcement trends, particularly regarding firm-wide governance and the potential for AML supervision to be further integrated or even shifted to other regulatory bodies, ensuring their compliance frameworks are agile and adaptable to these ongoing developments.