Changes to compliance officer roles postponed: managing the risk now

Background

In late October 2026, the Solicitors Regulation Authority (SRA) confirmed that it will not roll out the planned changes to rule 8.4 of its Authorisation of Firms Rules in January 2027, as originally proposed. The rule would prevent an individual with power to make ‘unilateral’ decisions from holding the role of compliance officer for legal practice (COLP) or compliance officer for finance and administration (COFA). It would apply to firms with a turnover of more than £600,000 or more than £2 million in client money, with limited exemptions.

Instead, the SRA has said they will work with stakeholders and confirmed there will be an appropriate lead-in time for any eventual changes. The pause will remain in place while it makes appropriate changes in response to feedback from the profession.

The postponement raises an important practical question: what should affected firms do now? They may no longer need to restructure or appoint new compliance officers from early 2027, but the governance risks identified by the regulator remain.

Build a proportionate compliance plan

The current regime already requires firms to maintain effective governance, systems and controls, and to enable their compliance officers to discharge their duties. COLPs and COFAs must take all reasonable steps to secure compliance within their respective areas of responsibility and ensure serious breaches are reported promptly to the SRA. Properly applied, these existing requirements should materially reduce the risk arising from concentrated business control and compliance oversight, although they cannot remove it entirely.

Affected firms should use this breathing space to assess how existing arrangements operate in practice. The concentration of business and compliance responsibilities in one person does not, of itself, mean that the firm’s governance is ineffective. The question is whether significant decisions receive meaningful scrutiny and whether the firm can demonstrate that they do.

One way to establish an effective and defensible interim position is through a concise, documented risk assessment setting out who is responsible for what, how significant decisions are made and challenged, the risks arising from the current arrangements, the safeguards already in place and any further improvements required.

The following areas provide a practical framework for carrying out that assessment and identifying proportionate safeguards:

1. Map authority and responsibility

Define what the firm regards as a significant decision and catalogue the types of decision that fall within that definition, such as substantial financial commitments, changes to ownership or management, departures from agreed risk appetite, or decisions affecting client money or regulatory compliance. Record who makes each type of decision, who should review or challenge it and where responsibilities overlap. Include exceptions to normal procedures and compare written governance arrangements with what happens in practice. Make a note of the safeguards around those decisions, rather than assuming that a different job title would resolve the risk.

2. Test, challenge and escalate

Walk through a realistic concern involving an owner or senior manager. Who could question the decision, obtain the relevant information and review the response? Where there is no senior leadership team, consider how the firm could introduce an appropriate degree of independent challenge such as through a trusted peer, an external compliance or professional adviser, or relevant regulatory guidance. The firm should test whether the concern can receive meaningful scrutiny through an appropriate internal or external route, particularly where the individual whose decision is being challenged is also the firm’s sole decisionmaker.

3. Check capacity and continuity

The COLP and COFA roles need protected time, appropriate training and reliable management information. Deputies or alternates should understand when they may act, what information they need and how issues will be handed over. In a small practice, arrangements may be simple, but they should still work when a key individual is absent.

4. Check the evidence

Select a small sample of significant decisions and consider what was reviewed, what challenge took place and how any concerns were resolved. Identify any gaps or recurring weaknesses, decide whether further safeguards are needed and record the action to be taken, by whom and by when. This helps the firm demonstrate that its arrangements operate effectively in practice, rather than merely appearing in a policy, and provides a clear record of the reasonable and proportionate steps it has taken.

5. Prioritise targeted improvements

Where the review identifies a weakness, choose a practical safeguard that fits the firm. This might mean requiring a second person to check higher-risk payments or decisions, setting a clear financial approval limit, scheduling a regular review with another senior member of the firm, or obtaining external input where there is no suitable internal option.

The aim is not to impose a larger firm’s structure, but to adopt safeguards that are both realistic for the practice and capable of working consistently.

Keep the outcome practical

These are practical risk management options, not additional regulatory requirements or a substitute for existing obligations. External input can support challenge and provide specialist perspective, but it should not be treated as transferring the firm’s responsibilities. Equally, appointing a new compliance officer internally who lacks seniority, access or influence may weaken governance rather than improve it.

For a sole practitioner, several responsibilities may necessarily sit with one person. The review should recognise that reality and focus on how risks are managed, not attempt to replicate a larger firm’s structure. Proportionate safeguards might include documented decision criteria, periodic external review, clear records of significant judgements and a defined route for obtaining independent external advice when needed.

Keep the plan under review

As the regulatory position develops, the plan should evolve with it. Give someone responsibility for monitoring SRA updates and retaining the current governance map or risk assessment. This will help the firm distinguish between improvements it can make now and decisions that depend on further regulatory change.

For now, the task is neither wholesale restructuring nor business as usual. The profession has been put on notice that the concentration of business control and compliance oversight can create a material governance risk, and firms should consider how that risk is managed within their own arrangements. Firms that take a proportionate and documented approach will be better prepared for any revised requirements and, more importantly, will strengthen their compliance arrangements under the current regime.