The SRA’s decision to delay its controversial Rule 8.4 changes beyond January 2027 has been welcomed by many. But what should affected firms do now? Kate Burt, solicitor and founder of legal risk and compliance consultancy HiveRisk, sets out how firms can use this breathing space to strengthen internal governance arrangements, build a more defensible position and mitigate risk in their own practices.
Many firms have been breathing a sigh of relief following last week’s announcement, particularly the smaller and owner managed firms facing difficult decisions about how to restructure their compliance framework
The proposed changes to Rule 8.4 would have restricted the ability of unilateral decision-makers to hold the COLP and COFA roles. For firms built around a small leadership team, that raised significant questions about how compliance responsibilities could be allocated in practice.
On 22 October, following its earlier pause, the SRA confirmed that it will not roll out the proposed changes to Rule 8.4 of its Authorisation of Firms Rules in January 2027 as originally planned. It has committed to working with stakeholders, testing alternatives and considering wider approaches to firm governance, with an appropriate lead-in time for any eventual changes. This is not confirmation that the proposals have been permanently abandoned, but it is a significant and welcome development.
The SME & Boutique Law Firm Alliance, of which I am a co-founder, has welcomed this reprieve while continuing to press for greater clarity about how the SRA intends to identify higher-risk firms and consideration of alternative safeguards to protect client money. There is genuine progress to recognise, but continued engagement remains essential.
This is a win for proportionate regulation, not an argument against effective oversight
The wider regulatory context matters. The SRA remains under significant pressure from the Legal Services Board (LSB) to improve its regulatory effectiveness. In September, the LSB announced that it was initiating further enforcement action against the regulator to secure urgent improvements, following its earlier Directions after Axiom Ince.
Better identification of risk, protection of client money and timely action to prevent consumer harm remain central to that scrutiny. Concentration of power in some law firms is a key governance risk identified in this work: where one individual controls significant business decisions and compliance oversight, meaningful checks and balances can be weakened. The SRA’s response to the LSB’s Directions expressly includes addressing the risks of one person holding multiple ownership, management and compliance roles.
Recognising that risk does not mean accepting that mandatory role separation is the right answer for every firm.
Defend what works and strengthen what does not
The regulatory scrutiny described above has put the profession on notice: concentration of ownership, management and compliance responsibilities can weaken independent challenge and leave significant decisions insufficiently scrutinised. That does not mean every firm with overlapping roles has ineffective governance, but it does mean that the risk warrants deliberate assessment by each firm as part of its own governance review.
Postponement of the wider rollout does not remove the possibility of targeted regulatory engagement or the underlying risks a firm may be vulnerable to. Firms should not wait for a revised rule before addressing a risk already identified. Firms I am speaking with are already reviewing their governance arrangements in light of the proposals. That work remains worthwhile despite the changed timetable. For firms taking stock now, four areas deserve particular attention:
Map where authority sits. Start with a short account of who makes significant business decisions, who oversees compliance and where those responsibilities overlap. Look beyond job titles to how decisions actually happen, including financial approvals and exceptions to normal procedures. The purpose is not to assume that overlapping roles are defective, but to identify where a decision could escape meaningful scrutiny.
Test the route for challenge. Consider how a concern would be raised if it involved a significant decision by an owner or senior manager. Is there a clear escalation route that does not rely solely on the person whose decision is being questioned? Walk through a realistic scenario and check whether the arrangements provide an appropriate route for review and a clear record of the response.
Gather evidence. Select examples of financial checks, compliance reviews and significant decisions, recording what was examined, what was questioned and how any issue was resolved. Keep the exercise proportionate. A concise, usable record is more valuable than another policy that nobody consults.
Close gaps. Where scrutiny is weak, consider targeted measures such as a second review of defined decisions, clearer approval limits or periodic external input. Choose measures that address the particular risk rather than adding layers for appearance’s sake. Record the improvement, assign responsibility and set a review date. These are practical options to consider, not a substitute for meeting applicable regulatory obligations.
Different firms need different safeguards
For a sole practitioner, for example, ownership, management and compliance responsibilities may necessarily sit with one person. That does not, in itself, mean the practice is non-compliant. What matters is whether the firm can demonstrate that its arrangements manage the risks effectively. Can they demonstrate how risks are assessed, how client money is protected, how significant decisions are scrutinised and documented, and how issues are identified and addressed. By showing how those safeguards work in practice, firms can make a stronger case for proportionate, outcomes-focused regulation that recognises different firm profiles.
For now, let us welcome a significant result for those firms affected and a more constructive regulatory conversation. The next step is to turn that progress into an evidence-based, proportionate approach that protects clients and recognises how well-run firms actually operate.
About the author
Kate Burt is an experienced solicitor with over 25 years in the legal sector and the founder and CEO of award winning boutique compliance firm, HiveRisk, a a business helping law firms and professional service businesses navigate risk and compliance challenges with an eye on commericiality.
Through HiveRisk, Kate and her team advise law firms as well as global regtech and professional services companies on market strategy and regulatory compliance. Her areas of expertise include anti-money laundering (AML), counter-fraud strategies, data protection, professional codes of conduct, professional indemnity insurance (PII) renewals, and complaints handling. HiveRisk work with a broad range of regulated organisations.
Kate is also a founder and co-founder of several influential industry initiatives:
- SME & Boutique Law Firm Alliance – a working group helping smaller firms have a voice as regulations change
- The Lawyers Retreat – an annual 3 day offsite event for law firm leaders outside of the UK
- The Great Big Legal Offsite – a collaborative 1 day event focused on future-proofing law firms
- What’s the Buzz – a podcast for senior compliance professionals and law firm leaders
- Fear no Storm Podcast – embracing risk, creating impact for entrepreneurs
Known for her deep insight into complex regulatory matters, Kate and her team regularly advise on challenging and emerging issues, such as cryptocurrency, anonymous parties, and complex source of funds investigations. Her work helps firms and professionals navigate unusual scenarios with clarity and confidence, ensuring compliance while enabling commercial growth.
The views expressed in this article are those of the author and not necessarily those of Today’s Conveyancer.
