I read a bizarre and sad story recently about a solicitor disciplined by the Solicitors Disciplinary Tribunal following local newspaper reports of him hitting his 71-year old mother in the face with a saucepan. The local press suggested that the solicitor’s defence was that he had simply been watching snooker at the time and had thrown his arms up in disbelief when Ronnie O’Sullivan missed an easy shot and he just happened to be holding a saucepan full of dumplings at the time! It speaks volumes to the cavernous depths of my SRA compliance geekdom that what really leapt out at me was the additional rule breach finding that there had been a failure to report matters to the SRA. That seems a rather minor point to take in the circumstances but I do now regularly see the SRA adding the failure to report in for good measure when taking disciplinary action. While you hopefully do not need any support in the saucepan department, the hope of this article is to simplify what sort of problems do or do not need reporting to the SRA.

When do you need to report a ‘serious’ rule breach?

As a reminder, since the new rulebook came into effect in November 2019 the circumstances in which COLPs, COFAs & law firms need to report a regulatory problem to the SRA have been broadened significantly. The concept of a ‘material’ breach is now – like outcomes focused regulation – long gone (so 2012). Instead, the SRA is now asking law firms to consider whether a potential rule breach is ‘serious’. We have broken down what ‘serious’ means into a 5-step assessment below. It is worth stressing first however that we are now also concerned with potential rule breaches. The SRA discovered the hard way that asking lawyers to report rule breaches had the unintended consequence of only receiving reports once the firm had satisfied itself that there had in fact been a rule breach, regardless of how serious the allegations being investigated were. As often occurs with the SRA however, they have now somewhat overcorrected in my view.

SRA rules now require:

• (a) potential rule breaches to be referred to the regulator:
  “You report promptly to the SRA… any facts or matters that you reasonably believe are capable of amounting to a serious breach…”[1]
  
• (b) that even when those grounds are not satisfied, you should nonetheless report a matter to the SRA if you believe that it may be appropriate for the SRA to exercise its special investigative powers:
  “Notwithstanding paragraph 7.7, you inform the SRA promptly of any facts or matters that you reasonably believe should be brought to its attention in order that it may investigate whether a serious breach of its regulatory arrangements has occurred or otherwise exercise its regulatory powers.”[2]

I know what you’re thinking: what on earth does that mean!? Though possibly with less whimsical language?

Many subject to the Code will not appreciate that the SRA has some special statutory powers allowing it to compel anyone to provide it with information and documentation it needs to assist in a misconduct investigation. I think the key point to bear in mind is that sometimes the SRA will be better placed than you to look into a potentially serious misconduct issue, so hand it over to them.

Note importantly however that it is not all potential rule breaches which must be reported. It is only those which you reasonably believe are capable of amounting to a serious breach. There is no obligation to report clearly spurious allegations for example.

In summary then:

• we are now concerned with ‘serious’ rule breaches, not ‘material’;
• you can no longer await the outcome of your own investigation to report. If on the face of it there could be serious misconduct involved then the regulator wants to know;
• look for situations where the SRA would simply be better placed to get to the bottom of things.

What is a ‘serious’ rule breach?

 Now that we’re clear on the parameters of reporting serious rule breaches, what would make a breach or an alleged breach serious? As a reminder, if it is not serious then there is no need to report it to the SRA (though the position is a little messier for ABSs – see below).

There is no formal definition of a ‘serious’ rule breach. Instead, we have to consider the guidance provided in the SRA enforcement strategy and other SRA guidance and case studies.

Unfortunately, these are not easy reads so below I have extracted the key statements from those documents and turned them into a step-by-step process.

Step 1: Serious event checklist

Certain matters and facts are viewed as “inherently more serious” by the SRA and these are listed below in Step 1. Remember that we are concerned here with whether the facts or matters which are “capable” of being serious, not simply those which have already been proven beyond any doubt. When assessing potential rule breaches for our retainer clients we consider the following checklist first:

Examples of such serious matters would in my view include:

• your email or case management systems being hacked;
• an allegation of sexual misconduct;
• a criminal conviction including cautions, other than low level motoring issues;
• any form of dishonesty – do not make the mistake which Duncan Lewis Solicitors were reported to have made some years ago of thinking that suspected misappropriation of money by a non-solicitor could be dealt with purely as an ‘internal’ matter because no client funds are involved.

Step 2: Serious intent checklist

In the absence of serious events, it may still be possible for something to be serious by virtue of the intent or motivation of the solicitor or firm concerned. The second checklist we consider when assessing a client’s rule breach therefore is this one:

Examples of such serious matters would in my view include:

• failing to declare and act upon an obvious own interest conflict;
• deliberately sharing confidential information with a friend because it’s just such a juicy story (even if the friend pinky swears not to tell);
• falling short of lying but still deliberately misleading clients, colleagues or the Court;
• repeated failures to comply with Court Orders;
• very offensive social media communications.

Note that a genuine mistake is unlikely to constitute a serious intention or motivation for these purposes, though could still be serious if by virtue of other considerations such as it falling into the table in Step1 above.

Step 3: Serious impact, harm or potential checklist

We then go on to consider what level of harm or impact the potential breach has caused or will likely cause:

Examples of such serious matters not falling into other categories might include a relatively innocent human error which has unfortunately had a very significant or widespread impact. Personally, I do not typically consider a client email being sent to the wrong person a serious breach because typically little confidential information if any has been shared and / or the information is easily re-secured. However, I can easily imagine situations where the consequences of doing so would tip it over into ‘serious’ on the basis of the checklist above. If such a simple human error revealed the location of a vulnerable witness who was endangered as a result for example or if there was a leak of financial information about large numbers of people which appeared online, I would expect the regulator to be informed.

 Step 4: Patterns and systemic problems checklist

The SRA has always stressed that a pattern of ‘non-serious’ rule breaches could eventually constitute a reportable problem. This is quite a difficult one to gauge in practice. In essence, we are asking ourselves whether there is a systemic or wider problem which has been allowed to persist. I personally tend not to worry too much about several similar human errors if the firm really has done all it can after the previous event, assuming that we are not concerned with one especially problematic human!

Step 5: Look at things as a whole and check your gut!

Finally, while the checklists above may identify a single incident or fact which would point towards a matter being serious and therefore would require a report to the SRA, the considerations overlap in practice. We should finally consider the combination of factors and whether it is something the regulator ought to know about i.e. where they may potentially want to monitor a situation, investigate a potentially serious problem or take action. Also, if you simply feel uneasy not telling the regulator about what has gone on, I would encourage you to listen to that instinct. Facts rarely look better when being rehearsed before the regulator, or indeed the Solicitors Disciplinary Tribunal (though I would think a Tribunal referral highly unlikely simply for a failure to report).

Tips for making reports

It is worth noting firstly that the new Code of Conduct introduced some welcome clarity that law firm staff need only report rule breaches to the COLP or COFA[3] in order to fulfil their own reporting duties. In big firms for example there is no need for hundreds of staff to send in their own report once word gets around!

If you do need to make a report to the SRA then you can send a letter to report@sra.org.uk. I always prepare a letter for the client to go to the regulator which sets out:

• factually what we know and why we are making the report;
• what harm or damage is possible and what steps the firm has taken or is taking to limit this;
• what steps the firm is taking to ensure that such a scenario does not arise again.

The intention is to reassure the SRA that the firm has things under control and that the SRA need not waste its precious resources looking into it any further! However, to be clear, there are situations in which the SRA should rightly investigate further. The report must not be in any way misleading. You need to state the facts as they are, albeit that you can reassure the regulator what you are doing to solve it yourselves. I have to say that in the vast majority of scenarios, this letter is sufficient for SRA purposes and they do not investigate matters any further.

If a matter is borderline, I have to say that on balance I typically tend to report it in order to avoid a later allegation of a separate rule breach for not having done so. It will depend upon the facts though, as well as the risk appetite of the firm.

If it is not a ‘serious’ rule breach then the SRA still encourages firms to keep a log of the rule breach. You can do that on a simple spreadsheet (perfectly adequate for small firms) or using an SRA compliance online tracker such as our Compliance Office in the Cloud. There is no need to report non-serious rule breaches to the SRA save for one unfortunate issue as regards ABS law firms. Sections 91(1)(b) and 92 of the Legal Services Act 2007 impose statutory duties on COLPs and COFAs (though they’re termed HOLPs and HOFAs in the legislation – don’t ask!) to report all rule breaches to the SRA as soon as reasonably practicable. The SRA were unable to relax this requirement when they relaxed the rules for other law firms in November 2019. The SRA used to have rule in place which stated that ‘as soon as reasonably practicable’ would be satisfied by an annual report by ABSs of their rule breaches. That has since gone but the SRA has displayed no interest whatsoever in receiving a report of all rule breaches from ABS law firms. Our current approach for retainer clients is to write to the SRA annually to inform them how many non-serious breaches have been logged that year and offering to send the log should they wish to see it. They have never asked to see such a log yet.

Other reporting duties

Thought that was it for SRA reporting duties? Unfortunately, not. We are just talking above about the duty to report serious potential rule breaches to the regulator. There are firstly a number of similar ‘judgemental call’ reporting duties which for completeness I have put below in Annex 1 (lifted largely from the SRA’s own guidance). There are also a number of strict events driven notifications too which I have not got into in this post, such as a firm being in financial difficulty, insolvency events generally or loss of eligibility as a law firm.  This list again is pulled from the SRA website and is at annex 2. Some of the most common ones here are to obtain SRA approval of new partner appointments, money laundering and financial services changes.

Final thoughts

Unfortunately the SRA have not made it easy to find the information which COLPs, COFAs and law firm need to consider. Following the steps above will help you to consider the key points from the more detailed guidance and SRA Enforcement Strategy. If in doubt and for complex matter do consider digging out those documents and of course get in touch with us if you would like some professional support with it.

Annex 1: ‘Judgement call’ reporting duties

The most common duty to report has been highlighted in bold. The COLP and COFA’s duty essentially replicate this duty to report ‘serious’ matters to the regulator. Staff duty is to report matters to the COLP COFA or directly to the SRA.

Annex 2: Strict notification requirements triggered by certain events

[1] 7.7 of the SRA Code of Conduct for Individuals. There are mirrored requirements in the Code of Conduct for Entities and also linked reporting obligations for the COLP & COFA in rule 9 of the Code for Firms.

[2] 7.8 of the SRA Code of Conduct for Individuals.

[3] 7.12 of the SRA Code of Conduct for Individuals, provided that it is on the basis that the COLP or COFA would then make an onward report as necessary.