Welcome to the Regulation & Compliance Office’s fortnightly roundup, where we look at all the latest stories to keep you ahead and informed in the world of law and compliance.
The RACO roundup is just another way in which we keep the solicitors and other law professionals we work with in the know, so we can ascertain that you are never missing the vital developments occurring in your profession.
Below, you will find the most recent headlines selected by our compliance experts, followed by a Security Section, where we will also give you an overview of the latest scams currently impacting solicitors and their clients.
***
VAT on Disbursements – A Reminder
Introduction
From time to time, the issue of when a disbursement is subject to VAT is put to us by Firms we support. We therefore considered it appropriate to put together a quick reference guide.
If you are ever unclear about whether to charge VAT or not, or if your Client challenges you, it is always advisable to speak with your accountant for guidance. We do, however, hope the following helps as a checklist to confirm you are getting this right.
When to Charge VAT and When Not To
The overall requirement when deciding whether to add VAT to a disbursement is whether:
- The disbursements incurred were for your purposes or only for the Client’s, and the Firm only acted as an agent – this is a True Disbursement.
- For example, if you pay a court fee on behalf of your Client because the court fee is the responsibility of the Client, and you are not advising on it.
- You provided guidance (services) when considering the ‘output’ of the disbursement. (In effect, the service is for you, so you can advise the Client) – This is classified as a Recharge.
- For example, you request searches on a property transaction and are required to review those searches and advise the Client before delivering the output to your Client.
HMRC advises that if it is the Client who buys and receives the goods, and you are acting as an agent only, VAT does not apply in the following circumstances:
- You paid the supplier on your customer’s behalf and acted as the agent of your customer
- Your customer received, used or had the benefit of the goods or services you paid for on their behalf
- It was your customer’s responsibility to pay for the goods or services, not yours
- You had permission from your customer to make the payment
- Your customer knew that the goods or services were from another supplier, not from you
- You show the costs separately on your invoice
- You pass on the exact amount of each cost to your customer when you invoice them
- The goods and services you paid for are in addition to the cost of your own services
HMRC further advises that Costs that your Firm incurs itself when supplying goods or services to customers are not disbursements for VAT. It’s you who buys the goods or services for use in your own business. Examples of this would be:
- A train ticket to visit your Client. If you recharge the cost of the ticket, you must charge VAT as the travel was for you, not the Client.
- A courier fee is charged to the Client, as this is a normal business cost and incurred by the Firm.
- A bank transfer fee is charged when transferring money to the Client, as it was a service provided to the Firm and not the Client.
It is also important to note that these rules apply regardless of whether the supplier of that service charges VAT or is exempt from charging VAT – such as a bank fee.
Also, remember that if you had to charge VAT on items you paid for because they were supplied to you and not to your Client, you can claim back any VAT you paid on them. The Client will also be able to reclaim the VAT on your invoice if they are VAT registered.
The Firm cannot reclaim the VAT if the goods or services were not for the Firm but for the Client. For the Client to be able to reclaim the VAT, they will need a VAT invoice in their name.
Summary
To summarise the position
- If you are providing advice relating to the cost incurred, you must charge VAT. For example, purchasing searches on a property transaction, reviewing those searches, and advising the Client.
- IF you purchase a service for the business and you seek to pass on the cost of that service (whether or not the service provider charges VAT – for example, the incurring of a taxi or bank fees, as this is for you and not the Client, VAT must be charged to the Client.
- You are simply passing on the cost of a service that has been obtained only for the benefit of your Client, and you provided no advice. – For example, a court fee (as long as it is not incorporated into the service delivery).
As an example, in a matter where a Firm provided legal services, travels to the Client and incurs a court fee:
- Legal Services – £2,500
- Travelling expenses – £300
- Amount on which VAT is due – £2,800
- VAT at 20% – £560
- Disbursements (No VAT)
- Court Fee – £150
- Total including VAT – £3510
Read full article here.
***
The DUAA and Changes to Data Protection Regulations and Legislation
What is to come?
It has been reasonably well publicised that, following the Data (Use and Access) Act 2025 (DUAA) receiving Royal Assent on 19 June 2025, the Government and the ICO (soon to be the Information Commission) have advised that changes to GDPR, the Data Protection Act and the Privacy and Electronic Communications Regulations 2003 will start to be phased in. At the time of writing, there have been no published changes, with the ICO still advising on its website that changes will be published as they are released. However, guidance can be found here:
https://ico.org.uk/about-the-ico/what-we-do/our-plans-for-new-and-updated-guidance
When giving Royal Assent, the Government advised that the changes would take effect in August and be phased in over the next twelve months. Guidance on the planned stages, including those already in effect, can be found here:
https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement
A summary of the main changes that will affect law firms is shown below, but of particular interest is the ICO’s intention to formally introduce an exemption for “legal professional privilege”, which will make it clear that Law Firms are not compelled to release confidential communications between them and their clients under a Data Subject Access Request (DSAR). This will be welcome news to law firms as the number of DSARs has increased exponentially in recent times.
Other changes that we can expect to be phased in are summarised as follows.
- Consent rules for low-risk cookies are relaxed (e.g. for analytics, site optimisation and emergency assistance cookies) – explicit consent will no longer be required.
- Fines increased under PECR to £17.5 million or 4% of annual global turnover.
- Timing for DSAR responses, including stop the clock provisions and Data Controllers must only carry out ‘reasonable and proportionate’ searches.
- ‘Further Processing’ as a new basis for lawful processing.
- ‘Recognised legitimate interests’ will no longer require a balance test.
- Firms will be allowed 30 days to address a complaint before the ICO will become involved in a complaint relating to a data breach.
- New rules for automated decision-making systems.
There are other changes listed, but these are unlikely to have an impact on law firms.
It is the ICO’s guidance to:
- Review the proposals, as they are not likely to change.
- Review your Cookie Policy to align with the new proposals.
- Review and ensure you have a written procedure for handling:
- Complaints relating to data
- DSAR’s
- Review if you have any automated decision-making systems (profiling) and review the proposed rules.
- Update staff training.
- Consider new technology and how this may impact on data management.
The ICO has launched a series of public consultations to help shape final guidance on the amendments to provide organisations with more confidence in handling personal information:
Conduct a GDPR Audit
For some Firms, if they have not performed a GDPR Audit, they may consider that the time is right to do so. Our UK GDPR and Data Protection Audit will provide the firm’s management with the confidence of knowing that it is compliant with the requirements of the regulation and can demonstrate such compliance. We will identify any issues or concerns along with knowledge gaps and provide solutions and proposals to rectify these.
The following key areas will be considered as part of the audit:
- All policies to ensure they are up to date with the latest regulations and legislation.
- Data Retention approach and management
- System security
- Data storage processes
- Internal
- External arrangements
- Data management control
- Data Portability
- Cyber Crime Protection and Awareness
- Remote working management
- Terms and Conditions
- Data Controller/Processor arrangements and agreements
- Contracts
- Customer Notices
- Internal systems and controls
- Staff Notices
- Reporting
- Breach Management
- Breach Storage
- Subject Access Request Management
- ICO Reports and Engagement
A full report will be issued to the firm, which will be followed up with a discussion of any recommendations and actions that are made. We will identify any issues or concerns along with knowledge gaps and provide solutions and proposals to rectify these. For detailed information on this service and costings, download our brochure.
For RACO Member Firms that are using the Regulation and Compliance Office’s services, we will ensure your policies, controls and procedures are updated as the ICO starts to implement the changes that impact law firms. If you are a Firm that does not utilise our Risk and Compliance Services, you can find more information below.
Full article here.
***
Being an Authorised Corporate Service Provider (ACSP)
New requirements for registering a business and making a filing with Companies House are underway. These requirements have already commenced with those who verify their clients’ identities, who must now be authorised to do so. Soon, the requirements will also apply to Firms that file with Companies House on behalf of their clients.
As the requirements become fully implemented, authorisation will be mandatory to file information with Companies House. It will be an offence to fail to comply with the legal obligations to register as an agent and follow the outlined requirements.
These changes are being introduced to ensure that Companies House knows who is filing information on the public register and to help ensure the data held is accurate, transparent, and not being used for fraudulent purposes.
You can apply for authorisation by following this link:
Register as a Companies House authorised agent.
Note: You will also need a 6-digit Company Authentication code. If you do not have one, you can obtain it by clicking this link:
Company authentication codes for online filing.
Once authorised, your Firm will gain access to an account from where all details can be managed.
As part of the ACSP registration process, Companies House will request the AML Supervisory Body membership number, which all Firms should already have if they are involved in the provision of in-scope services.
The UK Government has set out the requirements for authorised agents as follows:
- The agent must always be registered with at least one Anti-Money Laundering (AML) supervisory body.
- The agent must notify Companies House of any changes to the information it holds about the agent. They must do this within 14 days.
- If requested, the agent must provide additional information:
- About the agent’s filings with Companies House
- About identity checks, if the agent verifies someone’s identity for Companies House
- To prove the agent is complying with their legal responsibilities
- The agent must keep records of any identity checks for 7 years if they have verified someone’s identity for Companies House.
For Sole Traders, the Principal can register as an agent. For all other types of businesses, all officers (Directors/Partners) are responsible and must ensure the business is registered. The application must be made by someone in a senior role within the business. For example, you must be a director if you’re registering a limited company.
The final changes are expected to be implemented in Spring 2026. However, if your Firm is involved in identity verification, registration is already mandatory.
Our Compliance Services
At the Regulation & Compliance Office, we can offer a number of outsourced support solutions, including:
- Regulation & Compliance Service – Our Regulation and Compliance Service, Inc. Risk Management Assessment and AML Risk, provides a cost-effective but essential solution for law firms to ensure they achieve a compliant environment. We work with firms of all types, from sole practitioners through to partnerships, Limited Companies and ABSs. We recognise that it is essential to recognise how a firm implements compliance to tailor the solution to each firm’s working practices. This is why our service is completely bespoke to each firm we work with.
- Regulation & Compliance Outsource Guidance and Support Service – This service provides law firms with a cost-effective outsourced solution which sees the compliance managers of RACO take on the day-to-day guidance and support expected to be provided by COLPs, COFAs, Data Compliance Officers, MLROs and MLCOs. This addition to the Regulation and Compliance Service, including Risk Management and AML Risk, relieves Compliance Officers of most of the day-to-day burden of keeping up with regulatory requirements and ensures staff have access to compliance and risk advice when needed.
***
S C A M A L E R T S
Emails sent misusing the name of Milwyn Jenkins Limited
The SRA has been informed that emails have been sent falsely purporting to be from a genuine firm of solicitors in relation to conveyancing transactions.
The emails seen by the SRA misuse the name of a genuine employee of the real firm. The emails advise the recipients that deposit monies are required to proceed with an exchange of contracts and request payment to a fraudulent bank account.
The email also attached a bank account details form, which misused the name, letterhead and postal address of the genuine firm, and the name of a genuine employee.
The emails were sent using the email address ‘sspencer@milwyn-jenkin.co.uk’ – please note the missing ‘s’. Therefore, any business or transaction through the above email address and the domain name ‘@milwyn-jenkin.co.uk’ is not undertaken by a firm or individual authorised and regulated by the SRA.
The SRA authorises and regulates a genuine firm of solicitors called Milwyn Jenkins Limited. Its head office address is Cranford House, 1 Severn Square, Newtown, SY16 2AG and the telephone number is 01686626218. The genuine firm’s email domain is @milwyn-jenkins.co.uk.
Please note, however, that the genuine firm, Milwyn Jenkins Limited, employs individuals named Sue Spencer and Avril Evans. The genuine firm Milwyn Jenkins Limited and its employees have confirmed that they do not have any connection to the emails referred to above.
*
Website claiming to be law firm called ‘Georg Peter Sieben Solicitors’
Please note that a website at ‘www.gpssolicitors.co.uk’ is operating, falsely claiming to be a law firm called ‘Georg Peter Sieben Solicitors’.
The website provides a telephone number of ‘+44 7407603063’ and an email address of ‘enquiries@gpsolicitors.co.uk’.
The SRA does not authorise or regulate a firm of solicitors called ‘Georg Peter Sieben Solicitors’. The website appears to be a copy of a genuine firm’s website, misusing the registered postal addresses of the genuine firm.
Therefore, any business or transaction through ‘Georg Peter Sieben Solicitors’ or the above telephone number and email address is not undertaken by a solicitor authorised and regulated by the SRA.
Please note, however, that the SRA authorises and regulates a genuine firm of solicitors called Harper James Limited. The head office is based on Floor 5, Cavendish House, 39-41 Waterloo Street, Birmingham, B2 5PP. The telephone number is 08006891700 and the email domain ends with @harperjames.co.uk. See below for the website’s address: https://harperjames.co.uk/.
The firm has a branch office in Manchester, based at 13th Floor, Piccadilly Plaza, Manchester, M1 4BT and a branch office in Sheffield, based at 2-5 Velocity Tower, 1 St Mary’s Square, Sheffield, S1 4LP.
Harper James Limited has confirmed it has no connection to the activity mentioned above.
*
‘Rechtsanwalt & Steuerberater Law Firm’ website misusing the address of genuine law firms
The SRA has notified the public that a website (www.Rechtanwalteteuerberaters.com) or ‘Rechtsanwalt & Steuerberater Law Firm’ is misusing the address of three genuine firms.
The website for ‘Rechtsanwalt & Steuerberater Law Firm’ provides an email address of ‘frontdesk@rechtanwalteteuerberaters.com’. Please note that the SRA does not authorise or regulate a firm of solicitors called ‘Rechtsanwalt & Steuerberater Law Firm’.
Therefore, any business or transaction through ‘Rechtsanwalt & Steuerberater Law Firm’ or through the above is not undertaken by a firm or individual authorised and regulated by the SRA.
Please note, however, that the SRA authorises and regulates a genuine firm of solicitors called Anthony Leonard Associates, whose genuine address is Airport House, Purley Way, Croydon, CR0 0XZ.
The SRA authorises and regulates a genuine firm of solicitors called Awan Solicitors, whose genuine address is Airport House, Purley Way, Croydon, CR0 0XZ.
The SRA also authorises and regulates a genuine firm of solicitors called Wiseman Solicitors, whose genuine address is Airport House, Purley Way, Croydon, CR0 0XZ.
The genuine firms are believed not to have any connection to ‘Rechtsanwalt & Steuerberater Law Firm’ or any of the above contact details.
BEEN CONTACTED?
Here’s What to Do…
When a firm’s or an individual’s identity has been copied or cloned, due diligence is necessary. If you receive correspondence you believe to be suspicious, you should conduct your own due diligence by checking the authenticity of the correspondence by contacting the law firm directly by reliable and established means.
You can also contact the SRA directly to find out if individuals or firms are regulated and authorised by the SRA and verify an individual’s or firm’s practising details. Other verification methods, such as checking public records (e.g. telephone directories and company records), may be required in other circumstances.
Compliance Support for Law Firms
We at RACO are always at hand to provide tailored guidance to help you make the most informed and beneficial decisions. We help you understand the recurrent regulatory shifts and work with you to provide solutions. With our team of professional specialists and our renowned legal expertise, we can work with your firm to ensure you are never left unprepared in the wake of legal changes or cyber threats.
For more information on how we can help, call our consultants on 0203 985 8550 or email us at info@regulationandcomplianceoffice.co.uk
