I received a CoverProof request — is this legitimate?

Yes, if you received the email from your firm’s compliance team. CoverProof is a compliance platform used by FCA-regulated firms in the UK to manage their obligations under Section 250 of the Crime and Policing Act 2026.

The email was sent by your firm, not by CoverProof. CoverProof provides the platform that your firm uses to send declaration requests; the request itself is from your employer or a firm you work with.

If you are unsure whether the email is genuine, contact your firm’s compliance team directly (not by replying to the declaration email) to verify.

Section 250 of the Crime and Policing Act 2026, which came into force on 29 June 2026, provides that where a “senior manager” of a firm commits a criminal offence within the scope of their authority, the firm also commits that offence.

Your firm has assessed your role and concluded that it may fall within the s.250(3) functional definition of “senior manager” — someone who plays a significant role in making decisions about, or in managing or organising, the whole or a substantial part of the firm’s activities. This assessment covers individuals whether or not they are FCA-approved.

The declaration is your firm’s way of documenting that you have been informed of this assessment and that you understand the governance framework that applies to your role.

Completing the form creates a record that you have received and acknowledged the s.250 scope assessment communicated to you by your firm. Specifically, by signing you confirm that:

• You have been informed of the Section 250 statutory mechanism and understand how it applies to individuals in senior roles.
• Your firm has assessed that your role may fall within the s.250(3) functional definition of “senior manager”, and you understand that this is your firm’s governance judgment.
• You confirm receipt of the s.250 scope assessment communicated to you for your role.

The declaration is a governance receipt — it documents that your firm has communicated its s.250 assessment to you and that you have acknowledged receiving it.

Completing the form creates a Simple Electronic Signature (SES) under the eIDAS Regulation and the Electronic Communications Act 2000. The signature records your typed name, the submission timestamp, and your IP address — together these create an audit record that a court or regulator can examine.

A SES is a form of evidence. It indicates that a person intentionally submitted the form at a recorded time. Courts assess the weight of any particular signature on the facts of the case.

This declaration is not a statutory declaration under the Statutory Declarations Act 1835 (which requires a commissioner of oaths and has specific criminal consequences for false statements). It does not create a contractual obligation on you and does not constitute a statutory defence under s.250 for you or your firm.

If you have legal concerns about what you are being asked to sign, consult your own solicitor before completing the form.

The declaration form includes an option to decline. If you decline, a record is created showing that you received the request and chose to decline, with any reason you provide.

Declining does not close the matter — your firm will follow up with you. If you believe your role has been incorrectly assessed, contact your firm’s compliance team directly to discuss it.

You may also ask your firm for the basis of the assessment before deciding whether to sign or decline.

The declaration link expires 30 days after it is issued. If you take no action, the link becomes inactive. Your firm will be able to see that the declaration was not completed, and your compliance team will likely follow up with a reminder email or direct contact.

Whether you are required by your employment contract or otherwise to complete the declaration is a matter between you and your firm. CoverProof does not have any authority to require you to complete the form — only your firm does.

When you submit the declaration, the following data is recorded in your firm’s compliance records on CoverProof:

• Your typed name (as entered by you)
• The submission timestamp (UTC)
• Your IP address at the time of submission
• A SHA-256 cryptographic hash of the submission record
• The unique declaration token associated with your invitation

This data is held by CoverProof on behalf of your firm. Your firm is the data controller; CoverProof is the data processor. For questions about how your personal data is used, retained, or can be exercised, contact your firm’s compliance or data protection team.

Yes. CoverProof operates a separate subdomain for declaration forms at declarations.coverproof.co.uk. This is intentional — it keeps the declaration pages isolated from the main application and allows external recipients to complete their declarations without needing an account on coverproof.co.uk.

The page will show your name, your role, and your firm’s name as pre-populated fields. If any of these are incorrect, contact your firm’s compliance team before completing the form.

Contact your firm’s compliance team. The declaration email was sent by your firm; they are best placed to answer questions about why you have been asked to complete it, what the assessment means for your role, and any concerns you have.

CoverProof is the platform your firm uses to manage the declaration cycle. CoverProof cannot advise you on your legal position or on your firm’s assessment of your role.