How CoverProof achieves Section 250 compliance

Upload your SM&CR register as a CSV — the same format exported from the FCA Register Extract Service (RES). CoverProof accepts the FCA standard 17-file pipe-delimited format or a simplified CSV with individual names, roles, and function codes. The import process validates the data structure and flags malformed rows before any classification runs.

What we check: FRN consistency, duplicate IRNs, malformed function codes, missing mandatory fields. What we do not check: the accuracy of your source data — CoverProof is a classification and workflow tool, not an auditor of your HR records.

CoverProof uses Claude (Anthropic's AI model) with structured JSON output to assess each individual against the verbatim s.250(3) statutory test: does this person play a significant role in (a) the making of decisions about how the whole or a substantial part of the activities of the organisation are to be managed or organised, or (b) the managing or organising of the whole or a substantial part of those activities? The test covers all activities — not only financial ones — and is independent of FCA approval status.

Classification output per individual: (1) Exposure likelihood — HIGH / MEDIUM / LOW, (2) Confidence score (0–100) and tier — High Confidence / Moderate Confidence / Low Confidence — Review Required, (3) Reasoning steps — the analysis pathway applied, (4) Rationale — plain-English summary, (5) Uncertainty flags identifying information gaps. All Medium and Low-confidence classifications are flagged for human review. Your compliance team makes the final call on every individual.

The gap report shows every individual classified as IN scope (requiring a declaration) or BORDERLINE (requiring human review), with a plain-English explanation of why. Compliance staff can override any AI classification — marking an individual as OUT of scope with a documented reason, or promoting a BORDERLINE case to IN. Override decisions are recorded in the audit trail.

CoverProof does not send any declaration without explicit approval. The review step is mandatory. This is not a configuration option.

Once approved, CoverProof generates a unique signed URL for each declaration recipient. The URL contains a cryptographically signed token that identifies the specific declaration, the firm, and the recipient. Recipients click the link, review the declaration text, and submit. No account creation. No password. No friction.

Declaration emails are sent via Resend with delivery tracking. CoverProof records: send timestamp (UTC), delivery confirmation, open event, completion timestamp, IP address at completion. All timestamps are server-side — not self-reported by the recipient.

Every declaration has a RAG (Red/Amber/Green) status. Green: completed. Amber: sent but not yet completed, within the expiry window. Red: not completed and approaching or past expiry. CoverProof sends automated expiry reminders and allows one-click re-sending to non-responders. The evidence pack records every re-send attempt — which is itself legally significant documentation of reasonable steps taken.

Declaration expiry periods are configurable. The default is 30 days from send date. Expired declarations that have not been completed trigger an automatic alert to the compliance team.

CoverProof generates a PDF/A-3B document (ISO 19005-3 compliant) containing: the gap analysis report with all classifications and overrides; a declaration status log showing every send, re-send, completion, and expiry event; the SHA-256 document hash recorded in the CoverProof audit database at generation time; and an immutable XML audit log embedded in the PDF.

PDF/A-3B is the archival standard for long-term document integrity. The SHA-256 hash recorded at generation allows verification at any future point that the file has not been modified. These properties are designed to meet the documentation standards required in legal and regulatory proceedings. Courts ultimately determine admissibility — the pack provides the strongest evidential foundation currently achievable for this type of compliance record.