Policy version control: why "which version applied on that date?" matters

It might be an SRA inspector reviewing a closed file, a complaint that reaches the Legal Ombudsman a year after completion, or your own insurer after a claim. A historic policy helps show what your firm required at the time. It sits alongside the law, regulatory requirements, professional standards and the circumstances of the matter, but it is often the best evidence of what staff were told to do. If you cannot produce the version that applied, you lose that evidence.

What the rules require you to record

Two sets of rules make this more than good housekeeping.

• For AML, regulation 19(1)(c) of the Money Laundering Regulations 2017 requires a written record of your policies, controls and procedures, of any changes made after review, and of the steps taken to tell people in the firm about them. Regulation 19(2)(b) requires them to be approved by senior management.
• More generally, paragraph 2.2 of the SRA Code of Conduct for Firms requires you to keep and maintain records to demonstrate compliance with your obligations under the SRA's regulatory arrangements. Paragraph 2.1 requires effective systems and controls to make sure you comply.

Put together, the rules require a written record of the AML policies, the changes made on review, senior management approval and how staff were told. The rest of this article is our recommended way of meeting that, not a format the regulations prescribe. A folder of Word documents called "AML policy FINAL v3 (2)" covers none of those reliably.

How version control usually breaks

• Edits are made directly to the live document, so the previous wording is lost.
• Copies sit in email attachments, the shared drive and someone's desktop, and nobody is sure which is current.
• The reason for a change lives in someone's head or an email thread, not with the policy.
• Approval is a comment in a meeting, with no record of what exactly was approved.
• Staff are emailed the new version, but nobody can show who read it.
• Policies are reviewed on an anniversary, not when the law or the firm changes.

What good looks like

• One controlled copy of each policy, with every earlier version kept and dated.
• Every change carries a reason, whether that is a law change, an inspection finding, an audit recommendation or a new service line.
• Every version is approved by a named director or partner before it takes effect.
• An effective-from date on each version, so you can answer "which version applied on 14 March?" without a search.
• A record of how and when staff were told, and where training is needed, a record that they completed it.
• A link from the policy to the process that carries it out, so a policy change prompts a look at the process.
• Review triggered by events as well as the calendar. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 changed wording that many AML policies quote directly, and the relevant changes took effect on 30 June 2026.

The same discipline applies to the firm-wide risk assessment that sits above the AML policy. We cover that in keeping your firm-wide risk assessment live.

How ComplianceMinder handles it

Version control is the foundation ComplianceMinder was built on. Policies are controlled and versioned. Every change needs a reason and director approval, and old versions are archived in your SharePoint. Twice a year ComplianceMinder scans SRA, Lexcel and Law Society updates and proposes policy changes, and a policy change can flow through to a proposed process change. Staff training modules end in a short quiz and update each person's training record automatically.

See how ComplianceMinder works or look at our training modules.