In this article
Client Money Protection and Compliance Records: What Agents Must Hold in 2026
Agents holding client money must belong to an approved client money protection scheme covering the maximum amount held, and must display and publish their membership certificate. Scheme rules must also require written client money procedures, published on the website, records showing all dealings with client money, an FCA authorised client account, and appropriate professional indemnity cover.
This article is for general information purposes only and does not constitute legal advice. Letting agents should seek independent legal advice for their specific circumstances. It describes the position in England.
What client money protection actually is
Client money protection is a scheme of last resort that compensates a landlord or tenant whose money has been lost through the failure, theft or misappropriation of a property agent. It has been compulsory for property agents holding client money in England since 1 April 2019, under the Client Money Protection Schemes for Property Agents (Requirement to Belong to a Scheme etc.) Regulations 2019.
Two clarifications save a surprising amount of trouble.
The three tenancy deposit schemes are not client money protection schemes. This confusion appears regularly in Trading Standards enforcement. Deposit protection covers a specific sum held for a specific purpose. Client money protection covers rent, float, works money and anything else passing through the client account.
It is a scheme of last resort. A claimant is expected to pursue the firm, its insurers and any other available route first. That is one reason professional indemnity cover sits behind the whole structure, a point returned to below.
The two statutory duties, and what they cost
| Duty | Source | Maximum penalty |
|---|---|---|
| Belong to an approved or designated scheme, at a membership level protecting the maximum amount of client money the agent may hold | Regulation 3, 2019 Regulations | £30,000 |
| Display the certificate in each office, publish it on the website, and provide a copy free of charge to anyone reasonably requiring it | Regulation 4, 2019 Regulations | £5,000 per breach |
| Notify clients in writing of a change in scheme membership details | Regulation 4, 2019 Regulations | £5,000 per breach |
The cover level point in regulation 3 is the one agencies get wrong quietly. Membership must protect the maximum amount of client money the agent may hold, not the amount typically held. An agency that has grown, taken on a block of managed properties, or started handling refurbishment funds may be under-covered without anything visibly changing.
Local authority enforcement follows the standard civil penalty process: a notice of intent within six months of the authority having sufficient evidence, 28 days for representations, and 28 days from the final notice to appeal to the First-tier Tribunal. The wider set of branch and client file duties sits alongside these.
The seven conditions most agents have never read
The obligations above are the visible half. The other half sits in regulation 5(2) of the Client Money Protection Schemes for Property Agents (Approval and Designation of Schemes) Regulations 2018, which specifies conditions that a scheme must impose on its members before it can be approved. In substance these are operating requirements for every agent holding client money.
Scheme members must:
- Have and comply with written procedures for handling client money. Not merely have them. Comply with them.
- Publish those procedures on their website, where they have one.
- Provide a copy of those procedures free of charge to any person who may reasonably require one.
- Keep records and accounts showing all dealings with client money.
- Repay client money without delay, including where feasible any interest earned, once there is no longer a requirement to retain it or the client asks for it.
- Hold client money in a client money account with a bank or building society authorised by the Financial Conduct Authority.
- Hold and maintain professional indemnity insurance cover appropriate for the member's size, income, type of work and the amount of client money held.
Four of those seven are documentation requirements. An agency with an experienced bookkeeper and no written procedure is not compliant with condition 1, however well the client account is actually run. An agency with written procedures sitting in a folder and not on the website is not compliant with condition 2.
Approved schemes must also accept claims for compensation for at least twelve months after the date on which the circumstances giving rise to a claim occurred, which is worth knowing when a departing member of staff turns out to have created a problem.
What the client money records need to show
Condition 4 requires records and accounts showing all dealings with client money, and the practical standard that schemes and auditors apply is reconstruction: could a third party follow the money from receipt to destination without asking anyone?
That generally means a ledger per client and per property, with a description identifying the property, showing every receipt and payment with its date, so that each client ledger balance and the total of all client ledgers can be reconciled to the client account statement. Overdrawn individual client ledgers are treated seriously, because a negative balance on one ledger means that client's obligations have been funded from another client's money.
Regular reconciliation between the client account and the sum of the ledgers is the control that catches almost everything else, and it is the first thing an auditor asks to see.
Retention: how long to keep what
There is no single retention period across the client file. Different obligations run from different events, and the longest applicable one governs.
| Record | Indicative period | Source of the period |
|---|---|---|
| Customer due diligence documents and supporting transaction records | Five years from completion of the transaction or the end of the business relationship, and not more than ten years for certain records, after which personal data must be deleted subject to exceptions | Regulation 40, Money Laundering Regulations 2017 |
| Gas safety records | Until two further checks have been carried out on that appliance or flue, or two years from the last check where the appliance has been removed | Regulation 36(3)(c), Gas Safety (Installation and Use) Regulations 1998 |
| Client money records | Per scheme rules; agents are advised to check their own scheme's requirement | Regulation 5(2)(d), 2018 Approval Regulations, as implemented by each scheme |
| Right to Rent check copies | Per current Home Office code of practice; agents are advised to confirm the current period rather than rely on summaries | Immigration Act 2014 and associated guidance |
| Tenancy file generally, for contractual claims | Commonly aligned to the six year limitation period for actions founded on simple contract | Section 5, Limitation Act 1980 |
| Company accounting records | Commonly six years from the end of the accounting period | Companies Act 2006 and HMRC requirements |
Two tensions are worth naming. Article 5(1)(e) of the UK GDPR requires that personal data is not kept longer than necessary, which sits against the instinct to keep everything forever. And regulation 40(5) of the Money Laundering Regulations positively requires deletion of personal data once the period expires, subject to defined exceptions including retention for the purposes of legal proceedings. An agency with no retention policy is exposed at both ends.
The review that catches most of it
A short annual exercise covers the ground.
- Confirm scheme membership is current and that the cover level still matches the maximum client money the agency may hold
- Check the certificate is displayed in every office, published on the website, and that someone knows how to produce it on request
- Confirm the written client money procedures exist, are current, are published, and describe what the agency actually does
- Confirm the client account is with an FCA authorised institution and is designated correctly
- Reconcile the client account to the client ledgers, and investigate any overdrawn ledger
- Confirm professional indemnity cover is appropriate to current size, income, work type and client money held
- Confirm a written retention policy exists and is being applied
The last one is the one most often absent, and it is the cheapest to fix.
Compliance documents held per property, with the date obtained and the date served recorded against each, make retention and production straightforward rather than a search exercise. LLCR's Agency plan holds that position across a portfolio with role based team access.
Frequently asked questions
Does a letting agent need client money protection if they only pass rent straight through to the landlord?
The requirement in regulation 3 of the 2019 Regulations applies to property agents who hold money on behalf of a client, and money passing through a client account is held even if it is held briefly. The membership must protect the maximum amount of client money the agent may hold, not the average. The penalty for failing to belong to an approved or designated scheme is up to £30,000, and a further penalty of up to £5,000 per breach applies to the transparency requirements. Agents unsure whether their arrangements bring them within the requirement are advised to take advice rather than assume.
What client money procedures does an agent have to have in writing?
Regulation 5(2) of the 2018 Approval Regulations sets out conditions that approved schemes must impose on members. These include having and complying with written procedures for handling client money, publishing those procedures on the member's website where one exists, providing a copy free of charge to anyone who may reasonably require it, keeping records and accounts showing all dealings with client money, repaying client money without delay when it is no longer required, holding client money in an account with an FCA authorised bank or building society, and holding professional indemnity insurance appropriate for the member's size, income, type of work and amount of client money held.
How long should a letting agent keep compliance records?
There is no single period, because different obligations run from different events and the longest applicable one governs. Customer due diligence records must be kept for five years from the end of the business relationship under regulation 40 of the Money Laundering Regulations 2017, with a ten year cap on certain records and a positive duty to delete personal data afterwards subject to exceptions. Gas safety records must be kept until two further checks have been carried out on that appliance. Tenancy files are commonly retained in line with the six year limitation period for contract claims. Agencies are advised to hold a written retention policy rather than default to keeping everything indefinitely, because the UK GDPR works in the opposite direction.
This article is provided for informational purposes only and does not constitute legal advice. LLCR is a compliance management platform, not a law firm. For advice specific to your situation, consult a qualified solicitor.