The compliance landscape for Scottish charities
Plain English guides to the obligations that matter most for trustees and staff.
Overview
Understanding the compliance landscape
Scottish charities operate under a distinct legal and regulatory framework. The rules differ in important ways from the rest of the UK, and they have changed significantly in recent years. For trustees, senior staff and volunteers who came to their roles through passion for a cause rather than a background in governance, keeping up with what is required can feel like a full-time job in itself.
This section sets out the key areas of compliance obligation in plain English. It is not legal advice. It is a practical starting point for anyone in a charitable organisation who wants to understand what the law expects of them and where their charity might have gaps.
A note on this guidance
The guides below are a practical introduction to the key areas of compliance obligation for Scottish charities. They are not legal advice and should not be treated as a substitute for it. They are not exhaustive: the compliance landscape for any individual charity will depend on its specific activities, structure, income and the people it works with. Where the stakes are high or the position is unclear, trustees should seek qualified legal or professional advice.
How widespread are the gaps?
We have read the whole Scottish Charity Register through open data to answer exactly that. The State of the Scottish Charity Sector sets out what the register shows, and the interactive Sector Dashboard lets you explore the same picture for your own council area.
Governance and trustee duties
What OSCR expects of Scottish charity trustees
Every Scottish charity is regulated by the Office of the Scottish Charity Regulator (OSCR). OSCR holds trustees personally accountable for how their charity is run. This is not a formality. Trustees can face personal liability if a charity is mismanaged, and OSCR has the power to remove trustees, restrict a charity’s activities, or remove it from the register entirely.
The Charities and Trustee Investment (Scotland) Act 2005 sets out the legal framework. Within that framework, OSCR has published guidance on what it expects from trustees in practice. The core obligations fall into six areas.
The six trustee duties
Act in the interests of the charity
Trustees must put the charity’s interests above their own or anyone else’s. Decisions must be made for the benefit of the charity and its beneficiaries, not for personal gain or the interests of connected parties.
Act in accordance with the governing document
Trustees must understand what their constitution, trust deed or articles of association say and act within those boundaries. Activities outside the charity’s stated purposes require OSCR approval before they are undertaken.
Act with care and diligence
Trustees are expected to bring reasonable care and skill to their role. They do not need to be experts in everything, but they are expected to take decisions seriously, seek advice where needed, and act with the diligence a reasonable person would apply to their own affairs.
Manage conflicts of interest
Trustees must identify, declare and manage conflicts of interest. This includes situations where a trustee, or someone connected to them, stands to benefit from a decision the charity is making. Most governing documents require conflicted trustees to withdraw from discussion and not vote.
Not receive unauthorised benefit
Trustees cannot be paid for their trustee role unless the governing document explicitly permits it and OSCR has not objected. Benefits in kind, expenses above reasonable levels, or employment of trustees without proper authorisation can all constitute a breach.
Comply with OSCR’s requirements
Trustees must submit the annual return, manage serious issues as they arise (OSCR ended its Notifiable Events process in April 2024; unresolved serious issues are reported through OSCR’s raise a concern route), and cooperate with OSCR enquiries. Late or inaccurate returns are a common and avoidable source of regulatory concern.
How well your charity meets each of these duties depends on your specific circumstances. The Charity Compliance Engine reviews your position across all six areas and identifies where attention is needed.
Regulatory change
The 2023 Act: what changed for Scottish charities
The Charities (Regulation and Administration) (Scotland) Act 2023 made the most significant changes to Scottish charity law since the 2005 Act. Most provisions came into force in 2024 and 2025. Many charities have not yet fully assessed what these changes mean for them in practice.
Key changes trustees, staff and volunteers should be aware of
Trustees must now be named on the public register
OSCR now publishes the names of charity trustees on the Scottish Charity Register. This is a significant change from the previous position where trustee names were held by OSCR but not published. Trustees need to be aware that their involvement in a charity is publicly visible.
Annual accounts are now published in full on the register
Since 9 March 2026, the annual report and accounts every charity submits to OSCR are published in full on the Scottish Charity Register for five years, without redaction. Trustees should review what personal information their accounts contain, particularly the names of trustees and volunteers, before submission.
Strengthened OSCR powers
OSCR has new and extended powers to investigate charities, disqualify trustees, and take action against charities that are not meeting their obligations. The bar for regulatory intervention has not changed, but OSCR’s ability to act on concerns has been strengthened.
Charity names and working names
The 2023 Act gives OSCR clearer powers to direct charities to change their name where it is misleading, offensive or too similar to another charity. Charities operating under a working name different from their registered name should confirm they are meeting the requirements for how both names are used.
New disqualification grounds for trustees
The 2023 Act extended the grounds on which a person is automatically disqualified from acting as a charity trustee. Beyond trustees, charities should also satisfy themselves that those in senior management positions and volunteers working in regulated roles meet the relevant suitability and fit and proper person requirements. Boards should ensure that all trustees, senior staff and key volunteers have reviewed the applicable criteria and confirmed their eligibility.
The CCE reviews your charity’s position against current regulatory requirements, including the changes introduced by the 2023 Act, and identifies any actions needed.
People and safeguarding
Safeguarding obligations: what the law requires
Safeguarding is one of the areas where small charities are most commonly found to have gaps. The obligations are real, the risks of getting it wrong are serious, and the requirements are not always straightforward to interpret for smaller organisations without a dedicated HR or compliance resource.
The PVG Scheme
The Protection of Vulnerable Groups (Scotland) Act 2007 established the PVG Scheme, administered by Disclosure Scotland. Charities that work with children or protected adults in a regulated role are legally required to carry out PVG scheme checks before those individuals begin their role. Regulated work has a specific legal definition. Not every activity involving children or vulnerable adults falls within it, but many do.
A common mistake is to treat PVG checks as a one-off requirement. Scheme membership involves ongoing disclosure obligations. Members must disclose new information relevant to their suitability as it arises.
Safer recruitment
PVG checks are one element of safer recruitment, not the whole of it. OSCR and Scottish Government guidance expects charities working with vulnerable groups to have a safer recruitment policy that covers how roles are designed, how candidates are assessed, how references are taken, and how decisions are made. A PVG check on its own does not constitute a safer recruitment process.
Safeguarding policies
Charities working with children or protected adults are expected to have a written safeguarding policy. The policy should name a designated safeguarding lead, set out how concerns are reported and investigated, and be reviewed regularly. OSCR regards an absent or out-of-date safeguarding policy as a governance concern, regardless of whether a safeguarding incident has occurred.
Adult support and protection
The Adult Support and Protection (Scotland) Act 2007 creates specific obligations around adults who may be at risk of harm. Charities working with adults at risk need to understand what the Act requires of them, including when they are obliged to refer concerns to the local authority and how that process works.
Safeguarding requirements vary significantly depending on what your charity does and who it works with. The CCE assesses your specific activities and identifies the obligations that apply to you.
Data protection
Data protection and GDPR: the basics for charities
UK GDPR applies to Scottish charities in the same way it applies to any other organisation that processes personal data. The size of the charity is not a factor in whether the law applies, though it does affect some of the specific obligations. Most charities hold personal data: donor details, volunteer records, beneficiary information, staff files. All of it is subject to data protection law.
Lawful basis for processing
Every time a charity processes personal data, it needs a lawful basis for doing so. There are six lawful bases under UK GDPR. The most commonly used by charities are consent, legitimate interests, and legal obligation. The choice of lawful basis matters: it affects what rights individuals have over their data and what the charity must do to protect it.
Many charities default to consent for everything. This is often the wrong choice. Consent must be freely given, specific, informed and unambiguous. It can be withdrawn at any time. For data the charity genuinely needs to hold, legitimate interests or legal obligation may be a more appropriate and more robust basis.
Privacy notices
Charities must tell individuals what personal data they hold about them, why they hold it, how long they will keep it, and what rights the individual has. This is done through a privacy notice. A privacy notice is not a one-page disclaimer on a website. It needs to be accessible, written in plain English, and kept up to date as the charity’s data processing activities change.
Data retention
UK GDPR requires that personal data is not kept for longer than necessary. Charities need a data retention policy that sets out how long different categories of data are held and why. In practice, many charities hold data indefinitely by default, which is a breach of the law regardless of whether it causes harm.
ICO registration
Most organisations that process personal data are required to pay a data protection fee to the Information Commissioner’s Office and register as a data controller. This is a legal requirement under the Data Protection Act 2018, not an optional formality. Many small charities are unaware of this obligation or assume that their size or charitable status exempts them. It does not.
The annual fee is tiered by organisation size and turnover. Most small charities fall into the lowest tier, which is a modest cost. Failure to register is a criminal offence and the ICO actively pursues unregistered organisations. Registration also requires charities to keep their entry up to date: changes in the types of data processed, the purposes for processing, or the organisation’s contact details must be notified to the ICO promptly.
Subject access requests
Any individual has the right to request a copy of the personal data a charity holds about them. This is a subject access request, and charities have one calendar month to respond. Many small charities are not prepared for this. Having a process in place before a request arrives is far less stressful than building one under a one-month deadline.
Data protection obligations depend on what data your charity holds and how it is used. The CCE reviews your specific data processing activities and identifies the policies and processes you need to have in place.
Employment and volunteers
Employment law and volunteers: what Scottish charities need to know
Employment law applies to Scottish charities in the same way it applies to any other employer. The charitable status of an organisation does not reduce its obligations to staff. Many charities also rely heavily on volunteers, and the legal boundary between a volunteer and a worker is less clear than many trustees assume.
Volunteers and the risk of worker status
A person is a volunteer if they give their time freely without any contractual obligation to do so and without receiving anything that could be treated as pay. The moment a charity provides regular payments beyond genuine out-of-pocket expenses, or creates an expectation that a volunteer will turn up and perform specific tasks, the relationship may have shifted to one that carries employment law obligations.
The National Minimum Wage Act 1998 does not apply to genuine volunteers, but it does apply to workers. Charities that blur the line between volunteers and paid workers can find themselves exposed to back-pay claims and HMRC scrutiny. Volunteer agreements should be carefully drafted to avoid creating a contractual relationship.
Contracts and written statements
The Employment Rights Act 1996 requires employers to provide employees with a written statement of particulars from their first day of employment. This is not optional. The statement must cover pay, hours, holiday entitlement, notice periods, sick pay, and disciplinary and grievance procedures. Charities without up-to-date contracts in place are exposed at employment tribunal.
Equality and protected characteristics
The Equality Act 2010 protects employees, volunteers and service users from discrimination on the basis of nine protected characteristics: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, and sexual orientation. Charities must ensure that their recruitment practices, working conditions and service delivery do not discriminate directly or indirectly on any of these grounds.
For disabled employees and volunteers, charities have a specific duty to make reasonable adjustments to remove barriers that would otherwise put the disabled person at a disadvantage. What counts as reasonable depends on the size and resources of the organisation, but the duty applies regardless of size.
Working time and annual leave
The Working Time Regulations 1998 entitle workers to a minimum of 5.6 weeks paid annual leave per year, rest breaks during the working day, and a maximum average working week of 48 hours (unless the individual has signed a valid opt-out agreement). These entitlements apply from the first day of employment. Charities with staff working irregular or flexible hours need to ensure they are calculating leave entitlement correctly.
Employment obligations depend on whether your organisation has paid staff, how volunteers are engaged, and the activities they carry out. The CCE reviews your specific arrangements and identifies where your policies and contracts may have gaps.
Health and safety
Health and safety obligations for Scottish charities
Health and safety law applies to every Scottish charity that has employees or engages volunteers. The duty of care an organisation owes to its staff, volunteers, and the people it works with is not reduced by charitable status. For many small charities, health and safety is treated as a box-ticking exercise rather than a genuine governance obligation. That approach creates real risk.
The employer’s duty of care
The Health and Safety at Work etc. Act 1974 places a general duty on employers to ensure, so far as is reasonably practicable, the health, safety and welfare of all employees. This extends to volunteers in many circumstances. The duty covers the physical working environment, equipment, working practices and the provision of adequate training and supervision.
Charities with five or more employees are required to have a written health and safety policy. The policy must set out who is responsible for health and safety within the organisation and how risks are managed in practice. A policy that exists only on paper and is not followed provides no protection and may make the position worse in the event of an incident.
Risk assessments
The Management of Health and Safety at Work Regulations 1999 require employers to carry out suitable and sufficient risk assessments for all activities that could cause harm to employees, volunteers or others. Risk assessments do not need to be lengthy documents. They need to be honest, specific to the activities being carried out, and acted on.
Common areas where charities fail to carry out adequate risk assessments include lone working, manual handling, community outreach activities, and working with individuals who present a risk of challenging behaviour. Where a charity works with children or adults at risk, the risk assessment must take account of the specific vulnerabilities of the people involved.
Volunteers and health and safety
Health and safety law does not draw a sharp line between employees and volunteers. Charities have a duty to protect volunteers from risks arising from their activities in the same way they would protect paid staff. This includes providing adequate induction, training, supervision and equipment, and ensuring that volunteers are not asked to carry out tasks beyond their competence or in conditions that put them at risk.
Incident reporting
Certain workplace accidents, injuries and dangerous occurrences must be reported to the Health and Safety Executive under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013. Separately, serious incidents involving beneficiaries, significant harm, or events that could damage public trust in the charity should be managed by the trustees and, where they cannot be resolved satisfactorily, reported to OSCR through its raise a concern route. The RIDDOR duty applies regardless, and overlooking either route can compound the consequences of an incident significantly.
Health and safety obligations depend on the nature of your charity’s activities, the environment you work in, and who you work with. The CCE assesses your specific circumstances and identifies the policies, risk assessments and processes you need to have in place.
Finance, fundraising and resources
Financial management and fundraising compliance for Scottish charities
Financial mismanagement is one of the most common reasons OSCR investigates Scottish charities. Trustees are personally responsible for ensuring that the charity’s finances are properly managed, its accounts are accurate, and its funds are used only for charitable purposes. Fundraising compliance adds a further layer of obligation that many smaller charities have not fully assessed.
Annual accounts and independent examination
The Charities Accounts (Scotland) Regulations 2006 set out how Scottish charities must prepare and present their annual accounts. Charities below the audit threshold must have their accounts independently examined. The examiner must be independent of the charity and have the skills to carry out the examination properly. Appointing a friend of the board who happens to have a financial background does not meet the requirement if that person is not genuinely independent.
Since 9 March 2026, the accounts every charity submits to OSCR are published in full on the Scottish Charity Register for five years, without redaction. Trustees should review what personal information their accounts contain before submission.
Reserves policy
OSCR expects every charity to have a considered reserves policy: a document that explains how much the charity aims to hold in unrestricted reserves, why that level is appropriate, and what the reserves are for. A reserves policy is not a target to maximise reserves. It is a governance document that demonstrates the board has thought seriously about financial sustainability and risk.
Charities with no reserves policy, or with a policy that simply states a figure without any rationale, are routinely identified as having a governance gap. The policy should be reviewed annually and updated when the charity’s circumstances change.
Financial controls and fraud prevention
The Fraud Act 2006 and the Bribery Act 2010 both apply to Scottish charities. Fraud by abuse of position is a particular risk in smaller organisations where financial controls are weak and a small number of individuals have unsupervised access to funds. The Bribery Act requires organisations to have adequate procedures in place to prevent bribery. For most small charities this means a clear anti-bribery policy, a gifts and hospitality register, and staff and volunteer awareness.
Practical financial controls that OSCR expects to see in place include dual authorisation for payments above a threshold, segregation of duties between those who approve expenditure and those who process it, regular bank reconciliation, and trustee oversight of management accounts at every board meeting.
Anti-money laundering obligations
The Proceeds of Crime Act 2002 requires anyone who knows or suspects that a transaction involves the proceeds of crime to make a suspicious activity report to the National Crime Agency. This obligation applies to charity staff and trustees. Charities that receive large cash donations, work internationally, or operate in sectors identified as higher risk for financial crime should ensure they have assessed their exposure and have appropriate controls in place.
Fundraising compliance
Scottish charities that fundraise from the public are subject to specific legal requirements governing how fundraising is conducted. Collections in public places require a permit from the local authority. Fundraising communications must be honest, must not place undue pressure on potential donors, and must comply with data protection law in how donor information is collected and used.
Gift Aid allows charities to reclaim tax on eligible donations from UK taxpayers. To claim Gift Aid, a charity must be recognised by HMRC, must hold a valid Gift Aid declaration from the donor, and must keep accurate records of all claims made. Errors in Gift Aid claims are a common source of HMRC compliance action against charities.
Financial obligations vary depending on your charity’s income, how it raises funds, and how it manages its resources. The CCE reviews your specific financial governance arrangements and identifies where policies, controls or processes need to be strengthened.
Know the landscape. Know where your charity stands.
Understanding the regulatory framework is the first step. Knowing how your charity measures against it is the second. The Charity Compliance Engine does both, in a single structured session calibrated to your charity.