How we are regulated, and what you can hold us to

A&O SHEARMAN is authorised and regulated by the Solicitors Regulation Authority. Our work is carried out in accordance with the SRA Standards and Regulations.

• Solicitors we employ are regulated individually by the SRA and are bound by the SRA Code of Conduct.
• The SRA Standards and Regulations are published in full at sra.org.uk and govern our professional obligations.
• Professional indemnity insurance is maintained at the level required by the SRA; details are available on request.
• Our registered office and contact details are published on every engagement letter and at the foot of this site.

We set out scope, responsibility and cost in writing before work begins, so clients always know who is acting and on what basis.

• Every engagement opens with a letter of engagement setting out scope, the responsible partner and the basis of charging.
• Fee estimates are given in writing, and we tell clients promptly when an estimate needs to change.
• Conflict and anti-money-laundering checks are completed before a matter is opened.
• Clients can request a written update on the status and cost of a matter at any time.

We process personal data in line with UK GDPR and the Data Protection Act 2018, and only for the purposes for which it was provided.

• Personal data is collected for defined purposes — providing legal services, regulatory compliance and firm administration.
• Access to client data is restricted to the people working on the matter and those supervising it.
• Data subjects may request access to, correction of, or erasure of their personal data by writing to our contact address.
• Data retention follows our engagement terms and applicable professional-record obligations.

Client confidentiality is enforced technically, not only contractually. Our systems are built around least-privilege access and a full audit record.

• Access to matters and documents is role-based, and every consultant sees only the work assigned to them.
• Data is encrypted in transit, and authentication is required for every part of the client and consultant portal.
• Administrative actions — user creation, access changes, payments — are written to an immutable audit record.
• Suspected incidents are triaged, logged and escalated under our internal incident procedure.

We aim to meet WCAG 2.2 level AA across this website and the secure portal, and we treat accessibility defects as bugs rather than enhancements.

• The site is operable by keyboard alone, with a visible focus indicator on every interactive element and a skip-to-content link on each page.
• Colour is never the only means of conveying status; text alternatives are provided for meaningful images.
• Content is structured with landmarks and a single, ordered heading hierarchy for screen-reader users.
• If you encounter a barrier, tell us at the contact address below and we will respond with a remedy or a timescale.

If something goes wrong we want to hear about it quickly, and we will handle it under a published procedure.

• Raise the concern first with the partner responsible for your matter; most issues are resolved at this stage.
• If that does not resolve it, write to us at the contact address below and we will acknowledge your complaint in writing.
• We will investigate and give you a substantive written response within eight weeks.
• If you remain dissatisfied you may be entitled to refer the matter to the Legal Ombudsman, and complaints about our conduct can be reported to the SRA.