Serious incident reporting for charities

What a serious incident is, and whose rule it is

The Charity Commission for England and Wales defines a serious incident, in its guidance How to report a serious incident in your charity (last updated 16 January 2026), as “an adverse event, whether actual or alleged, which results in or risks significant” harm to the charity's beneficiaries, staff, volunteers or others who come into contact with it through its work; loss of the charity's money or assets; damage to its property; or harm to its work or reputation. “Significant” means “significant in the context of your charity, taking account of its staff, operations, finances and/or reputation”, so the same loss can be serious for a small village charity and minor for a national one.

Reporting is the trustees' job. The guidance says: “The responsibility for reporting serious incidents rests with the charity's trustees.” The work may be delegated to an employee or the charity's professional advisers, “However, all trustees bear ultimate responsibility for ensuring their charity makes a report, and does so in a timely manner.”

The test for timing is “promptly”, which the Commission defines as “as soon as is reasonably possible after it happens, or immediately after your charity becomes aware of it”. Charities should report themselves even when the police or another agency is involved, and “do not wait until someone is arrested, charged or convicted before doing this”. There is no fixed number of hours or days in England and Wales; the 72-hour clock people remember belongs to personal data breaches, which is a separate report to a separate regulator (section 04).

The legal footing is worth stating precisely. The Commission “requires charities to report serious incidents” in its guidance; no section of the Charities Act 2011 sets a free-standing duty to report each one. Three things give the requirement force. A charity with income over £25,000 must sign a declaration, as part of the annual return that section 169 of the Act requires, that nothing reportable went unreported. Section 60 makes it an offence knowingly or recklessly to give the Commission information that is false or misleading in a material particular, including through the annual return. And if trustees fail to report a serious incident that later comes to light, “the Commission may consider this to be mismanagement”, which may prompt regulatory action. The guidance gives the reason for reporting quickly: “Timely reporting allows the Commission to identify problems in charities at an early stage”. Below £25,000 there is no declaration, but the guidance says: “As a matter of good practice, all charities, regardless of size or income, should report serious incidents to the Commission promptly.”

This is the regime for charities registered in England and Wales. Northern Ireland and Scotland have their own regulators and different rules, set out in section 05.

What to report: the six categories

The Commission's guidance names six main categories of reportable incident, each with its own test:

• Protecting people and safeguarding. Abuse or mistreatment, actual or alleged, of beneficiaries that has resulted in or risks significant harm, where it happened while they were in the charity's care or someone connected with the charity, such as a trustee, staff member or volunteer, was responsible; other abuse of people who come into contact with the charity, connected to its activities; and breaches of policy that put people at significant risk of harm, “including failure to carry out relevant vetting checks which would have identified that a person is disqualified in law from holding their position within the charity”. The guidance says safeguarding should be a key governance priority for all charities, “not just those working with children or groups traditionally considered at risk”.
• Financial crimes: fraud, theft, cyber-crime and money laundering. “There is no minimum loss figure that should be reported”, and if there have been repeated incidents of low-value fraud, theft or cyber-crime, “the Commission would expect you to report this”. The guidance lists factors that make a fraud more serious, such as the person involved holding a senior or finance role, a pattern of incidents, money from a public appeal or a grant, and media interest.
• Large donations from an unknown or unverifiable source, or suspicious financial activity using the charity's funds. As a guide, trustees should report unverified or suspicious donations totalling £25,000 or more, and use their own judgement below that. Suspicious activity includes requests from third parties to cash a cheque for a large sum, convert large amounts of cash into another currency, or pay a fee to release funds to be donated.
• Other significant financial loss from any other cause, where it threatens the charity's ability to operate and serve its beneficiaries or its reserves cannot cover it – for example significant fire, flood or storm damage that destroys or seriously damages the charity's main premises. As a guide, any loss of funds or property “totalling £25,000 or more, or totalling less than £25,000 but which is in excess of 20% of the charity's income”. Falls in the value of investments, impairments, asset write-downs, pension deficits and bad debts need not be reported unless they pose a significant threat to the charity's solvency.
• Links to terrorism or extremism, including proscribed organisations, individuals subject to an asset freeze, or the kidnapping of staff.
• Other significant incidents. Insolvency; forced withdrawal of banking services without an alternative; a significant data breach or loss; a disqualified trustee or senior manager; a police investigation or a significant investigation by another regulator; major governance problems, such as mass resignation of staff or trustees, that leave the charity unable to operate; trustees or employees facing criminal proceedings in connection with the charity or their role in it; and incidents involving partners that materially affect the charity.

The money figures are guides, not floors. The Commission's own example is damage to a charity's main premises worth less than £25,000, or less than 20% of its income, that stops it delivering vital services, which may still be reportable. Criminal activity “will usually be reportable”; only in exceptional circumstances, such as “one-off theft of a very small amount of money”, will the Commission consider an incident involving crime not reportable.

Staffing incidents need judgement. The Commission does not expect every internal staffing incident to be reported, but a report should always be made where the harm to victims or the likely damage to the charity's reputation or public trust is particularly high, for example sexual misconduct by the chief executive or another person in a senior position or position of specific responsibility, such as the head of safeguarding. It also expects a report where the number and nature of staffing incidents point to widespread or systematic sexual harassment, abuse or other misconduct.

Routine inspections by Ofsted, the Care Quality Commission or Care Inspectorate Wales need not be reported unless they have resulted in significant adverse findings that place the charity's future in doubt, are likely to damage its reputation or public confidence in it, or relate to another category. Abuse that happens outside the charity – not connected with its activities, and not by a trustee, staff member or volunteer – is not normally reportable to the Commission, unless it is found or alleged that the charity did not handle it appropriately and harm resulted.

Deciding, and recording the decision

“It is the responsibility of the charity trustees to decide whether an incident is significant and should be reported.” Trustees may delegate the decision, but decisions made by others “should be reported back to trustees (particularly where incidents were ‘borderline’ and making a report was considered but it was decided not to make one)”.

A decision not to report is the one most likely to be questioned later. The guidance is direct: “If you decide not to make a report about something serious that has happened in your charity and the Commission later becomes involved, you will need to be able to explain why you decided not to report it at the time.” The same record is what the treasurer or chair relies on when signing the annual return declaration months afterwards. Deciding not to report is not deciding to do nothing: the guidance says, of a fraud, theft or cyber-crime judged not serious enough to report, that it is “still important that you handle the situation appropriately and take reasonable steps, perhaps by tightening financial controls and procedures, to ensure it doesn't happen again”.

Incidents involving partners need their own judgement. The Commission's guidance on reporting a serious incident when it involves a partner covers delivery partners and sub-contractors, trading subsidiaries, organisations the charity funds, and linked charities such as members of a federation. Where the charity's own funds, people or activities are involved, it calls this “the highest risk category”; where the public may not distinguish the charity from a partner with the same branding, a report may be needed “even if there is little or no impact on the charity's activities, finances or people”; where the charity is barely affected, a report would not usually be required, though the charity should still review its policies. In a federated structure, the Commission generally expects only the local charity concerned and the national or umbrella body to consider reporting, and one charity can make a joint report for several if it confirms its authority and sets out what each is doing.

A short decision log, kept by whoever the trustees have delegated reporting to and reviewed at each board meeting, answers most of the questions the Commission and the declaration will ask:

• the date the charity became aware, and how;
• what happened, in a sentence, without names;
• the category, and any guide figure considered (£25,000, 20% of income);
• who decided, when, and whether the full board of trustees was told;
• reported or not, with the reasons – especially for a borderline incident not reported;
• the Commission's reference number, the date of the report and of any updates;
• the other bodies told, with crime or case reference numbers.

The log sits naturally beside the charity's risk register, and the lead trustee for safeguarding usually reviews the safeguarding incidents in it; the safeguarding trustee guide covers the board's record of those decisions.

How to report, who else to tell, and what happens next

When something goes wrong, the guidance asks trustees to take immediate action to:

• prevent or minimise any further harm, loss or damage;
• report it to the Commission as a serious incident;
• report it to the police, and other relevant agencies, if a crime is suspected, and to any other regulator the charity is accountable to;
• plan what to say to staff, volunteers, members, the public, the media and funders;
• review what happened and prevent it from happening again.

Reports are made on the Commission's online form, Report a serious incident on behalf of the trustees, which also has a Welsh-language version. A trustee must confirm they have authority to report on behalf of the trustee body; anyone else must explain who they are, their relationship with the charity, and that they have the trustees' authority. The form asks for the date of the incident, what happened, the date the charity found out and how, the impact on beneficiaries, finances, staff, operations or reputation, whether the trustees are aware, which of the charity's policies or procedures relate to the incident and whether they were followed, the charity's response, meaning the steps the charity has taken to deal with it and to prevent similar incidents, and, where applicable, its media handling or press lines. It also asks for the charity's name and registration number, reference numbers and contacts at any police force or other organisation already told, and the names and registration numbers of any other charities involved. The Commission asks for enough detail to give it “a clear picture of what happened and when, the extent of any loss or harm, how you're dealing with it and the possible next steps”.

The initial report need not name the people involved. The form's own example is to say “an individual has stolen from the charity” rather than naming them, and the Commission will ask if it needs more. Some personal data is still required: the reporter's details, the name, date of birth and address of any disqualified trustee and the reason, and the contact at any other agency told. The Commission does not routinely guarantee that what it is told will be kept confidential. The form can be saved part-way and then downloaded and printed, so the charity can keep a copy of exactly what it said.

Material changes go in as an update on the same form, quoting the incident reference number from the confirmation email. That includes telling the Commission when a person alleged to be responsible is exonerated, or an allegation is found to be false or groundless.

Other bodies must be told separately; no report discharges another. The guidance says that if an incident involves actual or alleged crime, “you must also report it to the relevant agencies”:

• safeguarding crimes to the police (101 or a local station, with a crime reference number) and to the local authority and other relevant agencies – the safeguarding policy guide covers the referral routes, and the duty to refer to the DBS is separate again;
• fraud and cyber-crime to Report Fraud (which replaced Action Fraud in December 2025), getting a crime reference number and making clear you represent a charity; theft to the police on 101;
• links to terrorism or extremism to the police, through the National Crime Agency website, the Anti-Terrorist Hotline on 0800 789 321, or 101;
• a personal data breach to the Information Commission (still known as the ICO) without undue delay and, where feasible, within 72 hours under Article 33 of the UK GDPR, unless it is unlikely to result in a risk to people's rights and freedoms; the office of Information Commissioner was abolished on 30 September 2026 by section 118 of the Data (Use and Access) Act 2025. The data breach log guide covers the test;
• notifications to CQC, Ofsted or Care Inspectorate Wales where the charity runs care or early years services, which do not replace the Commission report and are not replaced by it (see incident reporting in care homes).

Terrorist finance carries its own legal duty. Under section 19 of the Terrorism Act 2000, a person who believes or suspects, from information met in the course of their trade, profession, business or employment, that someone has committed a terrorist property offence under sections 15 to 18 commits an offence if they do not disclose it to a constable as soon as is reasonably practicable. It is a defence to have a reasonable excuse, or for an employee to have disclosed under a procedure their employer has set up, which is one reason for a charity's procedure to name who takes such concerns to the police.

A charity's auditor or independent examiner has a separate duty to report matters of material significance to the Commission, which a trustees' report does not replace. Staff who suspect serious wrongdoing use the whistleblowing route instead: the serious incident framework is for trustees; an employee should usually raise the concern with the charity first under its whistleblowing policy, and can then report to the Commission, including anonymously, if it is not dealt with (see the whistleblowing policy guide).

After a report, the Commission confirms receipt and sends an incident reference number. It “will assess the nature and level of any risks and look at how you're dealing with the incident, and may take steps to verify the details, for example by contacting the police”, and then tells the charity the outcome. Any regulatory advice and guidance “will normally be limited to ensuring the trustees meet their legal duties”; “In the most serious cases the Commission may need to use its statutory powers in order to protect the charity and put it back on track.” The main ones: it can open a statutory inquiry under section 46 of the Charities Act 2011, after which it can suspend a trustee, officer or employee under section 76 or direct the trustees to take specified action under section 84. It does not deal with abuse itself: it “does not administer safeguarding legislation” and cannot prosecute, though it may refer concerns to the police, local authorities and the Disclosure and Barring Service.

The annual return declaration, and Northern Ireland and Scotland

Every registered charity with gross income over £10,000, and every charitable incorporated organisation, must file an annual return under section 169 of the Charities Act 2011, within 10 months of the end of its financial year. The Commission's guidance Prepare a charity annual return says that with income over £25,000, “You will need to declare that there are no serious incidents that you have not reported to us. Report serious incidents before you submit your annual return.”

The serious incident guidance spells out the consequence: until all serious incidents have been reported, “you will not be able to make this declaration, or complete the annual return”. An incident that was missed at the time is therefore reported late, before the return is filed, not left out. Knowingly or recklessly signing a declaration that is not true is an offence under section 60 of the Charities Act 2011, which carries up to two years' imprisonment on indictment; section 60 also makes it an offence wilfully to alter, suppress, conceal or destroy a document a person is or may be required to produce to the Commission.

Do not mix up the thresholds. For financial years ending on or after 30 September 2026, the independent examination threshold rose from £25,000 to £40,000 (Changes to charity accounting and reporting), but the serious incident declaration still applies above £25,000 of income. The trustees' annual report guide covers the rest of the year-end filing.

Northern Ireland. The Charity Commission for Northern Ireland's Serious incident reporting: a guide for charity trustees (EG059, April 2022) says “The Commission requires an actual or alleged incident to be promptly reported to all the relevant authorities.” Reports can be made through the online Concern about a charity form, as its serious incident reporting page now says (the 2022 guide gives an email address). The differences matter: there is no £25,000 line, because “All charities, no matter what their size or income, are expected to report”; trustees who are unsure are recommended to submit a report; and where an incident involves an alleged or actual criminal offence, trustees must give the names of the alleged or actual offenders – the opposite of the England and Wales advice – while leaving out personal details of victims of a safeguarding crime. Trustees must declare in the annual monitoring return whether all serious incidents have been brought to the Commission's attention, and giving false or misleading information is an offence under section 25 of the Charities Act (Northern Ireland) 2008. The 2022 guide still names Action Fraud, which Report Fraud has since replaced.

Scotland. The Office of the Scottish Charity Regulator ended its notifiable events process on 1 April 2024. “If an issue has been dealt with effectively and the problem has been resolved, there's no need to notify OSCR”; serious issues that cannot be addressed, or have not been dealt with satisfactorily, should be reported through its raise a concern form.

Cross-border charities. CCNI's guide says an incident should be reported to the charity regulator where the charity is registered, and also to the relevant statutory agencies where the incident happened.

The decision not to report is usually made by message

The Commission's form asks for the date the charity found out and how. In most small charities the honest answer is a message: a shop manager texting the treasurer that the till is short again, a volunteer messaging the chief executive late on a Sunday about something a beneficiary said, a funder's email forwarded to the chair. The question of whether to report is then often settled the same evening in a trustees' group chat or a phone call between meetings, and a borderline “we don't think this meets the threshold” is exactly the decision the guidance says trustees must be able to explain later.

Months afterwards, the treasurer signs the annual return declaration. If the reasoning sits in a group chat on personal phones, or in the memories of two trustees who have since stood down, the board cannot show who decided, when and on what facts. The copy of the form the charity can download records what it told the Commission; it does not record why it chose not to tell it about something else.

ComplyChat is designed to keep those conversations on the charity's record. Trustees, staff and volunteers talk in a channel the charity holds; everyone added is told it is on the record and can object or leave; and a mobile number verified by SMS is an identity, so a volunteer or trustee with no work account can take part. On paid plans, once the charity's Microsoft 365 tenant is connected, conversations are kept within the charity's own Microsoft 365 subscription, under the retention schedules it already runs. ComplyChat does not make or file serious incident reports, does not decide what is reportable, and is no substitute for the Commission's form, the police or the trustees' judgement.

A question for the next trustees' meeting: if a borderline incident from this spring surfaced next year, could the board show who decided not to report it, when, and why?

Questions people ask

What constitutes a serious incident in the Charity Commission?

The Charity Commission defines a serious incident as “an adverse event, whether actual or alleged, which results in or risks significant” harm to people who come into contact with the charity through its work, loss of the charity's money or assets, damage to its property, or harm to its work or reputation. “Significant” is judged in the context of the charity's own staff, operations, finances and reputation.

What counts as a serious incident?

The Commission's main categories are safeguarding incidents; fraud, theft, cyber-crime and money laundering; large donations from unknown or unverifiable sources or suspicious financial activity; other significant financial loss; links to terrorism or extremism; and other significant incidents such as insolvency, loss of banking, a police or significant regulator investigation, mass resignation that leaves the charity unable to operate, a disqualified trustee or senior manager, a significant data breach and incidents involving partners. Its examples table also lists what not to report, such as accident book entries with no significant harm or a one-off theft of an item such as jewellery or a mobile phone.

What are the reporting requirements for charities in the UK?

They depend on the regulator. Charities in England and Wales report serious incidents to the Charity Commission promptly using its online form, and a charity with income over £25,000 must declare in its annual return that none went unreported. Northern Ireland charities of every size report to the Charity Commission for Northern Ireland through its Concern about a charity form and declare in the annual monitoring return; in Scotland, OSCR ended notifiable events on 1 April 2024 and asks only for serious issues trustees cannot resolve, through its raise a concern form.

Who should report a serious incident to the Charity Commission?

The trustees. The Commission says “The responsibility for reporting serious incidents rests with the charity's trustees”; the task can be delegated to an employee or professional adviser, but all trustees remain ultimately responsible for making sure a report is made in a timely manner.

How quickly must a charity report a serious incident?

Promptly, which the Commission defines as “as soon as is reasonably possible after it happens, or immediately after your charity becomes aware of it”, without waiting until anyone is arrested, charged or convicted. There is no fixed number of hours or days in England and Wales.

Do we still report to the Commission if we have told the police?

Yes. The Commission expects charities to report what happened and how they are dealing with it even if they have also reported it to the police or another regulator, and a report to the police, Report Fraud or the National Crime Agency should be followed by a serious incident report to the Commission.

Official guidance and your next step

The primary sources are the Charity Commission's How to report a serious incident in your charity (updated 16 January 2026) and its examples table; its guidance on incidents involving partners; the online reporting form; Safeguarding and protecting people for charities and trustees (updated 8 October 2026), which says policies should be reviewed “always following a serious incident and at least once a year”; sections 46, 60, 76, 84 and 169 of the Charities Act 2011; section 19 of the Terrorism Act 2000; Article 33 of the UK GDPR and section 118 of the Data (Use and Access) Act 2025 (in force 30 September 2026 under SI 2026/1015); and the Commission's Prepare a charity annual return and Changes to charity accounting and reporting. For Northern Ireland, CCNI's EG059 and section 25 of the Charities Act (Northern Ireland) 2008; for Scotland, OSCR's notice of 1 April 2024. Quotations are from those pages as published on 21 October 2026.

This guide summarises guidance for charities in England and Wales, with notes on Northern Ireland and Scotland, and is not legal advice. Where an incident involves possible crime, a member of staff or a trustee, take advice before acting on anything beyond the immediate steps.

Then do one thing: at the next trustees' meeting, agree who decides whether an incident is reported, and start the decision log with the last incident anyone remembers – including the ones you decided not to report.