What policies does a new charity actually need?

England and Wales: This page sets out the position in full. Scotland: covered, and a genuinely different regime — OSCR’s application requires no policy documents either, but its trustee declaration form carries no safeguarding-specific question at all. The nearest equivalent is a pre-application planning prompt, not a declaration — see below. Northern Ireland: partly covered — CCNI’s published guidance and the false-statement offence are both established. But the actual CCNI trustee declaration form could not be read by this research, so whether it carries a safeguarding-specific clause of its own is not confirmed — see below.

Which charity policies the application asks for

The Charity Commission’s application in England and Wales asks for no written policy. Founders are often handed long lists of charity policies. But OSCR in Scotland and CCNI in Northern Ireland ask for none either (below). This page follows the step to show your charity status on documents, but it looks back at what the application itself asked for.

We read the Commission’s published list of questions in full. We searched it for every policy-shaped word: “policy,” “safeguard,” “financial control,” “reserve,” “conflict,” “complaint,” “risk” and “investment”. None of them is asked for.

What the form does ask for is not a policy at all. It asks for:

• a signed trustee declaration form for each trustee
• a governing document
• in one case only, the minutes of a meeting

The minutes are asked for only if the charity will use premises owned by a trustee or connected person. The same applies if it will buy goods or services from one. They are the minutes of the meeting that agreed the arrangement.

The law requires a short list of policies at registration, but only in narrow cases. These rarely apply to a brand-new charity. A written health and safety policy statement is required, but only once the charity has five or more employees.

Data protection law requires an “appropriate policy document”, but only where the charity processes special category or criminal-offence data in reliance on a condition in Schedule 1 to the Data Protection Act 2018 that requires one. That includes asking any trustee or volunteer about criminal records. A reserves policy statement is required too, but not at registration. It first bites on the trustees’ annual report, after the first financial year end.

Everything else is good practice only, at this stage. That includes:

• a safeguarding policy
• a complaints procedure
• a conflicts of interest policy
• an investment policy
• a whistleblowing policy
• a dozen others often listed as “essential”

Good practice is worth doing. It is not what the form checks for.

The safeguarding declaration in England and Wales

If a charity works with children or adults at risk, the England and Wales form asks more of the trustees. They confirm they have read the Commission’s guidance on protecting vulnerable groups. They also sign a declaration that all necessary checks required by law have been carried out.

Read that carefully. It confirms that the checks are done, not that a written safeguarding policy exists. The form does not ask to see one. When you come to it, the people hub explains how to write a safeguarding policy. The governance hub covers how the trustees adopt a safeguarding policy.

That difference is where charities go wrong. The declaration is one line among many in a long form.

The checks behind it take real work, such as arranging the criminal record checks the charity’s roles need. Signing before that work is finished is not a paperwork shortcut. The declaration would not be true, and giving the Commission false information knowingly or recklessly is an offence. The offence is covered below.

Scotland: no policy required, and no safeguarding declaration at all

OSCR’s evidence pack is even shorter than England’s. It asks for a completed and signed trustee declaration form for each proposed trustee, and a draft governing document. It asks for nothing else.

We read the trustee declaration form in full. It has each trustee declare in detail that they are eligible to serve. It also states, in its own words, that it is an offence knowingly or recklessly to give false or misleading information. Unlike the England and Wales form, it carries no safeguarding question at all.

The nearest thing in Scotland comes earlier in the process. It is a planning question, not a form field, and it prompts you to think ahead before you apply. OSCR asks whether there are “specific policies and procedures you would need, such as safeguarding or lone working”. The question is not a declaration, and it is not confirmed to appear anywhere in the application form.

Do not read it as the Scottish version of the English safeguarding declaration. It asks a different question, in a different place, and has none of the declaration’s legal weight.

Northern Ireland: what CCNI’s guidance requires

We read CCNI’s current registration guidance in full. It requires no policy document either. Its checklist invites an optional list of policies. It marks that list “not essential” and gives working with children or adults at risk as an example.

The declaration the guidance describes is a general one, about accuracy and privacy. No safeguarding wording appears anywhere in it.

This is where the page’s coverage of Northern Ireland falls short of the other two nations. CCNI publishes its trustee declaration form only as a file this research could not read. So the real form may well carry a safeguarding clause that the guidance does not mention.

OSCR’s form carries its own false-statement warning in this way. The England and Wales form carries its safeguarding clause in the same way. This page describes the published guidance, not the form, and says which it is describing.

CCNI has also paused new applications while it upgrades its systems. That pause does not change the position above. But it does mean nothing here can now be checked against a live application.

Two duties that sit outside charity law entirely

Two further duties are easy to miss, for two reasons. Neither comes from charity law at all. And neither is a “policy” in the sense the forms use the word.

DBS checking means processing special category or criminal-offence data. Where the charity relies on a Schedule 1 condition that requires one, data protection law requires an “appropriate policy document,” separately from any privacy notice. That duty is part of the charity’s ongoing data protection work, not registration.

The step to write your data protection policy covers what it has to say. Registering with the Information Commissioner’s Office and paying its data protection fee is a separate step again: pay the ICO fee or confirm your exemption. For a charity the fee is the tier 1 fee, £52 a year, whatever its size.

If your charity runs any criminal record checks, it must have a written policy on recruiting people with criminal records. On GOV.UK’s wording, that applies even to a single basic check. The people hub covers that duty, not this one: write a recruitment-of-ex-offenders policy. This page only flags that the trigger is running a check, not how senior the role is.

Why safeguarding applies to every charity

Safeguarding applies to every charity, because the duty protects its own staff and volunteers, not only its beneficiaries. The most common excuse — “we don’t work with vulnerable people, so safeguarding isn’t really our issue” — does not hold up. The Commission’s own guidance rules it out in terms. A charity that thinks safeguarding is someone else’s problem is the one most likely never to have checked. The people hub shows how to establish that safeguarding applies to you. It also explains how to appoint a safeguarding lead and set board oversight.

With your first policies decided, the next step is to hold your first board meeting.

Common mistake: declaring at registration that safeguarding checks are done, then doing them later

The declaration is one tick among many in a long form. The checks it stands for take real work. If a charity works with vulnerable people, including children, the trustees sign a declaration that they have read the regulator’s guidance.

The declaration also confirms they have carried out all necessary checks required by law. Signing that before it is true makes the declaration false, and knowingly or recklessly giving the Commission false information is an offence. It is not a paperwork shortcut.

Worked example

This example uses an unnamed charity that works with children. None of the site’s three fixed organisations (Wrenfield, Tollgate, Saltmarsh) is shown elsewhere as working with children or adults at risk. Inventing that fact here would go beyond what this project allows.

The trustees make the safeguarding declaration when they apply. So the real work has to come before it, not after.

The order that keeps the declaration true is to do the checks before the form is signed. The England and Wales offence is committed by giving false information knowingly or recklessly, so knowledge is not needed; recklessness is enough. Whether a particular signature met that test would be a question for a solicitor.