The annual return has quietly become a governance questionnaire. It no longer simply confirms your income and your trustees; it asks what policies you had in place at the balance sheet date, who your largest donors were, and whether any of them were related parties.
Most of the difficulty is not in answering. It is that the answers depend on information nobody was recording during the year.
What is the deadline?
Ten months after your financial year end. A 31 March year end means 31 January; a 31 December year end means 31 October.
Charities with income over £25,000 also file the trustees’ annual report, the accounts and the independent examiner’s or auditor’s report, and declare that there are no unreported serious incidents.
One practical trap: filing goes through My Charity Commission Account, and each trustee or filer needs their own account linked to the charity. Sorting that out in the week of the deadline is a reliable way to miss it.
What are the new questions?
The expanded return covers several areas that were not previously asked about.
Technology and cyber. Whether the charity uses artificial intelligence, and how it manages cyber risk, including whether a cyber security policy is in place. These are factual questions rather than a test. Answering that no policy exists yet but one is planned is a legitimate answer — and a useful prompt for the board.
Trustee payments. Any payment to a trustee, whether in their capacity as trustee, through a connected entity, or for goods and services. Reimbursed out-of-pocket expenses are excluded. This is broader than most charities assume and needs identifying from the ledger, not from memory.
Income analysis. All charities now analyse total income between donations and legacies, charitable activities, other trading, and investment income. Charities above £100,000 must also disclose the largest single donation from a corporate donor and from an individual donor, and say whether either was a related party.
Grant-making. Grant-makers disclose the value of grants to individuals, to other charities and to non-charities, with details of any grants to related parties.
Policies and procedures. A checklist confirming which policies were in place at the balance sheet date, covering financial controls, safeguarding, conflicts of interest and more, together with the date the safeguarding policy was last reviewed.
Structure and governance. Whether the charity is part of a wider group, and whether members other than trustees can vote under the governing document.
What goes wrong?
The recurring errors are mundane and avoidable.
Reporting income net of fundraising costs where gross income is required. Missing trustee payments made through a connected company. Being unable to evidence when the safeguarding policy was last reviewed. Estimating volunteer numbers with no underlying record.
None of these is a governance failure in itself. All of them look like one on a public register.
What should trustees change?
Work backwards from the form. If the return asks for the largest corporate donation and whether it came from a related party, that is something to tag in the accounting records when it arrives, not reconstruct nine months later.
Put the policy review dates in the board calendar. Confirming the safeguarding policy was reviewed is trivial if it happens at a scheduled meeting and awkward if nobody can find the minute.
And treat the AI and cyber questions as the board discussion they are clearly intended to prompt. The Commission is mapping sector readiness. A charity with no answer at all is telling the regulator something.
Frequently asked questions
When is the charity annual return due?
Within 10 months of the charity’s financial year end. For a 31 March year end that is 31 January, and for a 31 December year end it is 31 October. Charities with income over £25,000 must also file accounts, the trustees’ annual report and the examiner’s or auditor’s report.
Which charities have to file an annual return?
Charities in England and Wales with gross income over £10,000, and all CIOs regardless of income. Charities under £10,000 report income and expenditure only. Scottish charities file with OSCR and Northern Irish charities with CCNI, using different forms.
What counts as a trustee payment?
Any payment to a trustee, whether for acting as trustee, through a company or other entity connected with them, or for supplying goods or services to the charity. Reimbursement of genuine out-of-pocket expenses is excluded. Payments made through connected entities are the ones most often missed.
Do we need a cyber security policy to answer the new questions?
No. The questions are factual and there is no penalty for answering that a policy is not yet in place. The Commission is building a picture of sector readiness. That said, the question exists because the risk is real, and it is a reasonable prompt for a trustee discussion.
Who can submit the return?
Someone connected to the charity, through their own My Charity Commission Account linked to the charity record. Access cannot be shared, so each trustee or filer needs to be set up individually — worth checking well before the deadline.