Your contract: confidentiality, compliance and the rules that surprise people

Rules and figures checked: 2026-07-24. Funding, tenancy and tax rules move — verify before relying on them.

My contract arrived as a PDF about a month before I was due to start, and it did not come alone. There was the contract itself, a code of conduct, consent forms for background checks, a privacy notice, and a list of policies I was agreeing to that weren't even attached, just named, the way bands list their influences. I was 18. The longest document I'd signed before that was a phone contract.

I skimmed it. Everyone skims it. This article is the version I wish someone had handed me instead.

One thing up front: none of this is specific to banking. If your employer is regulated at any real scale (finance, law, defence, health, big government suppliers) some version of every rule below exists, and it applies to you at 18 exactly as it applies to a 45-year-old managing director. Nobody gets a junior discount on compliance. That sounds intimidating. It's actually the comfort: the rules are the same for everyone, they're written down, and they're navigable.

What's actually in the offer pack

The headline document is the employment contract: start date, hours, notice period, and a line saying the offer is conditional on satisfactory checks. That word "conditional" is doing real work. Until the checks clear you don't fully have the job, which is why you don't hand in notice anywhere or sign a tenancy until they do. In practice checks usually clear well before start day — mine had by the time our house hunt got serious — so sorting housing in advance is still realistic; just wait for the green light first.

Around it sit the supporting documents. A code of conduct, which is the one to actually read. Policies on IT use, social media and conflicts of interest, sometimes attached, often just referenced with a note that they live on an intranet you can't see yet. And consent forms: for background screening, for references, for the credit check we're about to discuss.

Save all of it. Make a folder. Future you, asked in year three whether you ever agreed to something, will be glad the folder exists.

Yes, they credit-check school leavers

The checks vary by sector but the shape is the same. Right to work, usually your passport. References, and a school or sixth form referee is completely normal at 18; nobody expects you to produce two former employers. A criminal record check (a DBS check), which in some sectors is a basic one and in others (health, anything involving vulnerable people) more detailed. And at financial firms, a credit check.

That last one surprises people. You're 18, you've never borrowed money, what is there to check? Mostly nothing, and mostly that's fine. A thin credit file, meaning you barely exist in the system, is normal for a school leaver and doesn't count against you. What they're looking for is trouble: serious defaults, court judgments for unpaid debts, that sort of thing. The logic is blunt but not stupid. People in serious money trouble are a higher risk around other people's money.

If you do have something on your file, a defaulted phone contract, say, it's a conversation, not an automatic no. Answer questions honestly. Across basically every topic in this article, the cover-up is worse than the thing. Lying on a screening form is the kind of act that ends careers; a messy phone bill is not.

Your thin credit file will also follow you into housing, incidentally. I've written about how that plays out when you're renting your first house at 17 or 18.

Confidentiality covers the boring stuff too

At 18 I assumed "confidential" meant secrets. Big deals, red stamps. The actual definition in your contract will be far wider: client names, internal documents, how processes work, things you overheard in a meeting, screenshots of anything. The stuff that feels too boring to be confidential is still confidential. That's the bit that catches people.

The practical test I use: would I be comfortable if the person behind me on the train were the client, or a journalist? If not, don't say it on the train, and don't put it in the group chat either. Group chats feel private. They are not, in any way that matters, and they are permanent.

I lived in a shared house with other apprentices from the same employer, and even there the habit was worth keeping. Not because anyone would have done anything with it, but because the whole point of the habit is that you stop making case-by-case judgements. Work stays vague at home; nothing to slip. (If a house full of colleagues sounds strange, I've covered it in moving out at 18 for an apprenticeship.)

You might need permission to buy shares

Here's the one that genuinely startled me. Many financial employers restrict what their staff can do with their own money in the markets. It's usually called personal account dealing, and depending on the firm it can mean getting pre-clearance before you buy or sell shares, being barred from certain stocks entirely, having to hold anything you buy for a minimum period, or routing your investing through accounts the firm can see.

This applies to you on day one, at 18, with your first fifty quid in a trading app, exactly as it applies to the people running the place. If you already have investment accounts when you join, you'll usually be asked to declare them. Do it. Every firm's version of the rules is different and you'll be told the specifics, but the reason is consistent: staff at financial firms sometimes know things the market doesn't, and the firm needs to be able to prove nobody's trading on that.

If your employer isn't a financial firm, this section mostly won't apply. The next ones will.

Gifts, hospitality and the free football tickets

Somewhere in your first weeks someone will mention the gifts and hospitality register, and you will wonder why a company needs a spreadsheet about sandwiches. Then a supplier will offer your team football tickets and it will click.

The rule at most large employers: gifts and hospitality above a certain value must be declared on a register, and some need approval before you accept. The threshold and process vary; you'll be told yours. The point isn't the sandwich. The point is the pattern: a company that can see all the gifts can spot the supplier slowly buying influence. And the register protects you as much as anyone. A declared, approved freebie is a non-event forever. An undeclared one that surfaces later is a problem, however innocent it was.

Your side hustle, your bar job and your Instagram

Three things that live in the same corner of the contract.

Conflicts of interest. If you do anything outside work that could collide with your job, the firm wants to know. At 18 this is less about owning a rival company and more about the modern stuff: a monetised YouTube channel, an Etsy shop, paid promotion on TikTok. Declaring it is not the same as being banned from it. Most declarations get a shrug and a note on file. Undeclared is the dangerous state.

Outside employment. Many contracts say you need approval to hold a second job, so the weekend bar shift you kept from sixth form may technically need signing off. It will almost certainly be fine, especially early on when money is tight. But ask rather than assume.

Social media. The policy will be pages long; the practical reading is three lines. Assume anything public will eventually be read by HR, your manager and a client. Never name clients, systems or colleagues. And "views my own" in a bio protects you from precisely nothing. If your profile says where you work, you're visible to the firm, and the disclaimer is decoration.

The laptop is not your laptop

IT monitoring is real, normal, and mostly not personal. Nobody is sat reading your emails live, but work devices and work accounts belong to the employer, systems log and flag things automatically, and if something ever needs investigating, the record exists. The clean way to live with this is simple: work things on work devices, personal life on personal devices. In particular, don't email work documents to your personal address to "work on later". That one move sits at the intersection of the IT policy and the confidentiality clause, and it looks terrible in hindsight even when the intent was innocent.

The apprentice twist: your coursework is inside the fence

Here's the part that's specific to us. A degree apprentice is an employee and a student at the same time, and the confidentiality line runs straight through your coursework. Your assignments and your end-point assessment evidence are built from real work: real projects, real problems, sometimes real clients. Your university markers are not inside your employer's walls, and they should never learn a client's name from you.

So you anonymise, properly. "A large corporate client" instead of the name. Strip the numbers that identify. Most employers running apprenticeships have guidance for exactly this, and your manager would far rather spend ten minutes reviewing an assignment than discover a client's details went to an external examiner. I'll get into how evidence and assignments actually work in the study articles on this site. For now, just know the rule follows you into your homework.

How to actually handle all of it

Three habits cover essentially everything.

Read the code of conduct properly, once, in week one. Not the night before signing, when none of it will go in, but in week one, when you have context. It's shorter than you fear, and an hour of reading buys you four years of knowing where the lines are.

Ask before, not after. This is the biggest cultural adjustment. Regulated firms do not run on "ask forgiveness". Asking first is always fine, costs nothing, and is usually answered in minutes; compliance teams and managers field these questions constantly and would infinitely rather you asked. Nobody gets disciplined for checking whether they can accept a ticket. The trouble is reserved for people who guessed.

Keep your own copies. Your contract, anything you sign, any approval you're given. If a question comes up years later, you want your own paper trail, not a memory.

The quiet upside

None of this is a reason to take the job or avoid it, and if you're still weighing the whole path, start with degree apprenticeship vs university. But I'll say this for compliance culture: it mostly exists to protect you, and taking it visibly seriously is the cheapest career signal available to an 18-year-old. Anyone can be enthusiastic. Not everyone can be trusted, and in regulated industries trusted is the currency. Being the apprentice who asked first, declared the thing and kept work off Instagram doesn't make you boring. It makes you the person they stop double-checking. At 18, surrounded by people twice your age, that's worth more than it sounds.