Some of the most recent enforcement decisions published by the Solicitors Regulation Authority (SRA) are worth taking notice of. Two came out of anti-money laundering desk-based reviews, and another followed a forensic investigation into a sole practitioner. The financial penalties range in severity from a few thousand to over twenty thousand. However, what links them is where the failures sit: the everyday controls every firm is expected to keep in order under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs 2017) and the SRA Accounts Rules, and the way a firm behaves once the regulator starts asking questions.
We previously reported on a round of SRA decisions in ‘AML Risk Assessments Still Catching Firms Out’. Below we look at another set of recent cases, what they have in common, and what lessons firms and legal practitioners should take from them.
£18,738 Fine for PCP and CMRA Failures
A recognised body in Loughborough was selected for an AML desk-based review (DBR) by the SRA’s AML Proactive Supervision team. The review and subsequent investigation found two core problems. First, the SRA found that between June 2017 and October 2025, the firm had not regularly reviewed, updated and maintained appropriate, risk-sensitive PCPs to manage the money laundering and terrorist financing risks that its own risk assessment had identified. The firm confirmed it held no versions of its PCPs before 2023, and the 2023 version was assessed as inadequate. There were further failures discovered regarding the firm’s client and matter risk assessments. On four of the six files reviewed, the firm had not kept records of its risk assessment under Regulation 28. Without those records, it could not demonstrate that the measures it had taken were appropriate, as Regulation 28(16) requires.
The matter was resolved by a Regulatory Settlement Agreement. The firm agreed to a financial penalty of £18,738 plus £600 in costs. The SRA originally calculated a basic penalty of £26,769, placing the conduct in Band B, then reduced it to £18,738 to reflect the firm’s mitigation: an early admission, steps to put compliant PCPs and a revised CMRA process in place, and full cooperation with the investigation. There was no evidence of actual harm, though the SRA noted the potential for it, particularly given how much the firm’s work was in conveyancing.
You can read the full decision here: https://www.sra.org.uk/consumers/solicitor-check/401191/
A £20,148 Personal Fine for a Sole Practitioner
A solicitor and sole practitioner at a practice in Powys, Wales, has been personally fined £20,148 and ordered to pay £1,350 in costs. In this case, the regulator initially responded to a report about the solicitor’s handling of an estate and the delays in administering it. When the SRA’s requests for information were met slowly, it issued a Production Notice, and only a partial response came back. That prompted a forensic investigation, which found a client account shortage of £30,848.73 that had persisted for almost three years and was only replaced four months after it was discovered, no client account reconciliations, and potential client debit balances. A further six complaints followed between September 2023 and May 2024, including a report from the Legal Ombudsman, and a second forensic investigation was opened.
The findings ran across the SRA Principles, the Code of Conduct, and the Accounts Rules. It was found that he had failed to comply with an undertaking to act in clients’ best interests and in a timely way, to handle complaints properly, and to cooperate with the Legal Ombudsman and the SRA. He had authorised an improper transfer from the client account and had failed to keep a book of accounts. His accountant’s report for 2022 to 2023 was qualified and was not submitted within the six months the Accounts Rules require.
The SRA placed his conduct in Band D, which carries a penalty of between 65 and 97 per cent of annual gross income, and set it in the middle of that band. It found a reckless disregard for the risk of harm and for his regulatory obligations, remedial action taken only when prompted, and no mitigating factors at all.
Read the full decision here: https://www.sra.org.uk/consumers/solicitor-check/081485/
£8,211 Fine for AML Failings and Delays to Rectify Compliance Issues
A recognised body in Gerrards Cross was fined £8,211 plus £1,350 in costs after a July 2024 desk-based review. At first glance, the failings look familiar. The firm had no documented firm-wide risk assessment (FWRA) between June 2017 and March 2023, and no appropriate one after that. Additionally, it did not establish and maintain compliant PCPs. On three of the six files reviewed, client and matter risk assessments were either missing or did not properly assess the level of risk. What sets this decision apart is what followed that initial inspection. The firm was given guidance and entered a compliance plan in October 2024, agreeing to demonstrate compliance by 3 December 2024. However, despite repeated requests, it failed to respond or act promptly and did not produce fully compliant AML documentation until 10 April 2026, well over a year past the agreed deadline. That failure to cooperate became a finding in its own right, and the conduct was placed in Band C at 2.4 per cent of annual domestic turnover.
The full decision can be read here: https://www.sra.org.uk/consumers/solicitor-check/487314/
The Lessons from These Cases
Read together, these latest decisions stand out for any COLP, COFA or MLRO.
An FWRA, PCPs, recorded CMRAs on file, and five-weekly reconciliations are the baseline the SRA expects, not advanced tests. Two of these three cases started as routine AML desk-based reviews, and the review is where gaps in the basics show up first. Being compliant is not the same as being able to prove it. Often, a firm can lose an argument on lack of documentation because a risk assessment not recorded on the file cannot be relied on later, regardless of what was actually done at the time. If a fee earner cannot point to the CMRA, for the SRA’s purposes it does not exist.
Furthermore, how a firm responds shapes the outcome as much as the original breach. In the first of these cases, the firm cooperated, admitted the position early and remediated, and the penalty came down from £26,769 to £18,738. The second case showed the opposite. The solicitor responded slowly, remediated only when pushed, and was placed in the highest conduct band with no mitigation. The last example showed how the firm let a compliance plan lapse and took another sixteen months to comply, resulting in the delay becoming in a separate finding
These cases show how a firm’s interaction with the SRA when an issue is discovered can materially affect the outcome. We set out the strategic considerations in our recent guide, Importance of Self-Reporting to the SRA: Risk, Strategy and Reputation Management.
How RACO Can Help – Effective Outsourced Compliance Management
For many firms, the gap between believing they are compliant and being able to demonstrate compliance is significant, and it is precisely the gap the SRA’s Proactive Supervision Programme is designed to expose. RACO works with firms and their COLPs, COFAs, and MLROs to close it. Our services include:
- Detailed Risk Management and Compliance Review – a structured, firm-wide gap analysis of your approach to risk, supervision, and regulatory compliance, identifying areas of exposure and setting out clear, practical recommendations.
- Client Due Diligence & Risk Assessment Service – an outsourcing option for completing client due diligence and client and matter risk assessments, including source of funds, source of wealth, and enhanced due diligence where needed.
- Auditing and File Reviews – a review of your staff, systems, and files to confirm procedures meet the required standard and are being applied at case level, with a report of the outcome, including AML Regulation 21 Independent Audits.
- Training – courses and mentoring for firms of all sizes, including bespoke sessions and dedicated masterclasses for COLPs, COFAs, and MLROs.
- SRA Compliance Essentials and Fully Outsourced Risk and Compliance Management – ongoing, specialist support to achieve compliance and then maintain it, with structured register administration, regulatory guidance, and monthly reporting.
When the SRA Is Already Involved: Regulatory Defence
The cases above were resolved by agreement, which is not automatic. Reaching a proportionate outcome usually depends on how a firm engages with the SRA from the first contact. Where a firm is facing an investigation, an enquiry, or the prospect of a referral, having experienced support from the outset can make a material difference to the result.
RACO provides a dedicated SRA Regulatory Defence and Disciplinary Support service, alongside specialist support with Self-Reporting, SRA Enquiries and Investigations, Regulatory Settlement Agreements, and representation before the Solicitors Disciplinary Tribunal. Whether you need to report a breach you have found, respond to a request from the AML Proactive Supervision team, or negotiate the terms of a settlement, we can help you manage the process and protect your firm’s position.
If you believe you are required to make a self-report, have received a notice of enquiry or investigation, if the SRA has arrived at your premises, or if you have been referred to the Solicitors Disciplinary Tribunal, you should contact us immediately on 0203 985 8550, and we will guide you on the initial steps to take.
Speak to Our Compliance Specialists
To discuss any of the issues raised in these decisions, or to review your firm’s AML framework before the SRA does, please call us on 0203 985 8550, complete the online enquiry form, or email us at info@regulationandcomplianceoffice.co.uk
