AML Compliance Lessons from Recent SRA Decisions
The Solicitors Regulation Authority (SRA) has published a run of enforcement decisions during July 2026 that tell a consistent story firms should be paying attention to. The AML Proactive Supervision team is still working through firms methodically, including with its desk-based reviews, and the failures it keeps finding are nothing new. They are failures being seen on a consistent basis: firm-wide risk assessments that were never adequate, and client and matter risk assessments that were carried out but never properly recorded.
We looked at a single decision on this theme in Client and Matter Risk Assessments – Lessons from a Recent Case. Another round of decisions published throughout July show it was not a one-off. Below we look at another set of recent cases, what they have in common, and what firms should take from them.
£20,920 Fine for Incomplete Client and Matter Risk Assessment Records
A Durham based firm was fined £20,920 plus costs after the SRA’s AML Proactive Supervision team reviewed its files and found that, in 10 of the 10 files sampled, the firm had failed to maintain full records of its risk assessment under Regulation 28 of the MLRs 2017. The firm could not demonstrate that the measures it had taken were appropriate, as Regulation 28(16) requires.
Notably, the SRA accepted that the firm had been risk assessing its clients and matters. The problem was that it had not been recording that assessment to the file. The firm undertakes high-risk in-scope work, and the SRA treated the nature of the conduct as more serious for that reason, while assessing the risk of actual harm as low. The basic penalty of £29,886 was reduced to £20,920 to reflect the firm’s cooperation and the remedial steps it took.
You can read the full decision here: https://www.sra.org.uk/consumers/solicitor-check/551177/
£6,380 Fine for Failing to Record Risk Assessments
A Hartlepool-based firm was fined £6,380 plus costs for a closely related failure. Between June 2017 and April 2026, it had failed to maintain records of its risk assessment under Regulation 28, and so could not demonstrate that its measures were appropriate.
The pattern is the same as the Durham case. The firm said it was risk assessing clients and matters but not recording the information to the file. What makes this decision worth reading is the SRA’s reasoning on risk. Around 46% of the firm’s work is conveyancing, which the SRA’s own Sectoral Risk Assessment identifies as high risk. The regulator was explicit that a firm doing that volume of high-risk work needs to be able to evidence how it assesses each client and matter, not simply assert that it does so.
You can read the full decision here: https://www.sra.org.uk/consumers/solicitor-check/055519/
£5,617 Fine for an Inadequate Firm-Wide Risk Assessment
A Pontypridd based firm was fined £5,617 plus costs after a desk-based review by the AML Proactive Supervision team found that, between June 2017 and June 2026, it had failed to have in place an adequate firm-wide risk assessment, contrary to Regulations 18(1) and 18(2) of the MLRs 2017.
This one is instructive because of how the SRA characterised it. The firm believed it had a compliant firm-wide risk assessment. The SRA’s view was that, had the firm properly considered the regulations and the guidance available, it would have realised otherwise. The conduct was treated as reckless and as part of a pattern spanning nearly nine years. The lesson is uncomfortable but clear: believing you are compliant is not the same as being compliant, and a good-faith assumption will not prevent a fine if the underlying document does not meet the standard.
You can read the full decision here: https://www.sra.org.uk/consumers/solicitor-check/067878/
What These Decisions Have in Common
Read together, various stand out for any firm reviewing its own position.
The first is that carrying out a risk assessment is nothing without recording it. In two of these cases the firm was genuinely assessing risk but could not evidence it. The MLRs 2017 do not reward good intentions that leave no trail. If it is not on the file, the SRA’s position is that it did not happen to the required standard.
The second is that proactive supervision is desk-based as well as on-site. Several of these investigations began with a remote review rather than a physical inspection. A firm cannot assume it is off the regulator’s radar simply because no one has visited.
The third is that historic non-compliance is being caught now. The failures in these cases stretch back to 2017, in one instance for nearly nine years. Firms that have not revisited their AML framework since it was first put in place are precisely the ones being identified.
The fourth is that cooperation and prompt remediation reduce the penalty but do not remove it. In each AML case the basic penalty was reduced to reflect the firm’s response, and in each case the SRA still considered a published fine necessary as a deterrent. Fixing the problem after the regulator finds it is better than not fixing it, but it is a poor substitute for getting it right beforehand, or for self-reporting on your own terms.
That last point is worth expanding. Where a firm identifies a breach itself, how and when it reports can materially affect the outcome. We set out the strategic considerations in our recent guide, Importance of Self-Reporting to the SRA: Risk, Strategy and Reputation Management.
How RACO Can Help – Effective Outsourced Compliance Management
For many firms, the gap between believing they are compliant and being able to demonstrate compliance is significant, and it is precisely the gap the SRA’s Proactive Supervision Programme is designed to expose. RACO works with firms and their COLPs, COFAs, and MLROs to close it. Our services include:
- Detailed Risk Management and Compliance Review – a structured, firm-wide gap analysis of your approach to risk, supervision, and regulatory compliance, identifying areas of exposure and setting out clear, practical recommendations.
- Client Due Diligence & Risk Assessment Service – an outsourcing option for completing client due diligence and client and matter risk assessments, including source of funds, source of wealth, and enhanced due diligence where needed.
- Auditing and File Reviews – a review of your staff, systems, and files to confirm procedures meet the required standard and are being applied at case level, with a report of the outcome, including AML Regulation 21 Independent Audits.
- Training – courses and mentoring for firms of all sizes, including bespoke sessions and dedicated masterclasses for COLPs, COFAs, and MLROs.
- SRA Compliance Essentials and Fully Outsourced Risk and Compliance Management – ongoing, specialist support to achieve compliance and then maintain it, with structured register administration, regulatory guidance, and monthly reporting.
When the SRA Is Already Involved: Regulatory Defence
The cases above resolved by agreement, which is not automatic. Reaching a proportionate outcome usually depends on how a firm engages with the SRA from the first contact. Where a firm is facing an investigation, an enquiry, or the prospect of a referral, having experienced support from the outset can make a material difference to the result.
RACO provides a dedicated SRA Regulatory Defence and Disciplinary Support service, alongside specialist support with Self-Reporting, SRA Enquiries and Investigations, Regulatory Settlement Agreements, and representation before the Solicitors Disciplinary Tribunal. Whether you need to report a breach you have found, respond to a request from the AML Proactive Supervision team, or negotiate the terms of a settlement, we can help you manage the process and protect your firm’s position.
If you believe you are required to make a self-report, have received a notice of enquiry or investigation, if the SRA has arrived at your premises, or if you have been referred to the Solicitors Disciplinary Tribunal, you should contact us immediately on 0203 985 8550, and we will guide you on the initial steps to take
Speak to Our Compliance Specialists
To discuss any of the issues raised in these decisions, or to review your firm’s AML framework before the SRA does, please call us on 0203 985 8550, complete the online enquiry form, or email us info@regulationandcomplianceoffice.co.uk
