In an earlier guide, we covered the SRA’s updated Sectoral Risk Assessment and its focus on cybercrime and AI, concentrating on the emerging technology risks the regulator has added in August 2026. However, the same document also restates and sharpens an established risk that too many firms are treating as marginal: cryptocurrency and crypto assets as a transaction risk.
Once thought to be a niche payment method used by a small number of tech-minded clients, crypto-currencies are becoming far more common. An increasing number of firms are encountering clients whose funds include, or have at some point passed through, crypto assets.
The Solicitors Regulation Authority (SRA), ‘preventing money laundering Q&A’ notes this directly: “Despite the risks associated with them, due to increased prevalence and awareness of crypto assets in the public, it is now much more common to encounter clients that have gained money from investment in crypto.”
The question is no longer whether your firm will see crypto-derived fund;, it is when they do arrive: Are your risk assessments and due diligence processes built to handle them correctly?
What the SRA Sectoral Risk Assessment Says
The SRA Sectoral Risk Assessment classifies crypto as an established transaction risk. That specific language and risk categorisation is worth paying attention to, because it tells you where the regulator is looking.
Crypto assets, including digital assets such as non-fungible tokens, may present an elevated risk where their legitimacy, ownership, or provenance cannot be established to a satisfactory standard.
The assessment highlights three features that make source of funds analysis on cryptocurrency more complex: their cross-border nature, the speed at which they can be moved, and the varying levels of transparency. The SRA then singles out stablecoins as being frequently identified in money laundering typologies.
Each of these points has practical consequences for how a firm and its staff handle a matter.
The regulator highlights cross-border matters because cryptocurrencies allow these to move between jurisdictions in minutes, without passing through the traditional banking controls that most firms rely on as a first layer of assurance. The speed point is an added issue because crypto-derived funds can change hands several times before they reach your client account, making the audit trail harder to reconstruct. The transparency point means some crypto assets, and some platforms, are deliberately designed to obscure ownership, while others, like Bitcoin, have publicly searchable transaction records. A firm that treats all crypto assets as if they carry the same risk profile is not applying an effective risk-based approach that would stand up to the scrutiny from the SRA or other AML supervisors.
The stablecoins reference is a newer, emerging risk that is worth understanding. Stablecoins are crypto assets pegged to a fiat currency, usually the US dollar. Because their value does not swing dramatically, they are used predominantly for moving large sums quickly and cheaply, which is precisely the characteristic that also makes them attractive for money laundering. A client who tells you their funds originated from a stablecoin holding is not giving you a low-risk answer that can be signed off as a completed source of funds check. You need to establish where the stablecoins came from, what they were used for, and whether the full trail is verifiable.
How The SRA Expects Firms to Treat Crypto Assets in a Transaction
The SRA’s position on cryptocurrency has been consistent for some time and across its Q&A, its Risk Outlook report on Crypto and DLT, and now the updated Sectoral Risk Assessment.
First, crypto should be treated as a high-risk indicator. The SRA’s Q&A on ‘Compliance with the regulations and preventing money laundering’ states that cryptocurrency should be an immediate high-risk indicator, and that firms should report any client seeking to use cryptocurrency as part of their funds to the MLRO for further guidance.
Second, crypto assets cannot be paid into the client account. The regulator does not consider crypto assets, including cryptocurrency, to be “money” for the purposes of the Accounts Rules, and no bank or building society currently offers accounts for crypto assets. The SRA specifies that, “any payment directly in cryptoassets would not have the same protection as fees paid into and held on client account, and this should be made clear to the client.”, adding that:
“…although they are not client money, cryptoassets are still subject to the protections of rules 5.2 of the Code of Conduct for Firms and 4.2 of the Code of Conduct for Solicitors (‘You safeguard money and assets entrusted to you by clients and others’) if you are holding them on a client’s behalf for any reason. An example of this could be as part of administration of a deceased estate, or under a lasting power of attorney.”
Third, source of funds must be established with evidence. The SRA’s Q&A sets out three specific checks:
- The source of funds for the original crypto investment, particularly where it was substantial relative to the client’s income.
- Whether claimed profits are consistent with what you know about the initial investment and how prices have moved over time.
- Transactions using publicly available records. Bitcoin and many other crypto assets allow you to track transactions involving specific assets or between specific wallets through publicly searchable databases such as blockchain.com. You will need the client’s wallet details or asset holdings to do this.
Those three checks should be built into how your firm handles any matter involving crypto-derived funds, ensuring relevant policies, controls, and procedures (PCPs) are implemented in practice and that appropriate training and recording are carried out. A firm that does not update its procedures with those in mind is not meeting the SRA’s own published guidance on what it expects.
Common AML Failures in Crypto Asset Transactions
We covered the regulatory position in detail in our previous guide, ‘Can I Accept Crypto Assets as a Payment from a Client?’, when the SRA first updated its AML Q&A in 2025. While the regulatory position has not changed, the way firms encounter crypto has.
The most common failure we see is a case handler not asking the right questions from the start. A conveyancing team receives a deposit funded by the proceeds of a crypto investment that was cashed out into a bank account several months ago. By the time the money reaches the firm, it looks like a normal bank transfer. If the source of funds enquiry does not investigate where the money came from before it reached the bank account, the crypto element is missed entirely.
The second failure is treating a bank statement as proof of legitimacy that earns a due diligence sign-off. The SRA is explicit on this point. A firm cannot assume that funds are legitimate just because they come from a UK bank account. If a client converts crypto holdings into sterling and deposits the proceeds, the bank statement shows the deposit. However, it does not show where the crypto came from originally, how it was acquired, or whether the profit claimed is consistent with the investment history.
The third, and increasingly problematic, is treating all crypto as the same. A client who holds Bitcoin, which has a publicly searchable blockchain, presents a different verification challenge from a client whose funds passed through a privacy-focused coin or decentralised exchange with limited transaction records. The firm-wide risk assessment and the client and matter risk assessment both need to reflect that distinction, because the SRA’s own language, “varying levels of transparency”, tells you the regulator already does.
What Firms Should Do Now
For any law firm updating its firm-wide risk assessment, this section needs particular attention. Under Regulation 18(2)(a) of the MLRs 2017, firms must take the SRA’s sectoral risk assessment into account when preparing their own policies, controls, and procedures (PCPs). If the regulator has classified crypto as an established transaction risk, a firm-wide risk assessment that says nothing about it, or training records that do not show staff have been given updated guidance, is already out of step with the SRA’s expectations.
In practical terms, ensure these steps are being followed:
- Update your firm-wide risk assessment to address crypto assets as a transaction risk, referencing the Sectoral Risk Assessment’s language on cross-border movement, speed, varying transparency, and stablecoins.
- Build crypto-specific questions into your client and matter risk assessments. At a minimum, ask whether the client holds or has recently held crypto assets, whether any part of the funds in the matter derive from crypto, and if so, what type.
- Train fee earners and support staff to recognise crypto as a high-risk indicator and to refer any crypto-linked funding to the MLRO before the matter progresses. This is one area where a missed flag at intake cannot easily be corrected later.
- Ensure your source of funds process goes beyond the bank statement. If funds were converted from crypto into fiat currency before reaching the firm, the enquiry needs to cover the crypto holding, the original investment, and whether the claimed return is plausible.
- Know which assets can be checked and how. Bitcoin and many other major crypto assets have public blockchain records. If your fee earners do not know that, or do not know how to use a blockchain explorer, that is a training gap the firm should close.
Speak to RACO About How We Can Support Your Firm
Crypto is one of the several areas where the gap between regulatory expectation and day-to-day practice tends to be the widest, because the risk is unfamiliar and the guidance is scattered across several SRA publications. Bringing an AML framework into line with the SRA’s current expectations, and backing it with defences that actually hold, is exactly the kind of work we support firms with every day.
At the Regulation and Compliance Office (RACO), we help identify gaps in a firm’s policies, controls, and procedures through our Detailed Risk Management and Compliance Review and Auditing and File Reviews Services.
Our Client Due Diligence & Risk Assessment Service provides an outsourced route for completing client and matter risk assessments, including source of funds and source of wealth work and enhanced due diligence regarding crypto assets where it is needed.
For firms wanting ongoing cover, SRA Compliance Essentials and Fully Outsourced Risk and Compliance Management provide continuing support to keep the framework current as the regulations evolve. Our Training courses, including dedicated MLRO and MLCO sessions, make sure the people doing the work understand both sides of the risk.
Speak to Our Compliance Specialists
For firms wanting ongoing support, or to ask any questions about how RACO can support your firm’s wider AML compliance arrangements, please contact us:
Telephone: 0203 985 8550
Email: info@regulationandcomplianceoffice.co.uk
Online Enquiry: Complete our contact form
Read other related articles:
