The Right Advice at the Wrong Moment Can Be Expensive
The Law Gazette recently reported that conveyancers are being advised not to rush into purchasing new AML technology products ahead of the FCA taking over AML supervision from the SRA and other professional body supervisors. That advice is worth noting, but that does not mean there is nothing to be done. The FCA has said it does not expect to begin taking on supervision until autumn 2028 at the earliest, with the transition likely to happen in phases and complete around 2030. There is no imminent deadline to prepare for, and firms that panic-buy expensive systems now risk paying for something that does not match what the FCA eventually requires.
The government has been equally clear in its stance. Its consultation response says firms already compliant with the Money Laundering Regulations should not rush to make changes to their existing AML controls. The regulations are not changing; the supervisor is.
So far, so reassuring. But that message has a gap worth filling.
Compliant Under Which Standard?
The statement that compliant firms need not worry is only relevant if the firm is genuinely compliant now. The SRA’s inspection data and enforcement decisions we have covered throughout this year suggest a significant proportion of firms are not. Incomplete client and matter risk assessments, firm-wide risk assessments that have not been updated for several years, CDD records that would not withstand a file review and policies that exist on paper but are not followed in practice are all exactly the kind of findings that have resulted in fines this year under the SRA. They will attract the same, or even sharper, attention under the FCA. We provided some guidance in an earlier article, ‘Preparing Your Law Firm for AML Supervision Move to FCA’.
The FCA currently supervises financial services firms with a data-driven, outcomes-focused approach. It uses skilled person reviews, thematic inspections, and enforcement tools that the SRA has not traditionally developed in the same way. Read our previous article, ‘FCA Warning to Senior Managers: Fitness and Propriety Can Follow You Across Sectors’ for related information.
However, the practical message is not to panic-buy expensive technology in the hope it is a fix-all solution. It is to get the foundations right while you still have time and while the supervisor you know is still the one asking the questions.
What “Getting the Foundations Right” Means in Practice
Rather than investing in new systems, firms should test whether their existing framework would stand up to scrutiny if their supervisor inspected it today. That means asking whether client due diligence is being completed properly and consistently in every matter, whether the firm-wide risk assessment reflects the work the firm actually does and the risks it actually faces, whether client and matter risk assessments are documented on the file rather than assumed, and whether staff understand what to do when something does not look right, and whether there are training records to document it.
These obligations are nothing new. They are the requirements firms already have under the MLRs 2017, and they are exactly what the FCA will test when it assumes its supervisory role. A firm that gets them right now will find the transition much easier.
It is also vital to remember that the transition to FCA AML supervision does not eliminate a firm’s existing regulatory obligations. Therefore, law firms will answer to two regulators: The FCA for AML matters and professional regulators, including the SRA, the Law Society of Scotland, CLC, or CILEx, for everything else.
This dual regulation requires careful coordination to ensure your compliance architecture serves both relationships efficiently without creating conflicts or gaps.
Where Outsourced Support Fits
This is where the “don’t panic buy” advice and the case for outsourced compliance support are not in conflict. They point in the same direction.
A firm doesn’t necessarily need a brand-new technology platform to get its CDD right. It needs a reliable, consistent process that is applied to every matter and evidenced on every file. Our Client Due Diligence & Risk Assessment Service provides exactly that: an outsourced route for completing CDD, source of funds, source of wealth, and enhanced due diligence, applied to a consistent standard across the practice and evidenced, without adding to the workload of fee earners who should be concentrating on client work.
For firms that want broader support, our Risk and Compliance Management service covers the full AML framework, from risk assessments and PCPs through to register management, monitoring, and reporting. Because RACO already works across SRA-regulated, CLC-regulated, HMRC-supervised, ICAEW-supervised, and FCA-regulated firms, we understand how the FCA supervises and what it expects. When the transition happens, firms we work with will not need to start from scratch with a provider that has never dealt with FCA requirements. That groundwork is already in place.
The point is not to spend money now on tools you may not need later. It is to make sure the compliance framework you already have actually works, because the FCA will not care what system you bought. It will care what your files look like and how your processes work in practice.
Firms already on our assisted compliance services will be contacted by our compliance teams with any required amendments to your policies, controls, and procedures, if or when any new requirements come into force.
For our members and non-members, if you need support preparing for the changes ahead or if you have concerns about your current compliance framework, contact a member of our team, and we will be happy to help.
Speak to Our Compliance Specialists
To review your firm’s AML framework or to discuss how outsourced CDD and compliance support can strengthen your position ahead of the FCA transition, please call us on 0203 985 8550, complete the online enquiry form, or email us at info@regulationandcomplianceoffice.co.uk
Read other related articles:
- SRA Reviews the Competence Checklist: Ethics, AI and Supervision All Set to Feature
- AML Risk Assessments Still Catching Firms Out: Lessons from Recent SRA Decisions
- AML, Accounts and Cooperation Failures – Lessons from Recent SRA Enforcement Cases
- The Sole Practitioner Problem: Meeting the CLC’s Independence Requirements When You Are the Only Principal
- Money Laundering Regulations 2026: Changes Now in Place
