Welcome to the Regulation & Compliance Office’s fortnightly roundup, where we look at all the latest stories to keep you ahead and informed in the world of law and compliance.

The RACO roundup is just another way in which we keep the solicitors and other law professionals we work with in the know, so we can ascertain that you are never missing the vital developments occurring in your profession.

Below, you will find the most recent headlines selected by our compliance experts, followed by a Security Section, where we will also give you an overview of the latest scams currently impacting solicitors and their clients.

***

THE FINALE IS HERE: What is Risk Part 3 HAS LANDED

Part 3 – Risk Recording, Documentation, and Reporting

For the finale to our three-part series exploring risk and how law firms should approach the assessment and management of risk, we look at:

• How Law Firms Can Respond, Document, and Report on Risk  
• Effective Risk Management and Recording Processes
• Conclusion
• Risk Management Guidance and Support

For our previous two instalments, see below:

• First Step of Risk Assessments – Part 1 (click here) and
• Risk, Identification and Action – Part 2, (click here)

To read the full article, CLICK HERE.

Alternatively, you can also read a sneak preview just below:

How Law Firms Can Record, Document, and Report on Risk

The final and essential element of an effective risk management process is overall evidence of how the firm has managed risk retrospectively and continues to manage risk into the future. Both Professional Indemnity Insurers and The Solicitors Regulation Authority expect firms to not only have a documented process for risk management and compliance but also be able to show how they have managed risk through active implementation and monitoring.

This is often considered the most difficult part of a risk management policy; as writing, delivering, and training are controllable, but ensuring the staff within the firm take full notice of the policies and procedures and apply them in their daily work is significantly more difficult.

It is not always obvious why the firm has adopted certain policies, and some will argue that in the busy life of a lawyer, the application of policies can ‘slip the mind’ when taking into account the other tasks required to perform in their role.

There are, however, no real acceptable excuses for not complying with a firm’s policies. They have been developed and delivered for areas on, and complying with them is not a ‘nice to have’ but essential.

The rest of this article provides guidance on how a firm can implement an effective process to ensure they have efficient solutions to document, evidence and demonstrate the firm’s activity and that it complies with the requirements of the regulators and insurers through robust risk management solutions.

At Regulation and Compliance Office, we work with firms of all sizes, offering expert and cost-effective solutions and providing annual risk assessments alongside developing bespoke policies and training for all staff.

For more information on how The Regulation and Compliance Office (RACO) works with firms on risk management, you can contact us on 0203 985 8550, email us info@regulationandcomplianceoffice.co.uk,or visit our website and make an online enquiry.

Risk Management Guidance and Support

Regulation and Compliance Office works with law firms of all sizes to create effective risk management processes that protect the firm and those it interacts with.

We have developed a cost-effective and consultative approach to the implementation of policies and procedures and have delivered packaged solutions to firms, including:

Detailed Risk Management & Compliance Review – This review can be independently secured by the Firm or through Professional Indemnity Insurers. For many firms, this is an essential step in the professional indemnity renewal process, which assists Insurers in gaining a greater understanding of the risk profile for their Insured Law Firm. This, in turn, will assist with renewal terms.

This review can be extended to include an Independent Audit for the purposes of Regulation 21 of the Anti-Money Laundering Regulations (MLR) 2017. Please click here to see our brochure on this service.

***

How Cyber Attack Caused by ‘Human Error’ Could Cost Marks and Spencer £300 Million

In a recent news update, it has been reported that Marks & Spencer has said that the damaging cyber attack over the Easter weekend was caused by “human error” and will likely cost the company around £300 million, with the aftereffects still ongoing.

According to one news article published on ITV.com, Chief Executive Stuart Machin said:

“We didn’t leave the door open, this wasn’t anything to do with under-investment.”

“Everyone is vulnerable. For us, we were unlucky on this particular day through some human error.”

Source – Marks & Spencer blames ‘human error’ as cyber attack set to cost £300m

Why a Cyber Security Audit is Vital

These cyber-attacks are becoming more prevalent, and law firms are one of the most targeted victims due to the vast amount of valuable data they hold on to. We have highlighted these concerns in previous articles, warning firms of their obligations and the consequences of failing to meet regulatory expectations.  

Only recently, the Information Commissioner’s Office (ICO) fined a Merseyside-based law firm £60,000 following a cyber-attack that led to highly sensitive and confidential personal information being published on the dark web. Read more about it here: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/04/law-firm-fined-60-000-following-cyber-attack/

Download our Cyber Security Audit Checklist:

We have designed a downloadable checklist to help firms undertake a cyber-security audit, which is one of the most invaluable exercises a firm can take. Understanding the threats your law firm’s data faces, not just due to cyber-criminal attacks, is vital. Click the link below to access your free checklist, which is designed to help your firm perform a Cyber Security Audit and identify threats such as:

• Malware and hacking attacks – being aware of external threats is vital to data security. Business Technology for law firms is constantly evolving, and attackers are resorting to sophisticated techniques to compromise business data security.
• Ransomware – Law firms can hold some highly sensitive information, and for this reason, this type of malware has garnered popularity in recent years. Law firms should be aware of this potential risk to their client’s data.  
• Denial of service attacks – the rise of IoT devices saw a dramatic rise in botnets. Denial of service attacks are now more widespread and dangerous than ever. If your business depends on uninterrupted network service, you should definitely assess risks associated with loss of service.
• Malicious insider threat – one of the biggest threats to a law firm’s data is its own employees or third-party vendors. Data can be easily leaked or misused and, unless you have specific monitoring tools in place, it can be hard to detect.
• Non-Malicious insiders – another risk group is the careless or uninformed employee, as not all insider attacks are done out of malicious intent. Data can be leaked unintentionally through errors such as forgetting to lock devices which contain sensitive information. Other common errors include downloading attachments or clicking links from suspicious email addresses or visiting unauthorised/malicious websites from the firm’s network.  – this includes remote workers, see next;
• Remote–working – the COVID-19 crisis and the obligated lockdown forced firms into a remote-working culture that many were not used to. Whilst there are some proven advantages, one of the biggest disadvantages is that remoteness can easily become carelessness in regard to cyber-security. To address this, employees need to be made aware of just how easily information can be obtained and the means by which they can protect themselves and their firms. Most employees will be aware of recent high-profile cyberattacks, so the reality of the recent M&S hacking should hold relevance when explaining the dangers.
• Personal Devices – Allowing staff to use personal devices (sometimes referred to as BYOD – bring your own device– can increase flexibility and productivity (such as personal laptops or phones with access to email systems), but it also introduces security risks, especially if those devices are not encrypted, lack proper security software, are shared with family members, connect to unsecured networks, are not covered by company monitoring tools or policies.
• Natural disasters and physical breaches – whilst this would be a rare occurrence, the consequences of suffering such a threat can be devastating. Therefore, it should be included in a plan to cover the loss should it happen.

Download Free Checklist Here

Once you have assessed the risks associated with possible threats to your law firm’s data, you will need to examine any existing security controls already in place, address those that need improving and implement processes that are missing. For example, you could consider measures such as:

• Firewall and anti-virus software
• Anti-spam filter
• Access Control – assess privilege users
• User activity monitoring – User activity monitoring tracks employee activity and can protect against insider threats
• Employee security training and awareness
• Ensure security measures such as multi-factor authentication (MFA) as best practice
• Complete regular data backup
• Server security
• Ensure your firm’s PI insurance includes Cyber security cover

If you want to ensure you are meeting your obligations or require us to assist in completing a Data Protection Audit, Regulation and Compliance Office can help.

Our UK GDPR And Data Protection Auditing Services

Our UK GDPR and Data Protection Audit will provide the firm’s management with the confidence of knowing that it is compliant with the requirements of the regulation and can demonstrate such compliance. We will identify any issues or concerns along with knowledge gaps and provide solutions and proposals to rectify these.

The following key areas will be considered as part of the audit:

• All policies to ensure they are up to date with the latest regulations and legislation.
• Data Retention approach and management
• System security
• Data storage processes
  • Internal
  • External arrangements
• Data management control
• Data Portability
• Cyber Crime Protection and Awareness
• Remote working management
• Terms and Conditions
• Data Controller/Processor arrangements and agreements
• Contracts
• Customer Notices
• Internal systems and controls
• Staff Notices
• Reporting
• Breach Management
• Breach Storage
• Subject Access Request Management
• ICO Reports and Engagement

A full report will be issued to the firm, which will be followed up with a discussion of any recommendations and actions that are made. We will identify any issues or concerns along with knowledge gaps and provide solutions and proposals to rectify these. For detailed information on this service and costings, download our brochure. 

***

The SRA’s AML BLITZ Continues with Another £64,000 Fine

In accordance with what the Law Gazette is referring to as an “AML SRA Blitz”, another exceptional turnover-based fine has been announced in relation to AML compliance failures, which supposedly lasted for close to six years.

Through the course of an extensive investigation, the Solicitors Regulation Authority found the breaches to have occurred for a period longer than was deemed acceptable, and a fine was issued at 1.6% of the firm’s annual domestic turnover.

Following a desk-based review of the firm conducted by the SRA’s AML supervision team, breaches were identified and passed on to investigators, who confirmed that between 2018 and 2024, AML policies, controls, and procedures were either not established or implemented satisfactorily. It was also noted that the firm, based in Kent, also failed to conduct client and matter risk assessments throughout this time.

Commenting on the situation, the SRA said: “the firm was responsible for its own conduct which was serious and had the potential to cause harm to the public interest and to public confidence in the legal profession.” 

“Any lesser sanction would not provide a credible deterrent to the firm, and others. A credible deterrent plays a key role in maintaining professional standards and upholding public confidence.”

Given that the firm is an alternative business structure, the SRA were able was able to exceed its £25,000 fine limit. Earlier this month, the regulator also fined another south east firm £77,784 for failing to comply with the rules on client checks for three years.

Remember: the regulator is in the process of a data-gathering exercise that will collect information from the profession as a whole concerning anti-money laundering. This is for the purpose of identifying firms that require desk-based reviews and further inspections.

Source: here.

How to Prepare for a Desk Based Review

Did you know: Last November, the regulator set itself the target to carry out 700 inspections in 2024/25. From November to February, the SRA conducted 297 inspections, exceeding its target by 128%.

Don’t get caught out. If you consider that your firm may not be compliant, it is essential that you ensure you are ready before the SRA arrives. You may not be able to fix the past, but ensuring you stop any breaches by achieving compliance will assist in mitigation and reduce a fine.

At RACO, we have 2 options to assist you:

OPTION 1 – OUR LIMITED-TIME OFFER – ONE OFF REVIEW

While our AML reviews typically cost £ 2,000, from June to July 2025, RACO is offering a discount of £500, bringing the cost down to £ 1,500.

What Does This Offer Include?

• Data request and identification of documents you need in place to demonstrate compliance (Policies, Controls and Procedures).
• A review of your
  • Regulation 19 Policies Controls and Procedures.
  • Regulation 18 Firm Wide Risk Assessment.
  • Training materials.
  • Client and Matter Risk Assessment forms.
• Guidance on any shortcomings and areas of improvement.
• Corrective action sheet that explains any concerns and how to fix them.
• A written report
• A discussion with the MLRO and Partners to run through each of the corrective actions.
• Identification of any issue you may confront with an audit and a strategy on how to address the SRA.

OPTION 2 – OUR COMPLIANCE SERVICES

If you recognise that you have gaps in your processes and need to overhaul your approach to compliance, including MLR 2017 compliance, our compliance services, starting from £333.33 per month, will put your firm in a position where it is immediately compliant.

You can see full details of each service by clicking the links below:

Regulation & Compliance Service – Our Risk Management Assessment Service has been specifically designed to review and update a firm’s approach to risk and compliance management.

• MLR 2017 Regulation 21 Independent Audit – A review of the firm’s approach to regulation and compliance, including AML procedures, with the audit meeting the requirements of Regulation 21 of AML 2017. The output provides the firm with a written gap analysis and solutions to remedy any issues and ensure compliance.
• AML Training Courses – Our Typical AML Training Includes:
  • AML Training for ALL staff to meet the firm’s obligation to provide annual training.
  • One-to-one training for the MLRO and MLCO on their obligations and requirements.

Compliance Service Offers

Please bear in mind that this is a limited-time offer, so please contact us immediately to take full advantage.

Our limited-time special offer review will ensure your firm can present to the regulator a compliant approach to MLR 2017 obligations before they request it. While unable to fix the past, we can protect your firm’s present and future.

The SRA will adopt a different approach toward firms that can demonstrate compliance proactively beforehand. Firms still requiring direction can expect sterner treatment.

Contact Us Now

Call us now on 0203 985 8550, email us at info@regulationandcomplianceoffice.co.uk or make an online enquiry here.

***

S CA M     A LE R TS

Misuse of the BPW Solicitors Ltd Name

A website is operating at ‘www.bpwsolicitorsltd.com’ which misuses the name and address of a genuine firm of solicitors.

The website seen by the SRA provides an email address of ‘info@bpwsolicitorsltd.com’ and a telephone contact number of ‘+44 741 860 7049’. The website misuses the images of three individuals working at another genuine firm of solicitors, plus the names of two unconnected solicitors.

Please note, any business or transaction through the website ‘www.bpwsolicitorsltd.com’, the email address ‘info@bpwsolicitorsltd.com’, and the telephone contact number ‘+44 741 860 7049’ is not undertaken by a firm or solicitor authorised and regulated by the SRA.

*

Misuse of the Christopher Bean Solicitors Name

The SRA have reported via its website that emails are in circulation purporting to be from a genuine firm of solicitors.

These emails request the recipient transfer funds into varying bank accounts unconnected to the genuine firm.

The SRA has been informed that emails were sent from the following domain which are similar to the genuine solicitor’s domain but with additional letters. The emails have been from the domain ‘christopher-beans.co.uk’ and the other with ‘christopheer-bean.co.uk’.

Please note that any business or transaction through the domain ‘@christopher-beans.co.uk’ or ‘christopheer-bean.co.uk’ is not undertaken by a firm or solicitor authorised and regulated by the SRA.

Please be aware that the SRA authorises and regulates a firm of solicitors called Christoper Bean Solicitors. Emails from the genuine firm use the domain ‘@christopher-bean.co.uk’ (with no additional letters). The genuine firm has confirmed it has no connection with the emails referred to in the above alert.

BEEN CONTACTED?

Here’s What to Do…

When a firm’s or individual’s identity has been copied or cloned, due diligence is necessary. If you receive correspondence you believe to be suspicious, you should conduct your own due diligence by checking the authenticity of the correspondence by contacting the law firm directly by reliable and established means.

You can also contact the SRA directly to find out if individuals or firms are regulated and authorised by the SRA and verify an individual’s or firm’s practising details. Other verification methods, such as checking public records (e.g. telephone directories and company records), maybe required in other circumstances.

Compliance Support for Law Firms

We at RACO are always at hand to provide tailored guidance to help you make the most informed and beneficial decisions. We help you understand the recurrent regulatory shifts and work with you to provide solutions. With our team of professional specialists and our renowned legal expertise, we can work with your firm to ensure you are never left unprepared in the wake of legal changes or cyber threats.

For more information on how we can help, call our consultants on 0203 985 8550 or email us at  info@regulationandcomplianceoffice.co.uk