Welcome to the latest RACO Roundup for March 2026! We’re keeping you ahead and informed with essential updates in the world of law and compliance. This month, we’re focusing on two fundamental compliance areas: The EU’s landmark overhaul of anti-money laundering regulation and what it signals for UK law firms, and the growing risk of open-source AI tools in legal practice following a significant Upper Tribunal judgment. As ever, our Security Section rounds off the issue with the latest scam alerts from the SRA.
Why UK Law Firms Should Be Paying Close Attention to AML Regulation Changes in the EU
Europe’s overhaul of anti-money laundering regulation, known as AMLR 27, comes into force in July 2027 and introduces a single, directly applicable rulebook across all EU Member States, enforced by a new supervisory authority called AMLA. Although the UK is no longer subject to EU law, this development carries significant implications for UK law firms. The changes include a reduction in the CDD threshold for occasional transactions, a new beneficial ownership standard set at 25% or more rather than the current UK threshold of more than 25%, and a strict five-working-day deadline for responding to financial intelligence unit requests. With the FCA expected to take over as the legal sector’s AML supervisor, the timing could not be more significant. This article explains what AMLR 27 will change, why the beneficial ownership threshold matters in practice, and what firms should be doing now to prepare for a more demanding regulatory environment. Read the full article here:
Why UK Law Firms Should Be Paying Close Attention to AML Regulation Changes in the EU.
Open-Source AI and Client Data: What Your Firm Must Do Now
A recent judgment from the Upper Tribunal Immigration and Asylum Chamber has put law firms on notice about the risks of using open-source AI tools such as ChatGPT with client documents. The ruling confirmed that uploading confidential client material to consumer AI platforms constitutes a breach of client confidentiality, a waiver of legal privilege, and a reportable data breach, regardless of the purpose for which the tool was being used. The solicitor in question was required to notify affected clients and self-report to the SRA and the Immigration Advice Authority. The Tribunal also made clear that supervisors who fail to ensure their teams understand the dangers of using non-specialist AI tools for legal work are likely to be considered more culpable than the individuals who make the error. This article sets out the distinction between open-source and closed-source AI tools, the immediate steps firms should take to review their AI use policies, and how to address any reporting obligations that may arise. Read the full article here:
Open-Source AI and Client Data: What Your Firm Must Do Now
Security Section
Latest SRA Scam Alerts
Warning: Emails Misusing the Name and Details of the Genuine Law Firm Phillips
Date: 27 March 2026
The Scam: 2026 Correspondence has been sent misusing the name and details of the genuine law firm Phillips in relation to a property transaction. Recipients should verify any correspondence directly with the genuine firm before taking any action. The emails seen by the SRA also provide ‘client care’ account details for a deposit payment that are not associated with the genuine firm of solicitors.
Fraudulent Contact Details:
- The bogus email signature includes the genuine law firm (see below) website and Shirebrook branch address and provides the telephone number ‘01623 740680’.
- The domain ‘@phillips-solicitors.com’ is not the genuine domain name used by the genuine firm of solicitors (see below).
- The SRA does not authorise or regulate an individual named ‘Emma Henry’.
Any business or transaction through the email address, telephone number and account details above, or generally through the domain ‘@phillips-solicitors.com’ is not undertaken by a firm or individual authorised and regulated by the SRA.
Is there a genuine firm or person?
The SRA authorises and regulates a genuine firm of solicitors called Phillips (SRA number 568305). The genuine firm uses the email domain of @phillips-solicitors.co.uk. Its head office address is 6 Wood Street, Mansfield, NG18 1QA. England. Its contact details are:
- telephone number 01623658556
- fax number 01623427530
- email address mmarriott@phillips-solicitors.co.uk
- website phillips-solicitors.co.uk
The genuine address of the Shirebrook branch office is First Floor, 9-11 Patchwork Row, Shirebrook, Mansfield, NG20 8AL, England. Its telephone number is 01623740685.
The genuine firm have confirmed they have no connection to the correspondence referred to in the above alert.
Warning: Emails Misusing the Name of Ross David Greenfield
Date: 26 March 2026
The Scam: Emails and documents have been sent misusing the name of Ross David Greenfield in connection with cryptocurrency and asset recovery. Recipients are advised to verify the identity of any individual or firm before responding or providing any personal or financial information.
Fraudulent Contact Details:
- The member of the public also received a document titled ‘agreement for the provision of legal services’ which was sent from ‘David Ross’ from the email address ‘davidross0914@gmail.com’.
- The document is signed by a ‘Thomas Butt’ ‘CEO Cyber Law Solution Ltd’ and quotes the telephone number ‘+44 (7418) 359-388′,
- The email address was ‘support@cyber-law.uk’,
- The address used was ‘Tiviot Dl, Stockport SK1 1TB, United Kingdom’
- The website details were ‘https://cyber-ltd.com’.
Any business or transactions through any of the above postal address, email address, telephone number and website are not undertaken by a firm or individual authorised and regulated by the SRA.
The SRA does not authorise or regulate a genuine firm of solicitors called ‘Cyber Law Solutions Ltd’.
The SRA does not authorise or regulate an individual by the name of David Ross or a Thomas Butt.
Is there a genuine firm or person?
The SRA authorises and regulates a genuine solicitor called Ross David Greenfield who is a solicitor for Birketts LLP.
Birketts LLP have confirmed that neither they nor Ross David Greenfield have any connection to the email or document referred to in the above alert.
Warning: Emails from ‘Andy Harris’ Misusing the Name of CMS Cameron McKenna Nabarro Olswang LLP
Date: 26 March 2026
The Scam: Emails have been sent to a member of the public from a person claiming to be ‘Andy Harris’, misusing the name of CMS Cameron McKenna Nabarro Olswang LLP in connection with an inheritance matter. The genuine firm has no connection to these emails.
Fraudulent Contact Details:
The document is purported to be from an unknown individual claiming to be a Compliance Officer.
- The document also provides the address ‘Lennéstraße 7, 10785 Berlin, Germany’,
- The telephone number ‘+49 30 20360’,
- A stamp seal which states the name ‘CMS Legal Registered Legal Entity’.
The SRA does not authorise or regulate a firm named ‘CMS Legal Services’.
Any business or transaction through the above document is not undertaken by a firm or individual authorised and regulated by the SRA.
Is there a genuine firm or person?
The SRA authorises and regulates a genuine firm of solicitors called CMS Cameron McKenna Nabarro Olswang LLP (SRA ID 423370). The genuine firm uses the genuine email domain @cms-cmno.com and the genuine firm’s website is www.cms.law. The genuine firm’s website is owned and operated by CMS Legal Services EEIG/EWIV. Its head office is Cannon Place, 78 Cannon Street, London, EC4N 6AF and contact number is 020 7367 3000.
The genuine firm of CMS Cameron McKenna Nabarro Olswang LLP has confirmed that neither they nor CMS Legal Services EEIG/EWIV have any connection to the document referred to in the above alert.
Lastest Scam Alerts Page
If you’ve been contacted by any of these scams or received suspicious correspondence claiming to be from a law firm, always verify directly using established contact details before responding or taking any action. For the full and up-to-date list of SRA scam alerts, visit the SRA Scam Alerts Page.
BEEN CONTACTED?
Here’s What to Do…
When a firm’s or individual’s identity has been copied or cloned, due diligence is necessary. If you receive correspondence you believe to be suspicious, you should conduct your own due diligence by checking the authenticity of the correspondence by contacting the law firm directly by reliable and established means.
You can also contact the SRA directly to find out if individuals or firms are regulated and authorised by the SRA and verify an individual’s or firm’s practising details. Other verification methods, such as checking public records (e.g. telephone directories and company records), may be required in other circumstances.
Reach Out to RACO
We at RACO are always at hand to provide tailored guidance to help you make the most informed and beneficial decisions. We help you understand the recurrent regulatory shifts and work with you to provide solutions.
With our team of professional specialists and our renowned legal expertise, we can work with your firm to always ensure you are never left unprepared in the wake of legal changes or cyber threats.
For more information on how we can help:
Call us on 0203 985 8550 or email us on info@regulationandcomplianceoffice.co.uk
