Whilst there is no confirmed date for the Financial Conduct Authority (FCA) to assume its responsibility for anti-money laundering (AML) supervision, as outlined in our previous article, ‘AML Reforms and Scottish Law Firms – What FCA Oversight Means for Your Legal Practice’, it is strongly advised that all Scottish legal practices ensure that their approach to compliance with the Money Laundering Regulations 2017 (MLRs 2017) is robust.
In the immediate term, this means meeting the expectations of the Law Society of Scotland (LSS) while also preparing for the transition to FCA Compliance.
Firms that have engaged with Regulation and Compliance Office (RACO) for support with compliance, will be comforted to know that we have experience in dealing with the FCA through our non-law firm department. Our policy-building approach is designed to meet regulatory expectations, ensuring the shift to the FCA oversight will not be problematic or daunting for our firms.
Our standard Regulation and Compliance Service is designed to ensure our firms are fully prepared for this regulatory move. If you are a firm that is concerned about its current approach to compliance with MLRs 2017 or would like to adopt a framework that aligns with the expectations of the FCA, we invite you to enquire now. Our support services start from as little as £300.00 per month for members and £350.00 for non-members.
Firms already using our service benefit from detailed monthly reporting, included as part of the guidance and support solutions we provide.
The transfer of anti-money laundering supervision from the SRA to the FCA represents one of the most significant regulatory shifts law firms have faced in recent years. While the government consultation is still underway, one thing is crystal clear: the FCA’s data-driven, risk-based approach is likely to involve greater levels of proactive disclosure and operational transparency.
Recent findings from the Office of Professional Body AML Supervision (OPBAS) paint a concerning picture. Progress has been at best, slow, with many firms failing to demonstrate consistent and effective compliance improvements. As the FCA prepares to take the reins, law firms have an opportunity to review their current approach to compliance with the MLRs 2017.
Recommendations – 8 Steps Scottish Law Firms Should Take Now
Below, our compliance team highlights 8 key recommendations that firms should consider now:
1. Conduct or Update Your Regulation 21 Independent Audit
Unquestionably, a Regulation 21 Independent Audit is a positive first step, as this audit will highlight areas of improvement and allow firms to identify areas of risk or regulatory gaps and take decisive action. The Law Society of Scotland and Legal Sector Affinity Group (LSAG) has given a strong indication to Law Firms that it expects an independent audit to be performed in all but micro firms.
As the audit is effectively an audit of not only the Law Firm itself but the Money Laundering Compliance Officer and Money Laundering Reporting Officer, who are expected to be Senior Managers the Independent Audit is often best outsourced.
As a body that is independent of the Firm, RACO would qualify as being truly independent and be able to meet the requirements of Regulation 21 of the MLR 2017. Click the link* to find out more about how we can assist firms and what our Regulation 21 Independent Audit includes: *MLR 2017 Regulation 21 Independent Audit.
2. Compliance Should Not Be a Tick Box Exercise – Stop Relying on Documentation
Applying a tick box approach to AML compliance is where many firms fail, leaving them exposed to regulatory gaps. A document-heavy approach might have satisfied some professional body supervisors, but the FCA expects something entirely different, proof that those policies and procedures actually work.
The FCA does not just want to see a procedures manual. They want evidence that your AML controls are preventing money laundering risks from materialising elsewhere in your firm. If you are unable to demonstrate measurable outcomes, you will fall foul of the new AML supervisor.
To fix the issue, firms must shift from documentation to demonstration. Conducting regular testing of the firm’s AML framework to prove preventative processes are working in practice. This means moving to the FCA’s mindset, and adopting a proactive approach, including:
- Capturing risk in a high-risk register and keeping the register up to date
- Training staff on what high risk means and what to do about it.
- Running transaction monitoring reports and analysing the results
- Testing client onboarding procedures with real scenarios and file reviews.
- Measuring how quickly suspicious activity is identified and escalated
- Tracking false positives and negatives in your screening systems and establishing with staff how to tackle them.
- Creating metrics that show risk reduction, not just process completion
3. Ensure Consistent File Review and Supervision
One of the core issues for many firms is the ability to maintain a robust and reliable supervision structure. Consistency is key, but when different teams apply different standards, this leads to inconsistent file reviews, and no systematic approach to ensuring compliance across all client matters. These gaps create compliance weaknesses within the firm that sophisticated money launderers can take advantage of.
At RACO, our compliance teams work with firms to establish a pragmatic but common method, that recognises the differences between areas of law but tries to standardise the approach and supervision processes across all teams and practice areas. We help firms establish clear, steadfast procedures for:
- Engaging external file reviews for independent support to ensure file reviews happen with a level of frequency that brings consistency. Focus your staff on service delivery and fee earning.
- How files are selected for review
- What triggers escalation to senior management
- How breaches are identified, documented, and addressed
- Regular training updates based on review findings
- Regular quality assurance checks on the review process itself
- Create a supervision calendar that ensures consistent coverage and maintains detailed records of all reviews, findings, and remedial actions.
4. Implement Strong Ongoing Monitoring Systems
While most firms have established systems for onboarding clients, these are not as effective when it comes to ongoing monitoring.
The FCA expects a greater level of monitoring and continuous assurance, rather than reactive responses. If your approach is to check clients when red flags emerge, this is already too late.
Firms need to implement ongoing monitoring that includes:
- Regular transaction pattern analysis
- Periodic review of client risk assessments (especially after 12 months)
- Being aware of changes for the client and matter and re-assessing risk
- Automated alerts for unusual activity or changes in client behaviour
- Systematic re-screening against sanctions and PEP lists
- Clear triggers for enhanced due diligence reviews
5. Ensure Your Clients Are Re-evaluated Correctly
Law firms must ensure that clients are reassessed when their legal needs evolve. For example, a client who starts with a simple employment matter but then needs help with a property transaction or corporate work presents different risks that require fresh assessment.
Firms must have clear protocols for client re-evaluation that trigger automatically when:
- Clients move into higher-risk practice areas
- The nature or value of instructions changes significantly
- New beneficial owners or connected parties are identified
- Geographic risk factors change
- Time-based reviews are due (typically annually for higher-risk clients)
There are various trigger points for a re-evaluation, and these should be detailed in your AML Policies, Control, and Procedures.
6. Senior Management Accountability
The FCA places heavy emphasis on senior management responsibility with direct involvement by senior management. A hands-off approach will not work for the FCA. The FCA wants to see board-level ownership of compliance outcomes. It is essential that compliance accountability sits at the top of your organisation:
- Outsource to gain external expertise when needed.
- Include AML compliance as a standing board agenda item
- Assign specific compliance responsibilities to senior partners
- Create performance metrics that tie compliance outcomes to leadership evaluation
- Establish clear escalation paths that go directly to senior management
- Ensure compliance officers have sufficient authority and resources to be effective
- Make compliance a strategic priority, not an operational afterthought
7. Perform a Gap Analysis Against FCA Standards
Many firms assume their current AML frameworks will satisfy FCA requirements. This assumption could prove problematic. The FCA’s supervisory approach differs significantly from other professional body supervision, with higher expectations for data analytics, risk management, and demonstrable outcomes. As noted above, using external expertise that has knowledge of the FCA and seeking an independent audit of your entire AML framework against FCA standards. This should cover:
- Policy comprehensiveness and alignment with FCA expectations
- System capabilities for data analysis and reporting
- Governance structures and accountability frameworks
- Training programs and competency assessments
- Record-keeping and documentation standards
- Incident response and reporting procedures
8. Review and Ensure a Robust Technology Infrastructure
Many firms will be relying on outdated compliance programmes on systems that were designed for a different era and are no longer efficient, secure, or compatible with current requirements. The FCA’s data-driven supervision model relies heavily on analytics, comprehensive reporting, and real-time risk monitoring capabilities that basic case management systems simply can’t deliver.
Firms should take this opportunity to assess the hardware, software, or other technology within the firm, including:
- Case management systems with built-in AML monitoring
- Client screening tools that update automatically
- Transaction monitoring capabilities
- Comprehensive reporting dashboards
- Data analytics tools for pattern recognition
- Integration capabilities between different systems
Engage with external providers and use proven compliance technology that is suitable for both legal sector needs and FCA expectations. At RACO, we have the advantage of covering regulators, including the FCA, across a wide range of sectors within our business and understand the requirements. We can help firms assess what is available and suitable for use within their business, providing solutions to modernise infrastructure.
Navigating Dual Regulation: FCA and Law Society of Scotland
It is vital to remember that the transition to FCA AML supervision does not eliminate a firm’s existing regulatory obligations. Scottish firms will continue to be regulated by the Law Society of Scotland for professional conduct, while the FCA will oversee AML compliance.
This dual regulation requires careful coordination to ensure your compliance architecture serves both relationships efficiently without creating conflicts or gaps. RACO has the experience to guide you through the challenge of dual regulation.
Take Action Now
The government’s consultation period provides a valuable window for preparation. Firms that use this time to strengthen their AML frameworks comprehensively will be well-positioned when the FCA takes over. Those that wait for formal implementation announcements will find themselves scrambling to catch up.
The FCA’s track record with other sectors shows they do not offer grace periods for inadequate compliance. Their enforcement approach is swift, public, and expensive for firms that fall short of expectations.
The investment in proper preparation will prove far more cost-effective than the alternative of FCA enforcement action.
The transition to FCA supervision represents both a challenge and an opportunity. Firms that embrace higher standards now will not only satisfy regulatory requirements but also strengthen their competitive position in an increasingly compliance-conscious market.
RACO can assist in ensuring the transition is smooth and is not more challenging that it needs to be.
Compliance and Support Services for Scottish Firms
All firms must demonstrate and uphold high standards in their AML systems and processes, as well as in their management and supervision. This also involves outlining how the firm operates, including the conduct of staff in accordance with established policies, controls, and procedures.
At the Regulation & Compliance Office, we can offer a number of outsourced support solutions, including:
- Regulation & Compliance Service – Our Regulation and Compliance Service, including Risk Management Assessment and AML Risk, provides a cost-effective but essential solution for law firms to ensure they achieve a compliant environment. We work with firms of all types, from sole practitioners through to partnerships, Limited Companies and ABSs. We recognise that it is essential to recognise how a firm implements compliance to tailor the solution to each firm’s working practices. This is why our service is completely bespoke to each firm we work with.
- Regulation & Compliance Outsource Guidance and Support Service – This service provides law firms with a cost-effective outsourced solution which sees the compliance managers of RACO take on the day-to-day guidance and support expected to be provided by COLPs, COFAs, Data Compliance Officers, MLROs and MLCOs. This addition to the Regulation and Compliance Service, including Risk Management and AML Risk, relieves the Compliance Officers from most of the day-to-day burden of keeping up with regulatory requirements and ensures staff have access to compliance and risk advice when they need it.
- Due Diligence & Risk Assessment Service – At the Regulation and Compliance Office (RACO), we provide law firms with a seamless, outsourced solution for Client Due Diligence (CDD) and Risk Assessments. Our Due Diligence and Risk Assessment Service has been designed to enable law firms to focus on the provision of the legal services while we collate the necessary documentation for Due Diligence, Enhanced Due Diligence (where needed), and completion of the Client and Matter Risk Assessment, which must be completed on all matters in scope of the Money Laundering Regulations 2017.
- MLR 2017 Regulation 21 Independent Audit – As a body that is independent of the Firm, RACO would qualify as being truly independent and be able to meet the requirements of Regulation 21 of the MLR 2017. The regulation 21 independent audit extension will further include a review of the approach adopted by the firm for compliance with AML regulations.
- AML Training Courses – Our Typical AML Training Includes:
- AML Training for ALL staff to meet the firm’s obligation to provide annual training.
- One-to-one training for the MLRO and MLCO on their obligations and requirements.
Contact Us
To ask any questions about the Regulation and Compliance Office and how we can support your Law Firm, please call us on 0203 985 8550, complete the online enquiry form, or email us at info@regulationandcomplianceoffice.co.uk
