The Solicitors Regulation Authority (SRA) has fined a law firm £14,751 following an investigation that found it had been operating without fundamental anti–money laundering (AML) controls for over six years. The recent decision, published by the SRA, reveals a pattern of failings that left the firm vulnerable to money laundering risks throughout a significant portion of its legal practice.
The regulatory settlement agreement highlighted several concerns. These include the fact that from June 2017 to July 2023, the firm operated without:
- A firm-wide risk assessment (FWRA),
- Compliant policies, controls, and procedures (PCPs),
- A documented client and matter risk assessment (CMRA) process
What Did the SRA Inspection Uncover?
The SRA’s AML Proactive Supervision team uncovered the issues during an inspection. When asked to provide their FWRA as part of a pre-inspection questionnaire in July 2024, the firm sent a document dated August 2024. However, during the investigation, the firm confirmed that their FWRA was only implemented one year prior, in July 2023, six years after the requirement came into force.
It became apparent that this same timeline applied to their PCPs, which were also only implemented in July 2023. Prior to this, they had operated without these essential documents since the Money Laundering Regulations 2017 came into effect in June 2017.
Additionally, when inspectors reviewed eight client files, none of these contained a client and matter risk assessment, or any form of documentation to show that risk had been considered at the instruction stage. At the time of inspection, the firm was using a template CMRA form, and it was in use on just four open matters. In publishing its decision, the SRA noted:
“It is unclear therefore how, if it all, the firm was risk assessing clients and matters, prior to the implementation of this form. It was also apparent that the CMRA provided was not in proper use at the time of inspection.”
Read full details here: SRA Recent Decisions: https://www.sra.org.uk/consumers/solicitor-check/067177/
Preparing for FCA Supervision
This is another case that highlights the serious concerns on AML failings within the legal sector. As we previously reported in our article: ‘AML Supervision Change: The FCA to Replace SRA As AML Supervisor for Law Firms’, the Financial Conduct Authority (FCA) will soon assume responsibility for AML supervision of all regulated businesses, including law firms and legal practices across the UK.
The FCA’s approach to supervision is fundamentally different from the professional body model. Its data-driven, risk-based supervision relies heavily on proactive disclosure, operational transparency, and demonstrable outcomes. The FCA will not be satisfied with just seeing that policies and controls are in place, it will want evidence that those controls are working in practice.
Firms that have operated with tick-box policies and gaps in their AML frameworks, similar to those identified in this case, will find themselves under significant scrutiny when the FCA takes over AML supervision.
Common Failings Firms Should Address Now
The issues raised in this case are not isolated to this firm, and many legal professionals and law firms struggle with:
- Missing or Inadequate Firm-Wide Risk Assessments – Although the requirement to conduct and document a FWRA has been in place since June 2017, this issue is one of the most common failings in firms and the cause of sanctions being issued by the SRA. Many firms continue to operate without one or produce documents that fail to assess actual risk. A compliant FWRA should identify the specific money laundering and terrorist financing risks your firm faces based on your clients, services, delivery channels, and geographic reach.
- Policies That Don’t Reflect Actual Practice – Having a set of policies on paper is not enough to fulfil the requirements. Often, templated documents fail to reflect how the business operates. Policies must be practical, relevant to the firm, understood by staff, and actually implemented.
- Inconsistent Client and Matter Risk Assessment – The absence of any documented risk assessment process is particularly serious. Every in-scope matter requires a client and matter risk assessment at the instruction stage, with effective monitoring procedures. This cannot be a tick-box exercise. It is essential that fee earners understand what they are looking for, when to apply enhanced due diligence, and how to escalate concerns. Read our previous article: Is your Firm’s Risk Strategy Up to Scratch? Which provides guidance on building a robust risk assessment strategy.
- Lack of Staff Training and Understanding – When compliance obligations are not properly demonstrated or implemented, staff are often unsure of what’s expected of them. These gaps create weaknesses that sophisticated money launderers can exploit.
Why Firms Struggle with In-House Compliance
At the Regulation and Compliance Office (RACO), our compliance teams regularly see firms struggle to get to grips with managing AML compliance effectively. It is often the case that firms are relying on fee earners and support staff to complete client due diligence and risk assessments alongside their day-to-day caseloads. When this becomes an additional burden without proper understanding or support, things get missed. Enhanced due diligence triggers are overlooked, source of funds checks are applied incorrectly or not at all, and risk assessments become formulaic rather than meaningful.
These are precisely the oversights that regulators are targeting. With the move to FCA supervision in the not-too-distant future, firms cannot afford to continue with fragmented or inadequate AML frameworks.
Firms that have engaged with RACO for compliance support benefit from our experience across multiple regulators, including the FCA. Our policy-building approach is designed to meet regulatory expectations, ensuring the transition to FCA oversight will not be problematic or daunting.
Related Articles:
Preparing Your Law Firm for the FCA’s AML Supervision
The Hidden Costs and Risks of In-House Client Due Diligence
AML Supervision Change: The FCA to Replace SRA As AML Supervisor for Law Firms
How RACO Can Support Your Firm
All firms must demonstrate and uphold high standards in their AML systems and processes, as well as in their management and supervision. This also involves outlining how the firm operates, including the conduct of staff in accordance with established policies, controls, and procedures.
At the Regulation & Compliance Office, we can offer a number of outsourced support solutions, including:
- Regulation & Compliance Service – Our Regulation and Compliance Service, including Risk Management Assessment and AML Risk, provides a cost-effective but essential solution for law firms to ensure they achieve a compliant environment. We work with firms of all types, from sole practitioners through to partnerships, Limited Companies and ABSs. We recognise that it is essential to recognise how a firm implements compliance to tailor the solution to each firm’s working practices. This is why our service is completely bespoke to each firm we work with.
- Regulation & Compliance Outsource Guidance and Support Service – This service provides law firms with a cost-effective outsourced solution which sees the compliance managers of RACO take on the day-to-day guidance and support expected to be provided by COLPs, COFAs, Data Compliance Officers, MLROs and MLCOs. This addition to the Regulation and Compliance Service, including Risk Management and AML Risk, relieves the Compliance Officers from most of the day-to-day burden of keeping up with regulatory requirements and ensures staff have access to compliance and risk advice when they need it.
- Due Diligence & Risk Assessment Service – At the Regulation and Compliance Office (RACO), we provide law firms with a seamless, outsourced solution for Client Due Diligence (CDD) and Risk Assessments. Our Due Diligence and Risk Assessment Service has been designed to enable law firms to focus on the provision of the legal services while we collate the necessary documentation for Due Diligence, Enhanced Due Diligence (where needed), and completion of the Client and Matter Risk Assessment, which must be completed on all matters in scope of the Money Laundering Regulations 2017.
- MLR 2017 Regulation 21 Independent Audit – As a body that is independent of the Firm, RACO would qualify as being truly independent and be able to meet the requirements of Regulation 21 of the MLR 2017. The regulation 21 independent audit extension will further include a review of the approach adopted by the firm for compliance with AML regulations.
- AML Training Courses – Our Typical AML Training Includes:
- AML Training for ALL staff to meet the firm’s obligation to provide annual training.
- One-to-one training for the MLRO and MLCO on their obligations and requirements.
Contact Us
To ask any questions about the Regulation and Compliance Office and how we can support your law firm, please call us on 0203 985 8550, complete the online enquiry form, or email us at info@regulationandcomplianceoffice.co.uk
