Latest Sectoral Risk Assessment Highlights Technology Risks
The Solicitors Regulation Authority (SRA) updated its Sectoral Risk Assessment on 6 August 2026, and the latest revisions tell firms where the regulator now expects their attention to go. Alongside the familiar high-risk areas of conveyancing and client accounts, the technology section has been rewritten to focus on an emerging threat: fraud and impersonation driven by artificial intelligence (AI), and the cybercrime that so often sits behinds these attacks.
For any law firm updating its firm-wide risk assessment, this section needs particular attention. Under Regulation 18(2)(a) of the MLRs 2017, firms must take the SRA’s sectoral risk assessment into account when preparing their own policies, controls, and procedures (PCPs). Where the regulator has singled out AI-enabled fraud as an emerging risk, a firm-wide risk assessment that says nothing about it, or training records that do not show staff have been given updated guidance, is already out of step with the SRA’s expectations.
What the SRA Now Says About Technology
The updated assessment draws directly on the work by the Financial Action Task Force (FATF), which has identified AI-enabled fraud as an emerging threat to the regulated sector. There are specific concerns raised by the SRA, which highlights how AI-enabled impersonation techniques, including deepfakes, increase the risk of identity fraud and misrepresentation during client onboarding and throughout the life of a matter. The risk becomes even greater where a firm relies on remote verification or digital onboarding, precisely the methods that are becoming more routine for most firms over the past few years.
The point about onboarding deserves particular attention. A deepfake video call or a synthetic identity document is designed to defeat exactly the checks a firm carries out when it cannot meet a client in person. The technology that made it possible to carry out remote instructions is the same technology criminals are now manipulating to their advantage. The SRA points firms to the HM Government’s Digital Identity and Attributes Trust Framework and its DVS Register, which provides a list of certified providers as one way of strengthening that assurance.
However, the latest assessment goes further than onboarding. It identifies cyber-enabled fraud as a money laundering risk in its own right, noting that legal businesses and the regulated sector are exposed in two distinct ways:
- Firms can be used as a conduit for criminal funds; or
- Firms can be attacked directly to access data.
The regulator points to an alert from the Five Eyes cyber security agencies that sets out practical steps to counter AI-enabled cyber criminals. The message running through the whole section is that financial crime risk and cyber security risk are no longer remote issues that a firm can hand the responsibility to separate people.
Why Cyber Fraud Belongs in Your Risk Assessment and Your Defences
It would be easy to read the technology section as a prompt to add a paragraph to the firm-wide risk assessment and move on. Doing so would leave gaps that could leave a firm vulnerable. The risk the SRA describes is not just a money laundering typology to be documented. It is an operational threat to the firm itself and must be treated as such.
We set out the scale of the threat in The Biggest Cyber Risks Facing Law Firms in 2026. Law firms are an attractive target because they hold client money, sensitive personal data, and confidential transaction information in one place. When the SRA warns that firms can be attacked directly, it is describing something many firms have already experienced through phishing, business email compromise, and fraudulent redirection of completion funds.
This is where the risk assessment, the PCPs, and the firm’s actual defences have to line up in practice. A firm-wide risk assessment that identifies AI-enabled impersonation and cyber-enabled fraud as risks, sitting above a firm with weak email security and no verified approach to identity, is not compliant. It is a written admission that the firm has recognised a risk and not put safeguards in place to control it. The assessment and the controls must be viewed as part of the same obligation.
Cyber Essentials – A Practical Baseline that Regulators Recognise
If the risk assessment identifies the threat, the firm needs a demonstrable solution and a set of safeguards. For most firms, the clearest starting point is a Cyber Essentials Certification, a UK Government-backed scheme developed by the National Cyber Security Centre (NCSC). It is designed to give organisations a recognised security baseline against the most common online threats, including phishing, malware, password attacks, and unauthorised access. It is the minimum cybersecurity standard recommended by the UK Government, and it is achievable for firms of any size, including sole practitioners. We explained the full case for certification in Why All Law Firms Should Hold Cyber Essentials Certification.
The updated Sectoral Risk Assessment only strengthens that case. When the regulator explicitly identifies cyber-enabled fraud and AI-driven impersonation as current risks, holding a recognised certification moves from being good practice to being a strengthened way of showing you have taken the threat seriously.
What Firms Should Do Now
The technology section of the risk assessment translates into a short list of practical steps:
- Update your firm-wide risk assessment so it addresses AI-enabled impersonation, deepfakes, and cyber-enabled fraud, rather than treating technology risk as an afterthought. It should reflect the SRA’s current wording, not a version written before August 2026.
- Review your client onboarding due diligence processes, particularly where it is remote. Consider whether your identity verification would withstand a deepfake or synthetic identity, and whether a certified digital identity provider would strengthen it.
- Tighten the controls that criminals actually exploit, including verification of any change to bank details, safeguards around completion funds, and staff awareness of business email compromise.
- Put a recognised cyber security baseline in place. Cyber Essentials certification gives you, your clients, and your regulator independent confirmation that the fundamental controls are working in practice.
- Make sure someone owns the overlap between AML and cyber security. These risks cross the line between the MLRO’s remit and the firm’s IT arrangements, and they fall through the gap when no one is responsible for both.
Speak to RACO About How We Can Support Your Firm
Bringing an AML framework into line with the SRA’s current expectations, and backing it with defences that actually hold, is exactly the kind of work we support firms with every day.
At the Regulation and Compliance Office (RACO), we help identify gaps in a firm’s policies, controls, and procedures through our Detailed Risk Management and Compliance Review and Auditing and File Reviews Services. On the cyber side, our Cyber Essentials Application Service takes firms through the certification from start to finish.
Our Client Due Diligence & Risk Assessment Service provides an outsourced route for completing client and matter risk assessments, including source of funds and source of wealth work and enhanced due diligence where it is needed. For firms wanting ongoing cover, SRA Compliance Essentials and Fully Outsourced Risk and Compliance Management provide continuing support to keep the framework current as the regulations evolve. Our Training courses, including dedicated MLRO and MLCO sessions, make sure the people doing the work understand both sides of the risk.
Speak to Our Compliance Specialists
For firms wanting ongoing support, or to ask any questions about how RACO can support your firm’s wider cyber and compliance arrangements, please contact us:
Telephone: 0203 985 8550
Email: info@regulationandcomplianceoffice.co.uk
Online Enquiry: Complete our contact form
Read other related articles:
