Anti-money laundering has moved to the centre of how law firms are judged. The Money Laundering Regulations were amended in June 2026, the SRA refreshed its sectoral risk assessment in September 2026, and supervision of the legal sector is set to transfer to the Financial Conduct Authority later this decade. Firms treating AML as a live discipline rather than a fixed process are best placed for that shift.
What is AML in law firms and why is it important
AML in law firms is the framework of risk assessments, client checks, monitoring and reporting that prevents legal services being used to move or disguise criminal property. It sits under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 as amended, the Proceeds of Crime Act 2002, and SRA rules, with sector detail from the Legal Sector Affinity Group.
It matters because the services firms provide are genuinely useful to people laundering money. The SRA continues to rate the legal sector as high risk, citing high-value transactions, the management of client funds and the creation of legal structures. Conveyancing remains the highest risk area. Strong control also protects authorisation and reputation, and increasingly features in panel reviews and client due diligence.
What checks do law firms have to complete to stay in line with SRA regulations?
Firms doing work in scope of the Regulations are expected to maintain:
- A firm-wide risk assessment under Regulation 18, current and informed by the SRA's sectoral risk assessment.
- Documented policies, controls and procedures under Regulation 19, approved at senior level.
- Client and matter level risk assessment, recorded on each retainer.
- Customer due diligence, identifying the client and beneficial owners and establishing the purpose of the relationship.
- Source of funds and source of wealth, a control the SRA examines closely in property and high-value work.
- Enhanced due diligence where risk is higher, including politically exposed persons.
- Sanctions screening, a separate regime that applies across all work, not only in scope matters.
- Ongoing monitoring, internal reporting and suspicious activity reports to the National Crime Agency.
- Record keeping, training under Regulation 24, and an independent audit function under Regulation 21 where appropriate to the firm's size.
- The annual SRA AML and sanctions data return, submitted by a COLP, COFA, MLCO, MLRO or authorised signatory. Firms with no in-scope work submit a nil return.
The consistent theme is judgement as much as documentation. Firms are expected to show why a given level of checks suited that client, matter and transaction.
What changes have there been to regulations in recent times
There have been changes, and they are already in force.
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 took effect on 30 June 2026. These are targeted reforms, not a new regime. Thresholds converted from euros to sterling, with the occasional transaction threshold becoming £800. Mandatory enhanced due diligence for high-risk jurisdictions now applies to countries on the FATF call for action list, with grey list jurisdictions remaining a relevant risk factor. New due diligence obligations apply to pooled client accounts, and the sale of off-the-shelf companies is now in scope. HM Treasury has signalled a further technical consultation.
The SRA sectoral risk assessment was revised in September 2026, adding material on global instability, passporting and reliance on due diligence done elsewhere in a firm, cash-intensive businesses, and AI-enabled impersonation in remote onboarding. Digital identity providers not listed on the Digital Verification Service register cannot reliably be treated as suitable for verification.
Supervision is changing. The FCA will become the single professional services supervisor for AML, with implementation expected toward the end of the decade. The SRA remains the supervisor for now, and firms' obligations are unchanged. Supervisory activity has also grown: 833 firms received an inspection or desk-based review in 2024 to 2025, with feedback often centring on risk assessments that read as generic templates rather than tailored documents.
What factors affect AML checks in law firms
The level of check is driven by risk, which the SRA groups into recognisable categories:
- Client risk, including PEPs, opaque ownership structures and long-standing relationships where familiarity reduces challenge.
- Product and service risk, particularly conveyancing, client account activity, trust and company services and third-party managed accounts.
- Transaction risk, including value, cash funding, cryptoassets, pooled funding and vendor impersonation fraud.
- Delivery channel risk, such as remote onboarding and third-party payments.
- Geographic risk, covering the jurisdictions attached to the client, the funds and their destination.
None is prohibitive on its own. Each shapes how much scrutiny a matter warrants.
Who are the people responsible for AML checks in law firms
Responsibility is shared and expected to work as a system.
- The MLRO receives internal reports and decides on suspicious activity reports to the NCA.
- The MLCO, where appointed under Regulation 21, is accountable for the overall compliance framework.
- The COLP and COFA cover wider regulatory and client money obligations that intersect with AML.
- Partners and boards approve policies, resource the function and set the tone.
- Fee earners are the first line of defence, spotting risk indicators and escalating.
- Compliance, risk and new business intake teams apply the process day to day.
SRA inspections reflect this, typically interviewing the MLCO and MLRO alongside fee earners.
How can firms strengthen their teams to stay up to date with changing regulations
- Keep the firm-wide risk assessment live, reviewed against the current sectoral risk assessment and the 2026 amendments.
- Train with a record behind it. Scenario-based sessions tend to land better with fee earners than policy summaries.
- Build specialist capacity. Demand for experienced MLROs, MLCOs, AML analysts and onboarding specialists has grown, and planning these hires ahead of an inspection cycle beats recruiting reactively.
- Give compliance standing, with clear reporting lines to the board and the authority to pause a matter.
- Prepare for FCA supervision now. The emphasis will fall on governance, records and evidencing that controls work, all of which is useful under the current regime too.
Building the compliance teams behind the checks
Birchrose Associates works with law firms across London on risk and compliance recruitment, from MLROs and compliance managers to AML analysts and client onboarding specialists. If you are planning your compliance hiring for the year ahead, our team would be glad to talk it through. Get in touch with Sam Hyde for more information.
Frequently asked questions
Is AML the same as sanctions compliance? No. They are distinct regimes with overlapping risk indicators, and sanctions obligations apply across all of a firm's work.
What changed in the AML rules in 2026? The 2026 amendments came into force on 30 June 2026, converting thresholds to sterling, narrowing the mandatory enhanced due diligence trigger, adding pooled client account requirements and bringing the sale of off the shelf companies into scope.
Who submits the SRA AML data return? A COLP, COFA, MLCO, MLRO or authorised signatory with a current role recorded in mySRA. A nil return applies where there is no in scope work.
Does the FCA supervise law firms for AML yet? Not yet. The SRA remains the supervisor for most firms in England and Wales while the legislation progresses.
