AML Updates for the Legal Sector

As we head into the final quarter of 2025, it’s clear that the regulatory landscape for law firms continues to evolve at pace. Having just wrapped up our latest AML webinar with Mariam Dobosz, Senior Risk & Compliance associate, I wanted to share some key takeaways and reflections - particularly for those who couldn’t join us live.

Catch up OnDemand below. 

IMPORTANT: AML Supervision to Shift from SRA to FCA

A major change is on the horizon - AML supervision for the legal sector is set to move from the Solicitors Regulation Authority (SRA) to the Financial Conduct Authority (FCA). This shift could have significant implications for how firms are monitored and held accountable.

For further insight into what this means and why it matters, check out my LinkedIn article here. 

Source of Funds: Still Catching Firms Out

Let’s start with the basics. The SRA recently flagged that the most misunderstood AML requirement remains the source of funds and wealth checks. Too many firms still think these checks are only necessary when client money hits the account. That’s wrong.

The correct approach is risk-based, triggered by factors like PEP status or high-risk jurisdictions. Regulation 35 and 28(11A) make this clear. Even if no money flows through your client account, you may still need to conduct checks. Your firm-wide, client, and matter risk assessments must reflect this.

And let’s be honest - if you’re still treating this as a tick-box exercise, you’re not doing it right.

National Risk Assessment: No Downgrade for Legal Sector

The UK’s latest National Risk Assessment (NRA) reminds us that while AML non-compliance is relatively low in the legal profession, the high-risk rating remains. Why? Because the nature of legal work still presents vulnerabilities.

The volume of suspected money laundering cases involving lawyers remains disproportionately high. With the SRA’s AML inspections ongoing, I suspect we’ll see more enforcement action soon. If you’ve told the regulator everything’s fine, make sure it actually is - misleading the SRA can lead to dishonesty findings.

Emerging Risks: Consultant Firms, Tech, and Capital Flight

• The SRA’s sectoral risk assessment highlights several emerging threats:
• Capital flight from high-risk countries
• Client account misuse as banking facilities
• Decentralised AML checks in consultant-led firms
• Digital ID in conveyancing - rushing transactions without proper checks

Consultant firms, in particular, need to be vigilant. If your firm operates a hub-and-spoke model, ensure that due diligence and ongoing monitoring are robust and consistent. Consultants must understand the AML risks and not rely solely on the hub’s initial checks.

Client Account Disclosure: A Threat to Confidentiality?

Draft money laundering regulations propose that firms disclose client details to banks upon request. While the Law Society is pushing back, the reality is that banks are already asking for this information.

This raises serious questions about legal professional privilege and client confidentiality. If you’re being asked to do the bank’s job, where does that leave your duty to your client?

Threshold Changes and AML Fines: Lessons Not Learned

The threshold for submitting a defence against money laundering has risen to £3,000. While this may not affect many firms, it’s another reminder to update your firm-wide risk assessment accordingly.

More concerning is the continued stream of AML fines. What’s missing in most cases? Accountability. Where were the MLROs, MLCOs, and senior partners? Why didn’t the independent audit function catch issues before the SRA did?

If you’re in one of these roles, you’re not just a title-holder; you’re responsible. And the SRA is watching.

Counterparty Due Diligence: It’s Not Optional

In conveyancing, both sides must conduct due diligence - not just on their own clients, but on counterparties too. Refusing to cooperate or hiding behind data protection is not acceptable. If your client refuses to share information, that’s a red flag.

Sanctions Regime: No Excuses

Sanctions breaches are increasing, and OFSI is clear: having a policy isn’t enough if it’s not fit for purpose. Whether it’s designated entities, general licences, or payment routing through sanctioned banks - get it wrong, and you’re in breach.

And remember: sanctions apply even if AML regulations don’t.

Companies House and Identity Verification: Change Is Coming

From 18 November, new directors must verify their identity to incorporate or join a company. Existing directors and PSCs will follow suit. If you offer trust and company services, update your policies and train your teams.

Final Thoughts: Time Is Not an Excuse

Whether it’s reading warning notices, updating risk assessments, or conducting due diligence - lack of time is not a defence. The SRA expects you to be informed and compliant. If you’re struggling, seek help early. Don’t wait until the regulator comes knocking.

As always, stay safe, stay compliant, and stay informed.