The SRA has issued a fresh warning to law firms about emerging money laundering risks, highlighting a series of vulnerabilities that could catch firms out even where they already have established AML procedures in place.
The updated sectoral risk assessment, published on 6 August, keeps the legal sector’s overall money laundering risk at high, with no significant change in its underlying vulnerabilities since 2020. But it introduces a number of important developments, including risks associated with cash-intensive businesses, nominee directors, cross-border “passporting” of clients and reliance on due diligence carried out elsewhere.
Firms will need to be able to demonstrate that their controls are being actively applied to the particular risks presented by their clients and matters.
The legal sector remains a high-risk target
The SRA’s assessment indicates that the fundamental risks facing solicitors have not gone away.
Conveyancing remains the highest-risk area, combining high-value transactions, substantial movements of money through client accounts, opportunities to obscure beneficial ownership and pressure to complete transactions quickly.
Trust and company services and the misuse of client accounts also remain among the services considered most vulnerable to money laundering.
The wider 2025 National Risk Assessment reinforces the point that the legal sector’s vulnerabilities and the scale of money laundering involving legal services remain high.
That means firms should not interpret the absence of a dramatic change in the overall risk assessment as evidence that their existing AML arrangements are sufficient.
In fact, the latest update suggests that the regulator is drawing attention to the ways criminals can exploit the gaps between established controls.
Are cash-intensive businesses a new warning sign?
One of the clearest additions is the risk associated with acting for cash-intensive businesses.
The SRA specifically highlights commercial property work involving businesses such as mini-markets, barbers, and car washes. These businesses can be legitimate, but their cash-intensive nature can make it more difficult to establish the true source of funds and understand who ultimately controls the business.
This is particularly significant given law enforcement activity targeting suspected criminal exploitation of high street businesses.
The SRA also warns about businesses whose reported turnover, profitability or activities do not appear consistent with their size, age or apparent operations.
For solicitors, this means the nature of the client’s business should feed directly into the risk assessment for the matter.
A commercial property transaction involving a cash-heavy business should not be treated as routine because the company is incorporated, has a registered address and can produce apparently satisfactory documentation.
The question is whether the overall picture makes sense.
Who really owns and controls the company?
The SRA has also added nominee arrangements to its emerging risks.
The regulator refers specifically to “ghost directors” or individuals whose names appear on company documentation despite having little or no genuine connection with the company or its operations.
This creates an obvious AML vulnerability. A director listed at Companies House may not be the person exercising genuine control. That makes beneficial ownership and control particularly important when firms are carrying out company work, commercial transactions or other matters involving corporate structures.
The latest warning also comes as Companies House continues its work to remove misleading information and improper company listings. The SRA cautions that criminals may still possess Companies House documentation relating to companies that have subsequently been struck off or otherwise removed from the register.
All this means Companies House should be a source of information, not a substitute for verification.
A company appearing on the register does not, by itself, establish that the company, its directors or its beneficial owners are legitimate.
Could “passporting” create a compliance gap?
Perhaps one of the most practically significant warnings concerns what the SRA calls “passporting”.
This can occur when a client moves from one office to another, or between different jurisdictions or business units within a wider firm, with one part of the organisation relying on due diligence already carried out elsewhere.
At first glance, this may seem efficient. But the SRA warns that it creates an inherent money laundering risk if proper controls are not applied. The problem is that previous due diligence may no longer be appropriate.
The earlier instruction may have been outside the scope of the Money Laundering Regulations. The client’s circumstances may have changed. The new matter may present different risks. Or the original due diligence may simply not have addressed the questions relevant to the new instruction.
CDD is no longer a one-time administrative exercise. When a new matter falls within the scope of the Regulations, firms need to consider what due diligence is appropriate for that particular matter and its particular risks.
That applies even where the client is already well known to the firm.
Sanctions evasion is increasingly part of the AML picture
The updated assessment also highlights the continuing threat of sanctions circumvention, particularly in connection with Russia.
The SRA points to attempts to procure goods through third countries and notes that seemingly innocuous products can potentially be connected to sanctions evasion or Russia’s war effort.
For law firms, this demonstrates why AML and sanctions risk cannot always be considered in isolation.
A transaction involving an apparently legitimate company, an apparently legitimate product and a third-country intermediary may look unremarkable when each element is examined separately.
The risk may only become apparent when the wider transaction, ownership structure, geography, counterparties and flow of funds are considered together.
This is particularly relevant for firms working on corporate transactions, international trade, commercial property and company structures.
How does this impact your firm-wide risk assessment?
The SRA explicitly reminds firms that they must take the sectoral risk assessment into account when preparing and maintaining their own firm-wide risk assessment (FWRA).
The SRA’s assessment is not a substitute for the firm’s own risk assessment. Firms must consider how the risks identified by the regulator apply to their own practice, clients, services and geographical exposure.
This matters because the FWRA is one of the key documents the SRA may request during a proactive inspection, desk-based review or investigation.
Simply downloading the latest SRA risk assessment and filing it away is not enough. The firm needs to be able to demonstrate how it has considered the risks identified by the regulator and translated them into its own risk assessment and controls.
What should UK law firms do now?
The first step is to revisit the firm’s FWRA against the latest SRA assessment.
Firms should consider whether the new risks identified by the regulator are genuinely reflected in their own risk assessment. That means looking specifically at exposure to cash-intensive businesses, nominee directors, complex corporate structures, cross-border work, reliance on CDD undertaken by another office or business unit, Companies House information and sanctions circumvention.
The next step is to examine whether those risks are reflected in actual procedures.
It is one thing for a firm’s FWRA to say that beneficial ownership, source of funds and sanctions risk are important. It is another for the client file to demonstrate that fee earners actually identified and addressed those risks.
This is particularly important in conveyancing and other high-value transactions, where client and commercial pressure can make it tempting to treat AML checks as something that needs to be completed quickly rather than as part of the substantive risk assessment.
Firms should also look closely at how they handle existing clients who instruct them on new matters. A client being known to the firm should not automatically mean that previous CDD can simply be carried forward without considering whether it remains appropriate.
For firms operating across multiple offices or jurisdictions, the latest warning should prompt a review of their internal CDD-sharing arrangements. There should be clarity about when previous checks can be relied upon, what information must be refreshed and who is responsible for making that decision.
And sanctions controls deserve particular attention. Firms should consider whether their sanctions screening and escalation processes are capable of identifying indirect exposure, including unusual ownership structures, third-country transactions and counterparties whose activities do not appear consistent with the stated purpose of the transaction.
The regulator is looking for evidence
Perhaps the biggest takeaway from the latest assessment is that AML compliance is increasingly about demonstrating how risk-based decision-making works.
The SRA is not saying that firms must avoid cash-intensive businesses, complex corporate structures or international clients. Nor does the presence of a particular risk factor automatically mean that a client or matter should be rejected.
Instead, firms need to understand the risks, assess them properly and apply controls proportionately.
A firm could have an excellent-looking AML policy and still have a serious compliance weakness if fee earners do not understand when enhanced due diligence is required, if source of funds checks are superficial, if beneficial ownership is accepted too readily, or if previous CDD is relied upon without considering the new matter.
The latest SRA assessment therefore represents more than another regulatory document to add to the compliance library. It is a prompt for firms to ask, if the SRA opened one of our files tomorrow, could we demonstrate that our AML controls actually responded to the risks in front of us?
For firms operating in a sector that remains classified as high risk, that is the question that matters.
