The legal profession is making progress in the fight against money laundering. According to the SRA’s latest Anti-Money Laundering Annual Report for 2025/26, there is still a significant gap between having AML controls on paper and applying them effectively.
The just-published report covers a year in which the SRA carried out its largest-ever programme of proactive AML supervision. It completed 966 compliance assessments, examining thousands of client files and scrutinising how firms identify, assess and manage the risks of financial crime.
The findings offer some encouragement. The proportion of firms assessed as non-compliant fell from 32% to 22%, while compliance improved across several important areas, including firm-wide risk assessments, AML policies and sanctions controls.
But the report’s main message is that the regulator is increasingly focused on whether AML procedures actually work.
For law firms, this means reviewing the decisions made on individual matters, the quality of their due diligence and the evidence they can produce to demonstrate compliance.
Improvement under increasingly intensive scrutiny
The fall in non-compliance is a positive development, but the scale of the SRA’s supervisory programme is also significant.
During 2025/26, the regulator carried out 985 proactive AML engagements, including 966 compliance assessments. Its work included desk-based reviews, onsite inspections, thematic engagements and reviews of independent AML audits. The scale of supervision has grown considerably since 2020/21, when the SRA carried out 253 engagements.
The regulator also reviewed AML policies, controls and procedures at 937 firms. Although compliance has improved, 46% of the policy sets reviewed were still assessed as partly or wholly non-compliant, according to the report’s accompanying findings on policy reviews.
The regulator is continuing to identify weaknesses and increase its scrutiny of the profession. This means there are increased consequences to falling short. The regulator’s enforcement activity includes financial penalties, regulatory settlement agreements and referrals to the Solicitors Disciplinary Tribunal. In the most serious cases, firms and individuals can face suspension or removal from the profession.
Collecting documents is not enough
One of the report’s most important messages involves source-of-funds and source-of-wealth checks.
The SRA continues to find cases in which firms have collected documents but failed to examine what those documents actually establish. A bank statement, sale agreement or other supporting record may provide useful evidence, but obtaining it is not the same as understanding where the money originated or whether the explanation makes sense.
Effective due diligence requires firms to assess the information critically. Does the source of the money fit what the firm knows about the client? Is the proposed transaction consistent with the client’s circumstances and risk profile? Are there unexplained payments, unusual funding arrangements or third parties involved who require further scrutiny?
Where the evidence raises questions, firms need to investigate. They must also record their reasoning and the conclusions they reach.
This is particularly important in conveyancing, which the SRA identifies as a significant area of money laundering risk. Half of the 24 suspicious activity reports the regulator submitted to the NCA during the reporting year were linked to residential property transactions.
Changes in funding arrangements also deserve attention. If a third party suddenly provides funds, or the source of money differs from what was originally declared, firms need to consider whether further enquiries are required before proceeding.
What is the firm’s real exposure?
The SRA also highlighted continuing weaknesses in firm-wide risk assessments and client and matter risk assessments.
The report found that six firms had no firm-wide risk assessment and were referred for investigation. Of the 931 assessments reviewed, 60% were compliant, up from 47% in the previous reporting year.
That means that a substantial proportion of reviewed assessments still fell short of the regulator’s expectations. And a generic template is unlikely to provide an adequate answer. A firm specialising in residential conveyancing will face different risks from one focused on corporate transactions, tax advice or private client work. Even firms undertaking similar work may have different exposures because of their client base, international connections or operating models.
Risk assessments must also be kept current. The SRA expects firms to take account of its latest sectoral risk assessment and ensure their own policies reflect the risks identified.
The bottom line is that compliance documents need to accurately describe the risks a firm faces,and not just demonstrate that a document exists.
AI, deepfakes and digital onboarding create new challenges
The report also highlights the evolving risks associated with technology.
AI, digital onboarding, deepfakes and fraudulent documents can make it harder to establish whether a customer is who they claim to be. Criminals may use convincing impersonations or manipulated records to circumvent identity verification and customer due diligence procedures.
These threats create a challenge for firms that rely on digital processes to onboard clients or verify information. Technology can improve efficiency, but it can also introduce vulnerabilities if firms do not understand how their systems might be exploited.
The SRA expects firms to consider the AML implications of introducing new products, practices and technologies. Their policies should explain how those changes will be assessed and how additional risks will be mitigated.
Importantly, firms should document that they have considered this requirement even if they have not introduced any relevant changes. Policies should also make clear when a review is required, so that changes in business practice trigger a corresponding review of AML controls.
With sanctions compliance, small mistakes can have big consequences
Sanctions are another area receiving increased attention.
The SRA reported that cases relating to failures to comply with sanctions regimes had tripled since the previous year. Much of the work involved human or administrative errors rather than deliberate misconduct, but that does not remove the regulatory risk.
The international sanctions landscape, particularly measures relating to Russia, creates complex compliance challenges. Firms must be alert to designated persons, ownership structures and attempts to circumvent restrictions. Where a firm is permitted to act under a sanctions licence, it must also ensure that the licence requirements are properly understood and followed.
During 2025/26, the SRA made one report to the Office of Financial Sanctions Implementation concerning a suspected breach involving a firm that acted for a designated person without the required licence.
The finding illustrates why sanctions compliance cannot depend on informal checks or assumptions. Screening needs to be supported by clear procedures, appropriate supervision and reliable escalation arrangements. Firms must also consider how they respond to potential matches and ensure that staff understand what to do when a concern arises.
Basically, they need to ensure that controls reflect real-world risks, staff understand their responsibilities and procedures are consistently applied. In an environment of increasingly sophisticated financial crime and closer regulatory scrutiny, the ability to demonstrate that AML controls work is what will set compliant firms apart.
