SRA’s annual AML report indicates that many firms remain non-compliant

Solicitors Regulation Authority’s FY 2022/23 audit to be released shortly

At the Law Society’s Anti-Money Laundering and Financial Crime Conference 2023, Collette Best, the SRA’s director of anti-money laundering, provided a sneak peek into the regulator’s upcoming annual report. The conclusion: Many UK law firms are non-compliant. The implications for these firms are important as Best noted that the SRA will likely be entitled to provide higher fines going forward.

Best’s numbers are sobering. Out of 225 firms that were audited, less than 20% were fully compliant. Only half the firms had compliant firm-wide risk assessments (FWRAs). Significantly, the SRA took enforcement actions on 47 firms this past year.

Best indicated that the SRA intends to issue a guidance note and a warning notice as it found significant areas of non-compliance. Perhaps more importantly, the SRA plans to release a template client and matter risk assessment – because of the non-compliance and the result of last year’s thematic review on risk assessments.

Next year’s thematic review will focus on AML training. “Good training is linked to good, broader AML outcomes and is a fundamental part of getting controls right”, said Best.

The SRA plans to continue its desk-based reviews and on-site inspections. Its enforcement will continue to focus on inadequate attention to firms’ policies and controls, inadequate supervision or training and events being allowed to happen both unchallenged and unchecked. An emphasis was placed on the fact that firms need systems and processes to ensure compliance and that higher fines – up to 25K GBP – will likely be implemented.

Omnitrack’s AML compliance solution will provide clients with the SRA’s client and matter risk assessment templates once they are available. Customised templates are also possible for those firms that prefer to create their own.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”