Anti-Money Laundering Annual Report 2025-26

Money laundering is when criminals 'clean' the proceeds (the financial gains) of crime. Criminals transform proceeds into assets, such as houses or businesses, or other seemingly legitimate funds, for example, money in a bank account. In some cases, laundered money is used to fund terrorism.

Money laundering makes these proceeds look like genuine sources of income, which criminals can then spend freely and without raising suspicion. Such criminals often make their money from serious crimes like fraud, trafficking people, wildlife or drugs. Often, these funds are used to finance further criminal endeavours.

Government estimates suggest that more than £100bn is laundered every year through the UK or through UK corporate structures. The National Crime Agency (NCA) believes there are approximately 4,500 organised crime groups operating in the UK.

The prevention of money laundering remains a critical priority both in the UK and internationally. This urgency is driven by a range of factors, including:

• continuing risks relating to terrorist financing
• the increasing importance of sanctions compliance and attempts to circumvent financial restrictions
• an increasingly complex and volatile geopolitical landscape.

This report outlines our anti-money laundering activity during the 2025/26 fiscal year (6 April 2025 to 5 April 2026), providing key insights into our regulatory approach and highlighting specific areas of focus in our ongoing efforts to combat financial crime.

This report is produced as part of our responsibilities as an AML supervisor and our duty to provide information to the Office for Professional Body Anti-Money Laundering Supervision (OPBAS) under regulation 46A of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017(as amended) (MLR 2017). Where throughout this document we refer to 'the regulations', this refers to the MLR 2017.

The Solicitors Regulation Authority (SRA) is the regulator of solicitors and law firms in England and Wales. We work to protect members of the public and support the rule of law and the administration of justice. We do this by overseeing all education and training requirements necessary to practise as a solicitor, licensing individuals and firms to practise, setting the standards of the profession and regulating and enforcing compliance against these standards.

We are the largest regulator of legal services in England and Wales, covering around 90% of the regulated market. We oversee over 200,000 practising solicitors and around 8,924 law firms. We supervise 5,422 firms for the purpose of AML requirements.

The European Union (EU) Fourth Money Laundering Directive and the Fifth Money Laundering Directive (5MLD) were integrated into UK legislation through amendments to the MLR 2017 in January 2020. Since leaving the European Union, new UK legislation came from recommendations made by the FATF and the UK Government. These were most recently updated in June 2026.

The regulations set out the categories of businesses whose services may be vulnerable to exploitation by money launderers. They include banks, estate agents and some legal services.

Laundering money through the legal sector

Solicitors and law firms can be targeted by criminals due to their trusted status, their role in handling substantial financial transactions, and their ability to lend legitimacy to the movement of money or assets. Most law firms work hard to prevent and to spot money laundering and take necessary action, but some get involved unknowingly. A very small number may even knowingly cooperate or work with criminals to launder money.

The legal sector also plays a key role in supporting the enforcement of financial sanctions, helping to limit the activities of individuals and businesses subject to those restrictions.

Firms and solicitors may become involved in money laundering—whether intentionally or inadvertently—often as a result of the nature of the legal services they provide.

• the sale and purchase of property allows large amounts of money to be moved and converted in a single transaction. It also involves assets which are attractive because they can produce income through rental payments or serve as residential property
• setting up trusts and companies can create structures which allow the true ownership and control of assets to be obscured
• money transfers made through client accounts enable funds to be moved, divided, or redirected—often with an added appearance of legitimacy
• providing tax advice where there are concerns regarding tax evasion or other criminal conduct.

Other factors relate to weaknesses in the internal processes and controls firms use, such as:

• failing to carry out appropriate due diligence on a client's source of funds reduces the likelihood of money laundering being detected
• failing to train staff also reduces the likelihood of money laundering being detected and reduces the effectiveness of AML PCPs
• failure to carry out appropriate client due diligence checks (CDD) on conveyancing matters, an area we consider to be high-risk for money laundering.

Our work as an AML supervisor

The regulations name professional bodies with responsibilities for AML supervision. The Law Society is the named supervisor for solicitors in England and Wales and delegates regulatory activities to the SRA. This means we must effectively monitor the firms we supervise and take necessary measures, including:

• making sure the firms we supervise comply with the regulations, and we approve the relevant beneficial owners, officers, and managers to work in those firms
• adopting a risk-based approach and basing the frequency and intensity of supervision on our risk assessments of firms
• encouraging firms we supervise to report actual or potential breaches of the regulations. We do this by:
  • making it a requirement to report in paragraph 3.9 of the SRA Code of Conduct for Firms
  • providing a secure communication channel for reporting, Red Alert line

We must take appropriate measures to review:

• the risk assessments carried out by firms (under regulation 18 MLR 2017)
• the adequacy of firms' PCPs (under regulation 19 to 21 and 24 MLR 2017), and the way in which they have been implemented.

We enforce the money laundering regulations mentioned above and carry out our work as an AML supervisor through:

• sharing and receiving information to prevent money laundering with other supervisors and law enforcement agencies
• publishing guidance on the regulations
• proactive supervision – we do this through desk-based reviews and onsite inspections
• investigating potential breaches of the regulations
• taking enforcement action where breaches of the regulations are proved
• annual data collection exercises
• carrying out thematic reviews.

Key findings from this reporting period

During 2025/26, we further increased our supervisory activity, carrying out 966 AML compliance assessments through inspections, desk-based reviews and independent audit reviews, compared with 864 in the previous reporting year. We also undertook thematic work focused on source of funds and source of wealth controls. Compliance levels improved during the reporting period, with the proportion of firms assessed as non-compliant falling from 32.4% to 21.9%. These findings suggest that many firms are continuing to strengthen their AML controls, although weaknesses remain in some areas.

Our proactive supervision

We continued to increase our AML supervisory oversight during the reporting period. We carried out 985 proactive AML engagements, compared with 935 in the previous year, and completed 966 AML compliance assessments. The difference reflects engagements that did not result in a formal AML compliance assessment, including thematic review activity and inspections conducted as part of ongoing investigations.

At the same time, the proportion of firms assessed as non-compliant reduced from 32.4% to 21.9%, indicating continued improvements in AML compliance across the regulated population.

The figures reported below relate to engagements rather than unique firms. Some firms received more than one form of supervisory engagement during the reporting period.

These were broken down as follows:

Excluding the 19 thematic engagements, 966 engagements involved a direct assessment of AML controls through either an inspection, a desk-based review, or an evaluation of the firm’s independent audit.

The three firms we engaged with as part of an onsite investigation did not have an AML compliance outcome. This is because we engaged with those firms as part of an ongoing investigation which follows a different process to AML supervision.

We have increased our AML supervisory oversight work year by year. The below table reflects our proactive AML engagement with the profession over the last six years:

Onsite AML inspections and desk-based reviews

For inspections and desk-based reviews, we typically review between six and twelve files for each firm, depending on the size and nature of the firm. For larger firms, or those doing a high volume of regulated work, we are likely to review twelve files. We reviewed 6,592 files in total in this reporting period. This is an increase from the last reporting year where we reviewed 5,873 files.

Our desk-based reviews involve examining:

• firm-wide risk assessments (FWRA)
• a firm's policies, controls and procedures (PCPs)
• client and matter risk assessments (CMRA)
• a sample of a firm's files to assess compliance with their PCPs and the regulations.

Onsite inspections also include document reviews and typically involve interviews with the firm’s Money Laundering Compliance Officer (MLCO) and Money Laundering Reporting Officer (MLRO). Additionally, we examined firms’ independent audit reports, training records, and Suspicious Activity Reports (SARs) logs. For some of the largest firms we also conduct interviews with fee earners to assess their knowledge of their firms AML processes and procedures and controls

Compliance levels

Of the 966 firms we engaged with, 937 received an AML proactive inspection or a desk-based review. These figures do not include firms where an inspection was carried out as part of an investigation.

We assessed 78% of firms as either compliant or partially compliant the proportion assessed as non-compliant fell from 32.4% in the previous reporting period to 21.9% in the current reporting period.

These results represent a positive shift compared with previous reporting periods. While we continue to identify firms with significant weaknesses in their AML frameworks, the reduction in non-compliance rates suggests that many firms are responding positively to supervisory engagement, guidance, thematic work and wider awareness initiatives.

Supervision actions

Below are the types of steps we take and an explanation, including how we define the compliance level at a firm. These are used throughout the report. We also set out the number of times we have taken these steps during the reporting period.

The figures below do not include the outcomes where we have identified AML issues as part of an onsite investigation. This is because the engagement, substance and outcome of an investigation is different to that of a desk-based review or an onsite inspection.

In most cases, we work with firms to improve their controls. Overall, we found most firms are doing very well and are able to demonstrate a strong commitment to preventing money laundering. We found 679 firms received guidance or engagement outcomes, demonstrating strong compliance and good controls.

Where matters are referred for disciplinary investigations, we often identify that these firms are referred for multiple breaches, or a systematic and long-term breach. When making the decision on an outcome, we consider several factors, such as:

• the extent of the breaches and how widespread the issues are
• the length of the breach
• the impact of the breach, for example, if a failure to risk assess files has led to insufficient due diligence being undertaken, or a failure to identify a politically exposed person (PEP)
• whether there is a systemic lack of compliance, for example, a firm that does not have adequate PCPs and is failing to comply with a significant number of the regulations.

The firm controls section of this report provides further detail on the most common areas of feedback and non-compliance.

Thematic work

During this reporting period, we undertook a thematic review of source of funds and source of wealth requirements. The review was designed to provide practical guidance to firms, improve understanding of compliance across the regulated population and identify areas where further improvements are required.

Source of funds and source of wealth checks remain fundamental components of an effective AML framework. They are also recurring themes within both our supervisory and enforcement activity.

We reviewed how firms were complying with these requirements in practice and identified examples of good practice, areas for improvement and common challenges. This work involved:

• engaging with 19 law firms of all sizes to gather more insights and emerging themes
• meeting with other regulators and representative bodies to identify best practice that could be shared
• we reviewed and tested the way we communicate with the profession about source of funds and source of wealth
• reviewing three years of data from our proactive supervision work (AML inspections and desk-based reviews) to identify how well source of funds checks were carried out at matter level.

Source of funds and source of wealth checks are one of the foundations of effective AML risk management. Conducting thorough checks can be crucial to preventing money laundering and terrorist financing. It is a key element in protecting law firms from being used by criminals to legitimise the proceeds of crime.

In response to our findings from the thematic review, we published:

• a template for source of funds requests
• a template to record evidence
• updated our FAQs on source of funds and wealth
• case studies.

As part of our proactive approach to AML compliance and guidance, we run awareness campaigns across the year. AML regulation can be complex, and the feedback we receive tells us that people appreciate proactive communications campaigns.

We continued to support firms through guidance, engagement and targeted communications. AML sessions again attracted the highest levels of interest at our annual compliance conference, which last year welcomed 1,150 in-person attendees. There were an additional 11,623 views of the virtual conference a week later, of which 5,283 were AML-related. We also delivered webinars on AML controls, AML for sole practitioners and AML enforcement.

During the reporting period we published our thematic review on source of funds and source of wealth checks. This was supported by practical tools and materials, including templates, case studies and updated guidance.

We also produced a client information page which solicitors can use to explain AML checks and the reason for them.

Work with larger firms

We also engaged with some of the largest firms in England and Wales as part of our supervision process. These engagements are supplemental to the SRA’s wider proactive AML programme and reflect our risk-based approach to proactive work with the largest firms.

These are broken down as follows:

Review of independent audits

Regulation 21 MLR 2017 sets out the requirement for firms to establish an independent audit function. The purpose of an independent audit is to examine the adequacy and effectiveness of a firm’s AML controls and procedures.

We expect large firms to regularly carry out independent audits, given the size and nature of their practices. An effective audit will make recommendations as to how PCPs can be improved and how well a firm’s controls are working.

In this reporting period, we carried on our three-year cyclical programme to review the outcomes of firms’ last independent audits.

We reviewed the independent audits of 26 firms.

The purpose of our review is to:

• assess if a firm's independent audit process is compliant with the MLR 2017
• establish any concerns that had been identified by the auditor and
• assess if the recommendations in the audit have been met.

Depending on the outcome of our review, a more in-depth review may be carried out by the Proactive Supervision Team or the AML Investigation Team to look at the firm's wider controls.

Where no issues are identified, no further action is taken.

We found that:

• all 26 firms had an independent audit process
• 24 out of 26 firms had carried out an independent audit within the last two years
• Most audits we reviewed (23 out of 26) involved a review of both AML PCPs and a sample of files. Showing evidence of the effectiveness of AML controls being reviewed
• 24 out of 26 firms had met the recommendations from their independent audits
• nine firms were referred for a desk-based review or inspection by the AML Proactive Supervision Team. This is because the audits had identified issues with the firms' AML controls, for example, missing CDD on files. Some of these inspections or reviews will take place outside of the reporting year. This demonstrates the value of independent audits in identifying weaknesses that merit further regulatory review
• none of the firms audits highlighted concerns that warranted a referral to the AML Investigations Team.

AML data collection exercise

In July 2025, we carried out our annual data collection exercise aimed at all SRA-regulated firms. This exercise enabled us to ensure the accuracy of our supervisory data, gain a clearer understanding of future resourcing needs, and build a more detailed picture of the size, scale, and nature of the supervised population and the precise nature of the work each firm or sole practitioner undertakes. The data collection exercise covered:

• areas within AML scope
• trusts and company services
• sanctions
• suspicious activity reports.

Firms and individuals, we regulate that fall in scope of the regulations

As of 6 April 2026, 5,422 firms fall within the scope of the money laundering regulations. This represents around two-thirds of the total firms we authorise (8,924).

As a professional body supervisor, we have a duty to make sure that the firms we supervise comply with the regulations and have appropriate controls in place to prevent money laundering.

The table below details the number of firms we supervise which fall within scope of the regulations. This includes the number of firms we supervise for AML purposes, where there is just one solicitor or registered European lawyer (REL) practising at the firm. This is the figure we report to HM Treasury and our oversight supervisor, OPBAS. The definitions are different to our definition of a sole practitioner, who may employ staff or work in conjunction with others.

Number of beneficial owners, officers and managers

Under the regulations, beneficial owners, officers and managers (BOOMs) must be approved by us. They must obtain a Disclosure and Barring Service check and submit it to us when they first become a BOOM or take on a new role. The table below shows the total number of BOOMs we regulate as of 6 April 2026. The total number of BOOMs remained broadly stable during the reporting period.

Enforcement tools

We have a range of enforcement outcomes available to us.

Following evidence of a serious breach of our rules by a firm or solicitor, we can issue a sanction or refer the matter to the Solicitors Disciplinary Tribunal (SDT). There are caps on the financial penalties the SRA can impose in different circumstances, and we have no power to strike off a solicitor. We will therefore refer the matter to the SDT where we think the seriousness of the matter indicates that an appropriate sanction would exceed the SRA's power to fine or justify a decision to strike off a solicitor.

In line with our fining guidance, we can impose financial penalties up to certain levels depending on the circumstances. We can impose fines of up to £250m on an Alternative Business Structure (ABS), also known as a licensed body, and up to £50m on managers and employees of an ABS. For traditional recognised bodies, recognised sole practices and individuals, different statutory limits apply. Since July 2022, we have been able to impose fines of up to £25,000 in appropriate cases, without referring the matter to the Solicitors Disciplinary Tribunal.

Where appropriate, we can also resolve a matter through a regulatory settlement agreement (RSA). Under an RSA, the facts and outcome are agreed by both parties. These allow us to protect both consumers and the public interest by reaching appropriate outcomes swiftly, efficiently and at a proportionate cost.

For less serious matters, we have internal outcome options which include closure with guidance, a letter of advice or a letter of warning where breaches have been identified. We can also rebuke or fine a firm or individual, or put conditions on their practising certificate or firm authorisation, limiting what they can do in their role or firm.

We publish the details of our decisions, including RSAs, on our website. To meet our duty to act in the public interest, we seek to redact or anonymise any information that cannot be published. This might be where information is confidential, legally privileged, or might prejudice other investigations or legal proceedings.

Number of money laundering related reports received

We receive reports about potential breaches of the regulations and money laundering activity from the profession and consumers. We monitor media and other reports for potential breaches, and receive intelligence from the NCA, other law enforcement bodies and government agencies. The number of reports also includes instances where we have identified a potential breach of the regulations, through an AML onsite inspection at a firm or a desk-based review of the firm’s AML controls.

We investigate suspected breaches of the money laundering regulations, the sanctions regimes, cases of suspected money laundering, and the SRA accounts rules. The table below shows the number of reports we have received year on year.

The number of reports received decreased from 426 to 336 during the reporting period. This reduction is consistent with improvements identified through our proactive supervision findings. Referrals received from external sources remained broadly consistent.

Types of reports received

We record the reasons why a report has been made. Often, reports have more than one suspected breach requiring investigation, and these can change during the life of a matter as we receive and assess more information.

The most common categories continue to relate to fundamental AML controls. Failures relating to CMRAs, source of funds enquiries, FWRAs and PCPs account for a substantial proportion of reports received. This is consistent with findings from our proactive supervision work and demonstrates that weaknesses in core AML controls remain the primary driver of enforcement activity.

These were the most common reasons for the AML reports we received:

Number of matters resulting in an internal outcome

The table below shows the number of matters resulting in an internal outcome.

Although compliance levels have improved in several key areas during this reporting period, enforcement outcomes have continued to rise. This is not necessarily inconsistent. Enforcement data reflects the conclusion of investigations, many of which were opened in earlier reporting periods. Increased proactive supervision activity in recent years has also generated more matters entering the enforcement process, leading to higher numbers of outcomes as those investigations conclude.

Below is a breakdown of the type of outcomes in the year 2025/26:

More information on the type of decisions we can make, and their purpose, can be found in our enforcement strategy.

We continue to handle the majority of our fines internally for recognised sole practices and recognised bodies. We are making increased use of our fining powers and regulatory settlement agreements, and we anticipate that this trend will continue. Please see our fining guidance.

In 2025/26 we issued 14 fines through SRA adjudicators totalling £363,726. These can be broken down as follows:

We agreed 145 Regulatory Settlement Agreements totalling £2,003,759. These are as follows:

Regulatory Settlement Agreements increased compared with the previous reporting period. This largely reflects the number and nature of cases reaching conclusion during the reporting period, including matters arising from proactive supervision activity undertaken in earlier years. It should not be taken as an indication that overall compliance across the profession has deteriorated. Findings elsewhere in this report show improvements in a number of key AML controls, including FWRAs, PCPs, and CMRAs.

Number of money laundering-related cases resulting in an outcome at the SDT

In the most serious matters concerning issues such as integrity or dishonesty, or where the recommended fine is above £25,000 (this is usually the case for firms with large turnovers, or high earning individuals) we refer firms and individuals to the SDT.

The SDT has powers that we do not, including imposing unlimited fines, and suspending or striking solicitors off the roll.

In 2025/26 the number of outcomes at the SDT totalled eight. There were two new referrals to the SDT during the reporting period. Given the timing of referrals and the independent nature of Tribunal proceedings, the number of future outcomes may vary from year to year.

Below is a breakdown of the outcomes at the SDT for 2025/26:

Fines at the SDT amounted to £228,000 and are broken down as follows:

All fines received are paid to His Majesty’s Treasury.

Themes from enforcement action

• Increased use of regulatory settlement agreements where appropriate.

While compliance levels have improved in several key areas, enforcement outcomes are influenced by when investigations conclude rather than when underlying conduct occurred. Increased supervisory activity in recent years and the progression of historic investigations through the enforcement process have therefore contributed to higher numbers of outcomes during this reporting period.

Weaknesses in core AML controls remain the main driver for enforcement action. Although there has been a reduction in firms having no AML documentation at all, enforcement continues to focus on inadequate AML control environments, especially weak, poorly documented or non-compliant:

• client and matter risk assessments
• firm-wide risk assessments, and
• policies, controls and procedures.

Scrutiny of source of funds remains a recurring issue. We have continued to see an increase in breaches where firms fail to carry out, evidence, or properly interrogate the provenance of funds, particularly in high-risk matters or where third-party funding is involved.

Understanding the source of funds to be used in a transaction is a fundamental part of the risk-based approach. Being clear about the legitimacy of the source of funds greatly reduces the risk of money laundering. Firms need to do more to understand and evidence the legitimacy of source of funds, particularly where higher-risk features or third-party funding arrangements are present.

Other recurring issues we have identified include a failure to:

• properly document and consider risk when taking instructions and throughout each transaction
• identify and verify the client, and/or carry out ongoing monitoring throughout the business relationship
• recognise work that brings the firm into scope of the regulations, which then carries all the legislative requirements of being 'in-scope' and the necessity to have in place mandatory AML controls
• have sufficient regard for our issued warning notices, red flag indicators (as highlighted by FATF) in transactions and sector-wide guidance (such as LSAG).

We have identified key themes that we believe contributed to these breaches:

• Failure to review and refresh AML controls, audit procedures, maintain records and supervise more senior team members
• Insufficient senior management oversight of AML compliance arrangements
• Inadequate training of fee earners on the regulations
• Having systems and processes that allow events to happen unchecked, such as the receipt of funds or moving to the next stage in a transaction, rather than an automated 'stop' being applied when an element of customer due diligence (CDD) has not been performed

Emerging themes

Since the last reporting year, cases relating to a failure to comply with sanctions regimes have tripled. It is noted that much of this work relates to human or administrative errors within firms, rather than deliberate misconduct.

We continue to work closely with the Office of Financial Sanctions Implementation (OFSI) to achieve sound and proportionate outcomes in these matters.

Enforcement action case studies

Case study one

Background

A desk-based review was carried out by the AML Proactive Supervision team in 2025. The firm was referred to the AML Investigations team after concerns were raised about:

• the firm's AML PCPs; and
• the firm's CMRAs – six of the eight files reviewed did not contain a CMRA .  

Allegations following investigation

• Between 26 June 2017 and 30 June 2022, the firm failed, in our judgment, to establish and maintain fully compliant PCPs, to mitigate and effectively manage the risks of money laundering and terrorist financing, identified in any risk assessment (FWRA), pursuant to Regulation 19(1)(a) of the MLRs 2017, and regularly review and update them pursuant to Regulation 19(1)(b) of the MLRs 2017.
• In six of the eight files reviewed, the firm failed to maintain records of its CMRAs under Regulation 28 of the MLRs 2017. Therefore, the firm was unable to sufficiently demonstrate that the extent of the measures it had taken to satisfy the requirements of Regulation 28 were appropriate, as required by Regulation 28(16) of the MLRs 2017.

Breaches

For conduct up to 24 November 2019:

• outcomes 7.2 and 7.5 of the SRA Code of Conduct 2011; and
• principles 6 and 8 of the SRA Principles 2011.

For conduct on or after 25 November 2019:

• principle 2 of the SRA Principles 2019; and
• paragraphs 2.1(a) and 3.1 of the SRA Code of Conduct for Firms 2019.

Outcome

A fine in Band 'C' of the SRA’s fining guidance was agreed via Regulatory Settlement Agreement, along with mitigation discount for the remedial action taken by the firm and the firm’s cooperation with the investigation.

This resulted in a fine of £24,922, plus costs of £600.

Case study two

Background

It was identified that a former licensed body (the firm) had acted on behalf of a company associated with a non-domestic politically exposed person (PEP), in a residential property purchase.

The AML investigations team reviewed the information obtained by the firm in respect of the PEP. The firm did not identify its client as a PEP until two months after the purchase had completed. As a result, the firm did not meet the requirements of Regulation 14(4) of the MLRs 2007 when acting for that client.

In addition, the firm caused inaccurate information to be provided to another firm of solicitors, in that it confirmed that it had 'verified the identity of the Buyer in accordance with the Money Laundering Regulations 2007…and [the Buyer] is not a PEP.'

Allegations following investigation

• In a residential property purchase, the firm failed to identify the beneficial owner of its client as a PEP and therefore failed to meet the requirements of Regulation 14 of the MLRs 2007, when acting for that PEP.
• In the same residential property purchase, the firm caused inaccurate information to be provided to another firm of solicitors.

Breaches

• outcome 7.5 of the SRA Code of Conduct 2011; and
• principle 8 of the SRA Principles 2011.

Outcome

A fine in Band 'B' of the SRA’s fining guidance was agreed via Regulatory Settlement Agreement, along with mitigation discount for early admissions and the firm’s cooperation with the investigation.

This resulted in a fine of £172,934, plus costs of £1,350.

Case study 3

Background

An investigation was carried out by the AML Investigations team after the firm had been selected for an AML inspection by the AML Proactive Supervision team. Following notification of the inspection, the firm was found not to have a documented and compliant AML control environment in place.

Allegations following investigation

• Between 26 June 2017 and October 2024, the firm failed to have in place a documented assessment of the risks of money-laundering and terrorist financing to which its business was subject (a FWRA) pursuant to Regulation 18(1) and 18(4) of the MLRs 2017.
• Between 26 June 2017 and October 2024, the firm failed to establish and maintain PCPs to mitigate and effectively manage the risks of money laundering and terrorist financing, identified in any FWRA, pursuant to Regulation 19(1)(a) of the MLRs 2017, and regularly review and update them pursuant to Regulation 19(1)(b) of the MLRs 2017.
• Between 26 June 2017 and February 2025, the firm failed to maintain records of its CMRAs under Regulation 28 of the MLRs 2017. Therefore the firm was unable to demonstrate that the extent of the measures it had taken to satisfy the requirements of Regulation 28 were appropriate, as required by Regulation 28(16) of the MLRs 2017.

Breaches

For conduct up to 24 November 2019:

• outcomes 7.2 and 7.5 of the SRA Code of Conduct 2011; and
• principles 6 and 8 of the SRA Principles 2011.

For conduct on or after 25 November 2019:

• principle 2 of the SRA Principles 2019; and
• paragraphs 2.1(a) and 3.1 of the SRA Code of Conduct for Firms 2019.

Outcome

A fine in Band 'C' of the SRA’s fining guidance was agreed via Regulatory Settlement Agreement, along with mitigation discount for early admissions, the remedial action taken by the firm and the firm’s cooperation with the investigation.

This resulted in a fine of £7,847, plus costs of £600.

Suspicious Activity Reports (SARs) play a vital role in supporting law enforcement to tackle money laundering and terrorist financing, as well as wider financial crimes such as fraud. They help to reduce harm, as well as trace assets and funds and assets derived from crime.

We have legal obligations placed upon us to submit SARs to the NCA if we have knowledge or suspicion of money laundering or terrorist financing identified through our work.

During the reporting period, we submitted 24 SARs to the NCA relating to suspected money laundering and terrorist financing concerns identified through our regulatory work. The matters reported involved transactions and funds with a combined value exceeding £102 million where money laundering or terrorist financing concerns had been identified.

The number of SARs submitted remains broadly consistent with recent years. The number of disclosures made by the SRA will naturally fluctuate depending on the matters under investigation and the intelligence received during the reporting period.

The SARs submitted this year revealed a number of recurring risk indicators. Many of these themes are also reflected in the findings from our inspections and investigations and may assist firms when identifying suspicious activity.

The red flags and key themes within those reports included:

• misuse of client account with no underlying legal purpose
• property conveyancing transactions presenting source of funds concerns
• suspected third-party involvement in instructions or funding arrangements
• AML checks failing or being ignored
• fraudulent property transactions (vendor fraud)
• circular and unexplained transactions
• exposure to organised crime groups
• funding, individuals and entities linked to higher-risk countries
• suspected illicit money flows through solicitors' office accounts.

Reports to Office of Financial Sanctions Implementation

During the reporting period we also made one report to the Office of Financial Sanctions Implementation (OFSI) concerning a suspected sanctions breach. The matter involved a firm of solicitors acting for a client who is a designated person, without the required licence from OFSI. We continue to work closely with OFSI where sanctions concerns are identified through our supervisory and enforcement work.

Learning from SAR reviews

Firms are obliged to report suspicious activity to the NCA under the Proceeds of Crime Act 2002 (POCA) or Terrorism Act 2000 (TACT) where the information of concern has come to the firm during the course of its business.

Where we conducted an inspection in the reporting year we reviewed a sample of SARs firms have submitted to the NCA.

We reviewed a total of 157 Defence Against Money Laundering (DAML) SARs ,102 information SARs and 1 Defence Against Terrorist Financing (DFT) SAR submitted by 128 firms.

A DAML can be sought from the NCA when a reporter suspects that the property they plan to handle may be linked to criminal activity. Proceeding without clearance could result in committing one of the main money laundering offences under POCA. A person does not commit one of those offences if they have received ‘appropriate consent’ (a DAML) from the NCA. Conversely, information SARs are submitted to notify law enforcement of potential instances of money laundering or terrorist financing.

We provided feedback on fewer than 10% of SARs reviewed. Overall, the quality of SAR reporting was generally good.

The most common issues were insufficient explanation of the suspected criminal property, limited detail regarding the firm's future intentions, and incomplete information supporting the suspicion being reported.

Firms should also include as much information as possible in SAR reports. For example, phone numbers, email addresses and company numbers should be included in a report, if available. This information is useful to law enforcement in investigating crime.

Poor quality SARs can lead to unnecessary delays, particularly where a DAML has been sought. This can also cause problems for the firm in explaining the delay to a client.

The NCA has previously highlighted concerns regarding SAR quality submitted by parts of the legal sector. Our own review suggests standards have improved considerably, although there remains scope for firms to provide more detailed narratives and intelligence.

We encourage firms to continue referring back to the NCA guidance when submitting SARs, to ensure they contain all relevant information.

Failure to make a disclosure to the NCA in appropriate circumstances can be a criminal offence and proceeding with a transaction in the absence of consent may result in the commission of a principal money laundering offence.

Our warning notice on SARs sets out that we expect all firms and individuals regulated by us to comply with the NCA guidance in relation to submitting DAML SARs.

We also encourage firms to watch our joint webinar with the NCA to understand when they should report concerns to us and how to submit a good quality SAR.

Several of the themes identified through SAR reporting, particularly source of funds concerns, third-party funding arrangements and misuse of client account, are consistent with the issues identified through our AML inspections and investigations. This reinforces the importance of effective CMRAs, source of funds enquiries and ongoing monitoring.

This section of the report examines how firms identify, assess and mitigate money laundering and terrorist financing risks through their risk assessments, due diligence processes and internal controls. It focuses on the measures firms take to assess risk at both firm level, as required by Regulation 18, and client and matter level, as required by Regulations 28(12) and 28(13). Effective risk assessments at both levels remain the foundation of a proportionate and risk-based approach to AML compliance.

Our proactive AML supervision identified continued improvements in firms' controls. Compliance with FWRAs increased from 47% to 60%, compliance with AML PCPs increased from 38% to 54%, and files lacking a or incomplete CMRA fell from 16% to 9%.

Firm-wide risk assessments

The FWRA serves to identify the money laundering risks to which a firm is currently exposed or may become exposed. Based on this assessment, firms are expected to implement proportionate PCPs to effectively mitigate those risks. The FWRA is a fundamental component of a firm's anti-money laundering framework and plays a critical role in safeguarding against financial crime.

When undertaking an AML inspection or desk-based review, firms must provide us with a copy of their FWRA. During the reporting period, we called in a total of 937 FWRAs for review. Despite the requirement to have a FWRA being in place for over nine years now, 6 firms did not have a FWRA and were referred for investigation.

Of the remaining 931 FWRAs we reviewed, we found the following levels of compliance:

During this reporting period, 60% of FWRAs reviewed were assessed as compliant, compared with 47% in the previous reporting year. The proportion assessed as non-compliant fell from 9% to 7%.

These findings indicate that firms are continuing to improve the quality of their FWRA. However, a proportion of firms still fail to adequately identify and assess the money laundering risks they face. A robust FWRA remains fundamental to the development of effective PCPs. We would urge firms to review and update this key document. We have provided information below that should help firms to do that.

We provided feedback where we identified areas for improvement within FWRAs. In many cases, firms received feedback across multiple risk factors. As a result, the total number of feedback points exceeds the number of assessments reviewed.

The most common areas requiring improvement are set out below:

A FWRA should be treated as a living document and reviewed whenever there is a material change to a firm's risk profile, including changes to legislation, regulatory guidance, service offerings, client base, ownership structure, operating model, areas of legal practice, mergers or acquisitions, or the introduction of new systems and processes such as client verification tools. However, we continue to encounter firms whose FWRAs have not been updated for prolonged periods. Firms should undertake reviews every one or two years to help maintain the FWRA accuracy and review emerging risks. We expect firms to take into account our sectoral risk assessment when updating their FWRA, this was recently updated in August 2026.

Several recurring themes were identified in non-compliant FWRAs.

• In some cases, firms only produced a FWRA after we requested one, despite having previously confirmed that one was in place.
• Other firms failed to provide a FWRA altogether, instead submitting alternative documents such as AML policies, CMRA, or operational risk assessments that focused on business rather than money laundering risks.
• We also saw firms relying on incomplete or poorly completed templates, including checklist-style documents, assessments lacking sufficient detail, and, in some instances, entirely blank templates.

Common weaknesses included failing to adequately address the five key risk areas required by Regulation 18 of the MLR 2017, producing assessments that were not proportionate to the size and nature of the practice, and identifying risks without properly assessing or explaining them.

• Some firms stated that they operated in high-risk jurisdictions without identifying the relevant jurisdictions or evaluating the associated risks.
• We also found that many assessments focused on activities the firm does not undertake, such as trust formation services or acting for politically exposed persons, rather than assessing the money laundering risks arising from the firm's actual day-to-day work.

These findings reinforce the importance of maintaining a FWRA that is tailored, comprehensive, regularly reviewed and kept up to date to reflect the firm's current risk exposure.

Good practice

We identified a number of examples of good practice through our reviews of FWRAs during the reporting period.

The strongest FWRAs demonstrated a clear understanding of the firm's business model, client base and transactional activity. They were tailored to the firm's specific circumstances and supported by evidence rather than generic statements of risk. In some examples we saw, it was clear the person undertaking the FWRA had worked closely with various teams and partners across the business to assess the risks. The advantage of this was that all areas of the business were feeding into the FWRA. It also helped to demonstrate a risk-based approach, as something which would be low risk in one business area may be considered high-risk elsewhere.

Several firms supplemented their assessments with management information, including data relating to internal SARs, high-risk clients, overseas instructions and transaction values. We consider this to be particularly effective in supporting a genuinely risk-based approach to compliance.

Given the long-standing nature of this requirement, we expect firms to have effective and compliant arrangements in place. Over the years we have provided a variety of resources to help firms draft an effective firm risk assessment if they don't already have one.

• our sectoral risk assessment
• a checklist to help firms prepare for a firm risk assessment
• an updated  FWRA template 
• two webinars on FWRA.

Proliferation financing risk assessment

From 1 April 2023, firms must risk assess and document their exposure to proliferation financing (PF). This is a requirement under regulation 18A of the MLR 2017. This assessment can be done as part of the FWRA or as a standalone assessment. Proliferation Financing means the act of providing funds or financial services for use, in whole or in part, in the manufacture, acquisition, development, export, trans-shipment, brokering, transport, transfer, stockpiling of, or otherwise in connection with the possession or use of, chemical, biological, radiological or nuclear weapons, including the provision of funds or financial services in connection with the means of delivery of such weapons and other CBRN-related goods and technology, in contravention of a relevant financial sanctions obligation.

We found that 778 of the 937 firms reviewed (83%) were able to demonstrate a documented proliferation financing (PF) risk assessment.

While this represents encouraging progress, 17% of firms were unable to demonstrate compliance with Regulation 18A. Given that this requirement has been in force since April 2023, firms should ensure that PF risks are formally assessed and documented.

We have previously highlighted the need for firms to conduct a PF risk assessment.

Client and matter risk assessments are a key requirement of Regulations 28(12) and 28(13) of the MLR 2017 and play a critical role in ensuring that firms identify and assess the money laundering and terrorist financing risks presented by each client and matter.

Effective CMRAs inform the level of CDD required and support a proportionate, risk-based approach to compliance. As part of our desk-based reviews and onsite inspections, we reviewed 6,592 files during the reporting period.

Compliance with the requirement to complete a CMRA has improved. We found that 612 files (9%) did not contain a CMRA, or contained an incomplete assessment, compared with 16% in the previous reporting period. Our reviews consistently demonstrate that files containing effective and well-reasoned CMRAs are significantly more likely to be compliant overall.

However, the quality of many risk assessments remains an area of concern. Following our review of inspection and desk-based review findings, we found that 36% of the firms we visited or reviewed had ineffective CMRAs. In addition, we disagreed with the risk rating recorded by firms on 10% of files reviewed, concluding that a higher risk rating should have been applied on the majority of these files. This suggests that some firms continue to underestimate risk factors present within matters, creating a risk that the level of due diligence and ongoing monitoring applied may not be commensurate with the actual risk exposure.

Although completion rates have improved, we continue to observe instances where CMRAs are treated as an administrative requirement rather than a meaningful assessment of risk. In these cases, risk ratings are often recorded without sufficient explanation of how the conclusion was reached or what mitigating measures have been considered.

A compliant CMRA should clearly explain the factors influencing the risk rating, the rationale for any judgement made, and how identified risks will be managed throughout the matter. A lack of CMRAs on files remained the most common reason for firms being referred for further investigation. Of the 206 firms found to be non-compliant following an onsite inspection or desk-based review, 87 firms (42%) were referred due to deficiencies relating to the absence of CMRAs on files. We expect all matters within scope of the MLR 2017 to have an appropriately completed CMRA. Where a CMRA is missing, the file will be assessed as non-compliant, and firms may be referred for further investigation where deficiencies are systemic.

We continue to identify examples of firms relying on overly simplistic assessments that do not adequately address the requirements of Regulations 28(12) and 28(13) or reflect the principles set out in our warning notice and guidance. In some cases, firms were referred for investigation where the CMRA was clearly deficient. Common weaknesses included fee earners treating the assessment as a tick-box exercise, with little or no explanation of how the risk rating had been determined, why a particular level of CDD was considered appropriate, or what measures would be taken to mitigate identified risks.

We also found that CMRAs did not always align with the firm's FWRA. For example, firms that identified certain activities or jurisdictions as presenting a higher risk within their FWRA sometimes assessed individual matters involving those same risk factors as low risk without recording any rationale for the discrepancy. In other cases, firms lacked a consistent approach to risk assessment across the practice, with CMRAs completed for some matters but absent from others. These findings demonstrate the need for firms not only to complete CMRAs but to ensure they are tailored, evidence-based, aligned with the firm's wider risk assessment framework, and capable of demonstrating the rationale behind the level of due diligence applied.

Our thematic review, warning notice, good practice guidance and CMRA template have helped improve awareness and compliance across the profession. Nevertheless, the findings from this reporting period indicate that further work is required to improve the quality, consistency and effectiveness of CMRAs.

This section concentrates on the customer due diligence (CDD) measures firms must apply to mitigate against any money laundering risks under regulations 27 and 28 of the MLR 2017. Overall, we are continuing to observe good practice in this area.

CDD is a key requirement of the MLR 2017 and one of the most effective controls firms can put in place to protect against money laundering. CDD requires firms to take a holistic approach to have a comprehensive view of the risks associated with a particular client or parties to a matter or client. This section of the report focuses on the obligation to identify and verify clients and conduct source of funds checks.

Firms must have processes in place to identify and verify their client's identities. Identification of a client or a beneficial owner is simply being told or otherwise coming to know a client's identifying details, such as their name and address. Verification is obtaining evidence which supports this claim of identity.

Conducting CDD goes beyond identifying and verifying the client’s identity using a reliable independent source. It also includes:

• identifying an ultimate beneficial owner (where applicable) who may not be the client and taking reasonable measures to verify their identity
• understanding the purpose and intended nature of the business relationship or transaction
• taking a risk-based approach to determine the level of checks that is required for a client or matter. For example, a high-risk client or matter will require additional checks to a low-risk client or matter
• scrutinising transactions including the source of funds, where necessary, to ensure that the transaction is consistent with the firm's knowledge of the customer, the customer's business and risk profile.

Firms must also carry out regular ongoing monitoring of a business relationship, paying particular attention to:

• any indication that the identity of the client, or beneficial owner has changed
• any transactions which are not reasonably consistent with your knowledge of the client
• any change in the purpose or nature of the relationship; and
• any other matter which may affect your assessment of the money laundering or terrorist financing risk in relation to the client.

We assess firms' CDD processes when we review files as part of an onsite inspection or desk-based review.

Findings from file reviews

We found that:

Out of 6,592 files, 336 files (5%) did not contain evidence that the client had been identified and verified.

The high level of compliance in this area suggests that many firms are taking their CDD obligations seriously. We saw some good examples of ways firms were conducting CDD. These include:

• explaining to clients at the early stages why CDD is required to set expectations and foster cooperation
• system led controls preventing matters being worked on until CDD is in place
• file checklists to help ensure the appropriate CDD has been obtained before working on a file
• regular file reviews to ensure the CDD process is being followed across the firm
• making use of open-source information to search for adverse media on clients.

We also identified some examples of firms not complying with their CDD obligations properly. For example:

• we continued to see occasions where the client's identity was not independently verified because the fee earner or someone at the firm knew the client personally.
• inadequate identification and verification of corporate clients. On occasions, firms would only take copies of ultimate beneficial owners' identification and verification documents. Often, it was unclear whether this information had been verified against the company registry.
• we have also seen instances where firms have carried out substantial work for clients before undertaking CDD. For example, in some instances firms had received substantial funds before undertaking their CDD obligations.
• firms failing to investigate alerts which have appeared such as potential matches to politically exposed persons (PEPs) or designated individuals. We consider it good practice to document any decision making and rationale for ruling out any positive matches.
• despite generally good CDD compliance, we identified weaknesses in sanctions and PEP screening
• Of the 6,592 files reviewed, 20% contained no evidence of PEP screening and 21% contained no evidence of sanctions screening
• given the increasing importance of sanctions compliance and the growing sophistication of financial crime threats, firms should ensure that appropriate screening is undertaken and documented as part of their client onboarding and ongoing monitoring processes. You should also ensure clients are screened for PEP status, to ensure you do not inadvertently breach the MLR 2017.

There is no provision in the MLR 2017 for waiving CDD requirements based on long-standing or personal relationships. Taking this approach will not satisfy the requirement to undertake independent verification. Further, the value of personal knowledge in carrying out CDD will come to an end if the fee earner leaves the firm.

It is essential to establish the identity of the instructing party and to understand the ownership and control structure of any entities involved in the transaction on which the firm is acting. This is particularly important with entities involving ultimate beneficial owners. The better you know your client and understand your instructions the better placed you will be to assess risks and spot suspicious activities. It is important to keep records of company due diligence that is carried out on file, this will enable you to spot any changes as part of your ongoing monitoring obligations, and evidence the enquires you made to understand the company structure. Failure to do so properly may lead to the firm breaching the requirements of the MLR 2017, the UK sanctions regime and/or open your firm to reputational risks.

Nearly 91% of firms we met with carried out CDD on all clients, not just those in scope of the MLR 2017. This approach offers a practical advantage: by applying full AML checks universally, firms can transition clients from non-AML services to AML-regulated services—commonly referred to as passporting—without the need to conduct additional checks. However, this benefit is only realised where firms have a clear and robust process in place to ensure that the transition prompts appropriate AML considerations and that the checks already carried out remain valid and up to date.

We continue to see widespread use of electronic identification and verification technology. While these tools can improve efficiency and support compliance, firms remain responsible for understanding the capabilities and limitations of the systems they use. Almost 93% of firms we met with used technology, including electronic identification and verification (eIDVA), to help with their CDD checks.

Firms explained they use eIDVA to help verify identity checks, as well as adverse media and sanctions screening. Several firms also used eIDVA to help contribute towards their ongoing monitoring obligations, as some providers will send updates where adverse media or sanctions are recorded against names.

Just under half of the firms of firms we met with (48%) explained they often test the technology they use for accuracy. Some examples involved but are not limited to:

• screening names which were added to different sanctions list to see whether any results were returned
• one MLCO discovered that some PEPs were not identified by their provider and undertook further mitigation
• screening known PEPs or sanctioned individuals with provider to ensure system is accurate
• discussing discrepancies with providers.

Where firms are using technology, they must develop an in-depth understanding of the tools they choose to incorporate to fulfil their regulatory obligations. Firms should remain alert to emerging fraud and identity-verification risks, including the use of AI-generated or synthetic identity information. An electronic report is only as good as the understanding of the person reviewing the report. It should also be noted that eIDVA checks are not a substitute for a CMRA.

On 26 February 2026, HM Treasury and the Department for Science, Innovation and Technology published joint guidance on the use of digital ID in client due diligence. This states that 'Digital verification services which are not certified and therefore not on the DVS Register cannot reliably be deemed suitable for identity verification in compliance with the MLRs. Further guidance can be found here.

Additional guidance on the use of digital identity technology can be found under section 7 of the LSAG AML Guidance.

Source of funds enquiries remain one of the most effective controls available to firms. Obtaining evidence is only part of this process. Firms must also critically assess and understand how the funds have been generated and whether the explanation provided is consistent with their understanding of the client and transaction. Failing to identify where funds have come from or obtain evidence of the source of funds (where necessary), could put your firm at risk of committing an offence under the Proceeds of Crime Act 2002.

We continue to find that the quality of source of funds scrutiny is often more problematic than the collection of documents themselves.

Firms must have processes in place to ensure that the funds used in a transaction are from a legitimate source. This will help identify and mitigate potential money laundering risks. If you are clear around the legitimacy of the source of funds, the risk of money laundering is greatly reduced.

We have produced a thematic review on source of funds/wealth which can be found here.

Findings from our proactive work

We provided feedback on source of funds/wealth to 52% of firms who received an onsite inspection or desk-based review.

As gatekeepers for the profession, having adequate source of funds controls in place can prevent the firm being used to launder money.

Of the 6,592 files we reviewed, 5,349 files required source of funds/wealth checks to be completed. We found 9% of these files did not contain any source of funds checks, despite being required.

Where documents had been gathered, the source of funds had not been scrutinised in 18% of files we looked at. For example, we occasionally found firms would take a copy of their client’s savings account statement, which shows the availability of the funds for a residential property purchase. Often, these firms would have little understanding of how the funds in the account had accrued.

In 12% of the files we reviewed, we had concerns relating to the lack of SOFs on file. Some of these circumstances involved the following:

• the transaction involved a cash purchase, but the firm had not obtained source of funds evidence
• source of funds evidence had been obtained, but it did not demonstrate that the client had sufficient funds to complete the purchase. This indicated that the evidence had not been properly scrutinised
• funds were received from a company. The firm obtained limited SOFs evidence. For example, the firm obtained company accounts however this showed the company had limited profits
• funds were received from third parties. But the firm had not obtained sufficient SOFs evidence
• bank statements were not adequately scrutinised, despite showing unusual activity such as large deposits or cash deposits. The firm failed to query this activity.

Overall, we provided SOFs feedback on files to 51% of all firms which had a specific SOF process in place in their policy.

Further of all firms that were referred to our investigations team from our proactive work, 29% of the referrals were referred for SOF/SOW concerns. We also found that of the firms referred for SOF issues on files, 67% of these firms had a defined process in their Policy. Therefore, showing a disconnect between the PCPs and what is happening at matter level.

In 6% of files we reviewed, we found the information gathered as part of firms' source of funds checks did not match information contained on the ledger. Unexpected changes to the way a transaction is being funded is a potential red flag. Where identified, firms should consider whether there is a reasonable explanation for these changes.

Understanding and documenting source of funds/wealth should be approached as an opportunity to protect your firm from being used for money laundering.

The type of documentation you accept to verify source of funds/wealth should depend on the level of risk presented by the client and or matter. The higher the risk, the more comprehensive the documents obtained should be.

This section of our report focuses on how firms are complying with the requirements of being a trust and company service provider. Regulation 12(2) MLR defines services that fall within the definition of a TCSP. We still see firms providing these services without appropriate registration. Regulation 56 sets out you must be registered before providing these services. We found 9% of firms were providing TCSP services without being registered. These firms were referred for investigation.

We continue to identify firms providing services that fall within the definition of a Trust and Company Service Provider (TCSP) without being appropriately registered.

Common examples include company formation services and arrangements involving nominee directors or company administration activities.

Firms should regularly review the services they provide to ensure they are correctly registered before undertaking regulated TCSP work.

Further guidance can be found on our website here.

Policies, controls and procedures translate the risks identified within a firm's FWRA into practical measures that staff can apply consistently.

Effective PCPs should be tailored to the firm's business and provide clear guidance to staff on managing AML risks in practice.

We reviewed the PCPs put in place by 937 firms. 3 firms did not have PCPs in place when we carried out a desk-based review or an onsite inspection. They were referred for further investigation.

We found the following levels of compliance:

Below are some of the most commons themes and missed areas within firms AML PCPs:

Mitigation of Money Laundering (ML)/Terrorist Financing (TF) risk involving new products, practices or technologies

Under regulation 19(4)(c) MLR 2017, firms’ PCPs must assess and mitigate against money laundering risks associated with new products, new business practices or technologies.

This requirement is becoming increasingly important given the evolving nature of artificial intelligence and digital onboarding solutions. Firms should assess whether such technologies introduce new money laundering, sanctions or identity fraud risks and ensure controls remain effective against emerging threats. This also applies to any new products or business practices introduced at the firm.

We found firms did not include details of how staff assess and mitigate against risks associated with new products, new business practices or technologies in their PCPs. Further if there are no new products, business practices or technology to assess. This should still be documented to show that this requirement has been considered.

Reporting discrepancies to Companies House

Under regulation 30A MLR 2017, firms must inform Companies House of any material discrepancies between the information it holds about a person with significant control or registrable beneficial owner of an overseas entity, and the information on the Companies House register.

Any material discrepancies must be reported to Companies House as soon as reasonably possible.

We found that in some cases firms do not include their procedure on how they facilitate reporting of material discrepancies between beneficial ownership information obtained through due diligence checks and the information on the Companies House register.

Identifying and scrutinising patterns of transactions

Under regulation 19(4) MLR 2017, firms must have in place controls which identify and scrutinise:

• a transaction is unusually complex or unusually large in each case given the nature of the transaction
• unusual patterns of transactions
• transactions which have no apparent legal or economic purpose.

We found that many firms mentioned these factors within their PCPs. However, very little explanation was given as to what a large or unusually complex transaction looks like for that firm. Each individual firm will have their own measure as to what constitutes unusually large or complex transactions.

Firms' PCPs should outline a list of potential red flags that fee earners must be aware of. These red flags should be tailored to the firm. We accept that it is impossible to list every possible red flag, given that criminals are constantly adapting their methods to launder money. However, the inclusion of a non-exhaustive list will help fee earners identify transactions that may be out of the ordinary.

Since 30 June 2026, regulation 19(4) and 33(1)(f)(i) has been amended from complex or unusually large to unusually complex or unusually large, thus narrowing the definition. You will need to update your policies to update this wording.

Reliance

Reliance has a specific meaning within the regulations and relates to the process under regulation 39 MLR 2017. In certain circumstances, firms may rely on another person to conduct CDD, subject to their agreement. Reliance does not necessarily mean obtaining certified copies of documentation from other regulated professionals for due diligence purposes.

A firm's stance on reliance must be documented within their policies and procedures so fee earners know whether it is permitted by the firm. If reliance is not permitted, this should still be included to make the position clear.

We found most firms had decided to not make use of this provision under the regulations. If firms chose to make use of regulation 39 reliance, the appropriate controls must be in place.

Simplified due diligence

Simplified due diligence (SDD) is a common area of feedback we provided to firms. Numerous policies either lacked any reference to SDD or included conflicting definitions and guidance.

Regulation 37 allows SDD to be carried out where a firm determines that the business relationship or transaction presents a low risk of money laundering or terrorist financing, taking into account the FWRA.

SDD is the lowest permissible form of due diligence and can only be used where the firm has actively determined that the client presents a low risk of money laundering or terrorist financing.

It is important to note that, while there is no obligation on firms to apply SDD, it is something they may wish to consider adopting, in the appropriate circumstances. However, a firm's approach to SDD must be set out in its policies and procedures. This is so fee earners know whether they can apply it or not.

If firms do permit SDD, they need to set out the circumstances and the checks they would expect to see, as CDD will still need to be applied albeit to a lesser extent, and fully documented.

Products or transactions favouring anonymity

The regulations are clear that firms must set out their position on whether they offer services that favour anonymity. If this is a service firms offer, they must make sure their AML policy contains a section which sets out mitigating actions for their fee earners. In many cases, we provided feedback on including a section within PCPs to take additional measures when dealing with products or transactions that may favour anonymity.

High-risk third countries/ jurisdictions

While the list of countries requiring mandatory enhanced due diligence has narrowed following recent legislative changes, firms should continue to assess wider geographic risk indicators and should not assume that jurisdictions outside the FATF Call for Action list present low risk.

We found that many firms failed to identify high-risk third countries/ jurisdictions or comment on their approach to them.

While it may be unusual for some practices to come across overseas clients, firms must make sure their fee earners are aware of any high-risk jurisdictions so they can exercise caution and apply enhanced due diligence (EDD).

Regulation 33(1)(b) of the regulations requires firms to apply EDD measures in circumstances where high-risk third countries are involved.

Since 30 June 2026, High risk third countries under regulation 33(b) and 3A will only be those subject to a Call to Action by the Financial Action Task Force – currently Iran, North Korea and Myanmar. Firms must ensure they update their policies to reflect this.

Regulation 33(1)(b) of the regulations requires firms to apply EDD measures in circumstances where high-risk third countries are involved. It is therefore important firms identify where their clients, client entities or the transactions they are working on are linked to, and whether they are high risk jurisdictions.

Sanctions

Firms may be at risk of being used to evade sanctions. PCPs should mention what steps a fee earner should take to make sure their client is not subject to financial sanctions. It is important that fee earners are aware of all parties involved within a transaction, including any beneficial owners, to ensure they are complying with the sanctions regime and regulation 33(6)(ii) of the MLR 2017.

Firms may choose to document their approach to complying with the sanctions regime within their AML policy document or as a separate sanctions policy.

We have undertaken a suite of work in this area in the reporting period. Please see the sanctions section of this report for full details.

Renewal of Customer Due Diligence

We have found that we have fed back to firms where their PCPs do not outline the circumstances when they would renew CDD for existing clients. Regulation 27(9) sets out the circumstances when you are required to renew CDD for existing clients.

It is important to note that in certain circumstances you must update CDD if there is a change to the clients' identification information. This would include change of name, address, beneficial owner or business.

We also consider it good practice to renew CDD for existing clients where there is a gap between instructions.

Other findings

We noted there is still a tendency for firms to use ‘off-the-shelf’ AML Policy documents, which have not been tailored to the firm, and/or are not being applied in practice by fee earners.

We have also seen circumstances where a firm’s policy sets out a specific procedure, but this is not followed in practice. For example, a policy sets out that SOF and SOW checks are required to be carried out on residential conveyancing transactions. However, the files we reviewed did not contain these checks.

A firm’s AML policy should be specific to the firm. It should be used to guide fee earners on what steps they need to take to mitigate risks for their firm. We will take further action where policies have not been followed, and breaches of the regulations have been identified.

Further details can be found in our thematic on PCPs.

This section of our report focuses on how firms ensure their staff are complying with AML PCPs.

Effective AML frameworks require ongoing monitoring to ensure that policies are implemented consistently in practice. Monitoring activities provide assurance that controls remain effective and allow firms to identify trends, weaknesses and training needs.

The requirement to monitor compliance with policies is set out under regulation 19(3)(e) MLR.

There are various ways in which firms can monitor compliance with AML PCPs. These include:

• undertaking regular file reviews
• file checklists to be completed before opening or closing a filereports to be provided to senior management on AML compliance
• ongoing supervisor checks for open matters.

We assess how firms are complying with regulation 19(3)(e) when carrying out our onsite inspections. We found:

• That 86% of firms we inspected were carrying out internal file reviews. In some cases, the findings of these reviews informed training or development needs across the firm. Firms can then enrol effective tailored training to staff to address any areas of weakness as highlighted in the file review process.
• That 36% of these firms did not consider source of funds as part of the firms internal file review process, instead only focusing on whether the correct client due diligence (CDD) was undertaken. Where source of funds isn't considered, we consider the review to be less effective.
• A small number of file reviews we looked at were ineffective. These reviews focused solely on operational factors, such as whether the correct legal advice had been provided or whether there was a conflict of interest. In some cases file reviews lacked or gave minimal consideration to AML risk factors. While we consider it to be good practice to evaluate wider factors, these reviews neglected to check whether AML processes had been followed correctly and therefore did not comply with regulation 19(3)(e).

We have also produced thematic guidance on PCPs, including a template file review form to assist firms in this area.

Under regulation 21 MLR 2017, where appropriate to the size and nature of its business, firms must establish an independent audit function. The purpose of an independent audit is to examine the adequacy and effectiveness of a firm's AML controls and procedures.

We ask firms to provide copies of any independent audits and review these as part of the onsite AML inspection process. This differs from the independent audit work we carry out with larger firms, as set out earlier in this report. We found just over half (63%) of firms had carried out an independent audit.

We found that 18% of these audits were not fully compliant with regulation 21. AML policies were often reviewed as part of these audits; however, files were not assessed to assess the effectiveness of these policies. A compliant audit should include a review of both the firm's AML policies and a sample of client files, as this provides a more reliable means of assessing whether the policies are being properly implemented and followed.

We observed higher levels of compliance among firms that had undertaken a compliant independent audit.

'Independent' does not necessarily mean engaging a specialist agency or consultancy, though that is an option. Firms should make sure that, as a minimum, those with responsibility for maintaining their AML framework are not those auditing it. As well as an external entity, this could for example be:

• a senior member of the firm who does not carry out regulated work
• an MLRO from another firm
• an office manager with no regulatory or fee-earning role
• a reciprocal arrangement between small firms to review each other's compliance.

The profession has continued to make measurable progress across several key areas of AML compliance. Improvements in FWRA quality, CMRA completion rates and PCPs compliance suggest that firms are increasingly embedding AML obligations into their governance and operational processes.

These improvements are positive and indicate that many firms are taking steps to strengthen their AML controls. However, further improvement is still required. We continue to identify weaknesses in firms processes and controls which, if not addressed, may expose firms to money laundering risks.

During the last two reporting years, we continued to refer firms for investigation where we identified breaches concerning the MLRs. The table below sets out the five most common reasons firms are referred to the investigation team from our proactive supervision work. Some firms were referred for multiple reasons.

The recurring nature of these referral themes demonstrates that many firms continue to struggle with the practical implementation of AML controls, particularly in relation to risk assessment and source of funds enquiries. Our thematic guidance on PCPs is designed to assist firms in this area.

Firms that perform well typically demonstrate strong leadership oversight, clearly defined responsibilities, tailored AML documentation and effective ongoing monitoring of compliance. Embedding a positive compliance culture remains one of the most important factors in achieving sustainable compliance with the MLR 2017.

Firms with stronger AML compliance typically have tailored policies, effective controls and procedures, and a positive compliance culture led by senior management. We also note that, where key AML roles are not properly understood, this may affect the AML compliance. For example, in our inspections programme, we observed that firms where we identified concerns regarding the MLCO’s understanding of their role were more likely to be referred for wider control failures.

We have published a range of support, including guidance, thematic reviews and webinars, to help firms understand and meet their AML obligations.

Introduction

During this reporting period, we continued our programme of sanctions supervision, engagement and guidance across the firms we regulate.

Although relatively few firms act directly for designated persons, sanctions risks remain relevant across the legal sector. Firms may encounter these risks through international transactions, overseas counterparties, beneficial ownership structures, links to sanctioned jurisdictions, or the movement of funds connected to sanctioned individuals or entities.

We therefore continued our risk-based approach to sanctions supervision by:

• collecting sanctions-related information from all regulated firms through our annual data collection exercise
• reviewing sanctions controls during AML inspections and forensic investigations
• providing targeted guidance to firms where controls could be strengthened
• conducting desk-based reviews of selected firms outside the AML supervisory population to better understand sanctions exposure across the wider profession
• carrying out dedicated sanctions inspections where firms reported acting for designated persons
• updating and promoting guidance to help firms understand sanctions obligations and emerging risks.

Law firms remain at risk of being used to facilitate sanctions evasion. Effective sanctions controls therefore require firms to understand all parties involved in a matter, including beneficial owners, counterparties and the origin of funds.

Our AML inspections found that 91% of firms' AML policies included guidance for fee earners on identifying and managing sanctions risks. We consider this a key control and will continue to assess sanctions compliance as part of our wider supervisory work.

Given the continued importance of the financial sanctions regime, we have once again featured sanctions updates on our website throughout the year including a revision of our published sanctions guidance and regular mentions in the SRA update.

Our proactive supervision

As part of our 2025 data collection exercise, we asked all regulated firms a series of questions to understand their exposure to sanctions risk and the controls they have in place.

The responses showed that:

• 88% of firms had assessed their sanctions exposure in writing.
• 15% reported clients with links to sanctioned countries.
• 28% undertook work in practice areas carrying elevated sanctions risks.
• 86% screened new clients against UK sanctions lists.
• Fewer than 1% had acted for a designated person during the previous 12 months.
• Fewer than 1% held frozen assets belonging to a designated person.
• Fewer than 0.5% had reported a sanctions breach during the previous year.

These findings demonstrate that while direct interaction with designated persons remains uncommon, a large proportion of firms continue to encounter sanctions-related risks through their client base and areas of practice.

During the reporting period we conducted 949 proactive sanctions engagements across the entirety of the SRA-regulated population, not only those supervised under the money laundering regulations. These figures represent supervisory interactions and do not necessarily represent separate firms, as some firms may have received more than one type of engagement.

Sanctions inspections

While fewer than 1% of firms reported acting for a designated person, 15% of firms reported clients with links to sanctioned countries and 28% undertook work in practice areas carrying heightened sanctions risk. This demonstrates why sanctions controls remain important even for firms that do not routinely advise designated persons.

Firms acting for designated persons

We conducted 12 dedicated sanctions inspections of firms that had reported acting for a designated person.

Although only a small proportion of firms undertake this work, the complexity of the sanctions regime means that strong controls and effective oversight are essential.

Our inspections assessed:

• firms' understanding of their sanctions risks
• client screening arrangements
• compliance with OFSI licensing requirements
• reporting obligations
• controls governing payments to and from designated persons.

Of the inspections completed:

Overall, we found a high level of compliance. Most firms demonstrated strong controls, clear governance arrangements and a good understanding of their obligations.

Where guidance was provided, it most commonly related to:

• strengthening client screening arrangements
• improving sanctions-related risk assessments and policies.

One firm was referred for investigation following concerns regarding compliance with sanctions licensing requirements.

Where we gave guidance to a firm, we always signposted them to our published sanctions guidance.

Lessons from our inspections

The licence breaches identified during this reporting period demonstrate the importance of maintaining effective oversight of sanctions matters throughout their lifecycle. Firms acting for designated persons should ensure they have allocated sufficient resource to manage sanctions matters. To mitigate the risk of a licence breach, it is important that firms continue to:

• monitor sanction regimes for updates to identify changes to sanctions licences and expiry dates
• consider amending existing controls and procedures if required, such as adjusting diary alerts and signing up for notifications from OFSI or OTSI
• periodically review sanctions controls to ensure they remain effective as the regime evolves
• ensure compliance, legal and finance teams work closely together when managing payments. This should include oversight of licence terms and conditions, reporting to OFSI or OTSI, and monitoring all payments from or to the client
• make sure that any search to identify funds held by a designated person is thorough and should have management oversight and control.

Findings from Sanctions Inspections

During the reporting period, we inspected 12 firms.

Overall, we found these firms had:

• acted for 35 designated persons in the last 24 months
• applied for 2 specific licences
• worked under a general licence 24 times
• helped a client apply for a licence 16 times
• assisted a client to challenge their designation once
• reported a firm breach of the sanctions regime once to OFSI
• held frozen funds in the sum of £110,007 for four designated persons over a total of four matters.

These findings demonstrate the importance of maintaining specialist expertise in firms undertaking sanctions-related work.

Best Practice

We identified a number of examples of good practice during our inspections.

These included:

• maintaining a documented sanctions risk assessment
• clearly documented procedures for responding to potential sanctions matches
• screening clients, beneficial owners and counterparties
• regular staff training tailored to role and risk exposure
• dedicated oversight of sanctions matters by suitably experienced personnel
• regular monitoring of changes to licensing requirements and sanctions legislation.

Firms that regularly advise on sanctions issues typically had additional controls, including central oversight, specialist advisers, close cooperation between compliance and finance teams, and procedures specifically designed to monitor compliance with licence conditions.

For those firms actively providing sanctions advice:

• due to the complexity of this area, advice was only being given by those who are experts within the firm
• increased central oversight and controls on all sanctions matters with cooperation and coordination between matter experts, compliance teams, and finance teams
• specific procedures and controls in place to ensure they meet licence terms and conditions such as payment routes and reporting requirements
• through our work, we observed that not all firms have implemented these measures. We also found that attention to detail is vital in avoiding breaches related to licence reporting.

Onsite inspection - file reviews

As part of our inspections, we reviewed 26 files involving sanctions-related matters to assess how well due diligence controls work.

We found:

• most matters contained evidence of client identification, with only two files with no evidence
• six of the matters did not have sanctions screening results on file. However, the client had notified the firm that they were designated persons and seeking advice.
• all matters had source of funds evidence on file or details on when it was appropriate to carry out these checks.

We also assessed firms' compliance with licence terms and conditions. We found that:

• five complied in full
• two firms did not comply in full but had already engaged with OFSI
• five firms did not have any matters with a licence to assess.

Overall, we found that even the firms that had not complied with the licence conditions, did have controls in place. However, they breached the sanctions regime in the following ways:

• by failing to report fees paid by a linked company when using a general licence – a self-report was made to OFSI and the SRA
• by reporting fees received later than the terms of the licence – OFSI had already considered this matter before our inspection.

This highlights the continued importance of:

• keeping up to date with changes to the regime and licences and reviewing existing controls and procedures to ensure they remain fit for purpose
• increased oversight and more checks and controls in place for sanctions matters and specifically to ensure the firm is meeting any licence terms and conditions
• ensuring any payments, in or out, are covered in full by a licence – it is crucial for fee-earners, compliance and finance teams to work together to manage this risk.

Sanctions controls

All but one of the firms inspected had formally assessed their sanctions risks, and all firms had implemented controls designed to prevent sanctions breaches.

While sanctions legislation does not prescribe how controls should be implemented, firms must ensure they have arrangements proportionate to their exposure. Firms in scope of the MLR 2017 have a prescribed set of controls they must follow.

The strongest examples we observed combined:

• documented risk assessments
• client screening
• staff training
• clear escalation procedures
• oversight of sanctions-related matters.

Our published guidance on complying with UK sanctions provides information on sanction controls relevant to all firms we regulate.

Sanctions guidance letters

In December 2025 we wrote to 461 firms that reported they had neither documented their sanctions risks nor routinely screened new clients against sanctions lists. This is a reduction from the 1076 firms we wrote to in January 2024, and suggests that more firms now have documented sanctions risk assessments and screening arrangements in place.
We adopted a preventative supervisory approach by providing practical guidance on:

• understanding sanctions exposure
• conducting sanctions risk assessments
• using sanctions screening tools
• implementing proportionate controls.

We wrote to these firms because conducting a sanctions FWRA can help a firm understand their exposure to the sanctions regime and determine what controls will mitigate those risks. Failing to screen clients to check if they are a designated person increases the risk of inadvertently acting for a designated person and providing services that are not permissible.

The letters sent included guidance on complying with the regime and how to improve controls. The letter also included guidance on completing a firm wide sanctions risk assessment along with a link to our published template firms can use. We also included information on client screening, which firms can do for free using the online tool offered by the Foreign, Commonwealth & Development Office.

This targeted intervention was designed to improve compliance and reduce the likelihood of future breaches.

Desk-based review

Of the firms that received a sanctions guidance letter, we identified a cohort of 61 firms, who we do not supervise under the MLR 2017 regulations, and who confirmed:

• they had connections, or their clients had a connection, to a country on the current UK sanctions regime list.
• or they were offering immigration, shipping, aviation, or trade services to clients.
• As these firms had not carried out a sanctions risk assessment and did not screen clients, we wanted to assess their exposure to sanctions risk and understand how their controls work to mitigate that risk. The desk-based review involved carrying out telephone interviews with firms' Compliance Officer for Legal Practice in which we discussed: The firms approach to risk assessments and understanding firm wide risk
• understanding the firm's controls, and
• understanding the firm's clients, services, geographical and transactional risks.

We found all 61 firms’ sanctions risk exposure was generally low. This assessment was based on the nature of the services provided, the firms' client bases, geographic exposure, transactional activity, and the likelihood of the firms acting for designated persons or handling matters requiring a sanctions licence.

We noted:

• the firms were small and included 20 sole practitioners
• while these firms appeared to offer services that are at higher risk of exposure to sanctions or designated persons, some of the firms offered niche services that made the likelihood of exposure to sanctions risk low. For example:
  • One firm answered they provide Trade advice (imports/exports outside of the UK) but specialised in music and entertainment intellectual property for a small stable UK client base.
  • One firm mentioned shipping in the services they provide but offered support to human resource teams on managing employee issues.
  • Two firms were undertaking legally aided criminal work where exposure to designated persons was low .
•  Of the firms providing immigration services, they confirmed that:
  • Clients seeking asylum are usually already living in the UK and known to the home office.
  • They check identification documents when these are available.
  • Most clients are met face to face.
  • While matters involve payment for legal fees, it was considered unlikely that these matters would involve designated persons requiring a licence.
• 52 firms confirmed while they did not have a written FWRA they assessed their risk as low
• four firms confirmed they had answered the survey incorrectly and did have a written assessment in place
• 25 firms had already taken additional measures to improve their controls after receiving our guidance letter
• following receipt of our guidance letters, 40% of firms reported taking steps to strengthen their controls and improve their procedures.

Sanctions controls reviewed during AML inspections

We reviewed sanctions controls at 359 firms through our AML inspection programme.

Overall, compliance continues to improve.

We found that:

• 96% of firms screened new clients against sanctions lists (up from 92%)
• 89% screened existing clients (up from 79%).

Only 7% of firms required feedback on sanctions controls or screening arrangements, compared with 12% in the previous reporting period.

These findings indicate that sanctions screening is becoming increasingly embedded within firms' client due diligence processes.

Controls reviewed through forensic investigations

Our Forensic Investigation team conducted sanctions controls checks at 56 firms, including 36 outside our AML supervisory population.

This broader supervisory approach enables us to assess sanctions controls across the wider regulated community.

We continue to see improvement across a number of areas:

• 93% had assessed sanctions risks in writing (up from 79%)
• 87% had documented procedures for dealing with designated persons (up from 83%)
• 82% had provided sanctions training (up from 74%)
• 86% screened clients against sanctions lists (up from 74%).

These improvements suggest that sanctions awareness and compliance continue to mature across the profession.

Guidance and Support

Alongside our supervisory activity, we continued to promote awareness and understanding of sanctions compliance through targeted guidance and communications.

Throughout the reporting period we used SRA Update e-bulletin and other communication channels to raise awareness of:

• the latest financial sanctions updates and highlight materials being published by the government, ourselves, and others.
• we have promoted:
  • The FCA report on sanctions systems and controls
  • The government's strategic approach to the enforcement of sanctions breaches
  • The need for firms to update their policies following the introduction of General Licence INT/2025/7323088 that now covers most UK Autonomous Sanctions Regimes and the change to a single list for UK sanctions designations.
  • Highlighted sanction articles in 9 of the 11 bulletins issued between July 2025 and June 2026.
• we also updated our published sanctions guidance to reflect legislative developments, including the transition to the UK Sanctions List as the single authoritative source for UK sanctions designations.
• our guidance to help firms comply with the financial sanctions regime continues to provide firms with practical information on sanctions risks, red flags and the controls we would expect to see in a proportionate compliance framework.

Not all of the risks identified below are new. Some are well-established risks that continue to evolve in response to changes in criminal methodologies, technology and the geopolitical environment.

Emerging risks

We identify and assess evolving and emerging risks through a range of sources, including:

• reports from law enforcement agencies or other authorities
• the National Risk Assessment by the UK government
• our proactive supervision of firms
• through our investigative work
• with our MLRO and Intelligence colleagues.
• media reports
• external engagements.

Evolving risks

Conveyancing

Conveyancing, particularly residential, remains the area of greatest risk. Over the past year, 50% of the 24 Suspicious Activity Reports (SARs) we submitted were linked to residential property transactions. Although this represents a reduction from previous years, this is still a substantial proportion.

Conveyancing combines several high-risk factors:

• high transaction values
• the movement of substantial funds through client accounts
• the opportunity to conceal beneficial ownership
• a process where time pressures and client pressure are often present
• the ability to convert criminal proceeds into an apparently legitimate and appreciating asset.

This trend has persisted over several years, reinforcing the need for firms to treat conveyancing as a high-risk activity. The 2025 National Risk Assessment continues to rate the risk as high.

Technology

The Financial Action Task Force (FATF) has identified AI-enabled fraud as an emerging threat. Technologies such as deepfakes may increase the risk of identity fraud, impersonation and the circumvention of customer due diligence processes, particularly where firms rely on remote onboarding. The report provides case studies of how this has happened and how firms can protect themselves.

AI-enabled tools may also facilitate the creation of convincing false documentation, potentially increasing the challenges firms face when verifying source of funds and source of wealth information.

FATF sets out in a separate paper that cyber-enabled fraud is a key money laundering risk. Cyber fraud intersects with other areas of organised crime, such as human trafficking, drug trafficking, and human rights abuses.

Passporting and reliance on existing due diligence

For the purposes of this report, passporting refers to the practice of moving clients from a firm's office in one jurisdiction to another office within the same firm

This can pose an inherent risk of money laundering if proper controls are not applied. Risks may arise where firms rely on due diligence undertaken by another office, jurisdiction or business unit without adequately considering whether it remains appropriate for the instruction being undertaken. This equally applies to clients moving between departments within firms.

Company registration

The Third Progress Report on the Economic Crime and Corporate Transparency Act 2023 sets out progress on Companies House reform. This includes purging the Companies House register of misleading information and improper company listings. In the past year, 920 companies entered expedited strike-off, the mechanism Companies House uses to dissolve companies giving false information. This highlights the importance of verifying that corporate entities remain properly registered and that company information relied upon during due diligence is accurate and current.

Cash-intensive businesses and high street crime

Law enforcement reporting continues to identify some cash-intensive businesses as being vulnerable to exploitation by organised criminal groups, including for money laundering and other criminal purposes such as modern slavery. News reports, law enforcement and Companies House reporting have all highlighted the use of nominee or 'ghost' directors to obscure beneficial ownership and control.

Global instability and uncertainty

Geopolitical instability may increase corruption, sanctions evasion and illicit movement of assets. Clients, transactions and funding connected to jurisdictions experiencing political instability, conflict, substantial governmental change, or elevated corruption risk may present increased exposure to money laundering, sanctions evasion and proliferation financing risk.

Sanctions

The Russian invasion of Ukraine reached its fourth anniversary this year. The array of global sanctions against Russia has led to various techniques to circumvent them. OFSI and OTSI have produced guidance on how to spot attempts to circumvent this sanctions regime. This could include commodities such as printing inks or lubricants, potentially moved via third countries.

Other sanctions regimes have also evolved during the reporting period. Firms should remain vigilant and undertake appropriate checks to make sure they do not breach any sanctions regime.

Further detail on current and emerging risks can be found in our sectoral risk assessment.

Our AML resources

• Money laundering regulations and who they apply to
• What does my firm need to do?
• Your AML obligations
• How we regulate money laundering
• Sectoral Risk Assessment - Anti-money laundering and terrorist financing
• Anti Money Laundering annual report 2021-22
• Anti Money Laundering annual report 2022-23
• Make changes to your Anti-Money Laundering authorisation
• Money Laundering Governance: Three Pillars of Success
• Firm wide risk assessment guidance
• Client and matter risk assessment warning notice
• Client and matter risk assessment thematic report
• Client and matter risk assessment template
• AML training thematic report
• Source of funds and source of wealth thematic report

AML and sanctions webinars

• AML controls- March 2026
• AML for sole practitioners - May 2025
• AML enforcement - May 2025
• Sanctions: Insights and updates - March 2025
• AML Questions and Answers webinar – May 2024
• Client and matter risk assessment webinar – February 2024
• AML: enforcement trends – September 2023
• Government sanctions regime: how all firms can stay compliant – May 2023
• Compliance Officers Virtual Conference 2022
• AML: How to do a firm-wide risk assessment – June 2022
• AML officers: what they need to know - February 2022

Our sanctions resources

• Complying with the UK sanctions regime – SRA guidance
• FCA report on sanctions systems and controls
• Government update on the enforcement of sanctions breaches
• New framework for prioritising sanctions licence applications - OFSI
• Sanctions regime - firm-wide risk assessments – SRA guidance

Other relevant sector guidance

• Proceeds of crime guidance  

Published by the Legal Sector Affinity Group

• Legal Sector Affinity Group Guidance – Part 1

Legal Sector Affinity Group – Part 2 (barristers, Trust or Service Company Providers and Notaries)

• Barristers – to be read independently of Part 1
• TCSPs – to be read in conjunction with Part 1
• Notaries – to be read in conjunction with Part 1

Published by the National Crime Agency

• Guide to submitting better quality SARs
• SARs Online User Guidance
• SARs FAQs
• SARs Glossary Codes

Produced by HM Government

• UK National Risk Assessment