An SRA reviewer opens a matter file looking for five answers on paper. They cover who the client is, who owns or controls it, whether both were screened, where the money came from and how the firm rated the risk. In the year to 5 April 2026 the regulator put those questions to 6,592 files, according to its AML annual report for 2025/26.
Lawyers count among the designated non financial businesses and professions only for certain work. Property deals, client money and company formation are the heart of it, since property purchases and shell companies are common money laundering methods.
When do anti money laundering rules reach a law firm, and which guidance applies?
A law firm falls under anti money laundering rules when it takes part in listed transactions for a client.
Table 1. AML scope for law firms in seven rulebooks (as of November 2026)
| Rulebook | Who is covered | For which work | Supervisor | Report goes to | Privilege line |
|---|---|---|---|---|---|
| FATF (R.22(d), INR 23) | Lawyers, notaries, other independent legal professionals | Real estate, client money, accounts, company contributions, legal persons and arrangements, business sales | Set by each country | The FIU, or a self regulatory body that cooperates with it, where the country allows | No report on information under privilege or professional secrecy; each country sets the scope |
| UK (MLR 2017 reg. 12; POCA) | Independent legal professionals; TCSPs | The same five, plus TCSP services such as forming companies, acting as director or trustee, providing a registered office and, since 30 June 2026, selling a shelf company | SRA for 5,422 firms, plus other legal bodies; FCA to take over | Nominated officer, then the NCA, or the NCA directly | A defense for privileged information, lost if it was given to further a crime |
| EU (AMLR art. 3(3)(b), from 10 July 2027) | Notaries, lawyers, other independent legal professionals | The same five, crypto accounts included | National supervisor | The FIU, or a designated self regulatory body (art. 70(1)) | Advice and litigation exempt, unless the lawyer takes part, advises for laundering or knows the client seeks such advice (art. 70(2)); a member state may lift it for higher risk transaction types (art. 70(3)) |
| US (31 U.S.C. 5312(a)(2)) | No lawyer category under the Bank Secrecy Act | No AML program; Form 8300 for cash over $10,000 (31 CFR 1010.330) | No AML supervisor | No SAR duty | No report duty to carve out |
| Australia (AML/CTF Act, tranche 2) | Lawyers, conveyancers and other professional service providers, from 1 July 2026 | Designated services in table 6, such as acting on a property purchase or forming a company | AUSTRAC | AUSTRAC, within 3 business days (24 hours for terrorism financing) | A report may be refused when all the grounds for suspicion are privileged (s. 41(2A)); report time stretches to 5 business days when part of the information may carry someone else's privilege |
| UAE (Cabinet Resolution 134 of 2025, art. 3(4)) | Lawyers, notaries, other independent legal professionals | Real estate, client funds, accounts, company contributions, legal persons and arrangements, business sales | Not named in the Resolution's article | The FIU, immediately (art. 18(1)) | Advice, litigation, arbitration and mediation exempt, and other work under professional secrecy (art. 18(2)) |
| Türkiye (Regulation on Measures art. 4(1)(ş)) | Self employed lawyers | Property sales and limited real rights; forming, merging, running, transferring and winding up companies, foundations and associations; managing accounts and the assets in them | MASAK | MASAK | Information from work under art. 35(1) and (3) of Attorneyship Law No. 1136 and from alternative dispute resolution is excluded |
Read the UK row against regulation 12(1). It covers a firm "when participating in financial or real property transactions", and participating includes "assisting in the planning or execution" of one. So advising a tenant in a lease dispute is outside, while acting on the purchase of the building is inside.
Nearly 91 percent of the firms the SRA met skipped that line and ran due diligence on every client, in scope or not. So a litigation client who later buys a house is already known. The SRA's condition: the checks already done must still be valid and up to date when the work changes.
The SRA also expects firms to have regard to its warning notices, FATF's red flags and sector guidance such as the Legal Sector Affinity Group's. Under section 330(8) of the Proceeds of Crime Act 2002, a court deciding a failure to report charge must consider whether the person followed Treasury approved, published guidance from a supervisor or other appropriate body.
Are US law firms subject to AML rules?
Not under the Bank Secrecy Act. 31 U.S.C. 5312(a)(2) lists the financial institutions the Act covers, and attorneys aren't on it. One federal duty does apply: a firm paid more than $10,000 in cash, in one transaction or related ones, files Form 8300 under 31 CFR 1010.330. In the bar rules, ABA Model Rule 1.16(a) tells a lawyer to "inquire into and assess the facts and circumstances of each representation" before taking or keeping it. It binds once a state adopts it.
Who supervises UK law firms, and what changes when the FCA takes over?
The SRA supervises 5,422 firms for AML. That is about two thirds of the firms it authorizes. HM Treasury decided on 21 October 2025 that legal, accountancy and TCSP firms will answer to the FCA for AML. Its response of 18 June 2026 set out the FCA's registration, supervision and enforcement powers. It gave no start date.
What is new for law firms in 2026?
- 26 February 2026. HM Treasury and the Department for Science, Innovation and Technology issued guidance on digital ID in client due diligence.
- 19 March 2026. The Eastern District of Texas vacated FinCEN's Residential Real Estate Rule. FinCEN has appealed; while the order stands, nobody has to file Real Estate Reports.
- 30 June 2026. SI 2026/621 took effect. Selling a shelf company became a TCSP service, banks took on duties for new pooled accounts, and high risk third countries became "FATF call for action" countries.
- 1 July 2026. Australian lawyers came under AUSTRAC. Those already serving clients, with no other designated service, had until 29 July 2026 to enroll.
- 22 October 2026. The SRA published its AML annual report for 2025/26.
What draws launderers to law firms, according to FATF and the UK risk assessment?
On 7 January 2019 a solicitor was convicted of money laundering. The solicitor had acted for two clients on more than 80 property purchases worth over £7.3 million, funded by fraudulently obtained mortgages and unexplained cash. The solicitor was struck off. The UK national risk assessment of 2025 records it as Box 5.J.
Conveyancing is one of three services the assessment still rates highest risk in the sector, beside trust or company services and client accounts (para. 5.194). Criminals want the legitimacy a lawyer lends a deal and the sums a client account can move. The assessment finds the sector's risk "remained high" (para. 5.193). Company and trust work is also TCSP work.
FATF's 2013 study of legal professionals finds the same services abused and adds deceased estates, powers of attorney, insolvency work and litigation over a sham dispute (p. 83). The UK finds sham litigation rare, with one prosecution since its 2020 assessment (para. 5.197). The wealthiest criminals may hire several firms, so no single firm sees enough, above all where source of funds checks are weak (para. 5.196).
Infiltration from inside the firm is checked by the controls in regulation 21, applied where its size and nature make them appropriate. Relevant employees are screened before and during appointment for skills, knowledge, expertise, conduct and integrity. An independent audit function tests whether the firm's policies, controls and procedures work. It also recommends changes and checks they are made. Of the firms the SRA inspected in 2025/26, 63 percent had carried out an audit, and 18 percent of those audits fell short of regulation 21. The SRA approves a firm's beneficial owners, officers and managers. Each submits a Disclosure and Barring Service check when first taking the role or a new one.
What AML checks do lawyers and solicitors run before taking on a client?
KYC for law firms comes down to six checks, and best practice leaves evidence of each on the file. The SRA's 2025/26 file reviews show where it went missing.
- Identify and verify the client. 336 files (5 percent) held no evidence of it. Almost 93 percent of the firms the SRA met used technology such as electronic identity checks. Only 48 percent said they often test it for accuracy.
- Find the beneficial owner. For a company or trust client, record who owns and controls it and keep a record of your inquiries.
- Screen for PEPs and sanctions. 20 percent of files held no evidence of PEP screening and 21 percent none of sanctions screening. Write down why a possible match was ruled out.
- Check the source of funds. Of 5,349 files that needed a source of funds check, 9 percent had none and 18 percent held documents nobody scrutinized. A savings statement shows the money exists. It doesn't show where it came from.
- Rate the client and the matter. 612 files (9 percent) lacked a full client and matter risk assessment, and 36 percent of firms had ineffective ones.
- Treat a shelf company sale as regulated. Since 30 June 2026 selling a shelf company is a TCSP service that opens a business relationship.
Relying on another regulated firm's checks is allowed under regulation 39, unless that firm sits in a FATF call for action country. The relying firm must get the information at once, and copies of the identity records on request, and remains liable for any failure.
In one 2025/26 settlement, a former licensed body acted for a company linked to a foreign PEP on a home purchase. It identified the PEP "two months after the purchase had completed". The fine was £172,934 plus £1,350 costs.
In complead, formerly Sanction Scanner, beneficial owner checks follow owners up the chain until natural persons are reached. Its PEP and sanctions screening checks each client and owner against the lists it tracks, 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. When a possible match comes up, agents attach the evidence, a narrative and a work log, and the record shows which reviewer decided. A search log keeps who ran each search, the terms, the time and the result, a clear result included.
How should a firm monitor clients and its client account after onboarding?
Ongoing monitoring includes two duties under regulation 28(11): scrutiny of transactions through the relationship, including the source of funds where necessary, and keeping due diligence records up to date. At a law firm those transactions run through the client account. So the ledger is where monitoring happens. The SRA found source of funds information that didn't match the ledger in 6 percent of files.
The SRA's Accounts Rule 3.3 says: "You must not use a client account to provide banking facilities to clients or third parties." A payment with no legal work behind it is a violation.
Mishcon de Reya, a London firm, admitted breaching the 2011 version of that rule. In July 2016 one payment came into its client account and three went out with no legal transaction behind them. The settlement with the SRA, dated 20 December 2021 and published on 5 January 2022, also covered due diligence and training failures. The firm agreed to pay a £232,500 penalty plus £50,000 costs.
What does the 2026 pooled account rule ask of a law firm?
From 30 June 2026 a bank that opens a new pooled account must learn its purpose and use and test that against what it knows of the firm, updating due diligence on a mismatch. It then assesses and manages the risk, considering controls on the account (regulation 29(11) and (12)). The firm, as the bank's customer, must name on request the people whose money sits in the account and their beneficial owners. It keeps written records of every payment in and out for five years and answers law enforcement requests (paras. 14 to 16). It needn't hand over privileged information, and a disclosure under the rule doesn't breach a lawyer's duty of confidentiality (paras. 17 and 18).
What are the red flags for law firms?
FATF listed 42 red flags for legal professionals in 2013, grouped by the client, the source of funds, the choice of lawyer and the retainer (pp. 77 to 82). Table 2 pairs nine of them, plus one SRA finding, with the check that catches each.
Table 2. Ten red flags in a law firm file and the check that catches each
| Red flag (source) | What the file shows | Check that catches it |
|---|---|---|
| Secretive client (FATF 1) | Vague answers on identity, owner, money or purpose | Identity and beneficial owner check before work starts |
| Intermediary, no contact (FATF 2) | An agent instructs and the client avoids meetings, without good reason | Verify who gives instructions and on whose authority |
| Unexplained third party money (FATF 6) | Funds from a payer or country with no link to the client | Source of funds check on the actual payer |
| Changed payment route (FATF 13) | A request to change the agreed way to pay, with no reason | Repeat the source of funds review; MLRO sign off |
| Turned away elsewhere (FATF 25) | Another adviser refused or ended the work | Ask why and record the answer in the risk assessment |
| Complex ownership (FATF 28) | Layers of companies with no legitimate or economic reason | Beneficial owner check down to natural persons |
| Abandoned deal (FATF 34) | Matter dropped with no concern for the fee, or after funds arrived | Refund only to the paying account; consider a report |
| Last minute changes (FATF 35) | Instructions change without explanation, often just before completion | Screen any new party or payee again |
| Ledger mismatch (SRA 2025/26) | Ledger receipts differ from the source of funds file | Reconcile before completion |
| Third party payout (FATF 42) | A request to pay someone with no link to the deal | Pay only against a documented reason; consider a report |
A flag's significance depends on context, FATF notes. One flag alone isn't necessarily a basis for suspicion, since a client may have a legitimate explanation, while several together make suspicion more likely (p. 77). Regulation 24 makes spotting them trained work. Relevant employees get regular training in how to recognize and deal with such situations, and the firm keeps a written record of it.
Who reports a suspicion at a law firm, and where does privilege stop?
Every firm in scope, except a lawyer working alone, appoints a nominated officer under regulation 21(3). Staff disclose suspicions, or reasonable grounds to suspect, to that officer, or the NCA, as soon as practicable. The officer weighs them against what the firm knows (regulation 21(5)) and, where either stands, reports to the National Crime Agency.
Not reporting is an offense under section 330 for a person in the regulated sector, and under section 21A of the Terrorism Act 2000 for terrorist financing.
Privilege gives a defense, not an exemption from the regime. A lawyer who learns something in privileged circumstances, from a client seeking advice or about actual or contemplated litigation, commits no offense by not reporting it (s. 330(6)(b) and (10)). The defense falls away for information given "with the intention of furthering a criminal purpose" (s. 330(11)). Once a report is made, section 333A makes tipping off an offense where the disclosure is likely to prejudice an investigation.
A firm that suspects the money it is about to handle is criminal property can file a SAR of the DAML kind, asking the NCA for a defense before it goes ahead. The SRA's inspection sample shows the mix: 157 DAML SARs, 102 information SARs and one terrorist financing SAR, from 128 firms.
How is a law firm fined for AML failures, and how high can the penalty go?
After a 2025 desk review, the SRA found six of eight files at one firm without a client and matter risk assessment. Its policies, controls and procedures fell short of the rules from 26 June 2017 to 30 June 2022. The firm settled. It agreed a £24,922 fine plus £600 costs, discounted for its remedial work and cooperation. Regulation 19 sets what those policies must cover, including risk management, internal controls, customer due diligence, reliance and record keeping, and how compliance is monitored and communicated.
Settled outcomes like that one carried most of the SRA's AML fines in 2025/26: 145 agreements worth £2,003,759, against 14 adjudicator fines totaling £363,726. Serious cases go to the Solicitors Disciplinary Tribunal. It imposed six fines worth £228,000, one suspension and one strike off, a punishment only the Tribunal can give. The two biggest Tribunal fines came to £178,000 together. One more, in the £30,001 to £50,000 band, was £32,500.
The cap has moved. Section 44D of the Solicitors Act 1974 caps the penalty the SRA can set for a solicitor at £25,000. Since 4 March 2024, subsection (2A) removes that cap for failures tied to economic crime. Failure rates are falling. Across 966 assessments, the SRA's largest program yet, the share of firms found not compliant fell from 32.4 to 21.9 percent. Compliant policies rose from 38 to 54 percent of the firms the SRA reviewed, and compliant firm wide risk assessments from 47 to 60 percent.
A file that answers the reviewer's five questions holds a verified identity, a beneficial owner traced to a person and a dated PEP and sanctions search with any match ruled out in writing. It also holds a source of funds check tested against the ledger and a risk rating someone signed. Each SRA finding quoted here is one of those five gone missing.
