Your firm-wide risk assessment: from a document to a living system

Download the AML inspection readiness checklist (Word)

What the SRA found

In its anti-money laundering annual report for 2024 to 2025, the SRA reviewed the controls of 833 firms:

• Only around 13% were fully compliant. 54% were partially compliant and 32% were not compliant.
• 47% of the firm-wide risk assessments reviewed were compliant. 19 firms had none at all and were referred for investigation.
• Of 5,873 files reviewed, 16% had no client and matter risk assessment or an incomplete one, and 39% of the assessments reviewed were ineffective, often because they assessed operational risk rather than money laundering risk.
• Half of the non-compliant firms were referred because of missing client and matter risk assessments. In most of those firms, a process existed but was not followed.
• Around 38% of firms’ policies, controls and procedures were compliant, and 10% of the files that needed source of funds checks had none.

What the rules require

• A firm-wide risk assessment (regulation 18, and 18A for proliferation financing): written, specific to the firm’s clients, services, transactions, delivery channels and geography, taking account of the SRA’s own sector risk assessment, kept up to date, and provided to the SRA on request.
• Policies, controls and procedures (regulation 19): written, approved by senior management and proportionate to the risks identified, covering customer due diligence, source of funds and wealth, reporting, record keeping and more.
• Internal controls (regulation 21): a compliance officer and a nominated officer, screening of relevant staff, and an independent audit where that suits the size and nature of the firm.
• Training (regulation 24) for relevant staff, with records to show it.
• Client and matter risk assessments, so that the due diligence on each client and matter matches its risk.

Why assessments fail

• Generic templates that describe a law firm, not this firm.
• Written once, and not revisited when the firm takes on new work, new markets or new kinds of client.
• Disconnected from matters: the firm-wide assessment says conveyancing is high risk, but nothing at matter opening makes conveyancing matters get more scrutiny.
• A process that exists but is not followed, because it sits outside the system people work in, as a separate form or spreadsheet.
• Assessing the wrong risk: “is this matter complex?” rather than “could this matter be used to launder money?”

From a document to a living system

1. Assess at the front door: client and matter risk assessments built into onboarding and matter opening, asking about money laundering risk, so a matter cannot proceed without one.
2. Let the answers drive the controls: the risk rating sets the level of due diligence, source of funds and wealth checks, approvals and supervision automatically.
3. Feed the firm-wide view from real data: client types, matter types, values, jurisdictions and risk ratings reported from live data, so the firm-wide assessment is reviewed against what the firm actually does.
4. Manage policies as living documents: version control, senior management approval, staff acknowledgement, and links to the assessments and controls they govern.
5. Keep the evidence where the work is: ID and AML results, source of funds documents and the scrutiny of them, training records and reporting decisions, all reportable for an inspection or an independent audit.
6. Test it: an independent audit that includes file reviews, with actions tracked to completion.

Built in, specialist or both?

Some practice management systems include client and matter risk assessment, onboarding and policy tools. Specialist risk and compliance platforms usually go further on firm-wide assessment, policy management and reporting. Neither is automatically right. The questions that matter:

• Will fee earners actually use it at matter opening, every time?
• Does it share data with the practice management system and your ID and AML provider, so nothing is typed twice?
• Can the MLRO, MLCO and COLP see firm-wide risk without exporting spreadsheets?
• What does it cost alongside what you already pay for, and what does it duplicate?

A second system that nobody opens is not a control.

Could you evidence it tomorrow?

If the SRA asked tomorrow, could you produce your firm-wide risk assessment, your policies, controls and procedures, a sample of client and matter risk assessments with their source of funds checks, your training records and your last independent audit? Our AML inspection readiness checklist sets out what to have ready.

We help firms make anti-money laundering controls part of everyday work: designing risk assessment into onboarding and matter opening, connecting the systems involved, and choosing between built-in features and specialist platforms, independently of any vendor.