SRA AML Sectoral Risk Assessment (2025 Update): Important wake up call for law firms

On 31 July 2025, the Solicitors Regulation Authority (SRA) released its latest Sectoral Risk Assessment for Anti-Money Laundering (AML).

This follows hot on the heels of the latest National risk assessment of money laundering and terrorist financing 2025 which we discussed here.

For those in legal compliance, leadership, or ownership of firms working within scope of the Regulations, it’s vital to understand the current and emerging risk landscape and how to respond effectively. You can find the full assessment here.

Why It matters to law firms

The SRA emphasises that money laundering undermines society, enabling serious crimes such as human trafficking and drug trafficking. Law firms, entrusted with large financial transactions can be unintentionally exploited. This sectoral update emphasises the importance of a risk-based approach, sharpens the focus on emerging risks, and reinforces the regulator’s intent to intensify supervisory action and enforcement.

Emerging and evolving risks

The SRA identifies the following emerging and evolving risks:

• Capital flight from high-risk jurisdictions
  
  Clients or assets linked to sanctioned or high-risk regions – especially those seeking to move funds rapidly – represent a growing threat.
  
  
• Client account vulnerabilities
  
  Poor client account management, including using client account as a banking facility and retaining client funds for longer than necessary could facilitate money laundering, whether intentionally or not.
  
  
• Poor CDD scrutiny
  
  Inadequate review of source-of-funds or discrepancies in client ID evidence remain persistent failure points.
  
  
• New types of law firm business model
  
  The growth of consultant network models, with fully remote working, semi-independent lawyers running their own caseload, can cause difficulties in ensuring consistent application of AML PCPs across the firm. The SRA urges greater vigilance and a more interventionist approach and ensuring all new entrants are trained on the firm’s AML standards.
  
  
• Technology
  
  Adoption of any new technology should be preceded by an assessment of the risks and mitigations. Examples given include the potential use of deepfakes to impersonate legitimate clients in videocalls, and the threat of cyber-attacks.
  
  
• Economic uncertainty
  
  The SRA is concerned that economic uncertainty might prompt law firms to cut costs by reducing non-revenue generating compliance functions including AML compliance. Law firms are reminded that complying with the Regulations is a legal obligation, regardless of budget considerations.

Continuing risks

The Sectoral Risk Assessment also returns to risks highlighted in previous assessments, including:

• Supply chain risk
  
  Complex transactions through multiple intermediaries can obscure illicit fund origins. Law firms must scrutinise such chains carefully, including understanding their own role and those of other professionals in the transaction.
  
  
• Proliferation financing and sanctions
  
  Growing geopolitical risks and sanctions regimes deepen firms’ exposure, especially through unwitting facilitation.

Key AML compliance controls weaknesses identified

Drawing on its supervision work and AML inspections, the SRA has identified’ inadvertent failures and gaps in AML compliance’ as posing ‘real and dangerous vulnerabilities’ in a firm’s defence against money launderers. The most common weaknesses were inadequate:

• Source of funds checks
• Independent audits
• Screening of staff
• Matter risk assessments

Action points for MLROs, COLPs and law firm compliance teams

1. Review and update your FWRA
   
   Incorporate learning from the Sectoral Risk Assessment, including emerging risks. Ensure your FWRA reflects your firm’s size, clients, geographic risks, services, and delivery methods.
   
   
2. Review your Client & Matter Risk Assessment procedure
   
   If you use the SRA’s template, ensure it’s tailored to your firm. Ensure rationale and narrative accompany risk ratings, and that matter risk corresponds to firm-level risk. Regularly reassess during client relationships.
   
   
3. Ensure your team are adequately trained on your firm’s procedures, including assessing client and matter risk, and assessing source of funds and wealth.
   
   
4. Consider an independent AML audit.
   
   This is a legal requirement for most firms under Regulation 21, it will identify gaps and weaknesses in your firm’s AML compliance and advise you on remedial actions.
   
   
5. Prepare for increased supervision from the SRA
   
   Be ready to produce your risk assessments, PCPs and training records at short notice.

Conclusion

The SRA’s 2025 AML Sectoral Risk Assessment lays down a clear marker: law firms must update and deepen their risk-based approach.

With newly emerging vulnerabilities and regulatory scrutiny on the rise, firms must urgently review and update their firm-wide risks, client/matter risk assessments, and staff training. The time for complacency has passed…proactive compliance leadership has never been more critical.