SRA Launches Annual AML and Sanctions Data Collection Exercise

The Solicitors Regulation Authority (SRA) has announced its annual anti-money laundering (AML) and sanctions data collection exercise, which will take place in July 2026. The online form opened on 29 June (available here), and the SRA will contact compliance officers at regulated firms directly.

At Enderley Consulting, we work with law firms on compliance and regulatory matters and know from experience that these annual data exercises can catch firms off guard, particularly where roles have changed, mySRA access hasn’t been kept up to date, or data simply isn’t stored in a format that maps neatly to the SRA’s questions. We were exceptionally busy last August helping stressed MLROs who were up against the wire. Forewarned is forearmed, and there is time now to prepare!

What firms must report 

All regulated firms are required to provide information covering three areas: work carried out within scope of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017; any contact or involvement with the sanctions regime and persons designated under it; and the submission of suspicious activity reports to the National Crime Agency.

Firms with no involvement in any of these areas are still expected to participate – a nil return should be submitted where appropriate. Completion of the questionnaire is a regulatory requirement, and failure to respond may result in regulatory action.

Who can complete the form

The questionnaire must be completed by an individual holding one of the following roles: Compliance Officer for Legal Practice (COLP), Authorised Signatory, Money Laundering Compliance Officer (MLCO), Money Laundering Reporting Officer (MLRO), or Compliance Officer for Finance and Administration (COFA).

Practical steps to take now

Firms will need their mySRA login credentials and a six-digit code from an authenticator app to access the form. The SRA recommends verifying that the app is installed and correctly linked well in advance. It is also worth confirming now that the relevant compliance officer’s current role is accurately recorded in mySRA — access to the form depends on this.

A specimen questionnaire is available to download from the SRA’s website and is well worth reviewing before the form opens. In our experience, the questions around sanctions exposure and the categorisation of in-scope work under the MLR 2017 are the areas where firms most often need to think carefully before answering.

Why the SRA collects this data

The SRA is required by its own regulator, the Office for Professional Body Anti-Money Laundering Supervision (OPBAS), to take a risk-based approach to supervision. Accurate data allows it to assess the distribution of risk across the legal profession, informing both its programme of inspections and the guidance it issues to firms.

We can help!

If your firm is unsure whether it can respond confidently to the 2026 data exercise, we can:

• Review and advise on your FWRA and AML PCPs
• Deliver tailored AML training for your team
• Support your data gathering and questionnaire completion
• Arrange or conduct an independent AML audit

Now is the time to take action – not just in response to an SRA knock at the door, but to safeguard your clients, your firm, and your reputation.