Anti-money laundering compliance at law firms can easily become a routine of completed forms. The client is identified, sanctions and PEP screening is done manually or through software, and the file moves on. But a finished checklist does not mean the firm has understood the risk in front of it.
According to SmartSearch, even firms with advanced compliance software, thorough policies and regular training can fall short if fee earners do not apply professional judgement to each client and matter. The Solicitors Regulation Authority (SRA) has again flagged risk assessments as a weakness.
Its 2024/25 AML reporting found that 39% of client and matter risk assessments reviewed were ineffective, and 16% of files had no assessment or an incomplete one.
The regulator’s position is that firms must show more than evidence that checks took place. They must show they understood the risks, weighed them and reached a reasoned decision.
A client risk assessment looks at the individual or company. A matter risk assessment looks at the specific legal work.
A long-standing corporate client may be low risk in general, but a particular deal could bring in unfamiliar jurisdictions, opaque ownership or unexplained funding. SRA guidance expects firms to consider both, understand why services are needed, examine source of funds and record their reasoning. A rating of “medium” or “low” means little without that reasoning.
The decision to keep acting for a client is also a risk-based choice. Regulators warn against assuming existing clients are lower risk and expect assessments to be revisited when new information emerges. If beneficial ownership shifts, funding becomes unclear or a new jurisdiction appears, “Checks were completed at onboarding” is no longer an adequate answer.
Standardised forms are not the issue in themselves. The problem starts when the form replaces the thinking. The SRA has seen firms rely on yes/no questionnaires with no room for rationale, and on generic templates not tailored to their practice.
This encourages fee earners to repeat familiar answers, leaves no space for unusual context and erases the reasoning needed for later review. Numerical scoring can also create false precision, since firms weight factors such as geography differently. A score should be treated as an indicator, not a conclusion.
Under regulation 28(11) of the Money Laundering Regulations, ongoing monitoring is mandatory, so assessments must be reassessed as circumstances change.
Stronger processes begin with a consistent framework, such as the SRA’s template adapted to the firm’s risk profile. They also require space for written reasoning, a clear link between risk levels and due diligence, and reviews that genuinely consider what has changed. Technology such as SmartSearch can automate screening, verification and monitoring, but people must still interpret the results.
The most effective AML process is not the longest questionnaire. It is the one that proves the firm understood the risk and had a defensible reason to proceed.
Read the full SmartSearch post here.
Copyright © 2026 FinTech Global
