The SRA has issued revised guidance on the anti-money laundering controls it expects to see in firms. It will look for them if your firm is one of the many that it selects for a monitoring inspection, whether on site or remotely. There is little that is new in the note, but it is a useful reminder of the most common reasons why remedial action is required and, in more extreme cases, why a firm may face the dreaded referral to disciplinary. The SRA reviewed 934 sets of policies in 2025-26 and found 46 per cent to be partly or wholly non-compliant, down from 62 per cent the year before. It reports ‘some improvement’ as a result, but highlights the more common concerns where this is not the case.
One of the main points stressed in the guidance is that firms’ AML policies must be kept up to date. This is particularly topical. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 took effect on 30 June this year, and the SRA then rewrote its own sectoral risk assessment on 6 August, with a further small amendment on 4 September.
Regulation 19 of the Money Laundering Regulations 2017 requires every firm’s policies to address the risks identified in its own firm-wide AML risk assessment, and regulation 18 requires that assessment to take account of the risk assessment published by the firm’s supervisory body. The guidance also makes the point that AML policies must be regularly reviewed and updated. So if your firm’s risk assessment and policy have not been updated since the summer, you could now be judged non-compliant simply because both are out of date.
More specifically, the guidance lists 10 areas of common concern, all of which are addressed in our recently updated template AML Manuals for Firms and Sole Practitioners. The SRA fairly makes the point that any template must be edited so that it applies to the firm. An unedited document will not be acceptable. Some of the issues might also be seen as matters of form over substance. One example is the requirement for a statement in the policies, controls and procedures that the manual will be reconsidered if the firm introduces new products, practices or technologies. That assumes the statement will be remembered and acted upon at some point in the future, which is not a given in the light of the fee-earning and regulatory pressures most firms now face.
A further example is the SRA’s insistence that the firm’s approach to reliance under regulation 39 should be stated, though to be fair to the SRA this is a requirement of regulation 19(3)(d). Reliance is the process by which a firm may forgo its own customer due diligence on a client who has already been checked by another regulated business, using that organisation’s materials instead. It has never seemed an attractive option for most firms. A formal written arrangement is needed with the other business, and the firm remains liable for any failings in that third party’s process.
The SRA will nonetheless expect the firm’s policy to state that it does not onboard clients in this way. Note that requesting copy documents from another firm so that you can conduct your own CDD process from them does not count as regulation 39 reliance.
The guidance recommends AML file reviews for work within the regulated sector, as set out at regulation 12 of the 2017 Regulations, including the work of all those who fall within the definition of ‘tax adviser’ at regulation 11(d). A short template SRA file review form, with reviewer guidance, is available by a link from the note. Some will find it helpful, though most firms are likely to prefer to check whether CDD has been satisfactorily addressed as part of a more complete file review process.
One final point. Firms should keep a record of their policies as they develop, noting the changes made and when and how they were communicated to staff. If you are updating your risk assessment and policy now, keep copies of the versions you are replacing. Keep, too, any notes you send to the firm explaining why you have made the update and the main points that everyone should note.
Finallly, just to mention that regulation 21(1) requires an independent audit of a firm’s AML arrangements where that is appropriate to the ‘size and nature’ of its business, and so likely to be required at larger firms. Infolegal can provide this service where required, and the review includes advice on updating your AML risk assessment and policy. If this would be of interest, please contact Infolegal director Matt Moore at mattmoore@infolegal.co.uk.
