Anti-money laundering compliance for law firms

Law firms in England and Wales that carry out work within the scope of the Money Laundering Regulations 2017 (MLR 2017) must comply with anti-money laundering (AML) requirements. The legal sector is classified as high-risk in the UK National Risk Assessment because solicitors handle large transactions, manage client accounts, create legal structures, and facilitate property purchases — all of which can be exploited to launder the proceeds of crime.

This guide covers what is specific to solicitors and law firms. It does not repeat the general AML obligations that apply to all regulated businesses. If you are new to AML compliance, start with the generic AML guidance before reading this sector-specific guide.

When this applies to your firm

Your firm falls within the scope of the MLR 2017 if it provides any of the following services as an independent legal professional:

• Buying and selling real property (conveyancing, commercial property)
• Buying and selling business entities (mergers, acquisitions, share transfers)
• Managing client money, securities, or other assets
• Opening or managing bank, savings, or securities accounts
• Creating, operating, or managing trusts, companies, or similar structures
• Providing tax advisory services involving the above

Practice areas that typically do not fall within scope include family law (unless involving financial settlements channelled through the firm), criminal defence, personal injury, and employment law. However, if any in-scope work is carried out by any part of the firm, the entire firm must have AML policies and procedures in place.

Firm-wide risk assessment

Before undertaking any work within the scope of the MLR 2017, your firm must complete a written firm-wide risk assessment. This is not a box-ticking exercise. The SRA expects the assessment to reflect your firm's actual practice, client base, and geographic exposure — not a generic template downloaded from the internet.

The firm-wide risk assessment is distinct from the client and matter risk assessments you carry out on individual instructions. It looks at your firm as a whole and determines where the greatest AML risks lie so you can direct your controls accordingly.

High-risk areas for law firms

Certain types of legal work carry higher inherent money laundering risk. Your firm-wide risk assessment and your client and matter risk assessments must reflect these elevated risks, and you must apply enhanced controls where they are present.

Client due diligence in practice

Client due diligence (CDD) must be completed before you establish a business relationship or carry out an occasional transaction within the scope of the MLR 2017. For law firms, this means before you begin substantive work on an instruction, not at the point of completion.

Source of funds in conveyancing

For every property purchase, you must verify the source of the funds being used. This goes beyond simply identifying where the money is being transferred from. You must understand how the client acquired the funds. Common sources include:

• Sale of an existing property (verify through linked transaction records)
• Mortgage (verify through the lender's offer letter)
• Savings (verify through bank statements showing accumulation over time)
• Gift from a family member (obtain a signed gift letter and verify the donor's source of funds)
• Funds from overseas (verify through overseas bank statements, tax records, or employment documentation)
• Inheritance (verify through grant of probate or estate accounts)

A client stating "savings" or "from my account" is not sufficient verification. You must obtain documentary evidence that supports the explanation. Where funds come from multiple sources, verify each one separately.

Trust and company service provider (TCSP) duties

If your firm creates companies, establishes trusts, provides nominee shareholders or directors, or provides a registered office address, you are acting as a trust and company service provider. Regulation 12 of the MLR 2017 brings these activities within scope of the regulations; the customer due diligence obligations under Regulations 27–28 then apply, including identification and verification of all beneficial owners of the structures created. Given the opacity risk of complex structures, the SRA pays particular attention to TCSP work during supervisory reviews.

Enhanced due diligence

You must apply enhanced due diligence (EDD) in higher-risk situations. For law firms, the most common EDD triggers are:

• Clients who are politically exposed persons (PEPs), their family members, or known close associates
• Transactions involving high-risk third countries identified by the FATF or the UK government
• Complex or unusually large transactions with no apparent economic or legal purpose
• Non-face-to-face client relationships — a risk factor to weigh under Regulation 33(6) rather than an automatic mandatory trigger

EDD requires senior management approval to establish or continue the business relationship, enhanced ongoing monitoring, and establishment of the source of wealth (the overall origin of the client's financial resources, not just the funds for the specific transaction). Since 10 January 2024, the starting point under Regulation 35(3A) is that a domestic PEP presents a lower level of risk than a non-domestic PEP, and the extent of enhanced measures may be adjusted accordingly.

Legal professional privilege and suspicious activity reporting

Solicitors occupy a unique position in the AML regime because of legal professional privilege (LPP). Understanding the boundary of this privilege is critical to complying with your reporting obligations without inadvertently breaching client confidentiality or, conversely, failing to report when required.

The general reporting obligation

Under section 330 of the Proceeds of Crime Act 2002 (POCA), a person in the regulated sector who knows, suspects, or has reasonable grounds for knowing or suspecting that another person is engaged in money laundering must submit a suspicious activity report (SAR) to the National Crime Agency (NCA) through the firm's Money Laundering Reporting Officer (MLRO). Failure to report is a criminal offence carrying up to 5 years' imprisonment.

The privilege exemption

Section 330(6) of POCA provides that the reporting obligation does not apply to information received in privileged circumstances. Information is received in privileged circumstances if it is communicated:

• By a client (or their representative) in connection with the provision of legal advice, or
• By a person seeking legal advice, or by a person in connection with legal proceedings

However, this exemption does not apply if the information is communicated with the intention of furthering a criminal purpose. This is known as the "crime/fraud exception" — if the client is seeking legal advice to facilitate money laundering, the privilege does not attach, and you must report.

In practice

If you form a genuine suspicion that your client is engaged in money laundering based on information received outside the scope of privileged communications (for example, through your own due diligence, source of funds checks, or observations about the transaction), you must submit a SAR. Where you are uncertain whether privilege applies, seek guidance from the firm's MLRO and, if necessary, from the SRA or the Law Society's practice advice service. Do not allow uncertainty about privilege to prevent you from reporting where you should.

Tipping off

Once a SAR has been submitted (or you know one has been submitted), it is a criminal offence under section 333A of POCA to disclose to the client or any third party that a report has been made, if that disclosure is likely to prejudice any investigation. The maximum penalty is 2 years' imprisonment. POCA does provide limited statutory gateways: section 333C permits disclosure between professional legal advisers who share a client or a transaction, for the purpose of preventing a money laundering offence (and only where both advisers are subject to equivalent duties of confidentiality and data protection), and section 333D permits disclosure to your client for the purpose of dissuading them from engaging in criminal conduct.

What happens next

AML compliance is not a one-off exercise. After implementing these measures, you must:

• Review and update your firm-wide risk assessment at least annually, or when your practice areas, client base, or risk profile change materially
• Refresh staff training at least annually, covering new typologies and any changes to your procedures
• Conduct regular compliance monitoring through file reviews, testing whether CDD is being completed correctly and SARs are being filed appropriately
• Respond promptly to any requests from the SRA, whether for documentation, information, or corrective action
• Monitor updates from the SRA, NCA, and LSAG for changes to guidance, thematic findings, or emerging risks

Economic Crime Levy

If your firm's UK revenue exceeds £10.2 million, you must also pay the annual Economic Crime Levy: £10,000 for revenue between £10.2 million and £36 million, £36,000 between £36 million and £1 billion, and £500,000 above £1 billion. HMRC collects the levy from firms supervised by professional body supervisors such as the SRA. Firms with UK revenue below £10.2 million are exempt.