28.—(12) The ways in which a relevant person complies with the requirement to take customer due diligence measures, and the extent of the measures taken—

(a)must reflect—

(i)the risk assessment carried out by the relevant person under regulation 18(1);

(ii)its assessment of the level of risk arising in any particular case;

(b)may differ from case to case.

28.—(13)  In assessing the level of risk in a particular case, the relevant person must take account of factors including, among other things—

(a)the purpose of an account, transaction or business relationship;

(b)the level of assets to be deposited by a customer or the size of the transactions undertaken by the customer;

(c)the regularity and duration of the business relationship.

30.—(1) This regulation applies when a relevant person is required to take any measures under regulation 27, 28 or 29.

(2) Subject to paragraph (3) or (4), a relevant person must comply with the requirement to verify the identity of the customer, any person purporting to act on behalf of the customer and any beneficial owner of the customer before the establishment of a business relationship or the carrying out of the transaction.

(3) Provided that the verification is completed as soon as practicable after contact is first established, the verification of the customer, any person purporting to act on behalf of the customer and the customer's beneficial owner, may be completed during the establishment of a business relationship if—

(a)this is necessary not to interrupt the normal conduct of business; and

(b)there is little risk of money laundering and terrorist financing.

31.—(1) Where, in relation to any customer, a relevant person is unable to apply customer due diligence measures as required by regulation 28, that person—

(a)must not carry out any transaction through a bank account with the customer or on behalf of the customer;

(b)must not establish a business relationship or carry out a transaction with the customer otherwise than through a bank account;

(c)must terminate any existing business relationship with the customer;

(d)must consider whether the relevant person is required to make a disclosure (or to make further disclosure) by—

(i)Part 3 of the Terrorism Act 2000 M1; or

(ii)Part 7 of the Proceeds of Crime Act 2002 M2.

There should be a risk assessment for each new matter for a client - especially if the risk is novel

"There might be times however when it is less likely that one will be needed. For example, when matters for a client are highly repetitive in nature, with the level of risk remaining consistent between one matter and another and the risk is comprehensively addressed in the client risk assessment. You should however still conduct ongoing monitoring to make sure that any transactions are consistent with your knowledge of the client, their business, and their risk profile, and document your decision making accordingly."

"While there is no requirement to risk assess matters which fall outside of the money laundering regulations, it might well be appropriate to do so. For example, where the client might later instruct you on a matter which is within scope or the initial matter branch into scope of the regulations. Ancillary relief work, for example, is typically out of scope, but might in its later stages involve buying and selling real property or forming trusts."

You must record a risk assessment for every client and provide it on request. Whether you use high/medium/low or a numerical system, the key is to identify high-risk matters needing EDD and ensure fee-earners follow the right process.

The SRA continues to see overly basic, tick-box forms that lack space for rationale or commentary. This risks complacency, particularly in repetitive matters, and can miss unusual or high-risk factors.

Each assessment should record:

• the reasoning for the risk level,

• the reasoning for the level of due diligence to apply

• the mitigation to be used

• explanations for any departures from the firm-wide risk approach.

• this process need to be clearly documented

Firms with no clear process for identifying high-risk matters or recording decisions risk regulatory action.

The SRA accepts the use of CMRA templates as a starting point but stresses they must be:

• Comprehensive

• Tailored to the firm

• Aligned with the FWRA

• Up to date

• Reflecting actual ML risks

Generic, off-the-shelf templates without tailoring should be avoided. Even the SRA’s own CMRA template must be adapted to each firm.

The SRA notes that many firms use scoring systems to assess client or matter risk, with higher scores indicating greater risk. Fee earners should be trained to use these systems effectively.

Scores should guide but not replace judgment — certain factors, like clients in high-risk countries or PEPs, must automatically trigger a high-risk rating.

Any system that is confusing, poorly weighted, or fails to identify key risks is unlikely to meet regulations 28(12) and (13).