Matter risk

CDD in practice

The SRA's AML Annual Report 2024-25 (dated 30 October 2025)  — the most recent and most detailed supervisory data available — identifies client and matter risk assessments as the single largest cause of SRA referrals. Across the files reviewed, 16% had no assessment at all or incomplete documentation. A further 39% had an assessment that failed to effectively evaluate the money laundering risk. That is 55% of reviewed files with a client or matter risk assessment problem of one kind or another, under Regulation 28 of the Money Laundering Regulations 2017.

The same report records 151 AML outcomes in 2024-25 — up from 78 the previous year and 47 the year before that. The SRA carried out 935 proactive engagements including onsite inspections, desk-based reviews and thematic assessments. Almost a third of firms examined were assessed as non-compliant, with a further 54% only partially compliant. The direction of travel is unambiguous: supervisory activity is increasing, outcomes are increasing, and the expectation that all firms will face AML scrutiny in the near future has been stated explicitly by the SRA.

These documents provide vital insights, and point to the commonality of the issues experienced by many regulated law firms. But this commonality should not lead to complacency but proactive efforts. 

The risk-based approach — which underpins the entire AML regulatory framework — requires that the level of CDD applied to any client or matter is proportionate to the risk that client or matter presents. This means that risk must be genuinely assessed, not assumed. It cannot be adequately discharged by applying standard CDD to everything regardless of the actual risk profile.

The LSAG guidance distinguishes between three levels of risk assessment that must operate together: the Practice Wide Risk Assessment (PWRA or FWRA), which assesses the risk profile of the firm as a whole; the client risk assessment, which assesses the risk presented by each individual client; and the matter risk assessment, which assesses the risk of each specific transaction or matter separately from the client risk.

All three must be in place, must be current, must be documented, and must demonstrably inform the level of CDD applied. An adequate FWRA does not substitute for a client risk assessment. An adequate client risk assessment does not substitute for a matter risk assessment. They operate at different levels and serve different purposes.

The SRA has consistently found — and explicitly criticised — risk assessments that are very basic or tick-box in nature, where fee earners only mark a file as high, medium, or low risk without documenting what they considered to arrive at that rating. An assessment that does not capture the reasoning is, in the SRA's view, inadequate — and it creates a particular danger: it encourages complacency when dealing with similar or apparently straightforward matters.

A genuine, adequate risk assessment must connect to the firm's own FWRA (firm-wide risk assessment). The FWRA is the foundation. It tells fee earners what the firm's specific risk profile looks like — not in generic terms, but in terms of the actual work the firm does and the actual clients it serves.

The SRA's AML Controls Webinar illustrated this precisely through a fictional case study: a fee earner was directed not just to a generic policy, but to specific information in the firm's FWRA — the types of conveyancing work that practice typically undertook, the typical range of purchase prices in their area, whether the firm regularly received funds from outside the jurisdiction, and the fact that the firm's probate department had relationships with French and Spanish law firms who could undertake CDD checks in those jurisdictions. That level of granularity in the FWRA is what enables a genuine, firm-specific risk assessment rather than a generic one.

An independent file review is a targeted assessment — distinct from a full Regulation 21 audit — that examines how AML obligations are being applied in practice on your files. It is the most direct way to understand the gap between your written policies and what your fee earners are actually doing.

The review examines a representative sample of files across your higher-risk practice areas — testing whether client risk assessments are completed, specific, and documented; whether matter risk assessments reflect the actual characteristics of each transaction; whether CDD is proportionate to the risk level; and whether source of funds is adequately evidenced where required.

The output is a clear written report — in plain language — setting out what the file sample shows, where practice is consistent with your policies, and where it is not. 

• Representative file sample across higher-risk practice areas
• Client risk assessments — completeness, specificity, and currency
• Matter risk assessments — separate from client risk, transaction-specific
• CDD proportionality — matched to the assessed risk level on each file
• Source of funds and source of wealth — evidenced and evaluated where required
• EDD application — applied where the risk assessment indicates it is required
• PEP and sanctions screening — documented on file with dated results
• Ongoing monitoring — evidence of review as client relationships develop
• Consistency across fee earners — identifying training gaps from file evidence
• Written report with actionable recommendations

When a file review identifies inconsistency between fee earners — some applying the firm's CDD and risk assessment procedures rigorously, others not — it almost always reflects a training gap rather than a conduct issue. Fee earners have not been trained to the specific risks in their practice area, or to the specific requirements of the firm's own FWRA.

The Law Society of Scotland's AML guidance makes this explicit: training must be tailored to specific roles and responsibilities and to the specific circumstances of the practice. Generic AML training that does not connect to the work fee earners actually do — the client types they serve, the transactions they handle, the red flags relevant to their practice area — fails to change behaviour because it does not speak to the situation fee earners actually face.

Regulation 24 of the Money Laundering Regulations requires that relevant employees receive appropriate AML training — covering the risks of money laundering, the firm's procedures, how to recognise suspicious activity, and how to report internally. That training must be documented, current, and role-specific.

• Fee earners working on conveyancing need specific training on property-related red flags, source of funds requirements, and the risk factors identified in the firm's FWRA for property work
• Fee earners working on corporate and trust matters need training on beneficial ownership verification, PEP assessment, and the specific risks of complex structures
• Support staff collecting client ID need specific training on document verification and the indicators of false or tampered documentation
• The MLCO and MLRO need a deeper level of knowledge than other staff — and that knowledge should be current, not based on training received several years ago
• Training records must be maintained and demonstrate that training has taken place — an undocumented training session is indistinguishable from no training at all

Regulation 21 Independent Audit

The formal, comprehensive independent assessment of your entire AML framework — fulfilling the statutory independent audit function obligation under regulation 21(1)(c). Covers documentation, governance, file practice, training, and produces a written report.

AML Framework Document Review

An independent review of your FWRA, policies, controls, and procedures against the current regulatory standard — identifying gaps in your documentation before they become audit findings or supervisory concerns.