Here’s our last 2026 round up of all things risk and compliance, bringing you the latest practical guidance and regulatory insights…

New rules and guidance from SRA

Warning Notice: Misuse of AI

On 17 August 2026, the SRA published a warning notice on the misuse of AI. Its message is clear: blaming AI is not an acceptable excuse.

The two key concerns are hallucinations (fabricated cases, citations and “facts” that look entirely plausible) and confidentiality (entering client information into public AI tools, free or paid, risks breaching confidentiality and waiving legal professional privilege).

Why it matters

• Courts are taking this seriously. In Ayinde v Haringey LBC, fake citations led to a wasted costs application and regulatory referrals.
• AI has no legal personality, so users remain fully accountable for accuracy, and supervisors can breach their own duties if a supervisee submits unreviewed AI-generated work.

What firms should do

• Verify everything before it reaches a client or court.
• Know where your data goes before using any AI tool.
• Supervise in line with the SRA’s Effective Supervision
• Build real governance, not just a policy nobody reads.

The takeaway: Used correctly, AI is valuable, but judgement, verification and accountability remain with the human lawyer. For further details, see our blog here.

Guidance: Using or arranging Third Party Litigation Funding (and consultation)

The SRA has turned its attention to third party litigation funding (TPLF), particularly in high-volume consumer claims, following the collapses of SSB Law in 2024 and Pure Legal before it, which affected large numbers of consumers. Both a consultation and new guidance were published on 9 July 2026.

The consultation closed on 17/9/26 with the SRA’s response awaited. It proposed adding five new requirements to the SRA’s standards and regulations: namely to address professional conduct and, for firms using TPLF for consumer claims, a duty to give clients a ‘prominent funding information document’, to notify the SRA when using or arranging TPLF, and to provide to the SRA on request both a TPLF risk assessment and a plan for an orderly closure of the business (should it be necessary).

The guidance is aimed at firms that use TPLF to fund client litigation or introduces clients to funders. It covers assessing whether funding arrangements are in clients’ best interests, maintaining independence and managing conflicts of interests, ensuring clients have the information they need to make informed decisions, and financial stability. It also stresses that although litigation generally falls outside the Money Laundering Regulations, the Proceeds of Crime Act 2002 and the sanctions regime still apply, so firms must be alert to funders using TPLF to transmit criminal proceeds or evade sanctions, and to the risk of transferring funds to or from a designated person.
For further details, see our blog here.

SRA Annual Assessment of Continuing Competence

The SRA’s fourth annual assessment of continuing competence (published 20/8/26) finds that most solicitors and firms maintain competence well, but competence-related reports to the SRA have risen sharply, from 2,720 in 2024 to 4,038 in 2025.

Key findings: Documented reflection appears to be lacking. Of 123 training records reviewed from 66 criminal and civil firms, just under half did not explain how the learning need was identified or why it mattered; Learning is too narrow – competence is more than technical legal knowledge. Ethics and professional obligations need more attention; the SRA expects solicitors to keep up with its warning notices, guidance and thematic reviews; Its observations also flag limited explanation to clients of risks, options, potential outcomes, costs, timescales and deadlines, as well as process errors, especially in high-volume transactional work.

What the SRA proposes: Rules requiring solicitors to record their learning needs and how they were identified and addressed, annual mandatory ethics discussions, and targeted learning where competence concerns arise.

What firms should do now:

• Review systems for assuring staff competence (beyond purely technical legal needs)
• Encourage written records of reflection
• Discuss ethics regularly
• Circulate SRA warning notices and guidance, and check they are read
• Carry out regular file reviews to check on client communication and process errors
• Watch for the SRA’s post-consultation announcement later this year

For more detail, see our full blog here.

SRA Consultation: Statement of Solicitor Competence

Continuing with the ‘competence’ theme, on 8/10/26, the SRA launched another consultation, this time on the Statement of Solicitor Competence (SoSC) and the SQE Functioning Legal Knowledge (FLK). The SoSC, first published in 2015, sets the standards of competence expected of solicitors at qualification and throughout their career. The SRA now wants to bring it up to date, including by adding:

• Technology and AI: their growing importance across ethics, technical legal practice and supervision.
• Ethics: prioritising conflicting ethical obligations, and when and how to raise concerns about unethical behaviour.
• Supervision: a standalone section, aligned with the SRA’s Effective Supervision guidance.
• Health and wellbeing: managing your own and your supervisees’ wellbeing, and promoting an inclusive, healthy workplace culture.

The SRA is also proposing amendments to the FLK but will not add any new practice areas.

Responses are due by 3 December 2026, and any changes are not planned to take effect until September 2027. For further details, please see our blog here.

Guidance from the Law Society

Practice Notes and guidance

The Law Society appear to have been busy in recent months updating various Practice Notes, so much so we haven’t got room to list them all here! It’s worth having a look at the list and reading any which are particularly relevant to you (or just to know that they are there if you need them).  They also published a new Practice Note in September on the Differences in English and Welsh Law.

In addition, if you are not already aware, the Law Society has a useful Q&A section on their website covering a very wide range of issues, which is worth knowing about😊.

Conveyancing Protocol Consultation

The Law Society announced on 7/10/26 that they are consulting on proposed updates to the Conveyancing Protocol and are inviting members to share their views on the draft revised edition. Any residential conveyancing practices, especially CQS accredited firms which are required to followed the Protocol, should read the explanatory note and the draft revised protocol and respond to the Consultation if you have any thoughts or concerns.

Hot topics

SRA powers re privileged material

On 21/9/26, the High Court ruled that the SRA cannot use its section 44B powers under the Solicitors Act 1974 to require firms to produce legally privileged documents unless the client waives privilege. Mr Justice Butcher found the legislation was not clear enough to override legal professional privilege (LPP), and that it is for Parliament to decide whether the SRA should have such powers. The case arose from an SRA investigation into a SLAPPs (Strategic Litigation Against Public Participation) allegation against Carter-Ruck.

The SRA and anti-SLAPP campaigners are concerned that the ruling will result in a ‘toothless’ regulator. However, the Judge concluded that most SRA investigations would still be able to proceed without privileged material and/ or there would be implied waiver situations for example, where a client complains about their own solicitor.  Nonetheless, the SRA is seeking to appeal the decision and hoping to go straight to the Supreme Court on the back of a “leapfrog certificate”. We are waiting to see if the Supreme Court will agree to hear the appeal. This is an important case for the profession with significant implications either way, with concerns that if LPP is weakened as a fundamental right in favour of the SRA, this could be a ‘dangerous and slippery slope’ if other public bodies seek to follow suit.

What now?

• Treat every s44B notice (or indeed any request for information from the SRA) seriously and involve your COLP immediately.
• Identify privileged material and take client instructions on waiver. Do not simply comply. Document your reasoning and redact any privileged information if consent is not forthcoming.
• Remember that you cannot disclose privileged material in your own defence without client consent (and consideration must be given as to whether it is ever in the clients’ best interests to waive privilege).
• If privileged material has already been given to the SRA, consider seeking its return or destruction, and whether earlier decisions should be challenged.

For more detail, see our full blog here.

Compliance Officer Rule changes

Things move fast in the compliance world!  In our July update we reported on the SRA’s decision to go ahead with its plans to strengthen protections around client money following its consultation earlier this year, focussing on Accountants’ reports and the separation of management and compliance roles.  We provided further thoughts on the plans in September, expressing concerns, not just about the impact on smaller firms, but also about the impact on the compliance roles in general.  We were eagerly awaiting the SRA’s promised ‘autumn’ guidance….and then, at the end of September, the SRA paused its plans to separate management and compliance roles, following mounting pressure from the Law Society and the newly formed SME & Boutique Law Firm Alliance. The proposals would have affected firms with turnover above £600,000 and/ or client money held above £2 million.

Quite what happens next remains to be seen. The underlying questions around independence, oversight and governance are unlikely to disappear completely, but there is also a possibility that the proposals may evolve considerably (or even quietly disappear??), particularly as other regulatory priorities emerge (see the ‘SRA powers re privileged material’ section above for example). For now, firms need take no action. We will keep an eye on developments and update you as soon as we can.  For more detail, see our full blog here.

Information Commission

As of 30/9/26, the UK’s data protection regulator, the Information Commissioner’s Office (ICO) formally became the Information Commission, as a result of the governance changes brought into effect by the Data (Use and Access) Act 2025 (DUAA), albeit it will continue to be known as the ICO (which is a relief!).  Whilst this will not have any real immediate impact on firms, from a governance perspective, the powers of the ICO will be held collectively by a new corporate board, rather than the previously individual Information Commissioner, with the aim of strengthening the ICO’s transparency, accountability to parliament and effectiveness. The new board’s powers are also being extended under DUAA so we may see a shift in regulatory focus in due course. Our partners at VinciWorks have provided more detail about the change in their recent blog.

For the time being, next time you review your data protection policy, privacy and cookies notices, updating references to the regulator’s full title is recommended.

Anti-money laundering, sanctions & financial crime

SRA Sectoral Risk Assessment

The SRA published its updated Sectoral Risk Assessment on AML, terrorist financing, proliferation financing and sanctions on 6/8/26 (with a slightly updated version on 4/9/26). Firms must update their Firm Wide Risk Assessment (FWRA) to reflect the SRA’s latest concerns as soon as possible, as this is a requirement of the Money Laundering Regulations. (For clients we will shortly be updating our template documents to assist you with this).  Many of the “new emerging risks” are in fact existing risks that have been expanded upon.

Key areas include

• AML: deepfake identity fraud and cyber-enabled fraud; “passporting” and reliance on existing due diligence; cash-intensive businesses (including “ghost directors”); global instability; and misleading company registration information.
• Sanctions: rising Russian sanctions circumvention via third countries, and a new sub-section on regimes beyond Russia, Iran and North Korea.

What now?  Review the updated Sectoral Risk Assessment, update your FWRA (keeping previous versions), review client/matter risk assessments and source of funds processes, and make sure staff are aware of the changes.

To assist firms navigate the changes, we have summarised the main changes and recommended action points in our blog post here, and created a table of the risks addressed by the SRA, together with suggested mitigating-actions, and an indication of where your main focus should be in terms of updating your FWRA and training your staff. If you would like a copy of the table, do get in touch.

AML & Asset Recovery Strategy 2026-2029

On 15/9/26, the Government published its three-year strategy for the UK’s anti-money laundering (AML) and asset recovery system, with the stated aim of taking “the profit out of criminality”. It focuses on greater coordination, better use of technology and stronger enforcement powers, and cutting back low-value “box-ticking” work. Much of it points to future consultations, reviews and legislation rather than settled rules, but it shows the direction of travel. Key points for law firms:

• FCA supervision: Confirmation that the FCA will become AML supervisor for legal, accountancy and trust & company service providers, reducing the number of AML supervisors from 25 to 3 (FCA, HMRC & Gambling Commission).
• Tougher enforcement: HM Treasury will consult on stronger supervisory powers under the Money Laundering Regulations (MLRs), including unannounced visits and greater director accountability for breaches.
• Intelligence sharing: The strategy stresses closer collaboration between supervisors and law enforcement, but provides little information about how this will work and doesn’t address the fraught issue of legal professional privilege and tipping off.
• Supervisory risk assessments and SARs: HMT plans to streamline the approach to AML across the regulated sector, working to agree common principles for supervisory risk assessments and to enhance the use of intelligence from Suspicious Activity Reports (SARs).
• Companies House: Identity-verification requirements for those filing on behalf of companies are now expected no earlier than November 2027 (having previously been this November), and the Discrepancy Reporting Regime will be reviewed.
• MLRs and SARs reviews: A further MLRs consultation is planned for 2026/27, alongside a review of the SARs regime, including whether to raise the suspicion threshold for reporting under the Proceeds of Crime Act 2002 (POCA).
• Digital ID: HM Treasury will consider further steps to support digital ID verification for AML checks, to make customer due diligence quicker and easier.

For more detail, see our full blog here.

Law Society Economic Crime Conference

This took place on 17/9/26.  We have picked out some top takeaways to focus on in our blog here, covering:

• Transfer of AML supervision to the FCA, including interesting insights from the FCA’s Executive Director of Enforcement and Market Oversight and the FCA lead for financial crime.
• What the SRA will be left to do (without AML supervision), including double jeopardy concerns and the potential for increasing focus on sanctions enforcement.
• Controls: more important than policies, looking at the SRA’s main finding this year that there is a real disconnect between firms’ policies and what actually happens day to day.
• Data driven supervision, looking at how firms can leverage their data and be ready for the anticipated FCA requirements.
• Artificial intelligence and client identification, focusing on criminals using AI against firms, and its impact on the ID verification model firms rely on.

Sanctions – Frozen Assets Reporting

Every year HM Treasury carries out a review of frozen assets to update its records and to capture any changes during the reporting period.  All persons that hold funds or economic resources owned, held, or controlled by a designated person are required to submit a report to OFSI by Monday 30th November 2026.  If you act for any sanctioned clients and are holding any frozen assets, read the OFSI notice here for further information.

Corporate liability for criminal offences

Since 29/6/26, a law firm (of any size, including partnerships) can be convicted of any UK criminal offence committed by a ‘senior manager’ ‘acting within the actual or apparent scope of their authority’, pursuant to s250 Crime & Policing Act 2026. The firm doesn’t need to have benefited from the offence.

• Wider than before: it replaces the ECCTA 2023 provisions (s196), which covered only listed economic crimes, and now applies to all crimes (e.g. data protection, health and safety, computer misuse, obstructing investigations).
• ‘Senior manager’ definition: has not changed and covers anyone playing a significant role in managing the firm, or a substantial part of it, regardless of job title.
• No defence: unlike the failure to prevent fraud offence, it applies to all firms and has no ‘reasonable procedures’ defence.

Steps to reduce risk

• Identify your senior managers and document the limits of their authority
• Assess the criminal risks of their activities and screen staff robustly
• Train senior managers on the new rules
• Review governance (including file reviews for senior managers and client account controls), whistleblowing arrangements and insurance cover, including Directors’ and Officers’ insurance – or equivalent).

For more detail, see our full blog here.

Law firm management

Interest on Lawyers’ Client Accounts Scheme (ILCA)

We last reported on this issue in our April update, at which point we were awaiting the Government’s response to the feedback to its consultation which closed in March.  As a reminder, the Government is seeking to take the majority of interest earned on client account funds to support the justice system. No formal response from the Government has been published as yet, but adverts for two new senior civil servants to lead the proposals were spotted by the Gazette at the end of August, suggesting that the change in Prime Minister was not going to dampen the resolve despite significant push back from the profession, and the suggestion that banks will cut interest they pay on law firms’ client account if the plans go ahead (making it a rather pointless government exercise it would seem 🤔).  Seen by many as another attack on smaller firms, this is another case of ‘watch this space’. However, in the meantime, the SME & Boutique Law Firm Alliance are in the process of collecting signatures to an open letter to the Prime Minister asking him to reconsider the entire proposal. If you want to add your name, the link can be found here.

SRA complaints data collection exercise

The SRA announced in July that another data collection exercise (in addition to the AML & Sanctions one over the summer) is coming later this year, this time focusing on complaints handling.

The SRA is likely to be looking at:

• How long complaints take to resolve
• How many complaints are escalated to the Legal Ombudsman (LeO)
• Other complaints handling metrics

Although we haven’t heard any more from the SRA about this since July, do make sure you are keeping records of the date complaints are received and the date they are closed/ resolved/ escalated to LeO.

We will of course let you know as soon as we hear any more about timings for this exercise.

Legal Ombudsman Model Complaints Resolution Procedure (MCRP)

The Legal Ombudsman launched its final MCRP on 29/9/26, and the SRA has signposted it as a best-practice resource. It is a voluntary framework, supported by guidance, toolkits and template letters, that sits alongside (not instead of) your SRA complaints obligations. It has two stages: Early Resolution and Full Investigation.

To say you use the MCRP, your procedure must include:

• A link to LeO’s resources (consumer resources can be found here).
• Acknowledgement of every complaint, with an explanation of next steps
• An Early Resolution stage and a Full Investigation stage (albeit both may not be necessary/ appropriate for all complaints)
• A written outcome in every case

Beyond that, firms can adapt it to their size and work. Even if you don’t adopt it, it’s worth comparing it with your current procedure, as LeO regularly sees poor first-tier complaints handling. The SRA’s consultation on first-tier complaints (see below) closed on 1/9/26, so further clarity is expected.

For more detail, see our blog here.

First-tier complaints – the SRA tries again

After withdrawing its complaints-handling proposals in January when the LSB signalled it wouldn’t approve them, the SRA has revived them following a supplementary consultation (3 July to 1 September), adding two new requirements to the original proposals.

• New requirements: when a complaint is made, clients must be given a timeline for resolution and regular (not defined) updates on progress. (The SRA has also drafted a ‘Complaints Handling Requirements Statement’ bringing all of the existing and new obligations together in one place.)
• Original proposals still stand: complaints information to be given at the end of a matter as well as the start, more prominent website information, and adoption of the LSB’s definition of a complaint.

The Law Society and Birmingham Law Society have raised concerns, including about timing and the risk of creating an incentive to pay off unhappy clients. LSB approval is still required, so changes are unlikely until 2027. There’s no need to rush to do anything, but updating your complaints definition, checking your website for complaints information prominence, adding an expected timeline to your complaint acknowledgement letters and building in update prompts is good practice anyway.

For more detail, see our blog here.

Practising certificate renewals – now open

The renewal window opened on 1/10/26 and closes on 31/10/26. The SRA says there are no new questions in the practising certificate or registration renewal applications this year, which is a small mercy given the significant increase in fees.

A few key reminders

• Check your mySRA login details and authenticator app are working well in advance of the deadline, and that an authorised signatory is available to submit the bulk renewal application.
• Ensure everyone checks their mySRA details for accuracy and completeness in advance.
• Make sure you have budgeted for the higher fees (see the current fees page).
• Check you have the information you will need to complete your application in advance (including first-tier complaints numbers and continuing competence records). For a full list of what the SRA will require, see the Getting Started section on the SRA’s website here.
• Don’t leave it until the last minute to complete!

Liability caps – is yours worth the paper it’s written on?

A recent High Court decision is a timely reminder to review standard liability caps in your terms of business. In a claim against Kennedys Dubai LLP, the firm’s £3m cap survived only because UCTA 1977 didn’t apply (the retainer was more closely connected to Dubai than England). The judge said the cap would have been unreasonable had UCTA applied, because:

• The firm held £30m of PII cover, ten times the cap
• The cap was never negotiated, and there was no explanation of how the figure was reached
• The client hadn’t read the terms

The SRA’s position is equally clear: caps must be “fair and reasonable”, can’t fall below minimum cover (£3m per claim for incorporated firms and LLPs, £2m for others), and shouldn’t be applied “as a matter of routine”.

Pro-tips

• Check whether caps are applied routinely rather than case by case
• Record your rationale, linked to the matter’s value and risk and your actual cover
• Draw the cap to the client’s attention specifically, and keep evidence of this
• Never cap below the minimum terms

For more detail, see our blog here.

Moving landlines to digital technologies

As you may have heard, the UK’s traditional copper-based telephone network (PSTN) is being retired in favour of digital, IP-based services (which will rely on internet connection), with a current cut-off date of 311/27. If you haven’t already done so, firms should consider whether any older infrastructure still relies on analogue telephone lines, including phone and PBX systems, fax lines, alarm systems, door-entry systems, PDQ/ card machines, lift lines and other embedded systems and act accordingly sooner rather than later to avoid disruption.  We also recommend that you review your business continuity plan and consider how you will deal with loss of power/ internet connectivity and any confidentiality issues associated with the transfer to digital services.  For further information, see the government guidance here or speak to your provider direct.

SRA misbehaving

PM Law collapse – could the SRA have acted sooner?

An independent review published on 3/9/26 has concluded that the SRA had the information and opportunities it needed to act long before the Sheffield-based PM Law group collapsed in February, after which the SRA intervened.

• Missed warnings: The SRA held information from two forensic investigations, an AML inspection, a thematic review visit and ‘numerous reports’, and had classed the group as a high-risk ‘accumulator’ firm in 2024. However, it never drew this together into ‘a single, coherent risk picture’.
• Silos: Different SRA teams appeared to work separately using different systems, with insufficient shared knowledge.
• The impact: A fraud of around £40m is suspected, with the Compensation Fund again being called upon.
• What next: The review identified three ‘structural gaps’ (technology, training on complex group finances, and escalation procedures within the SRA). The SRA says it is focusing on client money rules, a more joined-up data and risk-driven approach, and added capacity.

Food for thought? Can firms learn lessons from the SRA’s mistakes? Could your COLP or management team easily aggregate information and draw together a single coherent picture from different teams, so you can act before problems escalate?

For more detail, see our blog here.

Tribunal trends and cases of interest

 

 

• A lawyer has been banned after repeatedly using AI-generated false case citations in disciplinary proceedings. Already facing action following a conviction for knowingly employing an illegal worker, he submitted misleading AI-generated quotations and citations to the SRA. When challenged, he used AI again to draft an explanation containing further errors. The SDT said either allegation justified removal, stressing that failing to verify AI-generated submissions risked the administration of justice and public confidence in the profession.
• A solicitor struck off for advising on a sham marriage and property transactions bearing hallmarks of fraud has failed to rejoin the profession. The SDT found he had not provided sufficient evidence of rehabilitation, insight, trustworthiness or professional development. His clean record and subsequent employment were insufficient to overcome the serious original findings. He was ordered to pay £3,000 in costs.
• A veteran solicitor has been suspended for nine months after allowing his firm’s accounts to fall into chaos, leading to over £400,000 in Compensation Fund claims. The solicitor admitted lacking integrity and acting recklessly. The SDT noted his long, previously unblemished career and ill-health but stressed his failure, as sole manager, COLP and COFA, to seek necessary help.
• A law firm has been fined £16,100 after failing to properly identify and manage a politically exposed person (PEP) across 14 property purchases. The firm lacked adequate systems to establish the client’s PEP status, source of funds and wealth, or apply required enhanced checks. The firm admitted multiple regulatory breaches.
• A law firm owner has been struck off after nearly £640,000 went missing from client account, with £451,000 unrecovered. The owner admitted dishonesty after client money was improperly transferred to office account and used towards firm expenses. The SDT found her conduct deliberate, calculated and repeated, causing significant harm to the profession’s reputation.
• A solicitor has been struck off for making a fraudulent insurance claim after his £1,700 bicycle was stolen. The solicitor had dishonestly attempted to add the bike to his policy after the theft and made misleading statements to his insurer. The SDT rejected his explanation and found personal stressors, including a friend’s murder, did not constitute exceptional circumstances. He was ordered to pay costs of £20,800.
• A senior solicitor has been reprimanded and barred from acting as COFA for 12 months after repeated compliance failures, including inaccurate insurance declarations, residual balance issues, late accountant’s reports and an unauthorised charity payment. The solicitor has been ordered to complete an SRA-approved COFA training course before returning and pay £39,000 costs.