This took place on 17/9/26. We have picked out some top takeaways to focus on here:
Transfer of AML supervision to the FCA
Unsurprisingly, various of the conference sessions addressed this evolving issue. The legislation which will give the FCA its new powers to regulate AML in the legal sector (as well as the accountancy sector and TCSP providers) is the Financial Services and Markets Bill. The FCA’s Executive Director of Enforcement and Market Oversight and the FCA lead for financial crime who spoke at the conference said that royal assent is expected in February/ March 2027 following which he anticipates progress towards the transfer moving at pace, with the first firms coming under the FCA’s wing towards the end of 2028, albeit the full transfer isn’t likely to have completed until mid-2030 at the earliest, and it is not yet known whether the FCA will start with the legal sector or one of the other sectors.
Key takeaways from the FCA
- They have not yet engaged properly with law firms, but plan to do so in the coming months, with the aim of increasing their understanding of the legal sector.
- The general tone from the conference appeared to be that there will be much more of a partnership between the FCA and SRA that anyone perhaps anticipated, which has to be a good thing.
- They will use a risk-based, proportionate approach to regulation, with no ‘one size fits all’, aiming to create friction for criminals, not firms, commenting that they are not looking to catch law firms out, but that they will seek out the small minority of lawyers who enable crime!
- In terms of data, the FCA will start with the data the SRA already holds/ collects but the SRA’s annual data collection exercise is likely to morph over time to match what the FCA will want, hopefully giving firms a bit of a lead in time. (It is worth noting that the FCA’s findings published in July from their Financial Crime questionnaire sent to Asset Management and alternative firms in November 2025 suggest that they request a lot more (and more detailed) information from their regulated firms than the SRA currently does of law firms).
- They are committed to building sector-specific expertise, so hopefully the LSAG guidance is relatively safe, but they were a little non-committal about how much of it they will adopt.
- Money Laundering Reporting Officers (MLROs) in law firms will be a key partner for the FCA. I will leave it to you to decide whether this quote from the FCA at the conference will allay the concerns of MLROs: “If I were a MLRO I wouldn’t be worried about this, I would be excited about the opportunities”. Interestingly, one of the panel discussions raised the possibility (likelihood?) that the FCA may expect the professionalisation of MLROs, i.e. no more MLROs who carry out the role as an aside to their fee earning/ management role.
- The FCA is keen on utilising AI opportunities to help spot key risks in firms, although what that will mean in practice is not yet clear.
How to prepare?
- Generally, for now, the overriding message remains: if you’re already doing what you’re meant to be doing for the SRA, you should be fine. Afterall, the MLRs aren’t fundamentally changing (as far as we are aware!). Just don’t take your foot off the pedal, but equally, there is little point trying to pre-empt changes at the moment.
- However, some specific suggestions from the conference included starting to think about getting job descriptions in place for staff, in particular MLROs/ MLCOs, (if you don’t already have them); putting in place terms of reference for compliance committees/ management boards to show that AML is discussed regularly; and ensuring your systems allow for enhanced data collection and reporting.
What the SRA will be left to do
Once the FCA takes over AML supervision, the SRA will continue to supervise everything they currently regulate that isn’t a strict breach of the Money Laundering Regulations (MLRs) – sanctions, POCA conduct, Terrorism Act conduct, plus all the other Code of Conduct and Standards & Regulations issues of course! (Don’t forget, that during the transition period (which is likely to take us beyond 2030 for it to be finalised) the SRA will continue with its AML supervision too, including inspections, desk-based reviews, thematic reviews etc.)
The biggest concern from the delegates was ‘double jeopardy’. There is such an overlap between AML, terrorist financing and sanctions, surely firms are going to find themselves facing double exposure: an FCA enforcement action for breach of the MLRs (which tends to be a finding against the entity), and separate SRA enforcement for breach of the Principles and/ or Codes of Conduct (which is likely to be taken against individuals). (Plus, separate criminal offences under the MLRs and Sanctions regimes.) Despite this having been a serious concern since the FCA bombshell was dropped last October, attendees were provided with no further information about what this will look like in practice, or how this risk will be addressed, other than the FCA confirming they will work alongside the SRA…whatever that means?
Another concern raised by an attendee was whether the SRA may actively “beef up” its sanctions work specifically to stay relevant, and to justify its budget, once AML moves across to the FCA. This is certainly a possibility! They have already confirmed that they will be carrying out sanctions-specific inspections from November onwards (although this may have been slightly knocked off course by the Carter-Ruck privilege decision (see our blog here)!).
Controls: more important than policies
The SRA’s main finding this year was there is a real a disconnect between a firms’ policies, controls and procedures, and what actually happens day to day. That gap is now the thing being supervised, and indeed is the subject of the SRA’s latest AML thematic review, which we are expecting to be published later this year. A key takeaway from the day is that “we have a policy for that” is not enough. The question the regulator (both the SRA and FCA in due course) will actually ask is whether you can demonstrate compliance with it. As always, “if it’s not written down, it didn’t happen!”, so, ensure staff are documenting their decisions to show your policies in action, particularly if they depart from what the policy says.
The SRA also commented that SRA inspections and Independent Audits shouldn’t be the only things to surface problems – internal file reviews should be picking up on issues before you get to that point!
Data driven supervision
We know the FCA is data-led and the SRA is becoming more so. The message from the data workshop was blunt: firms are not short of data but the problem can be knowing how to use it. The recommendation was to conduct an audit of the data you hold – looking at clients, work types, jurisdictions, who owns the client relationship, where instructions came from, EDD volumes, PEP exposure. While some firms have this centralised, many rely on fragmented spreadsheets scattered across departments, making auditing and reporting on the data difficult. Also think about how to collect your data and how to analyse it. Structured data collection, using proper fields, tells you what happened and when, and is easy to report on. Recording the ‘why’ (why did you consider a matter was low risk, why did you feel sufficient source of funds and wealth documentation had been obtained) is also important to evidence judgement and context. Then consider how you will analyse the data, looking for gaps and patterns and areas of risk, as well as areas of good practice.
There were two warnings given that are worth taking seriously:
- Remember data can mislead. You can complete client and matter risk assessments (CMRAs) on 100% of matters but it they are ineffective (and remember the that the SRA’s AML Annual Report last October stated that 39% of the CMRAs they reviewed were ineffective) then the assessments, and your data showing perfect completion, are meaningless. Completion is not effectiveness.
- Don’t let your own internal definitions distort the external answer. The example given was around PEP reporting. Your internal definition of “PEP,” for instance, may not match the MLR definition – and that gap needs to be understood before any number gets reported, particularly when reporting to the FCA who will use that to risk assess your firm in due course.
AI and client identification
The session on Artificial Intelligence and financial crime focused on the impact of AI on the ID verification model firms rely on, and criminals using AI against us, rather than our own misuse of AI (which was of course the focus of the SRA’s latest Warning Notice discussed in our blog here). With the panel making the rather terrifying point that a full set of fake identity documents and images capable of passing liveness tests, together with a full set of bank statements, can now cost around $15 and take 15 minutes to produce (significantly down from $500 only a year ago) and that criminals only need 20 seconds of somebody’s voice in order to clone it and fabricate an entire fake conversation, their message was: If firms are still satisfying themselves with only a passport and 3 months of bank statements to carry out their AML checks, this is inexcusable in the modern world. Firms really need to get to know their clients and their transactions and use a multi-layered approach to identifying and verifying them, using technology shields (such as NFC chip reads, physical inspection of holograms, biometric liveness testing) as well as possibly the back-to-basics approach of meeting clients in person…could that be where we end up? How will that work in this world of hybrid working?
Other important points included:
- AML controls are not about having a piece of paper, they are about whether what you receive makes sense. This applies not only to ID documents but also to source of funds information. Firms’ money laundering risk sits overwhelmingly in source of funds (given that ID&V only tells us where to find the client and that they are who they say they are, not whether or not they are money laundering) and if bank statements can now be fabricated so cheaply and easily, their evidential value (on their own) is clearly weakened.
- Vigilance must be individualised – every fee earner needs to be thinking about these risks, particularly given they have the client-facing role, and not rely on a centralised onboarding team or their technology provider. No technology removes the need for human judgement.