The UK government has this month published its latest National Risk Assessment (NRA) of money laundering and terrorist financing risks.
For most firms, the takeaway is simple: the overall picture hasn’t dramatically changed. But there are some subtle shifts, new areas of concern and some strong hints from the government about where they think the profession needs to pay closer attention. In that sense, it is an important document, but most in-the-know compliance professionals are unlikely to be knocked off their chair by anything it contains. Below we summarise the key themes and changes in emphasis.
What is the risk assessment and why does it matter to law firms?
The risk assessment is the government’s own assessment of where the main risks of money laundering and terrorist financing lay across the country. While the regulators publish their own sector-specific updates (we await the SRA’s updated sectoral risk assessment), the Money Laundering Regulations say you must take the NRA into account in your own firm-wide risk assessment (FWRA). So make sure that you document somewhere that you have reviewed the updated government risk assessment, even if you don’t feel it changes anything for you in practice.
Key risk themes (mostly familiar, but with some updates)
The NRA confirms that most of the big risks law firms need to be aware of remain much the same in substance. If you’re already alive to cash-heavy businesses, crypto and complicated trusts, then you’re halfway there. But there are some shifts and a few interesting new examples that might prompt you to dust off and update your own paperwork.
Here’s a summary:
Cash-intensive businesses – still very high risk. Interestingly, the government singles out the Post Office cash banking facility as posing a particular risk of exploitation by organised crime groups (OCGs). They highlight a £27 million cross-border money laundering scheme using Post Office cash deposits and note that cash deposits at the Post Office continue to rise, despite a general move in society to use less cash. Not exactly the sort of PR the Post Office would be hoping for in 2025.
Money Service Providers – the risks here are not new, but they are mentioned regularly within the risk assessment, particularly in the context of overseas operations and currency transfers. Worth keeping on the radar, especially if your clients operate internationally.
Crypto-assets – a well-known risk factor now among lawyers, but it is worth noting that the trends seem to be changing somewhat. Bitcoin, for example, is apparently a little less popular with criminals these days, as it is felt to be too traceable. Instead, the risk assessment suggests that criminals are moving to less regulated exchanges and privacy-focused coins. Apparently, ‘stablecoins’ such as Tether are increasing in popularity.
Property and conveyancing – no surprises here. The NCA estimates that up to £10 billion a year may be laundered through UK property. The risks are well known, but the scale is still eye-opening. Conveyancers will continue to come under scrutiny from regulators in this area.
Companies and trusts – the government highlights “widespread abuse” of otherwise lawful structures within the risk assessment. There has been a tendency among regulators to tar all ‘trust and corporate service providers’ with one brush. However, clearly there is a big difference between the risks involved in incorporating a company for a local business and offering nominee and registered office services internationally. Thankfully, the government risk assessment does expressly focus on nominee directors, other nominee arrangements, shell companies, trusts and international structures used with the goal of hiding true ownership and control. This is a much more sensible targeting of the risk factors. Lawyers are often essential to setting up such vehicles and anyone with exposure to such work will need to remain highly vigilant.
Overseas trusts – trusts from the BVI, Gibraltar, Guernsey and Jersey are specifically mentioned in the risk assessment. Their appeal? Familiar legal systems, strong infrastructure, and favourable tax treatment. Does this sound like any of your clients? If so, pay close attention.
Client account – another familiar risk for law firms. Remember that out-of-scope work such as litigation can also give rise to such risks.
Terrorist financing – the risk to the legal sector is considered low overall, but it’s not zero. The document highlights Islamist and extreme right-wing threats in particular.
What’s changed?
Sanctions evasion – unsurprisingly, sanctions now feature much more heavily in the risk assessment. Post-Russia’s invasion of the Ukraine, the UK has ramped up sanctions enforcement and the government is now openly concerned about the use of UK legal structures and services to circumvent sanctions. That includes shell companies, client accounts and law firms. Most firms will have their own dedicated sanctions risk assessment by now, but don’t forget to consider sanctions risk in broader money laundering and financial crime terms too, on your firm and client or matter risk assessments.
Environmental crime – this topic received repeated mention for the first time. Environmental crime could include illegal waste disposal, wildlife trafficking and similar offences. These now feature as predicate crimes for money laundering. For solicitors advising on asset sales or property disposals, this is sensible to have on your radar. Relatively innocent oversights by builders or developers can actually constitute a criminal offence and therefore raise the question as to whether the property’s value now partly comprises the proceeds of that crime. It’s one to watch.
Artificial intelligence and identity fraud – synthetic IDs, bots and automated onboarding tools get a mention. The concern is that firms relying heavily on automation may miss risks a human would spot, and that AI could circumvent usual anti-money laundering checks and balances.
Football clubs and agents – a new sector under the spotlight. Opaque ownership, foreign money and unusual funding structures are all suggested as possible reasons as to why clients in this space could be considered higher risk. If you work in this area it is worth taking a good look at the report from paragraph 6.15.
Universities and education – another sector getting fresh attention. Risks flagged include foreign donations, links to sanctioned entities and opaque sources of research funding. One study found “six recent instances where a UK school or university had admitted the child of a West African PEP that had been convicted of corruption related crimes or had their assets seized. Other reporting showed that at least fourteen leading universities had accepted funding from Russian sources.” If you work in this area it is worth taking a good look at the report from paragraph 6.9.
Referrers and intermediaries – finally, the risk assessment raises concerns about lawyers acting for clients introduced by third parties, particularly overseas. If you don’t really know who the client is or why they’ve come to you, that’s a risk in itself. This is not a new risk really, but it receives greater prominence in the revamped risk assessment.
So, what do you need to do?
If your firm already has a compliant, up to date Firm Wide Risk Assessment that covers the known risks, this new publication is not a cause for panic. However, it would be prudent to:
- Review the key parts of the 2025 national risk assessment relevant to law firms, in particular pages 22-61, 118-121 and 139-143;
- Consider the extent to which you need to change your Firm Wide Risk Assessment as a result, if at all;
- Record that you’ve done this, even if you decide no changes are needed.
In terms of who will need to make changes to their Firm Wide Risk Assessment, pay close attention to the following areas and the extent to which your firm is exposed:
- Sanctions evasion;
- Crypto-currency exposure;
- Complex corporate or trust structuring;
- Football or agent clients;
- Education sector clients;
- Environmental crime touchpoints;
- Clients introduced via referrers or intermediaries.
You can find the full risk assessment on GOV.UK here.
It is not exactly light reading, but it is important that it forms part of your firm’s assessment of risk, so make sure to stay in the loop and update your FWRA to take account of this.
Any questions, don’t be afraid to reach out.