The SRA published its AML Annual Report 2025-26 on 22/10/26, alongside its new guidance on AML policies, controls and procedures (PCPs), which we have covered here.
The report is long (and a little repetitive 🙄), so we’ve pulled out the points that matter most for firms subject to the Money Laundering Regulations 2017 (MLRs), plus a few relevant to all firms.
The headline: improving, but the basics are still being missed
The SRA’s largest ever proactive AML programme (966 compliance assessments and 6,592 files reviewed, up from last year’s figures of 864 and 5,873 respectively) shows “substantial progress”, with firms “increasingly embedding AML requirements into governance frameworks and day-to-day operations”.
- Non-compliant firms fell from 32.4% to 21.9%.
- Firm-wide risk assessment (FWRA) compliance rose from 47% to 60%.
- Policies, Controls & Procedures (PCPs) compliance rose from 38% to 54%.
- Files with missing or incomplete client and matter risk assessments (CMRAs) fell from 16% to 9%. But a completed CMRA isn’t necessarily an effective one: 36% of firms had ineffective CMRAs, only slightly down from 39% last year.
This is progress, but with more than 1 in 5 firms still non-compliant and the FCA waiting around the corner to take over AML supervision and enforcement, there’s clearly still work to do.
The SRA’s message is that the problem these days is rarely having no PCPs. It’s their quality and application in practice that matters, and that is where its focus has shifted. The new SRA guidance says the same.
Weaknesses in core AML controls are identified as the primary driver of enforcement activity, which is up: outcomes dealt with internally by the SRA (mainly regulatory settlement agreements, fines and letters of advice) rose from 137 to 256 this year. The most common reasons for referral for investigation are still the classics:
- missing CMRAs (42%)
- source of funds/wealth issues (29%)
- late implementation of FWRAs (24%)
- non-compliant PCPs (17%)
What to look for when reviewing your AML documents
FWRAs
- Make sure it’s up to date. The SRA expects a review every 1 to 2 years, and whenever your risk profile materially changes (new legislation or guidance, such as the SRA’s sectoral risk assessment, this report and the guidance referred to above, new services or practice areas, client base etc).
- Common failings:
- not assessing transaction risk (the nature and value of typical transactions).
- not describing services accurately (the SRA compares your FWRA with your website, so focus on the work you actually do, not what you don’t).
- ignoring delivery channels, geography and client types.
- not tailoring it to your firm’s business model, clients and activities across all areas of your business.
- not assessing proliferation financing risks. Despite it being a requirement since April 2023, 17% of firms hadn’t.
Client & Matter Risk Assessments
- The focus for CMRAs is now very much on whether they are effective, not just whether they are on the file. With the SRA finding that 36% of firms had ineffective CMRAs and the SRA disagreeing with the risk rating reached on 10% of files (i.e. they should have been higher!), this is an issue which needs addressing. Files with effective, well-reasoned CMRAs are significantly more likely to be compliant overall.
- A CMRA should explain the reasoning behind the rating and how the risk will be managed, and be consistent with your FWRA. If your FWRA says an activity or jurisdiction is high risk, a low rating without recorded reasons won’t go down well.
Client due diligence (CDD)
CDD needs a holistic approach: identifying and verifying clients and beneficial owners, understanding the purpose and nature of the matter, scrutinising transactions, including source of funds where necessary, and ongoing monitoring. The SRA found CDD compliance to be generally good, but there is still work to be done:
- 5% of files had no ID&V evidence, including where the fee earner knew the client personally. (The MLRs don’t allow CDD to be waived for long-standing or personal relationships.)
- For corporate clients, verify both the entity and its beneficial owners including against Companies House (or equivalent) data.
- Complete CDD at the start of the matter, and certainly before substantial work is done or funds received.
- Around 20% of files had no PEP and sanctions screening evidence. Where screening does take place, alerts must be investigated and the reasons for discounting a match recorded.
About 93% of firms use electronic ID verification. Know what your tools can and can’t do (nearly half of firms test theirs, for example by screening known PEPs). An e-check isn’t a substitute for a CMRA, and providers not on the DVS Register can’t reliably be treated as MLR-compliant.
Source of funds and wealth
This is one of the most effective AML controls available and yet the second most common reason for referral for investigation. Scrutiny is often a bigger problem than collection:
- Of 5,349 files needing source of funds/wealth checks, 9% had none, and 18% of those with evidence hadn’t scrutinised it. Knowing funds are available isn’t enough. You need to understand how they came to be in the account.
- 6% of files had source of funds information that didn’t match the client account ledger, which is a red flag. Work with your accounts team so all that careful scrutiny isn’t wasted when funds arrive from somewhere else.
- 67% of firms referred for source of funds issues had a defined process in their policy, showing again this disconnect between policy and practice.
- Scrutinise cash purchases, third-party funding, insufficient funds or profits in bank statements and company accounts, and unusual deposits. The higher the risk, the more comprehensive the evidence required.
Trust and company service providers (TCSPs)
9% of firms were providing TCSP services (company formation, nominee directors, company administration) without registering under Regulation 56. They were referred for investigation, so review your services regularly.
Policies, controls and procedures
This is covered in more detail in our thematic review article, but the headlines are:
- Of 937 PCPs reviewed, 3 firms had none, over 12% were non-compliant and only 54% were compliant. Lack of tailoring and PCPs not being applied in practice are the recurring problems.
- Update for the June 2026 MLR changes:
- Transactions requiring scrutiny are now “unusually complex or unusually large” (narrower than before). Define what that means for your firm, with tailored red flags for fee earners.
- Mandatory enhanced due diligence (EDD) for high-risk third countries now applies only to the FATF ‘black’ list countries (currently Iran, North Korea and Myanmar). However, the MLRs and SRA still expect you to consider wider geographic risk (including the FATF ‘grey’ list) and apply EDD as appropriate.
- Most commonly missed areas:
- risks from new products and technologies (including AI and digital onboarding, even if only to record that there are none).
- products or transactions favouring anonymity.
- reporting material beneficial ownership discrepancies to Companies House.
- your approach to simplified due diligence and to ‘reliance’.
- when CDD must be renewed (such as changes to ID information, gaps between instructions)
Monitoring, audits and culture
To close that gap between policy and practice, the report’s “Monitoring compliance” section is worth reading. It covers regular file reviews, use of file checklists as fee earner prompts, ongoing supervisor checks and independent audits to test what’s happening “on the ground”.
- 86% of inspected firms carried out internal file reviews, which is great, but they weren’t always effective. 36% didn’t check source of funds, and some ignored AML entirely, focusing instead on legal advice and conflicts. The SRA’s new template file review form is a useful resource.
- 63% of firms inspected onsite had an independent audit, but 18% of those weren’t fully Regulation 21 compliant, usually because file reviews weren’t used to assess how effective the policies were.
- Firms with compliant audits, strong compliance-led senior oversight and clear roles do better. Where the MLCO didn’t understand their role, firms were more likely to be referred for wider control failures.
Sanctions
The SRA will lose AML supervision to the FCA in due course but will keeps sanctions supervision, so get this right now, before the SRA sharpens its focus further 😉
- Firms can be used to facilitate sanctions evasion without knowingly acting for designated persons. Fewer than 1% of firms completing their annual data collection exercise had acted for one, but 15% had clients linked to sanctioned countries and 28% worked in higher-risk practice areas. Screening must cover everyone involved: beneficial owners, counterparties and the origin of funds. Sanctions liability is strict, so there’s no room to be lax. A documented risk assessment and policy (within your AML documents or separate) and staff training are expected.
- Of 12 dedicated sanctions inspections of firms that had acted for designated persons, compliance was high. Only 1 firm was referred for investigation, over licensing requirements. If you act under licences, have procedures to avoid missing reporting deadlines and licence conditions.
- Sanctions controls were also reviewed at 359 firms during AML inspections, again with good compliance. Keep up the good work 😊
Suspicious Activity Reports (SARs)
SAR quality is generally good, but narratives often failed to explain the suspected criminal property, the suspicion, or the firm’s next steps. Include all the identifying detail you have – poor SARs delay DAML (defence against money laundering) requests and make it harder to manage the client without tipping off. The SRA’s warning notice sets out its expectations in relation to SARs.
Emerging risks, areas of focus and the year ahead
As we saw in the SRA’s Sectoral Risk Assessment (which we wrote about here), keep an eye on:
- Conveyancing – still the highest-risk area.
- AI-enabled fraud (deepfakes, fake documents, synthetic identities) undermining remote onboarding and source of funds checks.
- ‘Passporting’ clients between offices or departments without checking the CDD still fits the new instruction.
- the accuracy and currency of company information, given Companies House’s recent/ ongoing purge of misleading entries.
- ‘Ghost’ directors and cash-intensive businesses used to obscure ownership.
- global instability increasing corruption, sanctions evasion (particularly in relation to Russia) and illicit movement of assets.
Next steps
If you do nothing else, check that:
- your FWRA, PCPs and CMRAs are tailored, current and consistent with each other. If you spot weaknesses, act before the regulator comes knocking.
- CDD, PEP and sanctions screening is evidenced on files, and your CMRAs are meaningful, accurate and reflect the matter’s actual risks.
- source of funds is genuinely scrutinised (don’t just collect bank statements!).
- your file reviews and independent audits test practice, not just paperwork.
If you need help, we’re here, whether it’s reviewing your PCPs, an independent AML audit or training, do get in touch.