Compliance · 8 min read · Updated 25 October 2026

AI and AML Checks in Conveyancing: What Software Can Do and What a Person Must

Software can gather and compare evidence. The Regulations and the SRA leave liability, and the decision to report, with people.

By Appan Pathmanathan, Chief Operating Officer, Lex Sentinel

Software can collect, extract and compare the information for an anti-money laundering (AML) check, but a conveyancing firm stays liable for the result. The Money Laundering Regulations 2017 make the firm responsible for any failure to apply due diligence, and the Solicitors Regulation Authority (SRA) says that remains true when a third party provides the service. The duty to report suspicion rests on individuals, so a named person should own every risk rating and reporting decision.

I work at Lex Sentinel, which builds AI tools for conveyancers, and none of the analysis below relies on any product. This is general information for firms regulated by the SRA in England and Wales and is not legal advice. I update it when the SRA or the government publishes something relevant. Our guide to the firm-level AML framework covers the policies behind these checks, and our guide to what the SRA expects of firms that use AI covers the wider rules.

Which AML tasks can a firm give to software?

A firm can give software the mechanical work in each of the six AML tasks below, but a person must make the decision in every one. The right-hand column is my reading of the Regulations and the SRA's guidance. I found no source that says in terms that software cannot take a due diligence or reporting decision.

Task	What software can do	What a person must do
Identity verification	Read documents, run liveness checks, match against a source	Decide whether the evidence is sufficient and the source is reliable and independent
Sanctions and politically exposed person (PEP) screening	Screen names against lists and flag matches	Review each match, decide what it means, and escalate
Client and matter risk assessment	Pre-fill factors and suggest a score	Own the rating and override it where the facts need it
Source of funds and wealth	Extract figures from statements and flag mismatches with the ledger	Judge plausibility against what you know of the client
Suspicion and reporting	Highlight unusual patterns	Decide whether there are reasonable grounds to suspect, and report
Record keeping	Store documents and log what was checked	Make sure the file shows why a decision was reached

What do the Regulations say about electronic identity checks?

The Money Laundering Regulations 2017 allow electronic identity checks, within limits. Regulation 28(18) of the Regulations defines verification as using documents or information from a reliable source, and treats documents issued by an official body as independent. Regulation 28(19) adds that information obtained through an electronic identification process can qualify, where the process uses electronic identification means or a trust service as defined in the retained EU eIDAS Regulation and is secure from fraud and misuse and capable of providing assurance that the person claiming an identity is that person, to the extent appropriate to manage the risk.

Regulation 39(1) of the Regulations says a firm that relies on another party stays liable for any failure to apply the measures, and regulation 39(7) applies the same to agents and outsourcing. Regulation 19(4)(c) requires you to assess the money laundering risk of new technology in preparation for and during its adoption.

Does a digital identity provider need to be on the government register?

I found no legal requirement for a digital identity provider to be on the government register, but the government says firms should rely on registered services. Part 2 of the Data (Use and Access) Act 2025 requires a public register of digital verification service providers. HM Treasury and the Department for Science, Innovation and Technology published guidance on using digital identities with the Money Laundering Regulations on 26 February 2026. It says certified and registered services are reliable, that regulated firms remain ultimately liable, and that they should make their own assessment of a customer's risk.

The SRA's sectoral risk assessment, updated on 4 September 2026, says that, under the government guidance, services not on the register "cannot reliably be deemed suitable for identity verification in compliance with" the Regulations. The SRA's April 2026 statement on digital ID adds three points. Being "safe harbour compliant" for HM Land Registry does not mean a provider is on the register, and the two are separate. A digital verification service does not by itself cover the purpose and nature of the client relationship. Regulation 40 record-keeping still applies.

What does the SRA expect of client and matter risk assessments when a tool scores them?

The SRA expects a person to treat a tool's risk score as a starting point and not the finished assessment. Its guidance on client and matter risk assessments, updated on 19 June 2026, says the overall score should be seen as indicative rather than definitive and that it is good practice to allow for overriding a lower rating where necessary. It says PEPs and clients from high-risk third countries must be treated as high risk, and it ideally has the person handling the matter complete the assessment. It criticises basic forms with no space for rationale and a tick-box approach. Software and AI do not appear anywhere on the page.

What did the SRA find about technology in its 2025/26 AML report?

The SRA found that firms use technology widely for customer due diligence and do not always test its accuracy. In its 2025/26 report, published on 22 October 2026, the SRA says almost 93% of the firms it met used technology, including electronic ID verification, for customer due diligence, and that 48% of the firms it met said they often test the technology for accuracy. One firm's compliance officer found a provider had missed some PEPs. The report says electronic ID checks are not a substitute for a client and matter risk assessment, and that an electronic report is only as good as the understanding of the person reviewing it.

On files, the SRA reviewed 6,592 and found 336 (5%) with no evidence the client had been identified and verified. It also found no evidence of sanctions screening on 21% of files and of PEP screening on 20%. Separately, the SRA received 336 AML reports in the year, down from 426, and 30 of the reasons cited were a failure to identify or verify the client. The two 336 figures are coincidence.

What risks does AI add to remote onboarding?

The main risk AI adds to remote onboarding is impersonation. The SRA's sectoral risk assessment says AI-enabled impersonation, including deepfakes, may increase the risk of identity fraud, and that remote onboarding can increase exposure to it. It also lists over-reliance on automated screening tools as a vulnerability in sanctions compliance. A tool that passes a document check does not tell you whether the person on the video call is the person in the document, so a firm should decide in its policies what additional steps it takes for remote clients.

What can't be delegated at all?

A firm cannot delegate the decision to suspect money laundering or the decision to report it. Under section 330 of the Proceeds of Crime Act 2002, a person in the regulated sector commits an offence by failing to disclose where they have reasonable grounds for knowing or suspecting money laundering. Disclosure to the firm's nominated officer, usually the money laundering reporting officer (MLRO), satisfies that duty. Under section 331, the nominated officer commits an offence by not disclosing to the National Crime Agency as soon as practicable. Regulation 21(3) requires the nominated officer to be an individual. Tipping off is an offence under section 333A, so what an AI tool shows to a client, or a client-facing message it generates, needs the same care as anything a fee earner says.

A tool can raise a flag. Whether the flag amounts to suspicion is a judgment about a person and a transaction, and the statute puts it on individuals.

About the author

Appan Pathmanathan is a solicitor and Chief Operating Officer of Lex Sentinel, which builds AI tools for UK conveyancers. He has worked in UK legal practice since 2001, including litigation involving money laundering and fraud, and conveyancing, and has been managing partner of a law firm. He delivers AML and compliance training. Connect on LinkedIn.

Sources

Checked on 25 October 2026.

Frequently Asked Questions

Can AI carry out client identity verification for a conveyancing firm?

It can perform the checks, but the firm remains liable for the result of an AI identity check. The Regulations allow electronic identification processes that are secure from fraud and misuse, and the government's guidance says certified and registered services are reliable. A person still decides whether the evidence is sufficient.

Does a digital verification provider have to be on the government register?

I found no legal requirement to be registered. The SRA's risk assessment says that, under HM Treasury and DSIT guidance, services not on the register cannot reliably be deemed suitable for identity verification in compliance with the Regulations, so a firm that uses an unregistered service needs a strong reason and a documented assessment.

Can software give a conveyancing client a risk rating?

It can suggest one. The SRA says the overall score should be indicative rather than definitive and that it is good practice to allow it to be overridden. A named person should own the rating on each file.

Can an AI tool decide whether to make a suspicious activity report?

No. The offences in sections 330 and 331 of the Proceeds of Crime Act 2002 attach to individuals, and the nominated officer under regulation 21(3) must be an individual. A tool can flag a pattern for review.

Does using a digital ID provider remove the need for a risk assessment?

No. The SRA says a digital verification service does not cover the purpose and nature of the client relationship, and its 2025/26 report says electronic ID checks are not a substitute for a client and matter risk assessment.