Compliance · 11 min read · Updated 24 October 2026

AML Compliance for Conveyancers: What the SRA Expects of Your Firm

The nine parts of a firm's AML framework, where size and nature matter, and what the SRA found across 931 firm-wide risk assessments.

By Appan Pathmanathan, Chief Operating Officer, Lex Sentinel

The Money Laundering Regulations 2017 require a conveyancing firm regulated by the Solicitors Regulation Authority (SRA) to have a written firm-wide risk assessment, policies and procedures approved by senior management, a nominated officer, regular staff training, and records kept for five years. The compliance officer, staff screening and independent audit apply where appropriate to the firm's size and nature. In the SRA's 2025/26 report, 60% of the 931 firm-wide risk assessments it assessed were compliant and 7% were not.

Lex Sentinel, where I work, sells AML software, so I have a stake in this subject, though nothing below depends on a product. This is general information for SRA-regulated firms in England and Wales, not legal advice, and I'll recheck the figures if the SRA republishes them. The article covers the firm-level framework only. For the checks on an individual purchase, read our guide to source of wealth checks.

What must a conveyancing firm's AML framework contain?

A conveyancing firm's AML framework has nine parts: a firm-wide risk assessment, a proliferation financing assessment, policies and controls, a compliance officer, a nominated officer, staff screening, an independent audit, training and records. They sit in different parts of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, which I'll call the Regulations. The Regulations apply to independent legal professionals as defined in regulation 12, which includes taking part in transactions for the buying and selling of real property.

Requirement	What the Regulations say	Where
Firm-wide risk assessment	Take appropriate steps, reflecting the size and nature of the business, to identify and assess your money laundering and terrorist financing risks across customers, geography, products and services, transactions and delivery channels. Keep an up-to-date written record, unless your supervisor has confirmed in writing that none is needed, and give the assessment to your supervisor on request	Regulation 18
Proliferation financing assessment	A separate duty to assess proliferation financing risk. The SRA says this can be a standalone document or part of the firm-wide assessment	Regulation 18A
Policies, controls and procedures	Set up, review and update them, keep written records, make them proportionate to your size and nature, and have senior management approve them. They must cover risk management, internal controls, due diligence, reliance, record keeping and monitoring	Regulation 19
Compliance officer	Where appropriate to your size and nature, appoint a board-level or senior officer responsible for compliance, and tell your supervisor within 14 days of the appointment or any change	Regulation 21(1)(a) and (4)
Nominated officer	Appoint a nominated officer to consider internal reports, and tell your supervisor within 14 days of the appointment or any change. An individual who neither employs anyone nor acts in association with anyone else is exempt	Regulation 21(3), (4) and (5)
Staff screening	Where appropriate to your size and nature, screen relevant staff for skills, knowledge, expertise, conduct and integrity before and during employment	Regulation 21(1)(b) and (2)
Independent audit	Where appropriate to your size and nature, set up an independent audit function that assesses your policies, makes recommendations and monitors whether they are followed	Regulation 21(1)(c)
Training	Make relevant staff aware of the law, including data protection, train them regularly to recognise suspicious activity, and keep a written record, scaled to your business and risks	Regulation 24
Records	Keep customer due diligence and transaction records for five years by default, counted from the end of the business relationship or, for an occasional transaction, from completion. Transaction records within a business relationship need not be kept for more than ten years, and personal data must be deleted when the period ends unless an exception applies	Regulation 40

Separately, anyone who owns, officers or manages the firm needs the SRA's approval under regulation 26. The SRA calls them beneficial owners, officers and managers (BOOMs), and its 2025/26 report counts 22,338 of them.

Does every firm need an MLCO, an MLRO and an independent audit?

A firm needs a nominated officer, the money laundering reporting officer (MLRO), unless it is a sole individual who neither employs anyone nor acts in association with anyone else. The compliance officer (MLCO), staff screening and independent audit apply only where appropriate to its size and nature. Within regulation 21 only paragraph (1) carries the size-and-nature qualifier, so the nominated officer in 21(3) is not qualified in that way. Regulations 18, 19 and 24 have proportionality wording of their own, and regulation 21(10) says you must take your risk assessments into account when deciding what is appropriate.

Most firms, around 90%, have one person hold both the MLCO and MLRO roles, according to the SRA's guidance for new compliance officers (published December 2021, last modified October 2023). The MLCO must be on the board, the equivalent body or in senior management, and partners, directors and LLP members count as equivalent to board members.

Both roles are BOOM positions, so the SRA must approve the person under regulation 26. Its authorisation page says the individual must not take up the role until approved, that it aims to decide within 30 days (longer if it needs more information), and that the basic Disclosure and Barring Service (DBS) check must be no more than three months old when you apply. Regulation 21(4) separately requires you to notify the SRA within 14 days of the appointment.

On the audit, the SRA's questions and answers page, updated on 28 January 2026, says "independent" doesn't have to mean external, and that an employee who wasn't involved in creating or applying your policies can do it. The page describes no small-firm exemption, and "nature" is judged by the type of work, the share of in-scope work and the results of your firm-wide risk assessment. A firm that decides the audit doesn't apply should record its reasoning and keep reviewing its policies. An annual audit may be appropriate, depending on previous results and any changes. The guidance for new compliance officers adds that the MLCO and MLRO shouldn't carry out the audit themselves.

How is a firm-wide risk assessment different from a client and matter risk assessment?

The firm-wide assessment looks at your firm's overall exposure. A client and matter risk assessment looks at one client and one transaction, and drives the level of due diligence and monitoring on that file. The SRA expects the two to line up, so the themes in the firm-wide document show up in the file-level ones.

The SRA's guidance on firm-wide risk assessments, updated on 19 June 2026, says the assessment should consider the SRA's sectoral risk assessment and the risk factors in regulation 18. It should be reviewed regularly and approved by senior management. A template is allowed if you tailor it, but the SRA warns against copied specimen text and says you can't hand your responsibility to a consultant. In a review of 73 assessments in 2021/22, almost a third used templated text that hadn't been tailored, and 10% didn't properly consider how services are delivered.

What did the SRA find in its 2025/26 AML review?

The SRA called in 937 firm-wide risk assessments for its 2025/26 review. Six firms had none and were referred for investigation. Of the 931 it assessed, 560 (60%, up from 47%) were compliant, 304 were partially compliant and 67 (7%, down from 9%) were not. It also found that 9% of the files it reviewed lacked a client and matter risk assessment or had an incomplete one, down from 16%.

The most common reasons for the 336 AML reports the SRA received in 2025/26 are in the table below. A report can cite more than one reason, so the counts don't add up to 336. The report contains some obvious typographical errors in its tables, so check any figure against the page before you quote it.

Reason cited	Number of reports
Failure to carry out a client or matter risk assessment	115
Failure to carry out a source of funds check	111
Inadequate policies, controls and procedures (regulation 19)	83
Inadequate firm-wide risk assessment (regulation 18)	76
No firm-wide risk assessment	39
Failure to identify or verify the client	30

The figures understate the practical problem. A firm can have a compliant policy and still fail, because the policy was written once and filed, and nothing connects it to the work a fee earner does on a Tuesday afternoon. The test I'd apply is whether a new joiner could follow the policy to a decision on a real file. If they couldn't, it was written for the supervisor.

What changed in the Money Laundering Regulations in 2026?

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 came into force in most respects on 30 June 2026. Two changes bear on the framework above. Regulations 19(4)(a) and 33(1)(f) now refer to transactions that are "unusually complex or unusually large", and "Financial Action Task Force (FATF) call for action country" replaces "high-risk third country" in regulations 33(1)(b) and 39(4), so check your procedures use the current terms. The SRA's own guidance pages may still quote the older wording, so read the legislation. The instrument also changes other provisions, including the definition of a trust or company service provider, so ask whether your firm's services are affected. A new regulation 34A on cryptoasset firms and correspondent relationships isn't yet in force. It is due on 1 February 2027.

The SRA's supervision of conveyancers isn't changing yet. The government has announced that the Financial Conduct Authority (FCA) will supervise AML for legal services, but the FCA's page says "Nothing changes immediately", that the necessary legislation is still going through Parliament, and that it doesn't expect to start taking on supervision until autumn 2028, with the remaining professional body supervisors moving by around 2030. The page doesn't say when the SRA's firms will move. For now the SRA remains your supervisor.

Where do AI tools fit in an AML framework?

AI tools fall within your existing AML framework, under regulation 19(4)(c), which requires a firm adopting new technology to take appropriate measures, in preparation for and during adoption, to assess and where necessary mitigate any money laundering risk the technology creates. Firms most often leave this one incomplete. In the SRA's guidance on policies, controls and procedures, published on 22 October 2026, 40% of the 934 policies it reviewed in 2025/26 were missing or incomplete on the new-technology assessment, more than for any other requirement in its table.

The SRA's sectoral risk assessment warns that new technologies may not yet be fully understood or embedded in a firm's risk framework, and it lists over-reliance on automated screening as a common sanctions vulnerability. If you rely on a third party for due diligence, regulation 39(1) leaves you liable for any failure to apply the measures. Name each tool in your firm-wide risk assessment and policies, say what it is used for and who reviews its output, and note how you test it. A person should own the risk rating on each file.

About the author

Appan Pathmanathan is a solicitor and Chief Operating Officer of Lex Sentinel, which builds AI tools for UK conveyancers. He has worked in UK legal practice since 2001, including litigation involving money laundering and fraud, and conveyancing, and has been managing partner of a law firm. He delivers AML and compliance training. Connect on LinkedIn.

Sources

Checked on 24 October 2026.

Frequently Asked Questions

Does a conveyancing firm need an MLRO (money laundering reporting officer)?

Yes, unless it is a sole individual who neither employs anyone nor acts in association with anyone else. Regulation 21(3) requires a nominated officer, which is the MLRO role, and regulation 21(4) requires you to tell your supervisor within 14 days. The SRA must also approve the person under regulation 26 before they take up the role.

Can one person be both MLCO and MLRO?

Yes. The SRA's guidance for new compliance officers says most firms, around 90%, have one person hold both roles. The MLCO must be on the board or equivalent body or in senior management.

Do small firms need an independent AML audit?

Possibly, depending on the firm's size and nature, and the SRA's questions and answers page describes no small-firm exemption. Regulation 21(1)(c) requires an independent audit function where that is appropriate. A firm that decides the audit doesn't apply should record its reasoning. The audit can be done by an employee who wasn't involved in creating or applying the policies, and the MLCO and MLRO shouldn't do it.

How often should AML training happen?

Annually, according to the Legal Sector Affinity Group (LSAG) guidance as reported in the SRA's training review, and regulation 24 requires regular training and a written record. The SRA itself says training should start as soon as possible after someone joins and should cover contractors and temporary staff. Asking staff only to read the firm's AML policy doesn't meet the requirement.

Is a template firm-wide risk assessment acceptable?

Only if you tailor it. The SRA's guidance allows templates but warns against copied specimen text, and in a 2021/22 review almost a third of the assessments it examined used templated text that hadn't been tailored.