SRA AML Annual Report 2025–26: Key Findings, Enforcement Trends and Compliance Priorities for Law Firms

Introduction

The Solicitors Regulation Authority’s (SRA) Anti-Money Laundering Annual Report 2025–26, published on 22 October 2026, highlights a significant development in UK anti-money laundering (AML) supervision: compliance is improving, but weaknesses in the practical implementation of controls continue to expose law firms to regulatory and financial crime risks.

Covering the period from 6 April 2025 to 5 April 2026, the report documents the SRA’s largest-ever programme of proactive AML supervision. The regulator completed 966 AML compliance assessments, while the proportion of firms assessed as non-compliant fell from 32.4% to 21.9%. However, recurring failures involving client and matter risk assessments, source of funds checks, firm-wide risk assessments and policies, controls and procedures (PCPs) remain central to enforcement activity.

The report also identifies growing concerns around sanctions compliance, third-party funding, transaction monitoring at matter level, senior management oversight and the use of technology in customer due diligence (CDD).

For AML compliance leaders, the message is clear: having an AML policy is not enough. Firms must demonstrate that their controls work in practice, that risk decisions are documented and that suspicious activity is identified before a transaction progresses.

This article examines the report’s principal findings, enforcement trends and emerging risks, and translates them into practical priorities for AML compliance professionals.

Key findings from the SRA AML Annual Report 2025–26

The report presents a mixed picture of progress and persistent control weaknesses across the legal sector.

Source: SRA, Anti-Money Laundering Annual Report 2025–26. Figures relate to the reporting period unless otherwise indicated.

These indicators should be interpreted together. Falling non-compliance rates suggest progress in the effectiveness of AML controls, while the increase in concluded enforcement outcomes reflects the scale of supervisory activity and investigations reaching completion. The report explicitly cautions against treating higher enforcement numbers as proof that overall compliance has deteriorated.

1. AML supervision is intensifying despite improving compliance

The SRA continued to expand its supervisory activity during 2025–26, increasing the number of AML compliance assessments from 864 to 966. It conducted 985 proactive AML engagements, compared with 935 in the previous reporting year.

The programme included onsite inspections, desk-based reviews, thematic work and reviews of independent audits. The SRA reviewed 6,592 client files, up from 5,873 in 2024–25.

The report also records a substantial improvement in the proportion of firms assessed as non-compliant.

The SRA reported that 78% of firms assessed through inspections and desk-based reviews were either compliant or partially compliant.

This improvement indicates that regulatory engagement, guidance and remediation can help firms strengthen their AML frameworks. Nevertheless, the number of assessments and files reviewed demonstrates the scale of supervisory scrutiny firms may face.

What this means for AML compliance leaders

Compliance teams should prepare for supervision by maintaining an auditable record of how their AML framework operates across individual matters.

Priority actions include:

• Maintaining current firm-wide risk assessments (FWRAs).

• Ensuring client and matter risk assessments (CMRAs) are completed and retained.

• Reviewing whether AML policies reflect the firm’s actual services, clients and geographic exposure.

• Documenting remedial actions and validating their effectiveness.

• Ensuring fee earners can explain and follow the firm’s AML procedures.

A written policy is only one component of an effective control framework. Supervisory reviews increasingly test whether those documented requirements translate into consistent decisions and actions.

2. Source of funds and source of wealth checks remain major AML weaknesses

Source of funds (SoF) and source of wealth (SoW) verification is one of the report’s most important themes.

The SRA’s findings show that the central challenge is not always obtaining documents. It is determining whether those documents adequately explain the origin, legitimacy and plausibility of the funds involved.

Of the 6,592 files reviewed, 5,349 required source of funds or source of wealth checks. The SRA identified several weaknesses in how firms carried out these checks.

Key findings on source of funds

• 9% of files requiring checks contained no source of funds checks, despite the requirement.

• In 18% of files examined for scrutiny, the SRA found that collected documents had not been adequately scrutinised.

• Source of funds or source of wealth concerns accounted for 29% of referrals to the SRA’s investigations team arising from proactive supervisory work.

• In 6% of files reviewed, information gathered during source of funds checks did not match the information recorded in the transaction ledger.

• The SRA provided feedback on source of funds and source of wealth to 52% of firms that received an onsite inspection or desk-based review.

The report also found that some firms had documented source of funds procedures but failed to apply them at matter level. Among firms referred for source of funds issues identified in files, 67% had a defined process in their policy.

This points to a gap between documented controls and operational execution.

Why collecting documents is not enough

A bank statement may establish that funds are available, but it does not necessarily explain how those funds accumulated. Similarly, company accounts may be insufficient where the company’s reported profits do not plausibly support the proposed transaction.

The SRA identified concerns involving:

• Cash purchases without appropriate source of funds evidence.

• Third-party funding without sufficient supporting information.

• Large or unusual bank deposits that were not investigated.

• Evidence that did not demonstrate the client had sufficient funds to complete a transaction.

• Discrepancies between source of funds information and ledger entries.

These findings are particularly relevant to residential conveyancing, where large transactions, client account movements and complex ownership structures can create opportunities to conceal illicit proceeds.

How firms should strengthen SoF and SoW controls

AML teams should adopt a risk-based verification process that moves beyond document collection.

1. Establish the stated origin of funds. Determine whether the funds come from savings, employment income, business profits, asset sales, loans, gifts or another source.

2. Obtain proportionate supporting evidence. The type and depth of evidence should reflect the risk presented by the client and matter.

3. Assess plausibility. Consider whether the evidence is consistent with the client’s known circumstances, financial profile and the value of the transaction.

4. Investigate discrepancies. Unexplained deposits, third-party payments and changes to funding arrangements should trigger further enquiries.

5. Document the reasoning. Record what was reviewed, what concerns were identified, how they were resolved and why the evidence was considered sufficient.

6. Escalate unresolved concerns. Apply the firm’s escalation and suspicious activity reporting procedures where appropriate.

The key distinction is between evidence received and risk understood. Effective source of funds checks require both.

3. Weak risk assessments and AML policies continue to drive enforcement

The SRA identifies failures involving FWRAs, CMRAs and PCPs as recurring causes of regulatory concern.

The report’s data on money laundering-related reports received during 2025–26 reinforces this finding.

Note: Reports may involve more than one suspected breach. These figures are report categories, not necessarily unique firms or confirmed violations.

Firm-wide risk assessments must reflect actual exposure

A FWRA should identify and assess the money laundering and terrorist financing risks associated with a firm’s business. This includes considering its services, clients, geographic exposure, delivery channels and transaction characteristics.

A generic or outdated assessment may fail to capture the risks associated with particular legal services, such as residential conveyancing or trust and company services.

Client and matter risk assessments must be documented

The report highlights failures to assess risk when instructions are accepted and throughout the transaction.

A CMRA should explain why a matter presents a particular level of risk and how that assessment determines the appropriate due diligence, monitoring and escalation measures.

Where risk changes during a matter, firms should reassess it rather than rely on the initial assessment indefinitely.

AML policies must be tailored and implemented

The SRA continues to encounter off-the-shelf AML policies that have not been adapted to the firm or are not followed by fee earners.

For example, a policy may require source of funds and source of wealth checks for residential conveyancing, yet the corresponding client files may contain no evidence that these checks were completed.

Compliance leaders should therefore evaluate both the design of controls and their implementation.

Practical implication: Review a sample of completed and ongoing matters against the firm’s own AML policy. Compare what the policy requires with what the file demonstrates. Investigate recurring gaps, assign remediation owners and verify that corrective action has worked.

4. Enforcement outcomes are rising, but the trend requires context

The SRA recorded 256 matters resulting in internal outcomes during 2025–26, compared with 137 in 2024–25.

The report attributes this increase partly to the larger volume of supervisory work undertaken in recent years and investigations reaching their conclusion. Enforcement outcomes may relate to conduct that occurred in earlier reporting periods.

Enforcement outcomes during 2025–26

The 145 Regulatory Settlement Agreements totalled £2,003,759. The 14 fines imposed by SRA adjudicators totalled £363,726.

Separately, eight outcomes were recorded at the Solicitors Disciplinary Tribunal (SDT): six fines, one suspension and one strike-off. SDT fines totalled £228,000.

These figures demonstrate the potential consequences of AML control failures, including financial penalties and professional disciplinary action in serious cases.

What drives enforcement?

The report identifies several recurring contributors:

• Weak or poorly documented risk assessments.

• Failure to verify clients or conduct appropriate due diligence.

• Inadequate source of funds enquiries.

• Failure to refresh AML policies and controls.

• Insufficient senior management oversight.

• Inadequate training of fee earners.

• Failure to prevent transactions from progressing when mandatory CDD has not been completed.

The SRA also highlights systemic or long-standing failures as relevant to enforcement decisions.

For compliance leaders, the lesson is that isolated policy updates are unlikely to resolve problems rooted in governance, staff behaviour or transaction workflows. Sustainable remediation requires addressing the underlying cause of control failure.

5. Sanctions compliance is an increasingly important supervisory priority

The report identifies sanctions compliance as a significant area of focus, even though fewer than 1% of firms reported acting for a designated person during the preceding 12 months.

Sanctions exposure can arise through clients with links to sanctioned countries, beneficial owners, counterparties, funding arrangements and transactions involving restricted assets or activities.

The SRA reports that cases involving failures to comply with sanctions regimes tripled during the reporting period. It notes that many of these matters involved human or administrative errors rather than deliberate misconduct.

What did the SRA find?

Its annual data collection exercise found that:

• 88% of firms had assessed their sanctions exposure in writing.

• 15% reported clients with links to sanctioned countries.

• 28% undertook work in practice areas carrying elevated sanctions risks.

• 86% screened new clients against UK sanctions lists.

• Fewer than 1% reported acting for a designated person.

• Fewer than 1% held frozen assets belonging to a designated person.

The SRA’s inspections also identified progress in sanctions screening and written risk assessments.

These figures demonstrate why sanctions controls cannot be limited to occasional checks on a narrow group of clients. Risk may arise through ownership, control, counterparties and changes in designation status.

Recommended sanctions compliance measures

AML and sanctions teams should:

1. Document the firm’s exposure to sanctions risk.

2. Screen clients and relevant parties against applicable sanctions lists.

3. Assess beneficial ownership and control where relevant.

4. Review changes in sanctions designations and applicable legal requirements.

5. Maintain clear procedures for potential matches, escalation and reporting.

6. Ensure staff understand the controls and the requirements governing sanctions licences.

7. Test screening systems and investigate missed matches or inconsistent results.

The report’s findings support a risk-based, firm-wide approach to sanctions compliance rather than treating sanctions screening as an isolated onboarding task.

6. Client due diligence must remain effective when technology is used

The SRA’s report also highlights the importance of understanding the limitations of digital identity verification and other technology used in CDD.

Technology can support identity checks, screening and risk assessment, but it does not remove the need for professional judgement.

The SRA warns firms to remain alert to emerging fraud and identity-verification risks, including AI-generated or synthetic identity information. It also emphasises that an electronic report is only as useful as the understanding of the person reviewing it.

The report notes that electronic identity verification and address verification (eIDVA) checks are not a substitute for a CMRA.

What should compliance teams consider?

Technology governance should address three questions:

Is the tool suitable? Firms should understand whether the provider and verification method meet applicable regulatory requirements. The report references joint HM Treasury and Department for Science, Innovation and Technology guidance published on 26 February 2026 concerning digital identity in CDD.

Can the results be trusted? Firms should test whether screening and verification systems identify relevant cases, including known PEPs and sanctioned individuals. The SRA describes examples where firms tested their providers and investigated discrepancies.

Does a human reviewer understand the result? Automated outputs should be interpreted in context. An identity match, screening report or verification result does not by itself establish that the overall client or matter risk has been adequately assessed.

For compliance leaders, technology assurance should be part of the wider AML control framework, supported by testing, escalation procedures and documented accountability.

7. Monitoring and independent audits must test controls in practice

The report emphasises that firms need effective processes for monitoring whether their AML PCPs are followed consistently.

Among firms inspected, 86% were carrying out internal file reviews. However, 36% of these firms did not consider source of funds as part of their file review process, focusing instead on whether CDD had been completed.

The SRA considers such reviews less effective because they may fail to identify substantive AML risks.

The report also found that 63% of firms inspected had carried out an independent audit. Of those audits, 18% were not fully compliant with Regulation 21 requirements. A recurring weakness was reviewing AML policies without testing a sample of client files to determine whether the policies were being implemented.

What an effective AML assurance programme should include

An effective programme should test both control design and operating effectiveness.

• File reviews: Test CDD, CMRAs, source of funds and wealth, ongoing monitoring, sanctions screening and escalation records.

• Pre-transaction controls: Confirm that mandatory due diligence is completed before a matter reaches the relevant stage.

• Management reporting: Report material control weaknesses, overdue remediation and recurring exceptions to senior management.

• Independent audits: Where required by the size and nature of the business, assess both AML procedures and a sample of client files.

• Remediation validation: Retest the controls after corrective action to confirm that the weakness has been resolved.

• Training feedback: Use audit findings and file review results to identify staff training needs.

Independent audits should not be treated as a documentation exercise. Their value lies in determining whether AML controls are adequate, effective and consistently applied.

8. Residential conveyancing remains a high-risk area

The SRA continues to identify conveyancing, particularly residential property transactions, as an area of greatest AML risk.

The report explains that property transactions can involve large sums, movement of funds through client accounts, complex ownership structures and pressure to complete transactions quickly.

The SRA submitted 24 SARs to the National Crime Agency (NCA) during 2025–26. The transactions and funds associated with these reports had a combined value exceeding £102 million. The report states that 50% of the 24 SARs were linked to residential property transactions.

This reinforces the importance of identifying suspicious funding arrangements before completion.

Property transaction red flags

The SRA identifies recurring indicators including:

• Unexplained or inconsistent source of funds.

• Third-party funding without a clear rationale.

• Unexpected changes to transaction funding.

• Large or unusual cash deposits in bank statements.

• Use of client accounts without an underlying legal purpose.

• Circular or unexplained transactions.

• Potential vendor fraud.

• Connections to higher-risk countries or organised crime groups.

These indicators should prompt further enquiries and a risk-based response. They do not, individually, establish that money laundering has occurred.

Strengthening conveyancing controls

Firms should ensure that funding arrangements are understood, beneficial ownership is appropriately assessed and evidence is consistent with the transaction. They should also establish clear escalation procedures when new parties, unusual payments or changes in funding emerge during a matter.

Importantly, time pressure should not override mandatory AML controls. Where required checks remain incomplete, firms should have procedures preventing the matter from progressing until the issue has been appropriately addressed.

9. Suspicious Activity Reports: what the SRA’s findings reveal

Suspicious Activity Reports are an important mechanism for providing intelligence to law enforcement.

During 2025–26, the SRA submitted 24 SARs to the NCA concerning suspected money laundering and terrorist financing. The reported matters involved transactions and funds worth more than £102 million.

The report identifies recurring indicators from these disclosures:

• Misuse of client accounts without an underlying legal purpose.

• Property transactions with source of funds concerns.

• Suspected third-party involvement in instructions or funding.

• AML checks that failed or were ignored.

• Fraudulent property transactions.

• Circular and unexplained transactions.

• Exposure to organised crime groups.

• Individuals or entities linked to higher-risk countries.

• Suspected illicit money flows through solicitors’ office accounts.

The SRA also made one report to the Office of Financial Sanctions Implementation (OFSI) concerning a suspected sanctions breach involving a firm acting for a designated person without the required licence.

Implications for MLROs and compliance teams

The findings underline the importance of connecting suspicious activity identification with the firm’s wider AML controls.

MLROs should ensure that staff know how to recognise and escalate concerns, that relevant information is preserved, and that internal reporting procedures are clear. They should also ensure that external reporting obligations are considered in accordance with applicable law.

SAR reporting should not be viewed as a substitute for effective prevention. Strong CDD, risk assessment and source of funds controls can help identify concerns before a transaction is completed.

10. Senior management oversight is essential to effective AML compliance

The SRA identifies insufficient senior management oversight as one of the factors contributing to AML breaches.

Other recurring themes include failure to refresh AML controls, inadequate training of fee earners, poor recordkeeping and insufficient supervision of senior team members.

The report also highlights the absence of effective transaction controls that would prevent a matter from progressing when CDD has not been completed.

These issues point to a governance problem as much as a procedural one.

Building stronger AML governance

Senior management should receive meaningful information about the effectiveness of AML controls, not merely confirmation that policies and training exist.

A practical governance framework should include:

• Defined ownership of AML risks and controls.

• Regular review of the FWRA and material changes in business exposure.

• Management information on overdue CDD, unresolved alerts and file review exceptions.

• Reporting of sanctions screening failures and source of funds weaknesses.

• Clear escalation routes for high-risk matters.

• Documented remediation plans with accountable owners and deadlines.

• Periodic assurance that corrective actions have been implemented effectively.

The objective is to embed AML compliance into ordinary business decisions rather than treating it as a separate administrative function.

11. Practical AML compliance checklist for law firms

The SRA report provides a useful basis for reviewing an AML control framework. Compliance leaders can use the following checklist to identify areas requiring attention.

Risk assessments and policies

• Is the FWRA current and tailored to the firm’s services, clients and geographic exposure?
• Are CMRAs completed and documented for relevant matters?
• Are risk assessments reviewed when circumstances change?
• Are AML PCPs tailored to the firm and consistent with applicable requirements?

Customer due diligence

• Are clients and relevant beneficial owners identified and verified?
• Are PEP and sanctions risks assessed appropriately?
• Are CDD renewal triggers documented and applied?
• Are digital verification tools suitable, tested and understood by reviewers?

Source of funds and wealth

• Is the source of funds established and supported by appropriate evidence?
• Is the legitimacy and plausibility of the funds critically assessed?
• Are third-party payments and unexpected funding changes investigated?
• Are discrepancies between evidence and transaction records resolved and documented?

Monitoring, training and assurance

• Do transaction workflows prevent progression when mandatory checks remain incomplete?
• Do internal file reviews test substantive AML controls, including source of funds?
• Are staff trained on the risks associated with their roles?
• Are independent audits conducted where required and do they test client files?
• Are findings reported to senior management and remediation independently validated?

Sanctions and suspicious activity reporting

• Is the firm’s sanctions exposure assessed and documented?
• Are screening arrangements tested for accuracy and effectiveness?
• Are potential sanctions matches escalated appropriately?
• Do staff understand internal suspicious activity reporting procedures?
• Are applicable reporting and recordkeeping obligations met?

This checklist is a practical starting point, not a substitute for assessing the firm’s specific obligations under the Money Laundering Regulations 2017 and other applicable legislation.

12. What AML compliance leaders should prioritise next

The report suggests that firms should focus on the effectiveness of controls rather than the existence of documentation alone.

A risk-based improvement programme can be organised into three stages.

Immediate priorities: identify critical gaps

Review high-risk matters, particularly residential conveyancing, and test whether source of funds checks, CMRAs and mandatory CDD are completed and documented. Identify any processes that allow transactions to proceed despite incomplete checks.

Medium-term priorities: strengthen control execution

Update firm-specific AML procedures, improve staff training and introduce targeted quality assurance. Use file review findings to identify recurring weaknesses, especially discrepancies between documented procedures and actual practice.

Ongoing priorities: demonstrate effectiveness

Establish management reporting, monitor remediation and conduct periodic assurance reviews. Test whether screening systems and transaction controls operate as intended and whether staff respond appropriately to exceptions.

For senior leaders, the central objective should be to demonstrate that the firm understands its risks, applies proportionate controls and can evidence the effectiveness of those controls.

Conclusion

The SRA’s Anti-Money Laundering Annual Report 2025–26 shows that AML compliance across the legal sector is improving, but persistent weaknesses continue to create exposure to money laundering, sanctions breaches and regulatory enforcement.

The reduction in non-compliance from 32.4% to 21.9% is encouraging. However, failures involving source of funds checks, risk assessments, AML policies, staff training and senior management oversight remain significant.

The report’s most important lesson for AML compliance leaders is that effective compliance depends on the quality of decisions and actions taken at matter level. Evidence must be scrutinised, risk assessments must reflect the transaction, and systems must prevent required checks from being bypassed.

As financial crime methods and sanctions risks evolve, firms need an AML framework that combines risk-based due diligence, effective technology, meaningful management oversight and continuous assurance.

For law firms and other regulated businesses, the priority is not simply to demonstrate that AML controls exist. It is to demonstrate that they work.

Frequently asked questions

What is the SRA AML Annual Report 2025–26?

The SRA AML Annual Report 2025–26 is the Solicitors Regulation Authority’s report on its AML supervision and enforcement activity during the financial year from 6 April 2025 to 5 April 2026. Published on 22 October 2026, it covers supervisory assessments, compliance findings, enforcement outcomes, suspicious activity reporting, sanctions controls and emerging risks.

What were the main findings of the SRA AML report?

The report found that the proportion of firms assessed as non-compliant fell from 32.4% to 21.9%. At the same time, weaknesses remained in source of funds checks, client and matter risk assessments, firm-wide risk assessments, AML policies and ongoing monitoring.

Why are source of funds checks important for AML compliance?

Source of funds checks help firms establish where the money used in a transaction originated and whether its origin is legitimate. The SRA found that some firms collected documents without adequately scrutinising them, particularly in higher-risk matters and transactions involving third-party funding.

How many AML compliance assessments did the SRA complete in 2025–26?

The SRA completed 966 AML compliance assessments during 2025–26, compared with 864 in the previous reporting year. It also carried out 985 proactive AML engagements.

What were the main reasons for AML enforcement action?

The most common reported issues included failures to perform client or matter risk assessments, source of funds checks, adequate PCPs and firm-wide risk assessments. Other concerns included failures to identify and verify clients, complete CDD and comply with sanctions requirements.

What does the report say about sanctions compliance?

The report identifies sanctions compliance as an increasingly important supervisory priority. Cases involving failures to comply with sanctions regimes tripled during the reporting period, and the SRA emphasised the need for written risk assessments, screening, staff training and effective oversight.

What should AML compliance officers do after reading the report?

AML compliance officers should review the firm’s FWRA, CMRAs, source of funds procedures, sanctions controls, transaction safeguards and internal file review programme. They should prioritise evidence of effective implementation, address recurring weaknesses and report material findings to senior management.

Does the report apply to all UK financial institutions?

No. The report primarily concerns the SRA’s supervision of solicitors and law firms in England and Wales under the Money Laundering Regulations 2017. Its findings may offer useful lessons for other regulated businesses, but the legal obligations applicable to those businesses must be assessed separately.

Source

Solicitors Regulation Authority (SRA), Anti-Money Laundering Annual Report 2025–26, published 22 October 2026. The report covers supervisory activity from 6 April 2025 to 5 April 2026.

Official source: Solicitors Regulation Authority

This article summarises regulatory findings and practical compliance considerations. It is intended for informational purposes and does not constitute legal advice.