Your firm-wide risk assessment: keeping it live rather than annual

Every firm within the Money Laundering Regulations 2017 must have a written firm-wide risk assessment. It is the first document the SRA asks for before an inspection, and the SRA calls it the backbone of your policies, controls and procedures. Yet in many firms it is written once, approved once a year and otherwise left in a folder. That is the habit worth breaking.

What regulation 18 requires

Regulation 18 requires the firm to take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject. In doing so it must take into account:

• information from its supervisor, which for most firms means the SRA's sectoral risk assessment
• risk factors relating to its customers, the countries or geographic areas in which it operates, its products or services, its transactions and its delivery channels
• the size and nature of its business

The firm must keep an up-to-date written record of the steps it has taken, and must give the SRA the risk assessment, the information it was based on and that record on request. Regulation 18A adds the same duty for proliferation financing, which can be covered in the same document. The SRA also expects the assessment to be approved by senior management.

What the SRA keeps finding

The SRA's guidance on firm-wide risk assessments lists the mistakes it sees most often:

• writing the assessment only after the SRA asks for it
• not referring to the SRA's sectoral risk assessment
• using a template without adapting it, or copying in specimen text
• thin treatment of delivery channels, especially remote, non face-to-face work
• confusing the firm-wide assessment with client and matter risk assessments, which are separate but should line up
• vague geography, such as splitting the world into "UK" and "worldwide"
• saying the firm does not act for politically exposed persons, instead of identifying them and having controls in place
• overlooking "passporting", where a client starts with low-risk work to avoid scrutiny on later, higher-risk instructions

The SRA's 2025/26 AML report shows compliance on firm-wide risk assessments rising from 47% to 60% of firms reviewed. Its most frequent feedback concerned transaction risk, then product and service risk, geographic risk, client risk and delivery channel risk. Its warning notice on the subject is blunt: the SRA will take robust enforcement action where a firm has no risk assessment or an insufficient one.

Why "annual" is the wrong habit

The duty in regulation 18(4) is to keep an up-to-date record. An annual review is a sensible backstop, but a risk assessment that was accurate last November may not be accurate now. In our experience the review should be triggered by events, not the calendar. For example:

• the firm starts a new type of work, or stops one
• you change how clients are onboarded, such as moving to remote ID checks
• clients start coming from new countries or through new referrers
• the SRA updates its sectoral risk assessment (the current version was updated in September 2026)
• the law changes, as it did on 30 June 2026 when SI 2026/621 switched the enhanced due diligence country test to the FATF Call for Action list
• an inspection, independent audit or file review finds a gap
• a suspicious activity report or near miss shows a risk you had not written down
• your MLCO or MLRO changes

Each of those should leave a trace: a dated note of what changed, what you considered and whether the assessment or the policy needed to move. That trace is the "record of steps" regulation 18(4) asks for, and it is far more convincing to an inspector than a document with a single annual sign-off.

How it connects to everything else

The firm-wide risk assessment sits at the top of a chain. Regulation 19 requires your policies, controls and procedures to manage the risks it identifies. Regulation 28(12) requires your customer due diligence on each matter to reflect both the firm-wide assessment and your assessment of the risk in that particular case. If the chain breaks anywhere, the inspector will find it on a file. For what that looks like in practice, see preparing for an SRA AML inspection.

Keeping it current in ComplianceMinder

ComplianceMinder keeps the firm-wide risk assessment current in two different ways, and it is worth being clear about which is which. Operational data from the firm feeds the assessment as it changes, and that matter-level picture is richer when ComplianceMinder is connected to CaseMinder. Regulatory change is handled separately: twice a year ComplianceMinder runs a scheduled scan of SRA, Lexcel and Law Society updates and proposes policy changes, and a policy change can flow through to a proposed process change. A scheduled scan is not continuous monitoring, so the event triggers above still matter between scans. The assessment downloads as a PDF whenever you need to send it, and registers, breach and incident logging and an MLCO to COLP review chain sit alongside it on one compliance dashboard.

See how ComplianceMinder works or book a walkthrough.