Preparing for an SRA AML inspection: what your firm should be able to show

If your firm acts in property transactions, company or trust work, or other financial transactions for clients, it is likely to be within the Money Laundering Regulations 2017, with the SRA as its AML supervisor. The SRA visits firms of every risk rating and says plainly that a visit does not mean it thinks you are high risk. So the useful question is not whether you will be inspected. It is whether you could send what the SRA asks for within ten days without a scramble.

What the SRA asks for before the visit

The SRA's guidance on firm inspections lists what it asks firms to send in advance, usually within 10 days:

• your firm-wide risk assessment under regulation 18, and your proliferation financing risk assessment under regulation 18A (which can sit in the same document)
• your AML policies, controls and procedures under regulations 19 to 21
• your client and matter risk assessment template
• any independent audit of those policies and procedures under regulation 21, with its recommendations and what you did about them
• your AML training records under regulation 24
• a list of fee earners doing work within scope, and matter lists so the SRA can choose files
• where your systems allow it, a list of open matters flagged as high risk

It also sends a short questionnaire about the services you provide.

Read that list with one question in mind: could you produce each item today, in its current version, with a date on it? Firms rarely struggle because a document does not exist. They struggle because it exists in three versions, nobody is sure which one applied in March, and the training record is a spreadsheet someone stopped updating in the spring.

What happens on the day

An on-site review can take up to five hours, so clear the diary. The SRA interviews your MLCO and MLRO about your controls and the documents you sent. It interviews two fee earners. It reviews a sample of open and closed files and their client ledgers. It looks at copies of any suspicious activity reports or defence requests you have made to the National Crime Agency, on site only. It asks firms not to send those in advance.

The fee earner interviews are where the paperwork meets reality. If the policy says every matter gets a client and matter risk assessment before work starts, the inspector will expect the fee earner to describe doing it, and expect to find it on the file.

Afterwards, the SRA describes four main supervisory responses: guidance, a letter of engagement, a compliance plan with actions and deadlines, and, for non-compliant firms, referral for investigation. They are not always alternatives: a referral can come with a compliance plan as well. The SRA's own examples of non-compliance are missing customer due diligence, no firm-wide risk assessment, outdated policies and failing to train staff.

The three things that must agree

Most AML findings come back to a gap between documents that should match.

• The risk assessment and the policy. Regulation 19 requires your policies, controls and procedures to manage the risks identified in your regulation 18 risk assessment. The SRA describes the risk assessment as the backbone of your policies. If the risk assessment names remote onboarding as a risk, the policy has to say what you do about it.
• The policy and the files. A policy that requires source of funds evidence on every purchase is only as good as the purchase files that contain it. The SRA's 2025/26 AML report says scrutiny of source of funds remains a recurring issue, with more breaches where firms fail to carry out, evidence or properly interrogate where the money came from.
• The policy and the people. Regulation 24 requires relevant staff to be trained regularly, with a written record. Where appropriate with regard to the size and nature of the firm, regulation 21 also requires screening of relevant employees before and during their appointment, and an independent audit function.

The direction of travel is encouraging. The SRA's 2025/26 report shows the share of inspected firms assessed as non-compliant falling from 32.4% to 21.9%, with compliance on firm-wide risk assessments up from 47% to 60% and on policies, controls and procedures up from 38% to 54%. That still leaves a large minority getting the basics wrong.

What a sound AML policy covers

Regulation 19 sets out what your policies, controls and procedures must include. They must be proportionate to the size and nature of the firm and approved by senior management. You must keep a written record of them, of any changes made on review, and of how you told staff. In practice the policy should cover at least:

• risk management, built on the firm-wide risk assessment
• customer due diligence, including when enhanced due diligence applies and how you identify politically exposed persons
• how you spot and scrutinise transactions that are unusually complex or unusually large given their nature, unusual patterns of transactions, and transactions with no apparent economic or legal purpose
• how anyone in the firm reports a suspicion to the nominated officer (your MLRO)
• reliance and record keeping (under regulation 40, records are generally kept for five years after the transaction completes or the business relationship ends)
• how you monitor compliance with the policy and tell staff about changes

Two changes made by the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621) are worth checking your policy against. Both took effect on 30 June 2026 (some other provisions of the instrument start in 2027). The test in regulations 19 and 33 now refers to transactions that are "unusually complex or unusually large in each case given the nature of the transaction". And the enhanced due diligence trigger in regulation 33 now refers to countries on the FATF list of High-Risk Jurisdictions subject to a Call for Action, rather than the UK's own high-risk third country list. If your policy still quotes the old wording, it is out of date.

A ten-day readiness check

• Is the firm-wide risk assessment dated and approved, and does it take account of the SRA's current sectoral risk assessment? (More on that in keeping your firm-wide risk assessment live.)
• Does the policy match the risk assessment, and can you show which version applied on any given date?
• Does every in-scope matter have a client and matter risk assessment, done at the start?
• Does every purchase file show source of funds evidence, not just a completed questionnaire? (See our source of funds checklist.)
• Is the training record current for every relevant employee, including new joiners?
• If your firm's size and nature call for an independent audit function, when was the last audit, and can you show its recommendations were acted on? If you decided you do not need one, is that decision and the reasoning recorded?
• Does the SRA know who your MLCO and MLRO are? Regulation 21(4) requires you to tell it within 14 days of an appointment. (For the wider compliance officer role, see COLP and COFA duties in a small firm.)

What about the FCA?

The government has announced that the FCA will become the AML supervisor for legal and accountancy firms. Nothing changes yet. The FCA does not expect to begin taking on supervision before autumn 2028, with a phased transition likely to finish around 2030, subject to legislation and implementation. That is not a fixed transfer date for any particular firm. Until then the SRA remains your supervisor and everything above applies as it does today.

Making the evidence easy to produce

Most of this is a records problem as much as a compliance problem, which is why we built ComplianceMinder the way we did. Policies are versioned, every change needs a reason and director approval, and old versions are archived in your SharePoint, so you can show which version applied on a given date. The firm-wide risk assessment downloads as a PDF, and training records update automatically when someone finishes a module. Matter-level AML, including Thirdfort ID checks and the source of funds questionnaire and evidence checks, runs in CaseMinder, which gives ComplianceMinder richer matter-level information when the two are connected.

See how ComplianceMinder works, look at our AML and compliance training, or read what compliance retainers miss.