top of page
Search

The ten-day AML test: could your firm hand over its paperwork if the SRA asked tomorrow?

Writer: Ashley Barwick
Ashley Barwick
2 days ago
4 min read

Been there. Seen it. Done it.


When the SRA selects a firm for an anti-money laundering desk-based review, it writes by email and attaches a questionnaire. From that point you have 10 calendar days to send back a defined set of documents. Not working days. Calendar days, which can include a weekend and the busiest week of your month.


The FCA will not start taking over AML supervision until late 2028, as Today's Conveyancer reported on 21 October. Until then the SRA is your supervisor, and its desk-based review programme is rolling, with several firms selected each month. So here is a test you can run this week.


Are you ready for the SRA?
Are you ready for the SRA?

What the SRA asks for


The SRA's own guidance lists what you must provide within the 10 days:

  • a completed AML questionnaire

  • your firm-wide risk assessment under regulation 18

  • your proliferation financing risk assessment under regulation 18A, which may sit inside the firm-wide assessment

  • your AML policies, controls and procedures under regulation 19

  • your template client and matter risk assessment

  • a list of fee earners whose work is in scope

  • your open and closed matter lists


Once those arrive, the SRA requests a sample of open and closed files with the client ledgers.


Run the test


Set a timer for one hour. Pretend the letter arrived this morning.


Find each of the seven items and put them in one folder. Note which ones you could not lay your hands on in ten minutes, and which ones were out of date when you found them. A policy last reviewed three years ago is a finding waiting to happen.


Then read the risk assessment as a stranger would. Does it describe your clients, your services and the way you take instructions? Or could it belong to any firm?


Pull three files


Pick three matters at random, one open and two closed. For each, ask four questions.


Is there a client and matter risk assessment on the file? Does it assess money laundering risk, or only operational risk such as whether the matter is profitable or the client is easy to work with? Where a source of funds check applied, is there evidence on file? Does the file show that someone actually looked at that evidence and understood it, rather than simply filing a bank statement?


The Law Society's guide to SRA AML inspections, written by AMLCC, shows why these questions matter. In 2024 to 2025, SRA reviewers worked through 5,873 files. Some 16% had no client and matter risk assessment at all, and 39% of those that did had a form assessing operational risk rather than AML risk. Of the files that needed a source of funds check, 10% had nothing on file, and 18% of the rest had not been meaningfully scrutinised.


Ask a fee earner


The same guide notes that on an onsite inspection, two fee earners are interviewed, and that a gap between what the policy says and what fee earners do is one of the most common drivers of a referral for investigation.


You can run a gentle version of that now. Ask a fee earner, or yourself if you work alone, to explain in three sentences what happens when a new client instructs you. Compare the answer with your written procedure. If they do not match, one of them needs to change.


What to fix first


Start with the client and matter risk assessment, because the same guide says missing or inadequate ones accounted for half of all referrals for investigation in 2024 to 2025. Then check the dates on your policies and your training records. One-off induction training with no follow-up is, according to the guide, a regular finding.


If you are a sole practitioner or a small firm where one person is both money laundering compliance officer and money laundering reporting officer, write down how you separate the two sets of duties. The SRA looks closely at whether each is genuinely discharged.


What happens next


Per the SRA, a desk-based review ends in one of four ways: guidance for a firm doing well, a letter of engagement for partially compliant firms, a compliance plan where concerns are wider, or a referral for investigation. Examples the SRA gives for referral include no firm-wide risk assessment, a failure to carry out client and matter risk assessments, out of date policies and a failure to train staff.

Most of those are fixable in a month if you find them yourself.


Want a second opinion?


Not sure whether your files, procedures and governance would stand up to an audit? I will go through them with you in a free health check, so you know where you are before anyone else asks. There is no cost and no obligation.


The contact page is an enquiry form, so please put "free health check" in the message subject and I will pick it up straight away.


Ashley Barwick, Fraxinus Business Associates. This post is general information and does not constitute legal advice. Fraxinus Business Associates is not authorised to provide legal advice.


Sources


 
 
 

Comments

Rated 0 out of 5 stars.
No ratings yet
Add a rating
bottom of page