SRA AML annual report 2025/26: key takeaways for law firms

Marcus Oulds

Chief Commercial Officer

Example H2

Find out how we can help you onboard clients faster

Book a demo

The SRA's AML annual report is the one document each year that shows a firm where it stands against the rest of the profession. The 2025/26 edition, published on 22 October 2026, covers the year to 5 April 2026 and draws on a record 966 compliance assessments and 6,592 client files.

It describes a profession that has, for the most part, built its AML controls. The regulator's attention has shifted to whether those controls do anything when a file reaches them. As Alexandra Jones, the SRA's Director of AML, writes in the foreword, most breaches now "relate not to the absence of controls, but to the quality and application of those controls in practice".

The headline numbers

Of the 937 firms that received a proactive inspection or desk-based review, 78% were assessed as compliant or partially compliant. The proportion found non-compliant fell from 32.4% in 2024/25 to 21.9%, after two years in which roughly a third of firms reviewed were falling short.

The two controls the SRA tests at every firm moved with it. Of the firm-wide risk assessments called in, 60% were assessed as compliant, up from 47% the year before. Compliance with policies, controls and procedures rose from 38% to 54%. On the files themselves, 9% had no client or matter risk assessment or an incomplete one, down from 16%.

Jones attributes the improvement to firms "increasingly embedding AML requirements into their governance frameworks and day-to-day operations". The rest of the report is concerned with the firms where that has not yet happened, and with what embedding looks like on an individual file.

Where the gaps remain

The firms that are still non-compliant are falling down in the same places as before. Of the 206 firms referred for investigation after a proactive review, 87 were referred for the absence of client and matter risk assessments on files. Six firms had no firm-wide risk assessment at all, and three had no policies, controls and procedures.

The enforcement caseload tells the same story from the other end. Among the AML reports the SRA received during the year, the most common failing was a missing client or matter risk assessment, cited in 115 reports. A missing source of funds check was next, at 111. Further down the list, 39 reports concerned firms with no firm-wide risk assessment of any kind, nearly a decade after the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, the MLRs, made one mandatory.

Source of funds is where the report is most specific. Of the files that required a source of funds or source of wealth check, 9% contained none. Where documents had been gathered, they had not been scrutinised in 18% of files, and in 6% the funds on file did not match the ledger. The SRA's conclusion is that "the quality of source of funds scrutiny is often more problematic than the collection of documents themselves".

A bank statement saved to the matter shows that a request was made, not that anyone read it, and the SRA's file reviews are now drawing that distinction.

Enforcement went up, and why

Enforcement outcomes rose from 137 in 2024/25 to 256. The SRA concluded 145 regulatory settlement agreements carrying fines of just over £2.0m, adjudicators issued 14 fines totalling £363,726, and eight cases concluded at the Solicitors Disciplinary Tribunal, including six fines totalling £228,000, one suspension and one strike-off. Taken together, the year's AML fines come to around £2.6m.

A rising enforcement count alongside falling non-compliance looks contradictory until the timing is taken into account. The report notes that outcomes are "influenced by when investigations conclude rather than when underlying conduct occurred". Much of what was fined this year was identified during the SRA's expanded inspection programme in 2023/24, when non-compliance was at its highest. The enforcement figures are a lagging indicator, and they will probably stay elevated for a while after the compliance figures have improved.

More useful than the totals is the SRA's account of what lay behind the breaches. It lists four themes: a failure to review and refresh controls and keep records; insufficient senior management oversight; inadequate training of fee earners on the regulations; and systems that allow events to happen unchecked, such as receiving funds or moving to the next stage of a transaction, rather than applying an automated stop when an element of CDD has not been completed.

The fourth is the one worth pausing on. A firm's policy may say that no completion proceeds without a scrutinised source of funds. If the case management system lets the fee earner mark the step complete and the finance team release the funds regardless, the policy is a statement of intent rather than a control. The SRA is now saying so in terms.

Sanctions: the emerging theme

The report's one new theme is sanctions. Cases relating to a failure to comply with sanctions regimes "have tripled" since the previous year. The SRA received 18 reports concerning sanctions regimes and a further 11 concerning sanctions processes, and made one report to the Office of Financial Sanctions Implementation about a suspected breach.

The cause matters more than the count. The SRA notes that "much of this work relates to human or administrative errors within firms, rather than deliberate misconduct". That is consistent with what the file reviews found: 21% of files contained no evidence of sanctions screening, and 20% no evidence of PEP screening. For a strict liability regime, an unscreened client or a screening run once and never repeated is enough.

What the SRA will focus on next

The foreword sets out the year ahead plainly: "we will maintain our focus on proactive supervision, sanctions compliance, thematic guidance, intelligence sharing, stakeholder engagement and enforcement".

Proactive supervision at the current scale, close to a thousand engagements a year across 5,422 firms in scope, means a firm should plan for a desk-based review rather than hope to avoid one. Sanctions compliance moving onto the named list means screening coverage will be tested, not just asked about. And the thematic programme is the SRA telling firms what good looks like in advance: this year it produced a source of funds review of 19 firms, with published request templates, FAQs and case studies, and the report was accompanied by new guidance on policies, controls and procedures.

What firms can do now

None of this requires a new policy. Most firms have one that would pass. The work is in showing that it was applied, file by file.

Check the client and matter risk assessments on live files, not the template. The 115 enforcement reports and 87 referrals concerned files with no completed assessment, not firms with no form. A sample across practice areas, read for whether the risk rating stands up, is the quickest test.

Separate gathering from scrutiny on source of funds. Add a recorded step in which a named person states what the documents show and whether it is consistent with the matter. The SRA's 18% figure is a measure of how often that step is missing.

Decide what an incomplete check should stop. Releasing funds, exchanging, or opening the matter: choose which events are held while an element of CDD is outstanding, and configure the systems to hold them. Compliance technology providers, Legl among them, have built for exactly this, applying the firm's own risk policy automatically at onboarding so that a gap holds the next step and a person decides, with the decision recorded.

Re-screen for sanctions on a schedule the firm can defend. Screening at onboarding is a snapshot. Set the frequency, name the owner of a hit, and set a limit on how long a hit can wait.

Put the firm-wide risk assessment and PCPs on a review cycle. Both improved this year because firms refreshed them. The SRA's first listed cause of breaches is a failure to review and refresh.

The bottom line

The 2025/26 report records a profession that has done the building and a regulator that has started testing the result. The firms that will find the next review straightforward are the ones that can show, for any file, that the policy was applied, by whom, and when.

If you would like a second opinion on how your firm's onboarding controls would answer that question, Legl's UK team is happy to have that conversation.