Originally published on 1 April 2026. The enforcement discussion and figures below relate to the first quarter of 2026.
So far in 2026, SRA AML audits and Regulatory Settlement Agreements have continued to highlight problems with static, generic or missing firm-wide risk assessments (FWRAs). The first-quarter cases are a reminder that having a document on file is not enough if it does not identify and assess the money laundering risks the firm actually faces.
A firmwide risk assessment is a legal requirement for firms within scope of the Money Laundering Regulations. It should reflect the firm’s clients, geographic exposure, products and services, transactions and delivery channels. It should also inform the firm’s policies, controls and procedures (PCPs), as well as its client and matter risk assessments.
The SRA’s firm-wide risk assessment guidance explains the regulatory requirements and provides access to the SRA template. Firms using a template must tailor it to their own practice.
The cost of non-compliance
In our review of AML-related settlements published in the first quarter of 2026, most financial penalties fell between £7,500 and £25,000. Several decisions referred to compliance gaps that had continued for four to seven years. Updating an assessment after an investigation begins may help address an ongoing gap, but it does not erase the period of earlier non-compliance.
The key issue is not simply whether the firm has a document labelled “FWRA”. The assessment must be appropriate to the size and nature of the firm, identify the relevant risks and explain how the firm will manage them.
An earlier example is discussed in Firm Fined for Inadequate FWRA, which covered an SRA decision involving a firm that had failed to maintain an appropriate assessment over a prolonged period.
Common weaknesses in firm-wide risk assessments
Our review of 2026 settlements identified recurring issues firms should check for:
- Missing or generic assessment. The document should describe this firm’s work, client base, locations and delivery methods—not a generic law practice.
- Failure to identify the firm’s actual risk profile. The assessment should consider the relevant risk factors, including client types, geographic connections, services, transactions and delivery channels.
- Failure to review and update. The FWRA should be reconsidered when the firm or its risk exposure changes, and reviewed periodically.
- Weak link to PCPs and client and matter risk assessments. The firm should be able to show how the controls respond to risks identified in the FWRA and how those risks inform individual client and matter assessments.
- Template copied without tailoring. A template can be a useful starting point, but it must be adapted to the firm’s circumstances. The SRA has warned against generic or near-identical assessments submitted by different firms.
For a wider discussion of the SRA’s approach to tailoring, see Firmwide Risk Assessment: Time for a Refresh?. Our earlier post, AML Firm-wide Risk Assessment: No1 Document, explains how the assessment connects to the rest of a firm’s AML framework.
Using the SRA template is not the same as completing the assessment
The SRA provides a template to help firms frame their assessment. Using it does not remove the need to assess the risks in the firm’s own business. The finished document should explain the firm’s reasoning and be consistent with the work it actually undertakes.
To avoid confusion, the SRA’s template and a bespoke assessment service are different things. The SRA template is available through its official guidance page. Lexsure’s separate service is a bespoke firm-wide risk assessment prepared following a consultation about the firm’s practice.
Lexsure offers a bespoke firm-wide risk assessment service based on a consultation about your practice. Find out about the FWRA service.
Connect the FWRA to the firm’s AML procedures
The FWRA should not sit apart from the firm’s working procedures. Where it identifies a particular risk, the firm should be able to show how the PCPs address that risk and how fee earners are expected to consider it when assessing a client or matter.
The firmwide risk assessment considers risks to the business as a whole. A client and matter risk assessment considers risks associated with a particular client or transaction. They are separate documents, but the individual assessment should be informed by the themes identified in the FWRA.
Review the assessment regularly
A firm should review its FWRA periodically and when a material change affects the practice—for example, a new service, a different client profile, a new office or a change in how legal services are delivered.
The question is not just whether an assessment exists. It is whether it still describes the firm, identifies its current risks and helps staff apply the firm’s AML controls in practice.