Robust anti-money laundering (AML) controls are an essential requirement for any law firm. But there’s often a disconnect between having a well-written Anti-Money Laundering Policy and making sure those controls actually hold up in the realities of day-to-day work.
The SRA is placing less weight on “paper compliance” and far more on what’s happening in practice. Firms are expected to show that AML awareness is embedded in their everyday operations. That’s where a Reg 21 Independent AML Audit becomes a critical tool for managing risk.
Under Regulation 21 of the Money Laundering Regulations (MLR) 2017, firms are required, where appropriate to their size and nature, to establish an independent audit function.
An independent AML audit is not a mere formality. It is a structured, risk-based objective assessment designed to ensure your systems and controls are:
- Effective: Do they actually catch high-risk activity?
- Embedded: Are fee earners actually following them?
- Sustainable: Can the processes withstand the intense scrutiny of an FCA AML Audit?
The AML Audit Process: What is Scrutinised?
A comprehensive Reg 21 Independent Audit goes deep into the operational mechanics of your firm. To satisfy the heightened expectations of upcoming FCA oversight, the audit must examine:
- Risk Assessments: Both firmwide and specific client matter risk assessments.
- Due Diligence: The depth of CDD and EDD checks.
- Wealth & Funds: The rigor of Source of Funds (SoF) and Source of Wealth (SoW) verification.
- Ongoing Monitoring: How the firm tracks changing risk profiles during a matter.
- Governance: The effectiveness of the MLRO oversight and senior management accountability.
- Training: Whether staff are actually competent or just “clicking through” modules.
Key Insight: The FCA wields powers that include criminal prosecution. They want to see a “culture of compliance” where issues are self-identified and remediated promptly.
Does Every Firm Need a Reg 21 Independent Audit?
The MLR 2017 suggests an audit is required “where appropriate,” but the upcoming shift in supervision makes it nearly mandatory for any firm seeking to avoid sanctions.
You should prioritise an independent AML audit if your firm:
- Conducts conveyancing or property work.
- Advises on corporate structures or operates across multiple offices.
- Deals with high-risk jurisdictions.
- Wants to avoid the “Double Trouble” of dual scrutiny from both the FCA (for AML) and the SRA (for general conduct).
For most law firms in recent years, the question has shifted from “Do we need one?” to “How often should we have one?”
The Benefits: Beyond Simple Compliance
While avoiding enforcement action is a primary driver, a Reg 21 Independent Audit offers several strategic advantages:
1. Proactive Evidence
During an SRA AML Audit, an assessor will ask for is the date and results of your last audit. Having a documented trail of audit and subsequent corrective action is the best evidence of “proactive compliance.”
2. Early Warning System
An audit acts as a “stress test,” identifying gaps in file documentation or inconsistent risk scoring before they turn into a reportable breach or a fine.
3. Culture and Governance
A third-party review reinforces a culture of accountability. It proves to the SRA that senior management is not just “marking their own homework” but is serious about independent oversight.
Who Can Conduct an Independent AML Audit?
The defining requirement is independence. The auditor cannot be the person who wrote the policies or the person responsible for daily AML implementation.
- Internal Audit: Larger firms may use internal staff from a different department, provided they have the requisite expertise and no involvement in the AML function.
- External Audit: For the vast majority of firms, outsourcing to an external specialist is the most reliable route. This ensures a level of objectivity and up-to-date regulatory knowledge that is difficult to replicate in-house.
While some larger firms use internal personnel from unrelated departments, most firms find that outsourcing to an external specialist is the most reliable route. An external independent AML audit ensures a level of objectivity and specialised knowledge, particularly regarding FCA expectations, that is difficult to replicate in-house.
Final Thoughts
In an era of record-breaking fines and a looming deadline for FCA supervision, proactive measures are your only defence. A Reg 21 Independent Audit transforms your compliance from a static manual into a living, breathing defense system.
Don’t wait for the inevitable FCA notification. Lexsure are hosting a webinar next month to help firms learn more about preparing for FCA AML audits.