FCA AML Audits: The Regulator May Change, but the Risk Will Not Divide Neatly

The proposed transfer of anti money laundering supervision to the FCA is often described as a change of regulator. For conveyancing firms, the harder question is what happens when the same facts engage AML rules, professional conduct, fraud prevention, sanctions and duties to clients or lenders at the same time.

The Government has selected the FCA model for professional services AML and counter terrorist financing supervision, but the transfer has not yet taken effect. Primary legislation is still required, secondary rules and transition arrangements must follow, and the first firms are currently expected to move before the end of 2028. The developing framework is set out in the Government’s consultation on supervisory duties, powers and accountability.

Until that happens, firms remain subject to their existing supervisory arrangements. More importantly, the SRA, CLC and other legal regulators will not disappear when direct AML supervision moves. They will continue to regulate professional conduct and the wider operation of legal practices.

The future is therefore not best understood as one regulator leaving and another arriving. It is a redistribution of functions within a regulatory system whose responsibilities will continue to intersect.

The phrase “FCA takeover” conceals an important distinction

Earlier commentary, including our article on the FCA’s anticipated AML supervision of the legal sector, used “takeover” as convenient shorthand for a major change in supervision. The developing position requires a more precise description.

The FCA is expected to become the single professional services supervisor for compliance with the Money Laundering Regulations. The legal regulators will continue to oversee matters such as integrity, client service, confidentiality, accounts, competence, supervision and professional conduct.

On paper, this can be expressed as a division:

• FCA: direct supervision of AML and counter terrorist financing compliance under the relevant statutory regime.
• SRA or CLC: continuing regulation of the firm and its lawyers in relation to their broader professional obligations.

On a conveyancing file, however, the facts rarely arrive prelabelled for one regulator.

One source of funds problem may engage two regulators

Consider a purchase where the declared source of funds does not match the money received. That may raise questions about customer due diligence, source of funds enquiries, the client and matter risk assessment, enhanced due diligence and whether a suspicious activity report should be considered.

The same facts may also raise professional questions:

• Did the solicitor follow the client’s instructions?
• Was information withheld from a mortgage lender?
• Was the transaction used to facilitate fraud or tax evasion?
• Were undertakings, accounts rules or duties of integrity engaged?
• Was the matter supervised by someone with appropriate competence?

An FCA review may therefore identify conduct that interests the SRA or CLC. A legal regulator examining a complaint, accounts issue or conveyancing file may identify an AML concern that should reach the FCA.

The challenge is not merely avoiding two regulators asking the same question. It is ensuring that information sharing, referrals and enforcement responsibility operate predictably when the same evidence supports different regulatory concerns.

AML does not sit apart from fraud, sanctions and tax evasion

The boundary becomes harder to draw because economic crime risks overlap. A failure to investigate ownership, funds or transaction purpose may indicate money laundering, but it can also expose mortgage fraud, a sanctions breach, tax evasion or abuse of a client account.

Sanctions compliance is not simply another name for AML compliance. Fraud prevention may involve duties to a lender as well as the client. Tax concerns may require careful consideration of the retainer, confidentiality and whether specialist advice is needed.

A firm should therefore resist redesigning its compliance arrangements around an artificial assumption that every risk has a single regulatory owner. Its policies, escalation paths and records should show how connected risks are identified and directed to the appropriate decision maker.

What might regulatory overlap look like in practice?

Until legislation, rules and cooperation arrangements are finalised, firms do not know precisely how parallel interest will operate. The practical questions include:

• whether the FCA and legal regulator can request the same files or information;
• how one regulator will refer concerns to another;
• whether evidence supplied for one supervisory purpose may be used for another;
• how legal professional privilege and client confidentiality will be protected;
• which regulator will lead where AML and professional misconduct are inseparable;
• whether remediation agreed with one regulator will satisfy the other; and
• how firms will challenge duplication or inconsistent requirements.

The Government has recognised these concerns and proposed cooperation and information sharing arrangements. The detail will determine whether firms experience genuine coordination or simply receive two differently framed requests about the same failure.

Registration and fitness requirements may create another boundary

The transition also raises questions about FCA registration, the information firms will need to provide and the treatment of checks already completed by a legal regulator.

If the FCA introduces fit and proper requirements for relevant individuals, firms will want to know whether existing regulatory assessments can be relied upon and when new evidence will be required. Some conveyancing practices already have a relationship with the FCA for permitted insurance activities, including the arrangement of indemnity insurance. The interaction between that status and future AML supervision will need to be explained clearly.

This is not a minor administrative issue. Poorly coordinated registration can consume management time, produce inconsistent records and create uncertainty about who is responsible for maintaining regulatory information.

The cost may arrive through more than one invoice

Direct FCA supervision will require funding. Firms can therefore expect some form of FCA fee structure while continuing to pay their legal regulator for its remaining responsibilities.

The direct fee is only part of the cost. Firms may also need to fund:

• changes to compliance systems and management information;
• additional staff training;
• new reporting or registration processes;
• responses to information requests;
• independent testing and remediation; and
• management time spent coordinating regulatory responses.

If functions currently funded through SRA or CLC fees transfer to the FCA, firms will reasonably ask whether existing charges will reduce. They should not build budgets on that assumption until the future fee arrangements are known.

What changes now, before the transfer?

The identity of the future supervisor does not alter the firm’s current obligations under the Money Laundering Regulations. Firms should continue complying with the present regime and responding to their current supervisor.

Preparation should focus on controls that will matter under either regulator:

1. Governance: Define responsibility across the MLRO, MLCO, COLP, COFA and senior management.
2. Risk assessments: Ensure the firmwide assessment drives client and matter risk decisions rather than existing as a separate document.
3. File evidence: Record the reasoning behind source of funds, source of wealth, enhanced due diligence and ongoing monitoring decisions.
4. Escalation: Explain how AML, sanctions, fraud, tax and professional conduct concerns move between responsible officers.
5. Data readiness: Know where the firm’s AML evidence is held and whether it can be retrieved accurately and promptly.
6. Independent testing: Test whether controls work in practice and document the remediation that follows.

For a more detailed preparation framework, see this guide to what solicitors need to know about an FCA AML audit and how to prepare.

Our earlier article, The Independent AML Audit: Why It Matters, explains the distinction between reviewing the design of an AML framework and testing its operation on actual files.

Independent audit provides evidence across the boundary

A Regulation 21 independent AML audit cannot answer every question about the future supervisory architecture. It can answer the more immediate question of whether the firm’s present controls are appropriately designed and operating effectively.

A meaningful audit should examine the firmwide risk assessment, policies, client and matter risk assessments, due diligence, source of funds and wealth enquiries, ongoing monitoring, reporting, training, governance and a representative sample of files.

It should then produce a prioritised remediation plan and evidence that senior management considered and implemented the findings. This will remain relevant whether the evidence is later examined by the FCA, SRA, CLC, a lender panel manager or a professional indemnity insurer.

The older article Independent AML Audit: Is Your Firm Prepared for the 2027 FCA Takeover? addressed preparation for more data driven supervision. The timetable and boundaries are now clearer, but its central message remains valid: policies must be tested against day to day practice.

The right question is not which regulator is tougher

Much commentary has focused on whether FCA supervision will be more aggressive than supervision by the professional bodies. That comparison may be less useful than asking whether the firm can explain its decisions and produce reliable evidence quickly.

The January article on the AML oversight shift for professional services anticipated a more centralised and data focused system. The present debate shows that centralisation will not eliminate every boundary. Firms will still need to understand the relationship between AML controls and their wider professional duties.

The regulator responsible for direct AML supervision may change. The underlying transaction will not reorganise itself into neat regulatory compartments. A suspicious payment, misleading lender disclosure or unexplained third party contribution may remain an AML issue, a conduct issue and a fraud risk at the same time.

The firms best prepared for the transition will not be those that guess where every future line will be drawn. They will be those whose governance can recognise an overlapping risk, escalate it correctly, preserve the reasoning and demonstrate what happened next.

This article provides general commentary on the proposed reform of AML supervision. The transfer has not yet taken effect and its final operation will depend on legislation, rules and transition arrangements. Firms should follow current requirements and guidance from their existing supervisor until formally notified otherwise.