An FCA compliance checklist for a law firm should not begin with future FCA forms or speculative new rules. It should begin with a more immediate question: can the firm prove that its existing anti money laundering controls work in practice?
The Financial Conduct Authority has confirmed that it does not expect to begin taking over AML supervision of legal and accountancy businesses until autumn 2028. The transition is expected to take place in phases and conclude around 2030.
Nothing changes immediately. Law firms must continue to comply with the Money Laundering Regulations and deal with their present professional body supervisor. Nevertheless, firms that wait until the FCA registration process opens may discover that longstanding weaknesses cannot be corrected quickly.
Start your FCA readiness review
Use the AML checklist for law firms to consider whether your firm’s documents, controls and evidence are ready for regulatory scrutiny.
Read the FCA AML audit readiness document checklist for solicitors
What does the FCA takeover mean for law firms?
The Government intends to transfer responsibility for AML and counter terrorist financing supervision of legal service providers from professional body supervisors to the FCA.
The proposed regime is expected to include a public register of supervised firms, registration as a condition of conducting AML regulated work and strengthened assessments of whether relevant people are fit and proper. The FCA is also expected to receive inspection, information gathering and enforcement powers for the newly supervised population.
The precise operating model is still being developed and legislation is required before the transfer can take effect. A responsible FCA compliance checklist must therefore distinguish between what is already required and what is still proposed.
Law firms should not attempt to predict every detail of the future regime. They should concentrate on building a defensible AML framework under the requirements that already apply.
1. Is your firm wide risk assessment genuinely specific?
The firm wide risk assessment should describe the risks arising from the firm’s actual clients, services, delivery methods, geographical exposure and transactions. It should not read like a generic description of legal practice.
Check whether the assessment:
- reflects the firm’s current work and client profile;
- covers money laundering and terrorist financing risks;
- addresses proliferation financing and sanctions exposure;
- identifies the risks associated with conveyancing and the movement of client money;
- records the controls used to mitigate each material risk;
- has been reviewed after regulatory, operational or practice changes; and
- has been approved and understood by senior management.
A firm wide risk assessment should drive the firm’s policies and its client and matter risk assessments. If these documents use different definitions, scoring systems or risk factors, the regulatory evidence chain is already fractured.
Our article on the AML evidence chain between the firm wide risk assessment, policies and client matter risk assessments explains why these documents must operate as one connected framework.
2. Do the AML policies describe what the firm actually does?
An AML policy is not effective merely because it is comprehensive or professionally presented. It must describe the procedures followed by the firm in practice.
The FCA compliance checklist should test whether the policies explain:
- when customer due diligence must be completed;
- how beneficial ownership and control are established;
- how source of funds and source of wealth are investigated;
- when enhanced due diligence is required;
- how politically exposed persons and sanctions matches are handled;
- how ongoing monitoring operates throughout a matter;
- when risk assessments must be updated;
- how internal suspicious activity reports are submitted and considered;
- what records must be retained; and
- who is responsible for supervision, escalation and approval.
The written procedure should agree with the forms, software, training and supervisory practices used across the firm. A policy that describes controls which fee earners do not understand or follow can become evidence of a compliance failure rather than evidence of protection.
3. Can the firm produce a complete client matter risk assessment?
A client matter risk assessment should be completed for every matter within scope. It should not be treated as an optional document reserved for clients already regarded as suspicious or unusual.
The assessment should record the relevant risks, the evidence considered, the resulting risk classification and the reasons supporting that conclusion. It should also identify the level of due diligence required and any approval or monitoring arrangements.
File testing should establish whether risk assessments are:
- completed at the correct stage;
- tailored to the client and matter;
- consistent with the firm wide risk assessment;
- supported by the due diligence obtained;
- reviewed when circumstances change; and
- closed or updated at the end of the matter.
Blank fields, unexplained low risk ratings and assessments completed retrospectively are unlikely to demonstrate that a risk based decision was made at the proper time.
4. Can source of funds conclusions be reconstructed?
Obtaining a bank statement does not complete a source of funds investigation. The firm must understand where the money came from and assess whether the explanation is consistent with the client, the transaction and the available evidence.
The compliance file should enable an independent reviewer to understand:
- who is providing each part of the transaction funding;
- how the provider obtained the money;
- whether third party contributors have been identified and assessed;
- whether the evidence supports the explanation given;
- whether source of wealth enquiries were required; and
- why the fee earner and any supervisor considered the position satisfactory.
The conclusion should not exist only in the fee earner’s memory. If another person cannot reconstruct the reasoning from the file, the firm may struggle to prove that an adequate assessment occurred.
5. Does ongoing monitoring happen after onboarding?
AML compliance does not end when identification documents are obtained. Regulation 28 requires ongoing monitoring of the business relationship.
The firm should be able to demonstrate how it responds to changes such as:
- a different source of funds;
- a new person contributing money;
- a change in ownership or control;
- an unexpected payment route;
- a material delay or alteration to the transaction;
- new sanctions or politically exposed person information; or
- conduct inconsistent with the original risk assessment.
The FCA has said that its expanded supervisory approach will be risk based, targeted and proportionate. A law firm should therefore be able to show not only that it collected information, but also that it recognised and responded to changing risk.
6. Can senior management prove that it owns AML compliance?
AML responsibility cannot be delegated entirely to the MLRO or compliance team. Senior management should understand the material risks, approve the framework and ensure that the people responsible for operating it have sufficient authority, time and resources.
Evidence may include:
- documented approval of the firm wide risk assessment and AML policies;
- minutes recording meaningful discussion and challenge;
- regular MLRO and MLCO reports;
- decisions concerning high risk clients and politically exposed persons;
- records of compliance incidents and remedial action;
- training attendance and competence records; and
- follow up of internal monitoring and independent audit recommendations.
A signature on the front of a policy does not demonstrate informed oversight. The records should show what management considered, what it challenged and what action followed.
7. Is your AML data reliable?
The transfer to the FCA may place greater practical emphasis on registration, regulatory information and structured data. Even before the new regime begins, firms should be able to answer basic questions about their AML regulated work accurately.
Consider whether the firm can reliably identify:
- the number of matters within the regulated sector;
- the number and nature of high risk clients and matters;
- politically exposed person relationships;
- sanctions alerts and their resolution;
- internal and external suspicious activity reports;
- client matter risk assessment completion rates;
- AML training completion; and
- outstanding audit recommendations.
Data should be capable of reconciliation with the underlying matter files. A spreadsheet or dashboard is of limited value if the source records are incomplete.
8. Has training changed behaviour?
Attendance at an annual AML presentation is not, by itself, evidence of competence. Training should reflect the risks encountered by the firm and the responsibilities of the people attending it.
The firm should retain records of the content, date, attendees and any assessment of understanding. File reviews and supervisory discussions should then test whether staff apply that knowledge consistently.
Training should also respond to weaknesses identified through audits, complaints, suspicious activity reports, file reviews or regulatory developments.
9. Has the firm tested its controls independently?
Regulation 21 requires an independent audit function where this is appropriate having regard to the size and nature of the business. Independence is not achieved simply by asking the person who designed or operates the control to confirm that it works.
An effective independent AML audit should move beyond a review of documents. It should test representative files, examine how policies are applied, speak to relevant personnel, identify weaknesses and produce practical recommendations.
The work is not complete when the report is issued. The firm should maintain a remedial action plan recording:
- the recommendation;
- the person responsible;
- the target date;
- the action taken;
- the evidence of completion; and
- the follow up testing undertaken.
Our earlier article explains why an independent AML audit should be an early step in regulatory preparation. The principle becomes more important as firms prepare for a change of supervisor.
10. Has the firm tested FCA readiness without pretending the FCA is already supervising it?
The SRA remains the AML supervisor for SRA regulated law firms during the transition. Firms should continue to follow the existing regulatory framework and communicate with their present supervisor.
FCA readiness should therefore mean strengthening the effectiveness and evidence of current compliance, not applying imaginary future rules.
The FCA AML audit readiness checklist for solicitors identifies the core documents and records that a firm should be capable of producing. These include the firm wide risk assessment, policies and procedures, senior management records, client matter risk assessments, audit reports, monitoring logs, training records and evidence of remediation.
For broader preparation, our earlier article asks whether conveyancing firms are ready for FCA AML supervision. Our December analysis also considers why the change of AML supervisor should influence law firm preparation.
A checklist identifies the questions. An audit tests the answers
A checklist is useful for organising a readiness review, but it cannot establish whether the firm’s controls are effective. That requires examination of the documents, interviews with the people responsible for applying them and testing of the underlying files.
The Lexsure Independent AML Audit now specifically addresses readiness for the anticipated transfer of legal sector AML supervision to the FCA. The audit considers the firm’s present compliance obligations while identifying gaps that could become more significant under a more centralised, data led and evidence focused supervisory model.
The review considers the relationship between the firm wide risk assessment, AML policies, client matter risk assessments and operational files. It also examines governance, implementation, training, monitoring and the evidence retained to demonstrate that controls are working.
Do not wait for FCA registration to expose an old weakness
A Lexsure Independent AML Audit can test the effectiveness of your present AML framework and assess its readiness for the expected FCA supervisory environment.
Learn about the Lexsure Independent AML Audit and FCA readiness review
The purpose of an FCA compliance checklist
The objective is not to predict every future FCA requirement. It is to ensure that the firm can explain its risks, demonstrate its controls and produce reliable evidence that those controls operate in practice.
A law firm that starts this work now has time to correct inconsistencies, complete missing assessments, improve its data and test whether remediation has worked. A firm that begins only when registration or inspection correspondence arrives may have documents to produce but no credible history of effective implementation.
The most useful FCA compliance checklist is therefore not a one day exercise. It is a structured programme of review, testing, remediation and follow up that begins before the supervisory handover.