A law firm had maintained Lexcel accreditation for more than ten years. It had paid external assessors, renewed the accreditation annually and believed its risk framework was robust. Then an SRA desktop AML audit exposed weaknesses that the accreditation process had not identified.
The consequences did not stop with the regulator. Within 48 hours of the SRA publishing its decision, panel managers were making contact. The firm was removed from a number of important lender panels.
For a conveyancing practice, that can be more commercially damaging than the regulatory sanction itself.
The Managing Partner was devastated. This was not a firm that had deliberately cut corners or refused to invest in compliance. It had spent serious money over many years obtaining and maintaining a respected quality mark. The partner genuinely believed that the framework had been tested and that it would withstand scrutiny.
It did not withstand a dedicated AML examination.
What the AML audit found
The regulatory review identified weaknesses in areas including the firmwide risk assessment, AML policies and client and matter risk assessments. These were not obscure technical points. They went to the foundations of the firm’s AML arrangements.
That distinction is critical. A general quality accreditation may consider governance, service standards, risk management and documented procedures across a wide area. A specialist AML review asks a narrower and more searching set of questions:
- Does the firmwide risk assessment reflect the work the firm actually undertakes?
- Do the policies translate the firm’s identified risks into workable controls?
- Are client and matter risk assessments completed consistently and revisited when circumstances change?
- Do files evidence source of funds and, where necessary, source of wealth enquiries?
- Can the firm prove that ongoing monitoring takes place?
- Do fee earners understand when an issue must be escalated to the MLRO?
A firm can perform well against a broad quality standard and still fail one or more of those tests. That does not make the quality mark worthless. It means that the quality mark and a specialist AML audit perform different functions.
Accreditation did not prevent lender panel removal
The commercial chain reaction was swift. A published SRA decision became a lender panel issue almost immediately. This illustrates why regulatory enforcement cannot be considered in isolation from the firm’s lender relationships.
Our earlier article on lender panels and compliance audits explains why panel membership should now be treated as something that must be actively maintained rather than assumed to be secure. Lenders and panel managers do not have to wait for a negligence claim or a failed transaction before reassessing whether a firm should continue to act.
Removal can interrupt live matters, damage broker and estate agent relationships, reduce new instructions and place immediate pressure on cash flow. Even where reinstatement is possible, the firm may have to act quickly to explain what happened, demonstrate remediation and rebuild confidence.
In this case, the story did not end with removal. Following specialist guidance and a structured response, the firm was reinstated. That was an important result, but it did not erase the cost, disruption or distress caused by the original failure.
What did the badge actually protect?
The experience left the Managing Partner asking whether the accreditation had created a false sense of security. He is now considering whether any legal recourse may be available. Whether such a claim could succeed would depend on the accreditation terms, the precise scope of the assessments, the representations made and the firm’s own responsibilities. It would be wrong to assume that accreditation amounted to a warranty of compliance.
Nevertheless, the broader governance question is legitimate.
If partners believe that annual external assessment means the firm’s AML framework has been independently tested in depth, are they less likely to commission a dedicated AML audit? Has a quality badge become a substitute, in the minds of some decision makers, for specialist assurance that it was never designed to provide?
The danger is not the existence of accreditation. The danger is misunderstanding its scope.
The optical illusion of compliance
In my own work reviewing AML failures, the overwhelming majority of firms I encounter hold CQS accreditation. Many also hold Lexcel. That is an observation from practice rather than a statistical claim about every accredited firm, but the pattern is too consistent to ignore.
These firms have usually invested substantial time and money in policies, assessments and renewals. Their leaders often regard themselves as compliance conscious. Yet a dedicated AML review can still reveal an outdated firmwide risk assessment, policies that do not reflect actual working practices, inconsistent matter risk assessments and insufficient evidence that controls operate on live files.
This is the optical illusion. The firm can point to a badge, an assessment history and a substantial compliance budget. Those features feel reassuring. They do not necessarily answer the question the SRA will ask: does the AML framework work effectively in practice?
That is why an independent AML audit should be treated as a distinct compliance exercise, not as work already completed through a wider accreditation.
Regulation 21 asks a different question
Regulation 21 of the Money Laundering Regulations 2017 requires a relevant person, where appropriate having regard to the size and nature of its business, to establish an independent audit function. The statutory qualification matters. The requirement is proportionate rather than identical for every practice.
Where the requirement applies, however, holding Lexcel or CQS does not remove it. The issue is whether the firm has an appropriately independent process that examines the adequacy and effectiveness of its AML policies, controls and procedures and makes recommendations where improvement is required.
Nor should independence be confused with distance. An audit is not effective simply because somebody outside the firm conducted it. The reviewer must have the expertise, scope and evidence necessary to test AML arrangements rather than conduct a broad quality assessment.
Firms should also decide the timing of an audit by reference to risk. Our guide to how often a firm should conduct an independent AML audit considers the regular cycle as well as events that should trigger an earlier review.
The budget problem nobody likes discussing
In principle, quality accreditation and an independent AML audit are complementary. One does not exclude the other. In practice, many high street firms operate within tight compliance budgets and must decide which exercises receive priority.
CQS may be commercially necessary because lender panel membership depends upon it. Lexcel may support wider standards, tendering, insurance discussions and the firm’s public reputation. A specialist AML audit may therefore be postponed because it feels less immediately visible.
That calculation can prove expensive. The cost of an audit should not be compared only with the price of another accreditation exercise. It should be compared with the potential cost of an SRA investigation, remediation work, management time, reputational damage and lender panel removal.
Would your AML framework withstand a specialist review?
A quality accreditation and an independent AML audit answer different questions. Start by understanding what a dedicated audit should examine and what should happen after the report is delivered.
An audit report is not the finishing line
Commissioning an audit does not itself make a firm compliant. The value lies in the quality of the testing and the action taken afterwards.
Partners should receive the findings, assign responsibility, set deadlines and retain evidence of remediation. Policies may need to be rewritten, but file level behaviour must change as well. Training should address the weaknesses actually found. Follow up testing should confirm that the new controls operate consistently.
This is particularly important if a lender or panel manager asks what the firm has done in response to a regulatory issue. A promise to improve is less persuasive than a documented audit, a completed remediation plan and evidence from subsequent file reviews.
The harder question for accredited firms
The lesson is not that Lexcel or CQS lacks value. Nor is it that every accredited firm has weak AML controls. The lesson is that a general quality mark should never be mistaken for specialist AML assurance.
Partners, MLROs and compliance officers should ask themselves:
- What exactly did our most recent accreditation assessment test?
- How deeply did it examine our AML files and decision making?
- When did somebody independent last test whether our AML controls work in practice?
- Could we evidence remediation if the SRA contacted us tomorrow?
- Have we assessed the effect that an adverse regulatory finding could have on our lender panels?
A badge may demonstrate commitment to standards. It cannot replace the need to test the risks that matter most.
For conveyancing firms dependent on lender panels, that distinction may determine whether an AML weakness is identified privately and corrected, or discovered publicly after the commercial damage has already begun.