Nine Years Without a Documented FWRA: What This SRA Fine Teaches

A small London law firm has been fined £6,180 after an SRA desk based review found that it had operated for almost nine years without a documented firm wide risk assessment and could not produce client and matter risk assessment records on half of the files examined.

The practice is based in north west London and currently has two SRA regulated solicitors listed on the regulator’s register. The firm’s identity is not important for present purposes. The value of the published SRA regulatory settlement lies in what it demonstrates about the regulator’s approach to AML evidence in a small practice.

Almost nine years without a documented FWRA

The firm admitted that between 26 June 2017 and March 2026 it did not have a documented assessment of the money laundering and terrorist financing risks to which its business was exposed. This was a failure to comply with Regulations 18(1) and 18(4) of the Money Laundering Regulations 2017.

The duration mattered. The SRA described the absence of proper documentation for almost nine years as a pattern of misconduct and assessed the nature of the conduct as more serious.

A firm wide risk assessment is not an administrative introduction to the AML policy. It should identify the risks arising from the firm’s clients, services, transactions, delivery channels and geographic exposure. Those conclusions should then shape the firm’s policies, controls, procedures and matter level assessments.

A generic document cannot reliably perform that function. Firms that have not recently tested whether their assessment reflects their actual practice should consider a bespoke firm wide risk assessment rather than assuming that an old template remains defensible.

Three missing CMRAs from six files

The file review produced an equally important finding. The firm was unable to maintain or produce records of its client and matter risk assessment on three of the six files examined.

This illustrates the danger of treating client due diligence and risk assessment as the same exercise. Obtaining identification documents or an electronic verification result does not, by itself, record the risks presented by the client and the particular matter. Nor does it explain why the level of due diligence and monitoring was appropriate.

A properly recorded AML client and matter risk assessment should identify the relevant risk factors, explain the resulting rating, record the measures used to manage those risks and be reviewed when circumstances change.

Good policies did not cure missing evidence

The outcome is particularly instructive because the SRA acknowledged the strength of the firm’s policies, controls and procedures and its assurances concerning oversight. The regulator also recorded that there was no evidence of client harm.

Those factors helped keep the assessed risk of harm low, but they did not remove the underlying breaches. Written policies can describe what should happen. The FWRA and completed file records help demonstrate why those controls were selected and whether fee earners actually followed them.

That is why AML policies should be reviewed as part of one connected framework. Firms needing to update the written component can examine these AML audit and policy resources, but the resulting procedures must still be implemented and evidenced on files.

This is also where an independent AML audit can provide protection that an internal document review may not. A properly conducted audit should test a sample of files, compare actual practice with the FWRA and AML policies, identify missing or inadequate CMRAs and report whether previous corrective action has been completed. Its value lies in finding the weakness before a regulator selects its own sample.

Remediation reduced the penalty, but came after intervention

The SRA recognised that the firm cooperated, introduced a documented FWRA, reviewed its in scope files to ensure that they contained CMRAs and provided training to fee earners. The basic penalty was consequently reduced from £7,725 to £6,180.

That is useful mitigation, but it also exposes the commercial weakness of waiting for regulatory intervention. By that point, the firm was responding under pressure, paying investigation costs and facing publication of the outcome.

As previously explained in why an independent AML audit should be the first move, firms are better served by identifying the gap themselves. An audit should test not only whether the required documents exist, but whether they correspond with one another and operate consistently across sampled files.

The work does not finish when an audit report is delivered. Our article on what must happen after a Regulation 21 independent AML audit explains why findings require named actions, deadlines, oversight and evidence that remediation has been completed.

The practical lesson

The decision is not simply a warning to firms that have no AML documents. It demonstrates that the SRA may compare the firm’s stated framework with a small sample of files and ask whether the practice can prove that its controls were followed.

For an MLRO, the immediate questions are straightforward:

• Is the current FWRA documented, tailored and approved?
• Can the firm produce a completed CMRA for every relevant file?
• Do those assessments contain reasoning rather than unexplained ratings?
• Are changes in risk recorded through ongoing monitoring?
• Can management demonstrate that weaknesses are identified and corrected?

For more practical articles on audit preparation, risk assessments, file testing and responding to findings, browse our independent AML audit guidance for solicitors and law firms.

This article is for general information only and does not constitute legal or regulatory advice. The underlying regulatory outcome was reached by agreement and should be read in full for its precise facts, admissions and mitigation.