“The firm undertakes ongoing monitoring.” Could a new conveyancer read that sentence and understand what they must do? It does not explain when to review a matter, where to record a change or who to approach when the client introduces a different funding arrangement.
The SRA’s AML policies, controls and procedures guidance, published on 22 October 2026, emphasises the importance of tailoring documentation to the firm. Its practical examples illustrate the difference between describing a legal obligation and explaining how staff should fulfil it.
For conveyancing practices, this is an opportunity to test whether the AML manual helps fee earners make and record decisions during a transaction.
The wider concern is consistent with Lexsure’s findings during independent AML audits: written procedures and what happens on individual files do not always align.
Tailoring means more than adding your firm’s name
A template can provide a useful starting structure. Effective tailoring requires the firm to consider its services, clients, systems, responsibilities and approval arrangements.
Replacing the name on the cover does not explain how an instruction operates in your practice.
The SRA’s guidance on AML policies, controls and procedures includes examples of tailored wording. The practical question for your own review is whether the document accurately describes the steps staff can and should follow.
Our article on six AML policy gaps conveyancing firms should check considers missing coverage. This article addresses the quality of the instructions within that coverage.
Give staff five practical answers
For each important procedure, check whether the wording answers:
- Who acts? Identify the responsible role.
- When? Explain the trigger or stage at which action is required.
- What must they do? Describe the action and any relevant judgement.
- Where is the evidence recorded? Identify the system, form or approved location.
- What happens if the issue remains unresolved? Explain the escalation and decision-making route.
The examples below illustrate that approach. They are drafting examples, not complete policy clauses, and should not be copied without checking them against your firm’s arrangements and applicable requirements.
Example one: a change in the buyer’s funding
Generic wording: “Fee earners must undertake ongoing monitoring and keep risk assessments up to date.”
This states an objective but leaves the practical response unclear.
Consider a buyer who originally proposes to use savings but later says that a relative will provide part of the contribution. A useful procedure should explain how that change reaches the fee earner, how the revised arrangement is assessed and what must be recorded.
More operational wording might explain:
Where you become aware of a change in the source, provider or route of funds, review the funding explanation and the client and matter risk assessment. Obtain and assess further information appropriate to the circumstances. Record the change, evidence considered, conclusion and any approval required under the firm’s procedures before taking the affected transaction step.
The firm would then identify the relevant recording location, approval roles and escalation procedure.
The instruction should support a risk-based assessment. It should not suggest that every change is suspicious or that the same documents are appropriate in every case.
Example two: an electronic verification result
Generic wording: “The firm uses electronic verification to complete AML checks.”
Staff need to understand what the service checks, what the result means and what remains for them to assess.
A useful procedure identifies:
- Who reviews the result and any alerts.
- What staff must do with an incomplete or inconsistent result.
- Which additional enquiries or approvals may be needed.
- Where the result and decision are retained.
- How concerns are escalated.
An electronic result should not become an unexplained substitute for the firm’s assessment of the client, transaction and relevant evidence.
Check that the procedure reflects the service the firm actually purchases and the way staff use it.
A risk rating should lead to a defined response. Our guide to what happens after a CMRA identifies higher risk explains how enquiries, mitigation, approval and monitoring should connect with the assessment.
Example three: compliance approval
Generic wording: “Higher-risk matters require compliance approval.”
Who provides that approval? What information must they consider? Where is the decision recorded? What happens if they are unavailable?
A procedure should distinguish the actions required of the fee earner from the decision made by the authorised reviewer. It should also explain any conditions attached to approval and how those conditions are monitored.
An approval to accept instructions should not be treated as automatic approval of every later change in the matter.
Where one person holds several compliance roles, describe the decision by reference to the relevant responsibility. Avoid assuming that the COLP, COFA, MLCO and MLRO are interchangeable.
Example four: scrutinising source-of-funds evidence
Generic wording: “Obtain evidence of source of funds.”
That instruction may lead to document collection without sufficient consideration of whether the documents support the explanation.
A clearer procedure explains that the fee earner must consider the evidence against the recorded funding arrangement, investigate material inconsistencies and record the reasoning behind the conclusion.
The appropriate enquiries depend on the risks and circumstances. A fixed number of bank statements does not automatically establish that the investigation is sufficient.
Our guide to testing source of funds during internal AML file reviews explains how supervisors can assess the quality of that work.
Make the written procedure match the available workflow
A policy may require a particular form or approval, but the case-management system may contain an older version or allow the matter to progress without the required step.
Before approving revised wording, ask a fee earner to demonstrate the procedure on the system.
- Can they find the current form?
- Is the responsible reviewer identifiable and available?
- Can the required evidence and reasoning be recorded?
- Are conditions or outstanding actions visible to another person handling the matter?
- Does the accounts team receive the information relevant to its responsibilities?
If the workflow and wording differ, resolve the inconsistency. Do not describe a safeguard as operational if it has not been implemented.
Use policy templates and updates as drafting support
Firms reviewing their documentation can browse the AML policies and procedures available from POLICYmonitor.
The value of a template lies in using its structure and wording to develop instructions that fit the practice. The firm still needs to identify its roles, systems, risk appetite and escalation arrangements.
For continuing drafting support, Lexsure’s AML Policy Update Service provides suggested amendments for consideration. Assess each relevant change, tailor it and decide whether forms, workflows or training also require amendment.
Our October 2026 AML policy update article considers areas firms should review.
Test understanding after making the change
Circulating a revised document records one step in implementation. It does not establish that the instruction is understood.
A short discussion using a realistic scenario can reveal ambiguity. Ask staff what they would do if an expected personal contribution arrives from a company, or if a client’s explanation conflicts with the evidence supplied.
Then review subsequent matters to establish whether the revised procedure is being applied. Record any remaining weaknesses and the action required.
This is also where independent scrutiny can help. An audit can compare the documented process with client files and staff understanding, identifying whether the problem lies in the wording, implementation or both.
Regulation 21 requires an independent audit function where appropriate to the size and nature of the business. The requirement does not mean that every firm must purchase an annual external audit.
Do your AML procedures work for the people using them?
Lexsure’s independent AML audits examine policies, risk assessments, client files and staff understanding to identify gaps between written instructions and everyday practice.
Discuss a review appropriate to your firm’s size, work and risk exposure.
Discuss your firm’s independent AML audit →
An audit supports oversight. Responsibility for AML compliance remains with your firm.