A client and matter risk assessment records “high risk”. The conveyancer carries on with the purchase. What should another reviewer expect to find between those two events?
The answer should include a reasoned assessment, appropriate additional measures, any required approval and a clear record of what remains outstanding. A risk rating alone does not demonstrate that the identified risks have been addressed.
The SRA’s AML policies, controls and procedures guidance, published on 22 October 2026, reinforces the importance of connecting written procedures with action on individual matters.
This concern is consistent with Lexsure’s findings during independent AML audits. Assessments may be missing, contain unsupported ratings or identify risks without demonstrating what the firm did in response.
The SRA’s findings: having a CMRA procedure did not ensure it was followed
In its latest guidance on AML policies, controls and procedures, the SRA reports that 135 firms were referred for a lack of client and matter risk assessments on files during its 2024–25 reporting year.
Of those firms, 111 had documented CMRA processes within their AML policies, controls and procedures. Those processes were not being followed.
The guidance also includes an illustrative tailored procedure connecting the assessment with where it is saved, enhanced due diligence and an identified approval route.
For conveyancing firms, that creates two practical questions: are assessments being completed, and do their findings influence how the transaction is handled?
Explain the rating before deciding the response
A reviewer should be able to understand why the matter has been assessed as higher risk.
“Property purchase” describes the legal service. It does not explain the particular client, funding, ownership structure or transaction features being considered.
Likewise, “overseas funds” may identify a feature requiring consideration without explaining its significance in the circumstances.
A useful assessment records:
- The relevant client and transaction features.
- The information and evidence considered.
- Why those features affect the assessment.
- What remains unclear or requires further investigation.
Distinguish the risk presented by the circumstances from the effect of the controls applied. If your assessment records a residual risk rating, the file should explain which measures support that conclusion.
“Apply EDD” needs to lead to specific action
An instruction to apply enhanced due diligence is a starting point. It should lead to measures appropriate to the identified risks and any specific requirements that apply.
Depending on the circumstances, that may involve further enquiries into ownership or control, additional evidence about funds or wealth, closer examination of the transaction’s purpose, additional approval or enhanced monitoring.
The file should make clear what was required, who would undertake it and how the response was assessed.
Collecting more documents without considering whether they resolve the concern may leave the original risk unanswered.
An illustrative purchase: the funding arrangement changes
A buyer initially explains that their contribution will come from personal savings. Shortly before exchange, they say that part will instead be paid by a relative’s company.
The change does not automatically prove suspicion or dictate a particular risk rating. It does mean that the original explanation no longer describes the proposed arrangement in full.
A practical assessment would consider questions such as:
- Who is providing the money and why?
- Is the contribution a gift, loan or another arrangement?
- What is the relationship between the buyer, the relative and the company?
- What enquiries and supporting evidence are appropriate?
- Does the arrangement create separate lender-reporting or other legal issues?
- Who must review the findings before the matter proceeds?
This is a hypothetical example. The enquiries required depend on the facts, risks and applicable requirements.
The updated CMRA should connect the new information with the action taken. Adding “third-party funds” to the form without recording a response would leave the assessment incomplete as a decision-making record.
Make the connection visible on the file
| Stage | What should be identifiable? |
|---|---|
| Risk identified | The relevant feature and why it matters in this transaction. |
| Response required | The enquiries, evidence, checks or approvals needed. |
| Evidence assessed | What was obtained, what it established and any unresolved inconsistencies. |
| Decision reached | The reasoning, decision-maker and any conditions attached to proceeding. |
| Monitoring arranged | The matters requiring further attention and the circumstances that trigger review. |
The assessment does not need to repeat every document. Clear references can connect the reasoning with the evidence, provided another authorised reviewer can follow them.
Our article on the AML evidence chain explains why the firm-wide assessment, procedures and individual matter records should remain connected.
Define what an approval actually covers
An approval should identify the decision being made. Approval to accept instructions at the outset does not automatically resolve a funding change introduced later.
Where the firm requires compliance sign-off, record who gave it, when, the information considered and any conditions.
A condition such as “obtain further evidence before proceeding” should remain visible until it is satisfied. A general approval marker should not obscure outstanding work.
The firm’s procedures should also explain the escalation route when the usual approver is unavailable or the concern involves someone senior within the practice.
A revised rating should follow the evidence
Obtaining additional information does not necessarily mean the risk has reduced. The information may resolve an uncertainty, confirm an existing concern or reveal a new one.
A rating should reflect the assessment reached, with the reasoning recorded. It should not be changed simply to allow the workflow to progress or make the file appear complete.
Equally, a higher-risk classification does not automatically prohibit acting. The firm must consider the applicable requirements, its risk appetite, the controls available and whether it can lawfully and appropriately proceed.
Where knowledge or suspicion arises, staff must follow the appropriate reporting and escalation procedures. That is a separate question from selecting a risk category.
Use digital assessments to support judgement and oversight
A structured digital assessment can help a firm organise its approach and make outstanding work easier to identify. Its value depends on the quality of the information entered and the judgement applied.
CDDmonitor’s digital client and matter risk assessment service provides support for initial assessments, ongoing monitoring and management oversight.
When evaluating a system, consider whether the firm’s process enables staff and supervisors to identify:
- The reasons supporting the assessment.
- The measures required in response.
- Unresolved enquiries and approval conditions.
- Changes occurring during the transaction.
- The evidence supporting the final decision.
Software supports the assessment process. It does not transfer responsibility for professional judgement away from the firm.
Review what happened after the rating
A supervisor reviewing a completed CMRA should follow the identified risks into the subsequent file activity.
If additional enquiries were required, were they made? If approval was conditional, were the conditions satisfied? If the funding changed, was the assessment reconsidered?
Our guide to source-of-funds testing during internal AML file reviews explains how to examine the investigation and conclusions.
Where the assessment identifies a risk but staff are unclear about the response, review the instructions. Our article on tailoring AML policies for conveyancing work considers how to turn generic requirements into usable procedures.
What independent AML scrutiny can establish
An independent AML audit can test whether assessments are timely, supported by evidence and reflected in the handling of the matter.
Lexsure’s audit findings illustrate why this matters. A form can exist without demonstrating an effective assessment, and an assessment completed retrospectively may not show how risk informed earlier decisions.
Regulation 21 requires an independent audit function where appropriate to the size and nature of the business. It does not impose a universal requirement for every firm to purchase an annual external audit.
A useful immediate check is to select a matter assessed as higher risk and ask: can we demonstrate what happened because of that assessment?
Do your CMRAs influence the work on your files?
Lexsure’s independent AML audits examine risk assessments alongside client files, procedures and staff understanding to identify gaps between recorded risks and the action taken.
Discuss a review appropriate to your firm’s size, conveyancing work and risk exposure.
Discuss your firm’s independent AML audit →
An independent audit supports oversight. Responsibility for AML compliance remains with your firm.