For many law firms, anti-money laundering (AML) compliance has become a routine exercise. The client is identified, sanctions and PEP screening is carried out, a form is filled in and the matter moves on. Yet ticking every box does not mean a firm has grasped the risk in front of it.
According to SmartSearch, Even with advanced compliance software, thorough policies and regular training, firms can still fall short if fee earners fail to apply professional judgement to each client and matter.
Regulators are increasingly alert to this gap. In its 2024/25 AML reporting, the Solicitors Regulation Authority (SRA) judged 39% of client and matter risk assessments to be ineffective, while 16% of files either had no assessment at all or had an incomplete one. The message is that compliance cannot rest on proof that checks were done. Solicitors must show they understood the risks, weighed them and reached a reasoned decision.
A client risk assessment looks at the risks posed by the individual or company, while a matter risk assessment focuses on the specific legal work. The two can diverge sharply. A long-standing, low-risk corporate client may bring a transaction involving unusual jurisdictions, opaque ownership structures or unexplained funding. A rating of low or medium means little on its own.
What matters is the reasoning behind it: whether the transaction fits the client’s profile, whether source of funds is consistent, what information is missing and why the firm is comfortable proceeding.
Onboarding is only the beginning. The decision to keep acting is itself a risk-based judgement, and regulators warn against assuming that established clients are inherently safer. Under regulation 28(11) of the Money Laundering Regulations, ongoing monitoring is mandatory. Changes in beneficial ownership, business activity or funding sources can all alter a client’s risk profile, and a check completed years ago offers no answer to new concerns.
The SRA has criticised firms for relying on simple yes/no forms, generic templates and scoring systems that create false precision. Such approaches encourage fee earners to repeat familiar patterns, leave no space to record unusual context and allow the rationale behind decisions to disappear. A client does not become low risk simply because a spreadsheet says so.
Stronger processes start with a consistent framework, such as the SRA’s own template tailored to a firm’s practice areas. Assessments should require written reasoning, link directly to the level of due diligence needed and be reviewed meaningfully rather than re-ticked. Technology also has a role.
Platforms such as SmartSearch can verify data, screen against sanctions and PEP lists, support configurable workflows and monitor for change. But technology should support judgement, not replace it.
Ultimately, the best AML process is not the longest questionnaire, but the one that proves a firm understood the risk and had a defensible reason to continue.
Read the full SmartSearch post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
