Risk assessments: anti-money laundering

Overview

Regulation 18 of the Money Laundering Regulations 2017 (MLR 2017) requires law firms to carry out a written risk assessment to identify and assess the risk of money laundering that they face.

Carrying out a risk assessment will help you to:

• develop policies, procedures and controls to reduce the risk of money laundering
• apply a risk-based approach to detecting and preventing money laundering
• understand the level of risk associated with certain business relationships and transactions
• make appropriate risk-based decisions about clients and retainers

It’s important that you keep your risk assessment under review.

The Solicitors Regulation Authority (SRA) may ask to see your assessment – especially if something goes wrong with compliance at your practice.

More detailed information can be found in chapter 2 of the anti-money laundering guidance for the legal sector.

Practice-wide risk assessment

There are no set rules that indicate your firm is at high risk of exposure to money laundering activity.

The conclusions of your practice-wide risk assessment are a matter of judgement and should reflect the nature of your work and clients.

However, your practice-wide risk assessment should consider:

• the UK's national risk assessment of money laundering and terrorist financing (NRA), updated in July 2025
• the National Crime Agency's national strategic assessment of serious and organised crime, updated in March 2025
• the SRA’s sectoral risk assessment, updated in July 2023

Your practice-wide risk assessment should also:

• clearly state what you do when you identify a high-risk client or matter
• reference your firm’s policies, controls and procedures
• list the steps your firm has taken to reduce the money laundering risk it faces

The MLR 2017 outlines what you should consider in your risk assessment, including:

• the clients you act for
• whether you work in or with countries that, for example, have significant levels of corruption or are subject to sanctions
• whether you offer services in practice areas deemed ‘high risk’ due to holding client money
• the characteristics of transactions, including the source of funds and whether a transaction is outside your firm’s normal area of work
• your firm's delivery services, including the use of agents and intermediaries or online services

For a full list of factors your risk assessment should consider, see section 2.3 of our anti-money laundering guidance for the legal sector.

It’s important that your risk assessment is written down and kept up to date.

Your risk assessment can be formatted in multiple ways, including in paragraphs, as a table or a matrix with risk ratings.

Make sure that when you complete your risk assessment you:

• keep a record of the sources you use
• review it regularly, reflecting changes in your circumstances or to the SRA's risk assessment. You should keep a note of when you carry out these reviews

Client and matter risk assessments

As well as a practice-wide risk assessment, you need to undertake a risk assessment at client and matter level.

This will inform the way you conduct your customer due diligence and ongoing monitoring.

You can use the SRA client and matter risk template as a base to develop a risk assessment tailored to your firm.

The factors listed in the SRA template are not exhaustive.

There may be other risk factors you should consider depending on the nature of the client or matter and your firm’s risk appetite.

Your processes for carrying out the client and matter level risk assessment should be set out in your practice-wide risk assessment. See section 2.5 of the guidance for the legal sector.