The AML Shake-Up: What the Move from SRA to FCA Means for UK Law Firms

AML supervision for UK law firms is undergoing the most significant structural change in a generation. In October 2025, the UK government announced that the Financial Conduct Authority (FCA) will become the Single Professional Services Supervisor for anti-money laundering and counter-terrorism financing, replacing the Solicitors Regulation Authority (SRA) and 21 other professional body supervisors currently operating across the legal and accountancy sectors.

For UK law firms, this is not a routine regulatory update. It is a fundamental shift in who is watching, how they watch, and what the consequences will be when things go wrong. The FCA operates with a different philosophy, broader enforcement powers, and a significantly more severe penalty framework than the SRA has ever applied to the legal profession. Understanding that difference, and preparing for it, is the most important compliance task facing legal firms right now, even though the transition itself may not be fully complete until 2028.

This blog sets out what is changing, why it matters, what the FCA will expect, and what law firms need to be doing with the preparation window they currently have.

Why the Government Decided to Act

The case for reform had been building for several years. The UK’s AML supervisory regime for professional services had long been criticised as fragmented and inconsistent. At the point of the government’s announcement in October 2025, AML supervision across the legal and accountancy sectors was divided between 22 separate professional body supervisors, each applying their own standards, conducting oversight at their own pace, and enforcing with their own tools.

The Financial Action Task Force (FATF), the international body that evaluates countries’ effectiveness in tackling money laundering and terrorist financing, had raised concerns about this fragmentation. The UK is due to undergo its next FATF evaluation in August 2027, and the government’s decision to consolidate AML supervision was explicitly framed, in part, as a response to the need to demonstrate a more robust and consistent approach ahead of that review.

The government concluded that the solution was the creation of a Single Professional Services Supervisor (SPSS), with the FCA as the nominated body. Four possible reform models had been consulted on since 2023. The option ultimately selected, a single FCA-led supervisor replacing all 22 professional body supervisors, was the most significant structural change available.

The Financial Services and Markets Bill, which includes the legislative provisions to enable this transfer, was introduced to Parliament and reached its first debate in the House of Lords in June 2026. Primary legislation is required before the transfer can take full effect, meaning the SRA will retain its AML supervisory function throughout most of 2026. But the direction of travel is confirmed and irreversible.

What the Shift to a Single Professional Services Supervisor Actually Means

The transfer of AML supervision to the FCA does not change the underlying legal obligations that UK law firms are subject to. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) and the Proceeds of Crime Act 2002 remain fully in force. Firms must continue to maintain firm-wide risk assessments, implement appropriate policies, controls and procedures, conduct client and matter-based risk assessments, and carry out customer due diligence on the same basis they do today.

What changes is who enforces those obligations, with what tools, and with what consequences for failure.

The SRA’s role will not disappear entirely. The SRA will continue to regulate solicitors in all other respects, covering professional standards, accounts rules, and professional conduct. But AML supervision specifically will transfer to the FCA, which will take on the powers to inspect, investigate, and enforce against law firms for failures under the MLRs.

This creates a supervisory architecture where a law firm may have to satisfy two regulators about overlapping aspects of its practice, a concern that has been explicitly raised by the Law Society, the Solicitors Disciplinary Tribunal, and a range of legal sector commentators. The practical implications of that architecture are explored further below.

How the FCA’s Approach Differs from the SRA’s

The most important thing for law firms to understand about this transition is that the FCA is not simply the SRA with a different name. The two regulators have fundamentally different approaches to supervision, and the gap between them is significant.

The SRA’s approach to AML supervision has been broadly characterised as guidance-led and collaborative. It has operated with a focus on supporting firms to comply, offering engagement, corrective guidance, and, until relatively recently, financial penalties that were modest by any standard. Its supervisory model reflected an understanding of legal practice, built over many years of working with more than 10,000 regulated firms across every area of law.

The FCA’s approach is materially different. As Priya Giuliani, a Partner at HKA, has noted in analysis of the proposed transfer: the FCA brings sharper scrutiny, broader powers, and a data-driven lens. This is a regulator whose enforcement philosophy is grounded explicitly in deterrence, which uses data analytics to identify and prioritise high-risk firms, and which expects the entities it supervises to demonstrate proactive risk management rather than wait for supervisory prompts.

The FCA’s track record in financial services provides the clearest indication of what law firms can expect. In its 2024 “Good and Poor Practice” review of corporate finance firms’ AML compliance, the FCA highlighted persistent weaknesses in client due diligence, ongoing monitoring, and senior management oversight, and explicitly warned that firms failing to meet standards would face enforcement action. This was not guidance. It was a warning, and enforcement followed.

Law firms that have operated comfortably within the SRA’s collaborative framework may find that the FCA’s expectations require a more fundamental shift in how AML compliance is structured, evidenced, and governed than they currently appreciate.

The Penalty Gap: Why This Change Has Real Financial Consequences

The difference in penalty frameworks between the SRA and the FCA is stark and deserves particular attention.

Under the SRA’s regime, fines for AML failures were capped at £25,000. In practice, enforcement actions in late 2025 resulted in fines ranging from £658 for smaller firms to £300,000 for more significant historical compliance failures, with more than 35 fines issued totalling over £565,000.

The FCA operates with no equivalent cap. It has issued fines of tens of millions of pounds against financial institutions for AML failings, including weaknesses in customer due diligence, beneficial ownership verification, and transaction monitoring. While the legal sector differs in character from major banks and investment firms, there is nothing in the FCA’s enforcement framework that limits its penalties for law firms to the scale that the SRA has historically applied.

The proposed framework also introduces mandatory registration of all AML/CTF in-scope firms, with “fit and proper” assessments for beneficial owners, operators, and managers (BOOMs). These requirements are significantly more extensive than anything the SRA has applied. Non-compliance with the BOOM requirement is not a regulatory failing. Under the existing MLRs, it is a criminal offence, carrying liability to a fine or imprisonment of up to two years.

For law firms that have treated AML compliance as a background administrative function, the financial and criminal exposure that FCA supervision will introduce represents a material escalation in risk.

The Double Jeopardy Problem

One of the most practically significant concerns raised about the transition has been the risk of “double jeopardy” for law firms caught in AML compliance failures during the transitional period and beyond.

The Solicitors Disciplinary Tribunal has explicitly flagged this concern in its consultation response. Because the SRA will continue to regulate solicitors on professional conduct matters, a firm that fails on AML obligations may face enforcement action from the FCA for breach of the MLRs and enforcement action from the SRA for breach of the SRA Code of Conduct for Firms, which requires firms to maintain effective systems and controls to ensure compliance with regulatory and legislative requirements.

As Fox Williams has set out in analysis of the transition, the same conduct, such as a failure in customer due diligence, may engage both regulators simultaneously, potentially resulting in duplicate fact-finding, inconsistent outcomes, and compounded financial exposure. The Law Society has raised additional concerns about dual fees, where firms may be required to pay levies to both the FCA and their professional body, as well as concerns about regulatory overlap more broadly.

The Treasury has acknowledged that some degree of dual regulation is inevitable during the transition. For law firms, this means the period between now and the full transfer of supervision is not a period of reduced scrutiny. It is a period in which both the SRA and the FCA will have legitimate interest in the quality of AML compliance, and in which failure could engage both regulators concurrently.

Where Current AML Compliance in the Legal Sector Actually Stands

Against this backdrop, the SRA’s own data on the current state of AML compliance in the legal sector makes for uncomfortable reading.

The SRA’s 2024-25 AML Annual Report recorded 935 proactive AML engagements during the reporting period, almost double the 545 recorded in the previous year, across on-site inspections, desk-based reviews, thematic work, and AML audit reviews. Of those, 833 firms underwent either on-site inspections or desk-based reviews.

The compliance picture revealed by those engagements was concerning. Approximately one-third of firms reviewed were found to be non-compliant with AML obligations. Over half were rated only partially compliant on policies, controls, and procedures. Key areas of deficiency included firm-wide risk assessments, customer due diligence, and ongoing monitoring, which are precisely the areas the FCA’s enforcement history suggests it will examine most rigorously.

The FCA’s own data adds further context. In 2023-24, the FCA rejected 44% of firm applications to operate in the financial services sector, while the SRA accepted all legal sector applicants. This is not a statistic that predicts how the FCA will treat existing law firms, but it is a meaningful indicator of the FCA’s general approach to regulatory standards and the threshold it applies to those it supervises.

What the FCA Will Expect UK Law Firms to Demonstrate

Based on the FCA’s existing supervisory approach in financial services, and the proposals set out in the consultation, legal sector firms can anticipate a supervisory model built around several distinct expectations that differ materially from the SRA’s historic approach.

Real-time understanding of client and matter risk is one of the most significant shifts. The SRA’s approach has largely tolerated annual risk review cycles. The FCA expects firms to maintain current, dynamic understanding of the risk profile of each client relationship, with monitoring tools that can identify changes in risk rather than simply recording them at onboarding.

Documented, evidence-based compliance is another clear expectation. The FCA does not accept the existence of a policy as evidence of compliance. It expects firms to demonstrate that policies work in practice, with audit trails showing how decisions were made, how risks were assessed, how due diligence was conducted, and how exceptions and escalations were handled.

Quality of Suspicious Activity Reports (SARs) will also be scrutinised. The Law Society has noted that firms will need to ensure the quality of their SARs, particularly around the articulation of suspicion, reflects the FCA’s standards rather than the more variable quality currently accepted under the SRA regime.

And the FCA will expect senior accountability to be clearly defined and demonstrated. Its supervisory approach in financial services consistently focuses on whether boards and senior leaders can demonstrate active governance of compliance, not simply confirm that a compliance function exists.

The Timeline: What Firms Can Expect and When

The transition will not happen overnight, and firms should understand the likely timeline clearly to plan their preparation effectively.

The Financial Services and Markets Bill, which enables the transfer, received its first debate in the House of Lords in June 2026. Primary legislation is required before the FCA can assume formal supervisory powers. The expected timeline, subject to parliamentary availability, is broadly as follows: a new AML Supervision Bill expected to be announced in summer 2026; draft legislation defining FCA powers in autumn 2026; Royal Assent expected around mid-2027; and preparatory and transition phases, including mandatory firm registration, fit and proper assessments, and publication of a new AML Handbook, expected through 2027 and 2028.

The SRA will therefore retain its AML supervisory function throughout 2026 and into 2027. But this does not mean the transition is a future concern. The SRA’s own enforcement approach has already been intensifying, with the volume of AML engagements nearly doubling year on year. And the standards the FCA will apply from 2027 are the standards against which law firms’ current compliance infrastructure will be assessed when the transfer takes effect.

The firms that begin preparing now are building compliance infrastructure that will satisfy both the current SRA requirements and the higher bar the FCA will set. The firms that wait are choosing to make that transition under pressure, with less time, fewer options, and no room to address gaps at pace.

The Operational Implication Nobody Is Talking About

The legal profession’s response to this transition has largely focused on the regulatory and legal dimensions. What has received less attention is the operational implication for law firms, particularly smaller and mid-sized practices.

Meeting FCA-level AML expectations is not simply a matter of policy. It is a matter of process, capacity, and governance. Dynamic client risk monitoring, evidence-based due diligence, audit-ready documentation, quality SAR production, and active senior accountability all require operational infrastructure, not just policy documents. And that infrastructure has to work consistently, across every client, every matter, and every fee earner, not just in the files that happen to be reviewed on a given day.

For many law firms, the honest answer to the question of whether their current AML operation could withstand FCA-level scrutiny is uncertain. Not because their intent is wrong, but because the processes that currently produce adequate SRA compliance are informal, inconsistent, and insufficiently documented to produce the evidence trail the FCA will expect to see.

The compliance challenge the FCA transition creates is, at its core, an operational one. Who owns each element of the AML process? How is it documented? How is client risk monitored on an ongoing basis? Who reviews and signs off on due diligence? Where is the audit trail? These are operational questions, and answering them requires operational investment.

Where BPO Support Fits Into AML Compliance Preparation

For law firms facing this transition, structured operational support offers a practical and proportionate way to build the compliance infrastructure the FCA will expect, without absorbing the entire cost and complexity internally.

Business process outsourcing in a legal compliance context is not about delegating legal judgement. It is about building the structured, documented, consistent processes that sit behind that judgement and make it evidenceable. That includes client onboarding administration and documentation management, ongoing monitoring workflows that flag changes in client risk profiles, systematic file review processes that maintain documentation standards across the practice, and the operational governance that makes compliance visible and auditable rather than informal and assumed.

For smaller and mid-sized law firms in particular, where the resources available to build this infrastructure internally are constrained, structured external support provides access to compliance-oriented process design and capacity that would be difficult to build and maintain in-house at a proportionate cost.

The window between now and the FCA’s formal assumption of supervisory powers in 2027 and 2028 is the time in which that infrastructure can be built thoughtfully, tested against the SRA’s current requirements, and refined to meet the higher bar the FCA will set. Firms that use this window well will enter the new supervisory regime from a position of strength. Firms that do not will be building under pressure, against a regulator with significantly more enforcement capability than any law firm has faced before.

At Alpha BPO, we support legal sector organisations with structured operational frameworks, compliance documentation support, and the process discipline that FCA-level expectations will require. If the AML transition is a concern for your firm, we would welcome the conversation.

Conclusion

The transfer of AML supervision from the SRA to the FCA is the most significant change to the regulatory environment for UK law firms in a generation. It is not a routine handover between comparable bodies. It is a shift to a regulator with a different philosophy, broader powers, and enforcement capability that dwarfs anything the legal profession has previously faced under the SRA.

The underlying AML obligations remain unchanged. The standards against which compliance will be assessed, and the consequences of falling short, are about to change substantially.

The firms that will navigate this transition best are not necessarily the largest or the best resourced. They are the ones that have looked honestly at their current AML compliance infrastructure, identified where it relies on informal processes and individual commitment rather than documented systems and evidenced governance, and invested in building something more robust while the window to do so is still open.

The timeline gives most firms the opportunity to prepare properly. The direction of travel gives them no justification for not doing so.

Sources and Outbound Links

Published On: 16 July, 2026
Table of contents
Related articles