Hello!
AI can produce a really convincing piece of work in seconds. Working out whether it is right, whether the information should have gone into the tool in the first place, and what to charge the client still takes some thought. Our lead article this week looks beyond invented cases to the decisions law firms need to make about supervision, confidentiality and the economics of AI-assisted work.
We also return to PM Law and the SRA’s missed opportunities, and tackle a deceptively simple confidentiality question: who is actually your client?
With practising renewals approaching, there is a practical job for September: checking what sits behind everyone’s continuing competence declaration. And in Compliance Corner, we consider how far you need to go when tracing the origins of money put into a trust more than 20 years ago.
Finally, we have a few spaces left on our COFA Masterclass in Birmingham on 7 October. If you have been meaning to book, the details are below.
Have a good weekend,
Jon and the team
AI risk in law firms is about more than just hallucinations
Checking that a case actually exists is only the start. Which AI tool has been used? Was it firm-approved? What client information went into it? Did the person reviewing the output have the expertise, source material and time to do the job properly?
Clients are using AI too, including to challenge advice and write complaints.
This article addresses the compliance risks identified in the latest SRA Warning Notice on AI misuse, and beyond.
PM Law: would another compliance officer have made any difference?
The independent PM Law review was published a couple of weeks ago. This week, we look more closely at what its published findings mean for the SRA’s approach to financial risk.
How much public protection will the new COLP and COFA eligibility rules provide if serious concerns still struggle to reach the right people and prompt action by the SRA?
Our analysis considers the limits of changing role holders and why the LSB is demanding evidence of better outcomes.
Confidentiality starts with “Who is the client?”
The daughter who makes the appointment. The group finance director who pays your bill. The relative who wants an update on the estate. All may have a perfectly understandable interest in the matter. But that doesn’t mean they are entitled to receive confidential information.
Drawing on our latest internal team discussion, this article explores where confidentiality becomes difficult in everyday practice: family involvement, corporate groups, preliminary enquiries, police requests and the tension between protecting one client’s information and telling another what they need to know.
The starting point is often a better conversation at the beginning of the retainer.
Welcome to Holly Heath Jones, our new Head of Risk and Compliance
We are delighted to welcome Holly Heath-Jones to JBL Compliance as our new Head of Risk and Compliance.
Holly brings more than 20 years’ legal experience and has held senior roles including COLP, MLRO, Training Principal and Executive Director. She has worked within both an insurer-owned law firm and a traditional specialist practice, giving her first-hand experience of balancing regulatory obligations with the commercial and operational realities of running a legal business.
She has also lectured at postgraduate level on legal ethics, governance and risk management, and most recently led strategic risk, governance and learning initiatives within a major multidisciplinary firm.
At JBL, Holly will lead our technical compliance work and help clients turn regulatory requirements into practical, workable systems. Her experience as a former COLP means she understands the pressures compliance officers face—and the importance of advice that works outside the pages of a policy.
We are very pleased to have her on board. You will be hearing much more from Holly through our client work, training and future editions of COLP Insider.
COFA Masterclass – a few places remaining
Birmingham | 7 October 2026 | £495 + VAT per delegate
Could you explain the figures in your latest client-account reconciliation, including the items carried forward from last month? Do you know what you would do if the explanation did not add up?
Our full-day COFA Masterclass is led by Sean Hankin and Liz Bond, both former SRA forensic investigators. It covers reconciliations, breaches, residual balances, banking facilities, accountants’ reports and supervision of the finance function, with space to ask the questions that arise in your own firm.
It is designed for COFAs, finance directors, legal cashiers, managing partners and others responsible for client-money controls. Whether you are new to the role or want to test how your existing arrangements would stand up to scrutiny, the aim is to leave with a clearer understanding of what to check, challenge and record.
There are a few places remaining, with less than three weeks to go.
”This was a really practical and useful course on the role, expectations and responsibilities of a COFA which, if I am honest, I expected to struggle through but it was the most useful course, on the subject, I have ever been on. A must for any COFA.
News and guidance
Law Society calls for a rethink on COLP and COFA changes
The Law Society is pressing the SRA to pause implementation and reconsider its approach to separating compliance roles from unilateral management authority. It wants a stronger evidence base and a model that assesses the risks presented by individual firms, rather than relying principally on turnover and client-money thresholds.
As discussed in our webinar last week (see below), similar firms can fall on opposite sides of a threshold without presenting materially different risks. The Society also wants realistic time for implementation, bearing in mind that some firms will need to recruit.
For now, lobbying for change does not reverse the approval already given. Firms should continue assessing their position and possible options, while tracking updates from the regulator.
Read the Law Society’s statement | Read our article about the approved rules
Small firms call for no-confidence motion in the SRA board
Opposition to the new COLP and COFA eligibility rules continues to grow. The SME & Boutique Law Firm Alliance, now backed by more than 70 firms, has asked the Law Society Council to support both a pause to the reforms and a motion of no confidence in the SRA board following the Axiom Ince and PM Law reviews.
The Conveyancing Task Force has also called for the SRA to publish the evidence showing how separating compliance and management roles would have prevented previous firm failures.
FCA AML supervision: “partnership”, not “us and them”
We now have a clearer indication of the timetable for transferring AML supervision from the professional body supervisors to the FCA.
Speaking in the House of Lords on 7 September, Treasury minister Lord Livermore said that the first businesses are expected to move to FCA supervision before the end of 2028. The transition will be phased, with the broad aim of bringing all affected firms across by mid-2030.
We also have an early indication of the FCA’s intended approach. Speaking at the Law Society’s Economic Crime Conference on 17 September, Stephen Smart, the FCA’s lead for financial crime, struck a deliberately reassuring tone.
He said that the FCA would not take a one-size-fits-all approach or overload firms with requests and paperwork. Its ambition is to use proportionate, predictable and technology-enabled supervision, creating friction for criminals while allowing legitimate businesses to get on with their work. Smart said that he hoped solicitors would experience the relationship as a “partnership”, rather than an “us and them” arrangement.
That does not mean a softer approach to poor compliance. Smart was clear that firms will still be expected to get the fundamentals right. The government’s new AML strategy also points towards more consistent, intelligence-led and outcomes-focused supervision, while possible additional enforcement powers remain under consideration.
The SRA will remain responsible for AML supervision and enforcement until the relevant transfer takes place. Firms should continue reviewing their risk assessments, policies, file controls and training, rather than waiting for the FCA regime to arrive.
Read the Law Gazette report on the FCA’s message to solicitors
Read the minister’s statement in Hansard
New AML strategy promises less box-ticking and better intelligence
The government’s AML and asset recovery strategy for 2026–2029 puts emphasis on the highest risks, better use of financial intelligence and recovering criminal assets. It also expressly targets low-value compliance activity.
For practitioners, that is a welcome ambition. Repeatedly collecting documents that add little to your understanding can consume time without improving the decision. The useful question is what the information tells you about the client, the money and the transaction.
The strategy also addresses professional enablers, cryptoassets and greater use of technology. It does not itself relax your existing obligations. Use it to inform discussion with your MLRO about where the firm’s effort is best spent, rather than as permission to stop checks.
Read the government’s AML and asset recovery strategy
English and Welsh law: check which rules apply
The Law Society’s new practice note on differences between English and Welsh law is worth circulating beyond Welsh offices. A firm based in England can still find itself advising on Welsh property, education, social care or planning.
The shared jurisdiction can make it easy to assume the same legislation, terminology and procedures apply. Increasingly, that assumption needs testing. The note explains important areas of divergence and the need to identify the applicable framework at the outset.
A useful response would be to check whether your opening procedures, precedents and supervision arrangements pick up Welsh matters early enough. An England-only template may look entirely familiar while giving the wrong answer.
MoJ counter-fraud strategy: prevention needs to be built in
The Ministry of Justice has published its counter-fraud strategy for 2026–2030. It focuses on governance, identifying risk, implementing controls and responding when things go wrong, supported by better data and staff capability.
This is a strategy for protecting the department and justice system, rather than a new set of requirements for every law firm. There is nevertheless a useful lesson for firms dealing with public money or reviewing their own fraud controls: build prevention and detection into the process, and give people a clear route to raise concerns.
EU AML rules: relevant for firms with EU offices
The EU’s new AML Regulation moves substantial parts of the regime into directly applicable rules, with tighter requirements on due diligence and beneficial ownership.
If your firm has EU offices, review which entities and services will be affected and what changes their onboarding and monitoring processes will need. A single UK policy should not be assumed to cover the position across the group.
The package is intended to apply from 2027. It does not replace the UK Money Laundering Regulations.
Read the Council of the EU’s explanation and legislative links
What to do this month
Get behind the continuing competence declaration
The practising renewal window runs from 1 to 31 October. In a bulk application, the firm supplies answers about its solicitors, including their ‘continuing competence’, and its authorised signatory confirms that the information is correct. The underlying duty to remain competent still belongs to the individual solicitor.
The practical question is how the signatory gets comfortable with those answers. An email asking everyone to reply “yes” may collect responses efficiently. On its own, it tells you little about the work behind them. See the SRA’s bulk renewal guidance.
We suggest a short process:
- Ask each solicitor to confirm their position in writing, with a link to or copy of their current learning record. Give them a route to raise gaps or uncertainty privately.
- Look for reflection, including needs identified through supervision, mistakes, complaints, new work and changes in law or regulation. A list of webinars does not explain why those activities were needed or what changed afterwards.
- Review a proportionate sample of records, with closer attention where you already have concerns. This is a suggested assurance measure, not a prescribed SRA sampling requirement.
- Decide who resolves exceptions and by when. Do not let a missing response become an assumed confirmation.
The SRA’s approach is based on identifying and addressing development needs, rather than completing a fixed number of hours. Learning should be relevant to the person’s role, including its ethical and regulatory demands. See the SRA continuing competence requirements.
Records can be managed centrally or held by the solicitor within an agreed process. The important practical point is that the firm can obtain and review them when needed. Once you have more than a handful of solicitors, collecting and checking this information becomes a job that needs an owner, a deadline and time in the diary.
AML and financial crime in the legal sector in 2026
Compliance Corner: old trusts and missing source of funds evidence
Q: We have taken over a number of trust files from another firm. Some contain assets settled more than 20 years ago. The clients are elderly and unlikely to have the original financial records. We cannot see that source-of-funds checks were ever done. Must we insist on documents they probably cannot obtain?
A: Start with the circumstances of each trust and the work you are now being asked to do. A missing document from 20 years ago should prompt an assessment, rather than an automatic demand for an impossible paper trail.
For work within the MLRs, regulation 28 requires scrutiny of transactions, including source of funds where necessary, and makes the extent of CDD risk-sensitive. You must be able to justify your approach. That is why a meaningful client and matter risk assessment is useful.
Our suggested starting point is to establish who created the trust, why it was created, what was settled and how it has been managed. Review the deed, accounts and available file history. Ask for an explanation of the original wealth and funds, then consider whether it fits what you know. An inheritance, property sale or established business history may offer avenues for proportionate corroboration even where old bank statements no longer exist.
The age of a trust and a coherent history can be relevant, but neither an elderly client nor the passage of several years necessarily proves the matter is low risk. Trusts are specifically identified as a higher risk legal vehicle. Look for unexplained additions, opaque ownership, unusual distributions, relevant overseas connections or inconsistencies. New funds or a new transaction need their own assessment.
Where the explanation is credible, the surrounding information supports it and the assessed risk is genuinely low, it may be reasonable not to demand original documentary proof of every historic receipt. Record why the available explanation and information are sufficient. That is different from routinely accepting the client’s word for it.
An assessment of low risk also does not dispense with applicable identification and verification obligations.
An absent historic bank statement is not, by itself of course, a finding of money laundering, but if you cannot satisfy the applicable CDD requirements, escalate to the MLRO, who will consider whether a disclosure is required.
This section provides general guidance. If you have a question you would like us to consider, email info@jblcompliance.com.
Free CPD
Recording: COLP and COFA changes approved — what firms need to do now
Missed our latest webinar? The recording looks at the approved COLP and COFA changes, the significance of “unilaterally”, and the practical assessment firms need to make of their governance arrangements.
It is useful viewing for compliance officers and the people making decisions about the firm’s response. Watch it together, then compare your conclusions about who really has the power to make or direct significant decisions alone.
Passcode: ?5cfpdY^
The recording is available for a short time, so please do not leave it too long. After that, it will only be available to subscribers (along with previous recordings and courses).
JBL Compliance training resources
Compliance Officers (COLP and COFA) — £99.99 + VAT
Being appointed, authorised and named on the SRA record is just the beginning of the role. The harder part is knowing what to monitor, what to record, when to escalate and how to demonstrate the steps you have taken.
Our online course covers the background to the regime, appointment and governance, the COLP and COFA roles in practice, recording and reporting, and personal liability and protection. It includes interactive exercises and a final assessment.
It is a useful starting point for a new role holder, a structured refresher for an experienced one, and a way for managers supporting compliance officers to understand what the job involves. Work through it with your own arrangements in mind: where do you have reliable evidence, and where are you relying on an assumption?
Disciplinary watch
Moss Solicitors LLP agreed an £18,738 fine. Its policies had not been appropriately reviewed and maintained, and four of six sampled files lacked records of client and matter risk assessments.
Knipe Woodhouse-Smith was fined £8,211 for failures involving its firm-wide assessment, policies and matter-risk assessments, together with failures to cooperate and take timely remedial action after the SRA identified the deficiencies.
Steinfeld Law LLP agreed a £2,160 fine for failing to maintain risk-assessment records sufficient to demonstrate that its CDD measures were appropriate.
Michael Taylor & Co agreed a financial penalty following findings involving a missing firm-wide assessment, missing matter-risk records and inadequate CDD and/or source-of-funds records on sampled files.
Bryn Roberts was fined £20,000 after findings including failure to comply with an undertaking, delays, complaints-handling failures, inadequate cooperation and accounts breaches. The investigation identified a client-account shortage lasting almost three years and an absence of reconciliations.
Shahbaz Jaffar was disqualified under section 99 following dishonest claims to insurers for vehicle recovery and storage services that had not been provided.
Lauren Dunn was also disqualified under section 99 after misleading a client about when a probate application had been submitted. The SRA made a finding of dishonesty.
Gurbinder Singh Sangha received a rebuke after a conviction for failing to provide a breath specimen when lawfully required.
What we do
- Outsourced COLP and COFA support
- Learning management system for multiple users
- Bespoke training – remote and in person
- Compliance audits
- New firm and ABS applications
- Independent AML audits
- AML and sanctions support
- SRA Accounts Rules and client money reviews
- File reviews
- SRA reports and notifications
- Escrow accounts for law firms
Contact us if you need help with any of the issues in this newsletter.
