Happy Friday
There will be a few relieved managing partners this week. The SRA has paused its controversial compliance officer changes following the profession’s backlash. A welcome decision, although the prospect of a no-confidence vote in the SRA suggests a fundamental disconnect between the profession and its regulator.
Can the SRA rebuild confidence by concentrating on the risks that actually harm clients? And, while that debate continues, where should firms concentrate their own efforts?
Holly has two particularly thoughtful contributions this week. The first continues our confidentiality series, looking at the sensitive information that passes through an onboarding team’s hands before a solicitor has even opened the file. The second asks whether your compliance arrangements are a fence at the top of the cliff or an ambulance waiting below.
Also of note: the Carter Ruck privilege ruling. We are already seeing its effect in SRA investigation correspondence, and the practical consequences are not all straightforward.
Finally, our COFA Masterclass takes place next Wednesday. If you have been meaning to book, this is your last nudge. We’ll see you there.
Have a great weekend,
Jon and the team
Confidentiality breaches: Is client onboarding your blind spot?
A prospective client emails their documents. A relative rings for an update. Someone adds the background to an internal chat so a fee earner can pick it up later.
Ordinary moments in a busy office. Each can create a confidentiality problem before the firm has formally accepted instructions.
Holly looks at why the people handling those first conversations need more than a process checklist, and how better training, clear boundaries and access to a senior colleague can make onboarding safer without making it painfully slow.
Read: Is client onboarding your blind spot?
The threat of a no-confidence vote: where next for the SRA?
Pausing an unpopular policy is one thing. Rebuilding a damaged relationship is another.
The compliance officer controversy has exposed a wider frustration: firms want a regulator that understands how they operate and directs its attention towards serious threats to clients, rather than adding administrative work of questionable value.
This article considers what a no-confidence vote could achieve, where the SRA’s priorities should lie, and why proportionate regulation is an important aspect of access to legal services.
A convenient lie or an inconvenient truth? Compliance should be a fence, not an ambulance
Compliance people will understand this feeling: there is a particular kind of exhausting week that feels productive because you have solved loads of problems.
But why did those problems arise in the first place?
Holly uses a Victorian poem to highlight the difference between dealing efficiently with crises and preventing them happening in the first place. It is a persuasive case for building proactive risk management into everyday work, with a look ahead at where AI might help.
COFA Masterclass – last call for next Wednesday
Birmingham | 7 October 2026 | £495 + VAT per delegate
If you sign off reconciliations, advise the COFA or oversee the firm’s finance function, you will know that the difficult questions rarely arrive neatly labelled with an Accounts Rule number.
Our Birmingham masterclass is a chance to work through those questions with former SRA forensic investigators Sean Hankin and Liz Bond, covering reconciliations, breaches, residual balances, banking facilities and the practical oversight of client money.
Wednesday 7 October · 10:00–16:00
Registration from 09:30
Castle Bromwich Hall Hotel, Birmingham
£495 + VAT, including lunch and refreshments.
This is a bargain. If you have been holding off, please book now so we can finalise arrangements.
”This was a really practical and useful course on the role, expectations and responsibilities of a COFA which, if I am honest, I expected to struggle through but it was the most useful course, on the subject, I have ever been on. A must for any COFA.
News and guidance
SRA pauses compliance officer changes
Despite having received the LSB green light, the SRA has paused implementation of its compliance officer rule changes and will go back to the drawing board.
The approved changes concerned the combination of compliance responsibilities with unilateral management powers, with different requirements depending on firm size and client money thresholds.
The pause is welcome. It is not, however, confirmation that the rules have been abandoned.
For now, keep the issue under review, but continue asking the underlying governance question: can your compliance officers challenge decisions, obtain information and escalate concerns in practice?
An organisation chart cannot answer that on its own.
Privilege and SRA investigations: a protection, but also a complication
In Carter Ruck Solicitors and another v SRA, the High Court held that the SRA’s powers under section 44B of the Solicitors Act 1974 do not override clients’ legal professional privilege. The SRA has said it is seeking permission to appeal.
We are already seeing investigation officers explain to firms that they do not have to provide privileged material.
That sounds positive for respondents until the privileged material is the very evidence a solicitor wants to rely on in their defence. The protection belongs to the client, not the firm. A client’s refusal to waive it can therefore make explaining what happened considerably harder.
This is an important protection for clients, with consequences on both sides of an investigation.
Read the judgment · Read the SRA’s response
Litigation funding: regulate the risk
The Law Society has called for new litigation funding rules to target real risks. It is another contribution to the wider debate about where regulatory intervention will genuinely protect clients.
Read the Law Society’s statement
AI is changing complaints, but it does not make them less valid
New Legal Ombudsman research found that 54% of people who had made or considered a complaint about regulated services in the previous year had used AI. That figure covers regulated services generally, not just legal complaints.
In its review of its own case files, LeO found indicators of AI use in 51%. The effects were mixed: AI could help people explain their concerns, but could also produce lengthy, confused or unnecessarily legalistic complaints.
The temptation to reply “this has clearly been written by AI” is best resisted. It does not answer the complaint.
Find the underlying service issue. Check any authorities or allegations rather than accepting them at face value. Ask what outcome the client wants. Then give a clear, human response.
LeO has published guidance for both sides of the conversation:
Research findings · Guide for consumers · Guidance for legal service providers
Four refreshed Law Society practice notes worth revisiting
The Law Society has updated four existing practice notes::
- Residual client balances – There is an obligation to return funds promptly when there is no proper reason to retain them. Review how balances are identified, the steps taken to trace clients and the evidence retained when money cannot be returned.
- SRA Transparency Rules – Check whether published prices, service descriptions, complaints information and regulatory details remain accurate. More on this below.
- Alternative business structures – Relevant if you are considering non-lawyer ownership or management. Build the regulatory approval work into the transaction timetable.
- Information on letterheads, emails and websites – Check the materials people in your team actually use, including saved letters and individual email signatures. Updating the website does not update everyone’s templates on their desktop.
You might also be interested in…
Litigation funding after PACCAR. The Gazette’s podcast is a worthwhile addition to the listening list, and this episode is a standout. Worth making time for if third party funding arrangements feature in your practice.
When did “not illegal” become the ethical test? Former Allen & Overy senior partner Guy Beringer has challenged the profession’s reliance on legality and regulation as substitutes for ethical judgment.
What to do this month
Look at your website as a client would
When did someone last check your website against the SRA Transparency Rules?
Not just whether the page still loads. Whether a prospective client can find, understand and rely on the information.
The Law Society’s refreshed practice note is a prompt to review:
- Coverage: have you identified all the advertised services that fall within the price and service publication requirements?
- Costs: are fees, VAT, likely disbursements and the basis of charging clear?
- Scope: can clients tell what is included, what is excluded and what might increase the price?
- People and process: are staff information, key stages and likely timescales accurate?
- Complaints and regulation: are the required details easy to find, with current Legal Ombudsman information and the SRA digital badge where required?
Ask someone outside the relevant department to try it on their phone. “It’s there if you know where to look” is not in the spirit of the rules.
Record the review, allocate any corrections and put the next check in the compliance calendar. Revisit it sooner if your prices, services or people change.
If a second pair of eyes would help, we can carry out a focused website transparency audit and give you a practical list of fixes.
AML and financial crime in the legal sector in 2026
Compliance Corner: Oops, we didn’t register for AML work
Q: “We have realised that some of our work falls within the Money Laundering Regulations, but we haven’t got AML authorisation. What should we do?”
A: First, treat this as a priority compliance issue, rather than a tidy-up exercise. You are likely to be practising unlawfully.
Being an SRA-authorised law firm does not automatically mean the necessary AML authorisation and individual approvals are in place. Every firm within scope of the Money Laundering Regulations has to apply for supervision.
If it turns out that was never done, our suggested response is:
1. Establish the facts promptly.
Involve the COLP, senior management and whoever is responsible for AML. Identify the activities concerned, when they began and the current and historic matters affected. Check the scope against the Regulations rather than relying on department names. Remember that the scope is broad, and just because you do not touch client money in transactions does not mean you are not caught.
2. Control the immediate risk.
Do not accept further affected work while the position is unresolved. Obtain urgent advice on existing matters, including client deadlines and any steps needed to protect clients. Do not assume that submitting an application permits the work to continue.
3. Contact the SRA and address authorisation.
Identify all beneficial owners, officers and managers requiring approval, alongside the required AML role holders. Get new DBS checks for them all. Explain the position to the SRA accurately and use the initial AML authorisation process (form FA10).
4. Review the controls and the files.
Check the firm-wide risk assessment, policies, training, client and matter risk assessments, due diligence and ongoing monitoring. Record the gaps. A firm that just does a little in-scope work has the same AML framework obligations as everyone else.
5. Consider reporting obligations separately.
Assess the regulatory reporting position promptly, taking advice where necessary. If you have been practising unlawfully, consider whether you should self-report separately to the SRA under your general reporting duty. If you do, make sure you can demonstrate how you mitigated the issue and have a plan for putting things right.
SRA guidance on initial AML authorisation
This section provides general guidance. If you have a question you would like us to consider, email info@jblcompliance.com.
Free CPD
Next free webinar: AI risk in law firms — beyond hallucinations
Checking that your AI isn’t misleading the court (by making up cases) is only the start.
Does your firm know which AI tools people are using? What should a supervisor check in AI-assisted work? Is a paid account necessarily safe for client information? And if a three-hour task now takes an hour, what should the client be charged?
On Wednesday 14 October at 12:00, we are holding a free, live panel discussion about the questions firms are having to answer now.
We will cover unapproved tools, verification and supervision, confidentiality and privilege, billing, clients’ own use of AI, and practical governance.
Wednesday 14 October 2026 · 12:00 · Online · Free
JBL Compliance training resources
Compliance Officers (COLP and COFA) — £99.99 + VAT
Being appointed, authorised and named on the SRA record is just the beginning of the role. The harder part is knowing what to monitor, what to record, when to escalate and how to demonstrate the steps you have taken.
Our online course covers the background to the regime, appointment and governance, the COLP and COFA roles in practice, recording and reporting, and personal liability and protection. It includes interactive exercises and a final assessment.
It is a useful starting point for a new role holder, a structured refresher for an experienced one, and a way for managers supporting compliance officers to understand what the job involves. Work through it with your own arrangements in mind: where do you have reliable evidence, and where are you relying on an assumption?
Disciplinary watch
Mahfuzur Rahman – Fined £4,950 under a regulatory settlement agreement concerning the use of client account as a banking facility and own-interest conflict risks.
Gandecha & Pau – The firm was fined £6,180 for failing to maintain a documented firm-wide AML risk assessment and missing client and matter risk assessments on files reviewed.
Fiona Hunter Blair Parsons – Conveyancer struck off by the SDT following a conviction for defrauding her employer.
Richard Melfi-Wroe – Disqualified from specified roles in licensed bodies following two convictions for witness intimidation.
Ayse Johnson – Made subject to a section 43 order following a public order conviction and dishonesty towards her employer about absences to attend her trial.
Sergio Felix – The SRA published an order restricting his employment in regulated legal practice.
What we do
- Outsourced COLP and COFA support
- Learning management system for multiple users
- Bespoke training – remote and in person
- Compliance audits
- New firm and ABS applications
- Independent AML audits
- AML and sanctions support
- SRA Accounts Rules and client money reviews
- File reviews
- SRA reports and notifications
- Escrow accounts for law firms
Contact us if you need help with any of the issues in this newsletter.
AI risk in law firms is about more than just hallucinations
Checking that a case actually exists is only the start. Which AI tool has been used? Was it firm-approved? What client information went into it? Did the person reviewing the output have the expertise, source material and time to do the job properly?
Clients are using AI too, including to challenge advice and write complaints.
This article addresses the compliance risks identified in the latest SRA Warning Notice on AI misuse, and beyond.
PM Law: would another compliance officer have made any difference?
The independent PM Law review was published a couple of weeks ago. This week, we look more closely at what its published findings mean for the SRA’s approach to financial risk.
How much public protection will the new COLP and COFA eligibility rules provide if serious concerns still struggle to reach the right people and prompt action by the SRA?
Our analysis considers the limits of changing role holders and why the LSB is demanding evidence of better outcomes.
Confidentiality starts with “Who is the client?”
The daughter who makes the appointment. The group finance director who pays your bill. The relative who wants an update on the estate. All may have a perfectly understandable interest in the matter. But that doesn’t mean they are entitled to receive confidential information.
Drawing on our latest internal team discussion, this article explores where confidentiality becomes difficult in everyday practice: family involvement, corporate groups, preliminary enquiries, police requests and the tension between protecting one client’s information and telling another what they need to know.
The starting point is often a better conversation at the beginning of the retainer.
