The out-of-office replies have thinned out, the school run is back and most offices are beginning to sound like offices again. The regulators, meanwhile, have returned with a fairly full book bag…
The biggest story landed yesterday. Two independent reviews have found that the SRA still has work to do on intelligence, complex financial investigations and proving that its reforms are changing outcomes. The Legal Services Board has kept the regulator under close supervision, set further targets and asked for more independent assurance. It is an uncomfortable start to term.
We also have new practical pieces on COLP and COFA eligibility, the SRA’s updated AML risk assessment and the right kind of friction in AML controls.
There is plenty to put in the diary too. Our updated COLP and COFA webinar is next week, and the COFA Masterclass returns to Birmingham on 7 October. Details of both are below.
Great to be back!
Jon and the team.
SRA COLP and COFA changes approved: what the final rules mean for firms
One small word may make a large practical difference. During the LSB approval process, “unilaterally” was restored to the restriction on certain owners and managers acting as COLP or COFA. That makes the final rule narrower than the version submitted for approval by the SRA.
Our article explains the different position for sole owner-managers and firms with more than one owner or manager, how the £600,000 turnover and £2 million client-money thresholds work, and why the real informal decision-making structure matters as much as the organisation chart.
Could your new client be a deepfake? The SRA’s updated AML risk assessment
The SRA published its 2026 sectoral risk assessment in August. It now brings proliferation financing into the picture alongside money laundering and terrorist financing, and reflects a threat environment shaped by sanctions evasion, cryptoassets and increasingly convincing digital impersonation.
This is not a document to file away. Compare it with your firm-wide risk assessment, matter-risk methodology, policies, controls and training. Record the review and any decisions, including a reasoned decision that an existing control remains adequate.
AML compliance needs the right kind of friction
Good AML systems remove pointless repetition. They should not remove the pause in which somebody asks whether the story makes sense. Lots of green ticks on a screen is not the same as scrutiny!
This piece looks at how firms can make routine work smoother while preserving judgement at the points that matter: source of funds, beneficial ownership, risk-rating changes, escalation and approval. It also suggests useful management information, including late checks, overridden alerts and files where the risk rating never changes despite new information.
News and guidance
SRA remains “on report” after two independent reviews
The SRA has published two independent reviews, both dated 3 September. Jenner & Block examined what the regulator knew about PM Law before the firm’s spectacular collapse earlier this year.
The PM Law group comprised 11 companies, 26 offices and more than 30 trading names. The SRA is investigating what it describes as a sophisticated fraud involving client funds. The Jenner & Block review found weaknesses that will sound familiar from Axiom Ince: how intelligence was used, how complex financial risk was investigated and when concerns were escalated. The result was missed opportunities to intervene earlier.
Separately, Berkeley Partnership assessed the SRA’s compliance with the formal directions imposed by the Legal Services Board after the Axiom Ince review.
The report found some progress in processes and controls but not enough evidence that the reforms had yet delivered better regulatory outcomes. The LSB has therefore retained its directions, set new performance targets, required a consolidated implementation plan and called for more frequent independent assurance. It also says the SRA Board must lead the work and challenge delivery more effectively.
On the ground, we can expect continued regulatory focus on client-money risk, financial stability, intelligence-led supervision and the quality of evidence behind assurances that controls are working. The combined client-money losses associated with Axiom Ince and PM Law are reported at around £100 million, much of which will be borne by the profession. That figure will continue to shape the SRA’s priorities.
Read the Jenner & Block review | Read the Berkeley review | Read the LSB response
NCA warns about the “A7” sanctions-evasion mechanism
The National Crime Agency has published an alert on A7, an alternative-value-transfer mechanism established in 2024 and backed by sanctioned Russian state entities. The network is linked to both crypto and money settlement, third-country financial institutions, shell companies, sub-agents, false invoices and promissory notes. A7 says it has settled more than $86 billion.
The warning signs include newly formed companies moving unexpectedly large sums, payments between apparently unrelated businesses, opaque ownership, high-risk jurisdictions, generic websites and location or VPN anomalies. Firms exposed to cross-border work, cryptoassets or sanctions-sensitive sectors should use the alert to test their sanctions and proliferation-financing risk assessments, onboarding questions and escalation routes.
SARs in Action: issue 37
The UK Financial Intelligence Unit has published the latest SARs in Action magazine. It is a useful training resource because it shows how financial intelligence supports live investigations and how information from different reporters can become more valuable when it is brought together.
MLROs may want to select one short case study for the next team meeting and use it to revisit what makes a report useful: clear suspicion, relevant dates and parties, concise transaction detail, appropriate glossary codes and a narrative that explains the criminal-property concern rather than merely describing unusual behaviour.
Free data-protection training for SMEs
The ICO has launched Data Protection Essentials, a free self-paced course for small and medium-sized organisations and sole traders. The professional-services examples cover record keeping, information sharing, marketing and reducing the risk of a breach. Individuals can receive a certificate, and organisations can complete a self-assessment with the option of appearing on a public register.
It could be a useful induction or refresher resource for teams that do not need specialist data-protection training but do need a consistent grounding in the basics.
Three updated Law Society practice notes
The Law Society has refreshed three substantial practice notes.
Firm closure: a detailed guide for managers and employees covering client files and money, regulatory obligations, professional indemnity insurance and run-off, employment issues and wellbeing. Firms with an ageing succession plan or financial pressure should check their closure plan before it is needed.
Outsourcing: a reminder that outsourcing a task does not outsource responsibility. Provider due diligence, clear written terms, confidentiality and data protection, supervision, service levels, contingency arrangements and exit planning all need attention.
Solicitors working through unregulated entities: the individual solicitor remains subject to the SRA Code. The note covers status and transparency, client protections, insurance, complaints, conflicts, confidentiality and privilege, undertakings, AML and supervision.
Firm closure | Outsourcing | Working through an unregulated entity
Four useful AML questions answered
A new set of Law Society Q&As deals with real life scanarios:
Bitcoin and property transactions: there is no blanket prohibition, but the conversion trail, source of funds and wealth, volatility, traceability and any lender requirements need careful thought. “It came from crypto” is the start of the enquiry, not the answer.
Beneficial owners of trusts: identify and verify the people who fall within the statutory definition, then apply a documented risk-based approach to the depth of the checks and any additional parties relevant to the matter.
Political-party membership: ordinary membership does not by itself make somebody a politically exposed person. The test is whether the person holds, or has held, a prominent public function and whether family members or known close associates are caught.
Requests from a bank for client-account information: understand the bank’s legal or regulatory reason for asking, identify the basis on which information may be disclosed and keep client confidentiality in view. Explain the position and obtain consent where that is the appropriate route.
Bitcoin | Trust beneficial owners | Political-party members | Bank requests
Three more Q&As for practice managers
DBS checks: a newly admitted solicitor does not automatically need a fresh check merely because they have qualified. Checks are required for specified SRA approval roles and may also be relevant under recruitment-screening obligations or accreditation schemes.
Newly qualified freelance solicitors: non-reserved work may be possible, but reserved legal activities generally require three years since admission. Competence, supervision, insurance and the client’s best interests still need a realistic assessment.
Complaints from prospective clients: a person can complain about an unreasonable refusal to provide a service. Legitimate reasons may include capacity, complexity or lack of the necessary expertise. Record the reason, explain it briefly and signpost the Legal Ombudsman where appropriate.
Law Society consultation responses: proportionality is the common theme
The Law Society has responded to three current reform proposals. It supports greater efficiency at the Legal Ombudsman but has serious concerns about the fee proposals; supports better first-tier complaints handling while calling for proportionate SRA reform; and warns that proposed notification duties on law firm M&A could create unnecessary regulatory burden. COLPs should keep an eye on the final shape of all three consultations – they could have practical consequences.
Legal Ombudsman fees | Complaints-handling reform | SRA notification proposals
SRA warning on misuse of artificial intelligence
The SRA’s new guidance focuses on two recurring hazards: false authorities and “hallucinations” appearing in legal work, and confidential or privileged client information being entered into public AI tools.
On the first point, the solicitor remains accountable for the output – you can’t point your finger at the machine.
On the second issue (which is probably a much bigger profession-wide concern), firms should be able to show where AI use is allowed, which tools are approved, how outputs are checked, what information must never be entered, how junior staff are supervised and how the firm will respond if something goes wrong. A generic instruction to “use AI responsibly” is unlikely to be enough.
Conduct of litigation: regulators strengthen their guidance
Following the Court of Appeal’s clarification in Mazur, the LSB reviewed how regulators explain the work that unauthorised people may do under the supervision of an authorised person. It found material variation between regulators.
SRA annual assessment of continuing competence 2026
Competence-related reports rose from 2,720 in 2024 to 4,038 in 2025, although they remained 23% of all reports. The SRA again highlights weak evidence of reflection, development plans confined to technical law, limited ethics training and failure to consider warning notices and guidance.
A CPD record should ideally show the chain from reflection, to an identified need, to a suitable activity, to an evaluation of what changed. The annual renewal declaration should be supported by that evidence (even though the SRA does not prescribe a minimum number of CPD hours).
You might also like…
What to do this month
1. Get renewal and PII information ready
The SRA renewal window runs from 1 to 31 October. Many firms also renew professional indemnity insurance around 1 October, so September is a pinch point for last-minute problems.
- Confirm that the authorised signatory and organisation contact can access mySRA and that deputies know what to do if somebody is unavailable.
- Check the bulk-renewal list, role information, practising status and any outstanding character-and-suitability or approval changes.
- Make sure continuing-competence declarations are supported by records, not assembled on the day of submission.
- Validate the turnover figure, fee calculation and payment authority in advance.
SRA organisation renewal | Individual renewal | Fee calculator
2. Review COLP and COFA eligibility
With new rules on the horizon, now is the time to map who can actually make or direct significant management decisions, whether they can do so alone, who can block a decision, and whether the written governance arrangements match day-to-day reality. Then test the position against the relevant ownership structure and financial thresholds.
Record the analysis, the information relied on and the planned response. If a change of role holder may be required, allow time for recruitment, approval, handover and contingencies. Our webinar below is designed to help firms work through that assessment.
Read the article about COLP and COFA eligibility for more information
Compliance corner: business continuity plans
Q: Our business continuity plan has not been reviewed for years, and our Lexcel assessment is approaching. Where do we start?
A: It sounds obvious, but start with what needs to continue in a crisis. Identify critical matters and deadlines, people, premises, systems, banking and client-account access, suppliers and information. Decide how long each can be unavailable before clients or the firm suffer serious harm.
Build short, usable responses for the scenarios that would disrupt those dependencies: loss of premises, ransomware or other cyber incident, power or telecoms failure, supplier outage, loss of case-management access, data loss and sudden absence of a key person. Name an incident lead and deputy, set an escalation and contact tree, and cover communications with staff, clients, courts, insurers, the SRA and other stakeholders where relevant.
The plan should identify practical workarounds. Things like remote access, offline contact details, backup and recovery arrangements, alternative suppliers, priority matters, manual payment controls and any reciprocal arrangement with another firm. Keep a copy somewhere that remains accessible when the network is not.
Then test it. A tabletop exercise is enough to expose a surprising amount: “It is 8.30 on Monday, the case-management system is unavailable and the supplier says recovery may take two days. What happens next?” Record what worked, assign the gaps, set dates and retest. Lexcel assessors will be more interested in evidence that the plan is owned, reviewed and exercised than in a glossy file nobody can use.
No two firms will have identical BCPs. A large multi-office firm needs clear incident command, role-based plans, cross-site recovery and testing across functions. A high-street practice may have a much shorter plan built around key contacts, secure backups and realistic reciprocal arrangements. A distributed firm should concentrate on identity and access, cloud suppliers, devices, home connectivity and an alternative communications channel.
This is not an area where you can rely on entirely templated documents.
This is not legal advice. If you have a question you would like us to answer in this section, feel free to send it to info@jblcompliance.com
Free CPD
Next webinar: COLP and COFA changes approved – what firms need to do now
In July we looked at the SRA’s proposed restrictions on who could act as COLP or COFA. The final rules have now received LSB approval, but the wording changed during that process: the word “unilaterally” was restored.
Next week’s webinar will explain what changed, how the rules differ for sole owner-managers and firms with several owners or managers, how the turnover and client-money thresholds operate, and how to assess who really holds decision-making power. We will use practical firm scenarios and consider the implementation timetable and options where an existing role holder may be affected.
If you joined us in July, this is the necessary update. If you did not, we will bring you up to speed before concentrating on the approved rules.
| Date: 9 September 2026 Time: 12:00PM Location: Live on Zoom Booking link |
JBL Compliance training resources
Training resource: Legal Professional Privilege
Legal professional privilege is easy to describe and difficult to apply under pressure. Is the communication confidential? Is the dominant purpose legal advice or litigation? Who is the client for privilege purposes? Has privilege been waived, or could circulation destroy it?
Our online LPP course works through the distinction between legal advice privilege, litigation privilege and ordinary confidentiality, with practical situations that help people spot when they need to pause and ask for advice. It is available as an individual licence, a group licence or as part of the JBL Compliance CPD subscription.
COFA Masterclass: Birmingham, 7 October 2026
The COFA role is not just a monthly reconciliation exercise with a job title attached. It sits at the point where the Accounts Rules, financial controls, supervision and business decisions meet.
Our full-day COFA Masterclass is delivered by Sean Hankin and Liz Bond, both former SRA forensic investigators. It is designed for COFAs, finance directors, legal cashiers, managing partners and others responsible for client-money controls. We cover the COFA’s role, reconciliations, breaches, residual balances, banking facilities, accountants’ reports, and supervision – all in a small group session where questions are encouraged.
Date: 7 October 2026 | Location: Birmingham | Price: £495 + VAT per delegate
To reserve a place, use the booking form or email sam@jblcompliance.com.
”This was a really practical and useful course on the role, expectations and responsibilities of a COFA which, if I am honest, I expected to struggle through but it was the most useful course, on the subject, I have ever been on. A must for any COFA.
Previous Masterclass delegate
Disciplinary watch
Abhishek Kumar – An RFL was removed from the register after knowingly employing a person disqualified from work by immigration status and, separately, filing fabricated or unsupported authorities and quotations generated by AI in his response to regulatory proceedings. No allegation of dishonesty was made in relation to the AI material. The case is an unusually direct example of why every authority and quotation must be checked against the primary source.
Syed Sibtain – Created and backdated a letter to a litigation opponent, then created a second backdated letter for his employer. The Tribunal found deliberate and repeated dishonesty and struck him off.
Matthew Moss – Undertook undisclosed paid work as a legal expert while employed by a firm and gave false explanations when challenged, including blaming his brother for payments. He was struck off.
Demi Perrin – Asked a colleague to hide a client file so that her firm would not discover that work had not been done, then made false statements to the managing director. She admitted dishonesty and was struck off.
Simon Langford – Repeatedly gave clients false or misleading information about registration of a property and failed to cooperate with the SRA. The experienced sole owner was struck off.
Kieran Ferguson – Submitted an insurance claim for a bicycle that was not covered and amended the policy after the theft. The conduct was found to be dishonest and he was struck off.
Gordon Keir – As equity partner, COLP and COFA, signed four PII proposal forms stating that no accountants’ report had been qualified, despite qualified reports and repeated accounts issues. Other admitted breaches included residual balances, late reports and payment of client money to charity without authorisation. A dishonesty allegation was withdrawn, but the SDT issued a reprimand and conditions on acting as COFA.
Fiona Jane Smith – As manager, co-owner and COFA, allowed a significant client-account shortage and improper transfers while substantial drawings were taken. She admitted dishonesty and was struck off.
Malika Williams-Gregoire – Continued to practise through an unauthorised firm after its authorisation ended and was responsible for inaccurate ledgers, a cash shortage and unsigned reconciliations. The SRA fined her £5,276.
Dean Wilson LLP – Was fined £25,000 after AML policies and matter-risk controls fell short. All eight sampled files lacked an effective client or matter-risk assessment, and an older form omitted relevant statutory factors.
Haworth & Gallagher – Was fined £25,000 for long-running weaknesses in AML policies and matter-risk assessment. The SRA found inadequate or late assessments on sampled matters and 89 files with no assessment.
CNA Solicitors – Was fined £750 after failing to submit workforce-diversity data and then failing to comply with a notice requiring the omission to be remedied.
Md Towhidul Islam – Accessed eight immigration files that were not allocated to him and failed to disclose a second job to his law-firm employer. The findings were based on recklessness rather than dishonesty. He was suspended for 12 months, followed by 12 months of restrictions.
Lewsis Duncan – An IT analyst removed a laptop without consent, took it home and failed to return it. The SRA found dishonesty and imposed a section 43 order preventing employment by a regulated firm without permission.
Nathan White – A former pre-litigation administrator was convicted of causing death by careless or inconsiderate driving. The SRA imposed a section 43 order.
Elizabeth Forrest – Failed over a long period to protect the property and income position of a vulnerable client for whom she acted as receiver and deputy, and submitted incomplete or inaccurate annual reports under a statement of truth. Lack of integrity was found proven. She was suspended for six months.
Julian Condliffe – Misled three people into believing they were buying a property, failed to transfer it and later misled the SRA and the court. Separate client money was held in a non-compliant account. He was struck off.
Nancy Ballard – Was rebuked after failing to progress probate and distribution within a reasonable time. The client died in February 2019, probate was obtained in August 2024 and part distribution followed in July 2025, despite an earlier Legal Ombudsman decision.
What we do
- Outsourced COLP and COFA support
- Learning management system for multiple users
- Bespoke training – remote and in person
- Compliance audits
- New firm and ABS applications
- Independent AML audits
- AML and sanctions support
- SRA Accounts Rules and client money reviews
- File reviews
- SRA reports and notifications
- Escrow accounts for law firms
Contact us if you need help with any of the issues in this newsletter.
