A letter from the SRA has landed in the inbox.
It refers to concerns about the firm. It asks for documents. It gives a deadline. It may ask for an explanation, a chronology, access to systems or copies of files.
The immediate reaction is often anxiety. That is understandable. For most law firms, contact from the regulator feels serious even before anyone has worked out exactly what is being alleged.
But the first point is important: receiving an SRA investigation letter does not automatically mean there has been wrongdoing.
It means the SRA has received information, identified a concern, selected the firm for review, or decided that it needs more information before deciding what, if anything, should happen next.
The way the firm responds in the first few days can make a real difference.
We have produced a short downloadable guide for firms.
This Compliance Corner takes the issue a stage further. The guide gives the immediate steps. This article looks at the judgment behind them.
Start by working out what kind of SRA contact this is
Not all SRA contact is the same.
That was one of the key points from our recent webinar write-up: “When the SRA comes knocking: how firms should respond to audits, investigations and regulatory contact”.
A thematic review is not the same as a complaint-led investigation. An AML desk-based review is not the same as a forensic investigation. A request for general policies and statistics is different from a letter asking for a detailed response to a specific allegation.
The distinction is important because it affects tone, strategy, evidence and urgency.
A firm selected for an AML review may not be accused of any wrongdoing. The SRA may be testing systems, sampling files, or looking at sector-wide compliance. But if the firm responds poorly, cannot produce the documents it says it has, or provides confused answers, a routine review can become something more serious.
Equally, where a letter is clearly complaint-led or file-specific, the firm should not treat it as a generic document request. It needs to understand the facts, preserve the evidence and respond to the actual concern.
The first question should therefore be:
What is the SRA really asking us to explain?
Not what do we wish it had asked. Not what is the easiest thing to send. What is the actual concern, and what information does the regulator need to decide whether there is a serious regulatory issue?
Do not panic, but do not drift
The worst first response is usually either panic or inertia.
Panic leads to rushed explanations, defensive emails, internal blame and sometimes the temptation to “tidy up” the file before anyone has taken proper advice.
Inertia is just as dangerous. The SRA’s deadline is diarised vaguely, nobody owns the response, the relevant fee earner is left to deal with it alone, and the COLP finds out three days before the reply is due.
A better approach is calm urgency.
Someone senior should take control quickly. In many firms that will be the COLP, COFA, MLRO, managing partner, head of risk or another senior person with enough independence from the underlying matter.
The immediate jobs are simple:
- Read the letter carefully.
- Identify every question and request.
- Diary the deadline.
- Preserve relevant material.
- Decide who needs to be involved.
- Acknowledge the SRA.
- Ask for clarification or an extension if needed.
That last point is worth emphasising. If the SRA has asked for a lot of material, or if the issue is complex, it may be sensible to ask for a short extension. That request should be made early, with a clear reason. There is a very significant difference between asking promptly for more time and simply missing a deadline.
Preserve the evidence before you start explaining it
Before drafting the response, the firm should make sure relevant evidence is preserved.
That may include the client file, ledgers, risk assessments, client and matter risk assessments, AML records, source of funds evidence, attendance notes, internal emails, supervision records, training records, complaints correspondence, policies, procedures and file review notes.
The firm should be especially careful not to create documents retrospectively to make the file look better.
If a document did not exist at the time, pretending otherwise is likely to make things much worse. The better approach is usually to be honest about the gap, explain what happened, and show what has been done to fix the process.
There is a legitimate difference between collating existing evidence and manufacturing a record after the event. The first is sensible. The second can create a much more serious conduct issue than the original problem.
Do a proportionate internal investigation
“Respond promptly” does not mean firing off the first explanation that comes to mind.
A good response usually needs a short internal investigation first. That does not have to mean a huge formal exercise. It means getting the facts straight before writing to the regulator.
Who acted on the matter?
What happened?
What does the file show?
What does the ledger show?
What do the policies require?
Were the policies followed?
Was the issue isolated or part of something wider?
Was there any client harm?
Has the firm already taken remedial action?
Is anyone personally exposed?
Are there privilege issues?
Is external advice needed?
This stage is often where firms find out that the initial internal story was incomplete. A fee earner may say the client was risk assessed, but the file may not show it. The accounts team may have dealt with a residual balance issue, but the audit trail may be thin. A partner may remember a conversation, but there may be no attendance note.
That does not always mean there has been misconduct. It may mean the evidence is weak. But the firm needs to know that before it responds.
Answer the questions, but do not answer them mechanically
If the SRA asks ten questions, answer the ten questions.
That sounds obvious, but many poor responses fail at this basic level. They provide a narrative without answering the specific requests. Or they send a bundle of documents and leave the investigator to work out the relevance. Or they argue about the background without addressing the point.
The response should be structured, labelled and easy to follow.
A simple approach is often best:
- Set out the firm’s understanding of the issue.
- Answer each question in turn.
- Refer to documents by clear labels.
- Explain any gaps honestly.
- Identify any remedial action already taken.
- Offer further information if needed.
- The tone should be professional and constructive.
That does not mean accepting allegations that are wrong. Firms are entitled to clarify, explain and disagree. But unnecessary aggression rarely helps. A combative response may satisfy the writer in the moment, but it can make the firm look as though it has missed the point.
The aim is not to “win” the correspondence. The aim is to help the SRA reach a fair and proportionate view on the evidence.
Use the Enforcement Strategy properly
The SRA Enforcement Strategy should not be treated as something to look at only when a sanction is being discussed.
It is relevant much earlier than that.
The Strategy gives firms an indication of how the SRA is likely to think about seriousness. It points towards questions such as harm, impact, intent, motivation, whether there is a pattern, whether the issue is isolated, and whether the firm has shown insight and taken remedial action.
That does not mean every response should contain a long, legalistic submission on the Enforcement Strategy. Often that would be overdone.
But the underlying thinking is useful.
If the issue was a genuine mistake, say so and evidence it.
If no client suffered loss, explain why.
If the issue was isolated, show how the firm knows that.
If there was a process gap, explain what has changed.
If the firm has apologised or put something right, include that.
If wider file reviews or staff training have been completed, say so.
The SRA is unlikely to be reassured by vague promises that “lessons have been learned”. It is more likely to be helped by clear evidence that the firm understands what went wrong and has taken practical steps to reduce the risk of recurrence.
Avoid the common traps
There are a few assumptions that often cause problems.
The first is: “If we cooperate fully, the SRA will go easy on us.”
Cooperation is important. It is also expected. But cooperation does not prevent enforcement action if serious breaches are found. A cooperative firm may still be sanctioned. The benefit of cooperation is that it avoids creating a second problem and may help the regulator understand the issue more quickly.
The second is: “If we explain our intentions, that will resolve it.”
Intentions can be relevant, but they are not the whole answer. The SRA will also look at conduct, systems, outcomes and risk. A firm may have acted with good intentions but still failed to meet regulatory requirements.
The third is: “It is only a minor breach.”
Sometimes that will be right. Sometimes a minor issue really is minor. But small breaches can also indicate a wider systems problem. One missing AML risk assessment may raise questions about whether the firm has a consistent process. One client account error may prompt questions about supervision, training or controls.
The fourth is: “We can handle this ourselves.”
Sometimes a firm can. Not every SRA letter requires external advice. But firms often underestimate the personal, regulatory or evidential risk in the early stages. That is especially true where the issue involves client money, AML, possible dishonesty, misleading the court or regulator, senior people, vulnerable clients, a potential self-report, or an invitation to agree a regulatory settlement.
Getting advice is not an admission of guilt. It is often just a sensible way of making sure the response is clear, proportionate and properly evidenced.
Think about who may be exposed
An SRA investigation letter addressed to the firm may still create issues for individuals.
The COLP may need to consider reporting obligations. The COFA may need to consider whether there has been a serious breach of the Accounts Rules. The MLRO or MLCO may need to consider AML implications. Supervising partners may need to explain decisions. Fee earners may need support if their conduct is being scrutinised.
This is one reason why the response should not be left solely to the person whose file is under review.
It may also be necessary to consider whether individuals need separate advice. That is not about creating conflict for its own sake. It is about recognising that the interests of the firm and an individual may not always be perfectly aligned.
Look after the people involved
SRA investigations can be stressful.
Even where the issue is manageable, the process can feel personal and prolonged. People may worry about their practising certificate, reputation, role, partnership status or future career.
The firm still needs to investigate properly and protect its regulatory position. But it should also recognise the human impact. That may mean checking in with the person involved, signposting support, making sure the issue is not being discussed unnecessarily across the firm, and avoiding internal speculation before the facts are known.
Support does not mean minimising the issue. It means handling it fairly and professionally.
The first response sets the tone
A good initial response will not guarantee a good outcome.
But a poor initial response can make things worse.
The best responses tend to be calm, structured, evidence-led and candid. They do not speculate. They do not overstate. They do not bury the investigator in irrelevant material. They answer the questions asked, while giving enough context for the SRA to understand the position properly.
Most importantly, they show that the firm has taken the contact seriously.
That does not mean treating every letter as a catastrophe. It means recognising that regulatory correspondence needs ownership, care and judgment.
If your firm has received an SRA investigation letter, our downloadable guide sets out the immediate steps to take.
You may also find our webinar write-up useful: When the SRA comes knocking: how firms should respond to audits, investigations and regulatory contact.
JBL Compliance helps law firms respond to SRA investigations, AML reviews, thematic reviews, self-reports and regulatory enquiries. If your firm needs help understanding the letter, gathering the right evidence or preparing a clear response, get in touch.
