The uncomfortable question after PM Law is how much warning a regulator needs before the pieces are put together.
The independent Jenner & Block report identifies significant opportunities for the SRA to act before its intervention in February 2026. Its findings concern the regulator’s handling of the group, rather than determining criminal responsibility for the suspected misuse of client funds.
In November 2024, concerns about PM Law prompted calls within the SRA for an urgent forensic investigation. A non-urgent, precautionary visit was commissioned instead. When that investigation began in March 2025, it examined PM Law Limited in isolation, without current management accounts or group-level financial information. It closed without identifying concerns.
The report identifies both the November decision and the conduct of the subsequent investigation as major missed opportunities.
The SRA already held substantial information about the group. Different teams knew about complaints, financial concerns, acquisitions and compliance arrangements. But it appears that that combined organisational knowledge was never brought together into a coherent assessment. The investigator conducting the 2025 visit was not even told about the earlier forensic investigation in 2023.
The shortcomings went beyond information sharing. Explanations were accepted without independent verification. Acquisition payments were not checked against agreements already obtained. A ÂŁ2 million movement from client account to office account and then to a conveyancing client account was not investigated. Supervision and records of the investigation were inadequate.
Nor did the opportunities end there. A further investigation into group firm 3M Law was accepted as high risk in October 2025. No investigator was allocated until 30 January 2026. The group collapsed before the visit took place.
The report recognises dedicated staff who identified risks and pressed for action. It also identifies individual errors and insufficient investigative rigour. Effective regulation requires capable investigators, proper supervision and systems that allow concerns to be understood and acted upon.
Would the new COLP and COFA rules have made a difference?
PM Law provides an obvious test case for the SRA’s new compliance officer eligibility rules.
The rules will prevent a manager or owner of a larger or higher-risk firm from acting as COLP or COFA where that person has authority (under the firm’s constitution, governance arrangements or usual practice) to unilaterally determine or direct significant management decisions about its structure or operation. The restriction applies where turnover exceeds £600,000 or the firm holds more than £2 million in client money.
This is not a general prohibition on chief executives, directors or senior managers acting as compliance officers. The decisive question is whether the individual can make or direct significant decisions alone.
It is intended to strengthen the checks and balances within law firms.
The PM Law arrangements do appear close to the risk the new rules are intended to address. The group CEO, since disqualified by the SRA, was also COFA across most of the group. The Jenner & Block report records that he held the compliance role across five ABSs. It also found that the SRA knew this during its 2024 thematic review but raised no concern.
The SRA’s subsequent regulatory decision goes further. It found that the COFA exercised “senior managerial control and financial authority” across the group, led its accounts team and oversaw its financial controls. It also found that he caused or allowed withdrawals leading to a client-account shortage, failed to report serious financial difficulties, provided false or misleading information and fabricated bank balances. The decision records that he reported to the group’s owner and chairman.
What the published material does not establish is whether the COFA had authority to determine or direct significant management decisions unilaterally within each authorised body. His title and seniority are not enough to answer that question. Nor does reporting to an owner necessarily rule out extensive delegated authority over financial matters.
The new rules would have applied to each authorised entity separately. If the individual was a manager or owner of an entity and could unilaterally direct significant decisions about how it operated or held client money, he could not have been its COFA. However, if in fact significant decisions genuinely required the agreement of the owner, directors or another governing body, the new restriction might not have applied, and the outcome would have been no different under the new rules.
In fact, this demonstrates how difficult it will be in practice to apply the new eligibility rule.
An independent COFA may well have provided an additional line of challenge around client-account withdrawals. But, even so, a different name in the COFA box would not automatically have prevented the loss. That person would still have needed access to reliable information, sufficient authority to challenge management and the willingness to report concerns externally.
And let’s not forget that the SRA had already examined PM Law’s arrangements and had authorised the CEO’s multiple compliance roles.
So on one hand PM Law supports the rationale for separating compliance oversight from concentrated management power. But it also shows that eligibility rules will only be effective if the regulator looks beyond titles and organisational charts, tests where authority sits in practice, and acts when the warning signs do not add up. The SRA’s clarification of the new rule makes that practical enquiry essential.
The regulator must demonstrate that its controls work
The LSB’s response calls for a consolidated implementation plan and more frequent independent assurance. Existing directions and performance targets remain in place, with further targets anticipated through the statutory process.
The Jenner & Block report acknowledges meaningful improvements already under way. Its findings nevertheless require more than tinkering around the edges.
The SRA needs to connect information across firms and teams, equip investigators to examine complex financial arrangements, and ensure that accumulating concerns reach people with the authority to act.
Firms are routinely asked to demonstrate that their controls work in practice. The profession is entitled to expect the same of its regulator.
