A client joins a video call, holds up identification and answers your questions. They look and sound convincing. But are you dealing with a real person or an AI-generated impersonation?
That is no longer a question for science fiction. It is one of the emerging risks identified in the Solicitors Regulation Authority’s updated sectoral risk assessment, published on 6 August 2026.
The SRA warns that deepfakes and other AI-enabled impersonation techniques may be used to defeat customer due diligence, particularly where firms rely on remote onboarding or video-based checks. It is the most eye-catching addition to the assessment, but not the only one. The regulator also highlights “passporting” old due diligence between offices or matters, ghost directors linked to cash-intensive businesses, misleading Companies House records, global instability, supply-chain risk and new methods of sanctions circumvention.
Firms within the scope of the Money Laundering Regulations must consider the new risk assessment and decide what it changes in their own AML risk assessment and controls.
The overall risk has not reduced
The legal sector continues to be rated high risk for money laundering. The central vulnerabilities remain familiar: high-value transactions, movement of money through client account and the creation of companies, trusts and other legal structures.
Conveyancing remains the area of greatest inherent money laundering risk. It combines large sums, client-account movements, opportunities to disguise ownership, time pressure and an asset capable of making criminal proceeds appear legitimate.
The other two highest-risk services remain trust and company work and the misuse of client accounts. The 2025 National Risk Assessment also raised the terrorist-financing risk for trust and company services from low to medium, although legal services as a whole remain rated low risk for terrorist financing.
So, this is not a wholesale change in the risk picture. It is an update to the ways in which familiar vulnerabilities may now present themselves.
What is new (or newly emphasised)?
Deepfakes and AI-enabled fraud
The SRA has sharpened its focus on technology risk. Deepfake video, images and audio can be used to impersonate real people, construct synthetic identities and manipulate biometric or video-based verification.
The linked Financial Action Task Force report on AI and deepfakes gives a striking example: criminals simulated a video conference, impersonated senior executives and persuaded a finance officer to transfer US$25 million. The immediate lesson for law firms is that seeing someone on a screen is no longer strong evidence, by itself, that they are who they claim to be.
This does not mean that remote onboarding is inherently unsafe or that digital identification should be abandoned. It means firms need to understand the assurance offered by their chosen system, including its liveness and fraud-detection controls, and avoid relying on a single check. The SRA points firms towards the government’s Digital Verification Services register when assessing providers.
The risk also continues after onboarding. A convincing video call or cloned voice could be used to change payment instructions, approve a transaction or pressure a fee earner into bypassing the firm’s normal process.
Passporting and recycled due diligence
“Passporting” is the practice of moving a client from one office in a firm to another and relying on due diligence already completed elsewhere. The SRA warns that the original checks may have been completed in another jurisdiction, by another business unit, for a different type of work or for a matter outside the scope of the Money Laundering Regulations.
The same problem arises entirely within the UK when a familiar client opens a new matter. Previous due diligence is useful information, but it is not automatically sufficient. The firm must decide whether it is current, reliable and appropriate for the new instruction and its risks.
High street crime, cash-intensive businesses and ghost directors
The assessment adds a specific warning about cash-intensive businesses and their possible exploitation by organised crime groups, including in connection with modern slavery.
One striking feature is the use of “ghost directors”: people who allow their names to appear on company records, sometimes for payment, despite having no genuine involvement in or knowledge of the business. The risks may surface in commercial property work, company matters or transactions funded by businesses whose stated turnover and profitability do not fit their age, size or apparent operations.
Companies House cannot be treated as historic proof
Companies House reform is intended to improve the reliability of the register, but the clean-up itself creates a practical trap. The SRA records that 920 companies entered expedited strike-off after supplying false information. Someone connected with one of those businesses may still hold an old certificate of incorporation or other company documents and present them as evidence that the company is legitimate and active.
Firms should check the company’s current status and filings directly. Companies House information is a useful source, but it is not a substitute for identifying and verifying the client, its beneficial owners and the people who actually exercise control.
Global instability and proliferation financing
The previous discussion of economic uncertainty and capital flight has been broadened into “global instability and uncertainty”. Conflict, political instability, corruption and significant changes in government can increase money laundering, sanctions-evasion and proliferation-financing risks.
Warning signs include links to politically exposed persons, opaque intermediaries, ownership or funding structures spanning several jurisdictions, difficulty verifying wealth, and goods, technology or finance that might ultimately support nuclear, chemical, biological or radiological weapons programmes.
Offshore structures are not automatically suspicious. The issue is whether they obscure ownership, control, the origin of funds or the commercial purpose of the arrangement.
Sanctions circumvention is wider than Russia
The SRA has expanded its sanctions analysis. It highlights attempts to procure apparently ordinary goods through third countries for use by Russia, as well as risks connected with shipping, aviation, international trade, luxury assets and commodities.
It also makes clear that sanctions exposure is not confined to a client’s nationality or country of incorporation. A designated person may exercise indirect or informal control through family members, agents, nominees, family offices or layered corporate structures. Ownership and control for sanctions purposes is wider than beneficial ownership under the Money Laundering Regulations.
The established risks still need attention
The assessment has been substantially rewritten and reorganised, but most of the underlying risks remain. Firms should not focus so heavily on the new headings that they miss the fundamentals:
- Client account must not be used as a banking facility, and third-party payments or unclear requests to hold, transfer or return money require scrutiny.
- A third-party managed account changes the flow of money but does not remove the firm’s responsibility to understand the transaction or the provider’s controls.
- Trusts, companies, nominees, shelf companies and unnecessarily complex arrangements can obscure ownership and control.
- Family offices, agents and other intermediaries can create distance between the firm and the true client or beneficiary.
- Familiarity can weaken professional scepticism — a longstanding client or trusted referral still needs risk-based checks.
- Source of funds and source of wealth remain central, and money arriving from a UK bank is not proof that it is legitimate.
- Cryptoassets, stablecoins, physical cash, pooled funding, unusually complex transactions and assets capable of providing anonymity can all make provenance more difficult to establish.
- Where the firm sees only one part of a wider transaction or supply chain, it may not understand the ultimate beneficiary, end use or sanctions exposure.
- Remote delivery, multiple service lines, unusual payment patterns and indirect instructions can reduce transparency.
None of these factors is an automatic reason to reject a client or stop offering a service. The SRA is describing inherent risk: the position before the firm’s controls are applied. The firm must assess the combination of factors, apply proportionate controls and decide whether the remaining risk is acceptable.
Why firms have to act when the assessment changes
Regulation 18 of the Money Laundering Regulations requires an in-scope firm to identify and assess its exposure to money laundering and terrorist financing. When doing so, it must take account of information made available by its supervisory authority under regulation 17 — which includes the SRA’s sectoral risk assessment. The assessment must be recorded in writing, kept up to date and appropriate to the size and nature of the firm.
Regulation 18A imposes a corresponding requirement for proliferation-financing risk. This can be addressed in a separate assessment or incorporated into the firm-wide risk assessment.
The exercise cannot stop at amending a document. Under regulation 19, the firm’s policies, controls and procedures must manage and mitigate the risks identified in its risk assessment. In practical terms, the chain should run from external risk information, through the firm-wide assessment, into procedures, client and matter risk assessments, due diligence, monitoring and training.
Sanctions sit slightly differently. The Money Laundering Regulations do not create a standalone statutory duty to maintain a firm-wide sanctions risk assessment. The SRA nevertheless recommends one for all firms and says it will have regard to that guidance when exercising its regulatory functions. Sanctions obligations also extend beyond work within the scope of the Money Laundering Regulations.
A practical response for law firms
The proportionate response is not to paste the SRA’s wording into the firm-wide risk assessment. It is to decide which risks apply, how they could arise in the firm and whether the existing controls are adequate.
1. Record the review
Open a short change record showing:
- The SRA assessment and publication date considered.
- Who reviewed it and when.
- Which practice areas, offices and systems were consulted.
- The risks that apply, do not apply or require further investigation.
- The changes agreed, their owners and deadlines.
- Senior-management approval.
Recording why a risk is not relevant is often as useful as recording that it is. A firm that does no remote onboarding, for example, may have limited exposure to deepfake CDD risk but could still face voice or video impersonation when instructions change during a matter.
2. Update the risk assessments
Review the firm-wide money laundering and terrorist-financing risk assessment and its proliferation-financing section or separate assessment. Update the firm-wide sanctions risk assessment at the same time, because several of the new themes overlap.
Assess both likelihood and impact before controls, describe the controls actually used, and then record the remaining risk. Avoid generic statements. The assessment should reflect the firm’s clients, work, transaction types, locations, delivery methods and experience.
3. Test the controls against the changed risks
| Risk | Practical response examples |
|---|---|
| Deepfakes and synthetic identities | Review the assurance level, liveness testing and fraud controls offered by digital-ID providers. Use more than one reliable and independent source where appropriate. Create an escalation route for inconsistent images, voices, documents or device information. Independently verify high-risk changes to bank details or authority to transact using trusted contact information. |
| Passporting or reliance on old CDD | Set expiry and refresh rules, but do not rely on time alone. Require a new risk decision when the client, matter, jurisdiction, ownership, funding or scope of work changes. Record who completed the original checks, to what standard and whether the evidence can lawfully and reliably be relied upon. |
| Cash-intensive businesses and ghost directors | Establish who genuinely owns, controls and operates the business. Compare filed information with the people giving instructions, trading evidence, accounts, premises, workforce and commercial activity. Investigate directors who appear unconnected or unable to explain the business. |
| Company registration | Check the live Companies House record, current status, filing history, registered office, officers, persons with significant control and recent strike-off or verification activity. Resolve inconsistencies rather than treating incorporation documents as conclusive. |
| Global instability and proliferation financing | Refresh geographic sources and country-risk methodology. Consider the client, owners, counterparties, funds, goods, technology, intermediaries, end user and end use. Escalate opaque structures or unexplained links with conflict, corruption, sanctioned trade routes or proliferation-sensitive sectors. |
| Trusts, companies, family offices and supply chains | Map the full ownership and control structure and identify the ultimate client, beneficiary and commercial purpose. Obtain enough information about the wider transaction to understand the firm’s part in it. Challenge unnecessary complexity, nominees, shell entities and jurisdictions with no clear connection. |
| Client account, third-party payments and managed accounts | Require a clear connection between the legal service and every material receipt or payment. Verify and record the rationale for third-party funds and payment destinations. Review long-held balances and unclear return instructions. Carry out due diligence on managed-account providers and understand what visibility the firm retains. |
| Conveyancing, cash, crypto and pooled funding | Trace the underlying source of funds, not merely the account from which money arrived. Understand source of wealth where risk requires it. Identify every material contributor, investigate unusual tranches or rapid movements, and use specialist blockchain analysis where proportionate. |
| PEPs, high-risk sectors and familiar clients | Ensure screening and ongoing monitoring can identify changes. Apply the statutory enhanced measures where required. Do not allow longstanding relationships, seniority or trusted referrals to displace documented checks and approval. |
| Sanctions circumvention and licences | Review screening coverage, ownership-and-control analysis, indirect links and relevant third-country routes. Do not rely solely on automated name matching. Diary licence conditions, reporting dates, fee caps and expiry dates, with clear responsibility and contingency arrangements. |
4. Push the changes into everyday work
The updated risks should appear where fee earners will actually encounter them. That may require changes to:
- Client and matter risk-assessment questions.
- Onboarding and CDD procedures.
- Source-of-funds and source-of-wealth prompts.
- Sanctions and PEP escalation forms.
- Client-account controls.
- Matter-opening or payment-warning messages.
- Digital-ID procurement and assurance reviews.
- File-review criteria.
If the firm-wide assessment says deepfakes, ghost directors or supply-chain opacity are relevant but the matter risk assessment never asks about them, the analysis has not yet been translated into an effective control.
5. Brief the right people and test understanding
Training should be targeted. Property teams need to understand high street crime, third-party funding and Companies House warning signs. Corporate and private-client teams may need more on nominees, family offices and proliferation financing. Cashiers and fee earners need a clear process for changed payment instructions and unusual requests involving client account.
A short case study is likely to be more effective than circulating a link. Ask staff what they would do if a familiar client appeared on video and urgently changed a payment destination, or if the director shown on Companies House could not answer basic questions about the business.
6. Check that the update works
Use targeted file reviews or a short thematic test after implementation. Sample remote onboardings, transferred clients, cash-intensive businesses, corporate structures and higher-risk payment changes. Check not only whether a form was completed, but whether the evidence supported the risk rating and the action taken.
The key takeaway
The SRA’s update does not require every firm to rebuild its AML framework from scratch. It does require a deliberate review.
The most visible new risk is the deepfake client, but the underlying message is broader: firms cannot rely on appearances, familiarity, old documents, automated screening or isolated fragments of a transaction. They need to understand who is really involved, where the money or assets come from, who ultimately controls them and whether the explanation makes sense.
That conclusion should now be visible not only in the firm-wide risk assessment, but in the controls and decisions made on live matters.
If you would like support reviewing your firm-wide risk assessment, proliferation-financing assessment or sanctions controls against the new SRA assessment, JBL Compliance can help.
