The Solicitors Regulation Authority (SRA) has published a thematic review focused on anti-money laundering (AML) training in law firms. This review is a timely reminder that training plays a significant part in regulatory compliance and risk management within firms.
As the SRA steps up its AML audit function, firms can expect training to become a key focus in future visits. Understanding the SRA’s expectations now will help firms prepare for more thorough scrutiny in the future. Here’s what the thematic review means for your firm.
AML training – What the SRA thinks ‘good’ looks like for law firms
The SRA reviewed the AML training practices of selected firms, assessing both content and delivery methods. Their findings underscore a clear message: they do not consider AML training to be a one-size-fits-all exercise but should be tailored to reflect the specific risks and services of each firm. To satisfy the regulator, firms must ensure that:
- Training content is relevant: AML training should go beyond basic knowledge, diving into the specific risks relevant to the firm’s practice areas, client profiles, and geography. The SRA expects firms to cover the latest legislative changes, risk indicators, and practical guidance on identifying and reporting suspicious activity. Content and delivery should be informed by the firm-wide risk assessment.
- Training frequency is adequate: The review points out that ongoing training is critical. For firms in high-risk sectors, annual or even semi-annual training may be necessary to ensure teams are equipped to recognise emerging risks. The Money Laundering Regulations 2017 (MLRs) require regular AML training for all relevant staff, ensuring knowledge stays current and risks are managed proactively.
- Engagement and comprehension are assessed: It’s not enough to simply deliver AML training. Firms are expected to evaluate the understanding and application of AML principles in practice. The SRA’s report emphasises that comprehension assessments—such as quizzes, case studies, or scenario-based discussions—should be embedded in training sessions to ensure that staff can apply what they’ve learned.
- Training is documented and demonstrable: The SRA’s checklist highlights the importance of maintaining accurate training records. These records should reflect each employee’s training history, with clear dates and topics covered, to demonstrate compliance if inspected. Documentation can be crucial evidence that a firm takes its AML responsibilities seriously.
How to use the SRA’s AML training checklist
To support firms, the SRA has released an AML Training Checklist. This checklist serves as a practical tool for firms to assess their AML training programs, addressing relevance, frequency, evaluation and documentation.
This checklist can be a helpful starting point for firms reviewing their AML training approach, particularly as the SRA continues to scale its AML audits.
SRA AML audits and ‘Regulation 24’ requirements
AML training is more than just a good practice; it’s a regulatory requirement under Regulation 24 of the Money Laundering Regulations 2017.
Alongside AML risk assessments and policies, training must be prioritised within firms as part of their compliance obligations. The SRA’s focus on AML training in its thematic review reflects the regulator’s commitment to increasing the breadth and depth of its audit function. Firms should anticipate more SRA visits, with AML training forming a core component of future reviews. This shift is particularly important in today’s regulatory climate, where failure to meet AML obligations can lead to significant penalties.
The implication is that all AML training must be recorded.
For firms looking to improve their AML training program and meet the SRA’s expectations, our tailored AML Training Services can provide specialised, up-to-date sessions designed to address both foundational knowledge and complex, firm-specific risks.
Examples of ‘bad’ practice
While the SRA highlighted several examples of good practice, the thematic review also uncovered common areas where law firms fall short. To ensure your firm passes regulatory scrutiny, avoid these frequent pitfalls:
“Tick-box” training packages: Relying solely on generic, off-the-shelf training modules that fail to address your firm’s specific practice areas, client base, and risk profile. For this very reason, all our training courses come with an option to tailor the content to your firm.
Lack of content customisation: Failing to incorporate your own firm-wide risk assessment (FWRA) and AML policies, controls, and procedures (PCPs) into the training syllabus. If you think that would be better incorporated into an in-person or workshop session, we can deliver bespoke classroom-style AML training to support the on-demand courses.
No assessment of understanding: Providing training but failing to test whether staff have actually understood the material and know how to apply it in real-world scenarios. All our on-demand courses incorporate assessments with 80% pass mark requirements. Learners cannot just run the video and say “I’ve done it”!
Inadequate record-keeping: Being unable to produce comprehensive, centralised records showing exactly who was trained, when, and what topics were covered. Our courses are contained within a professional Learning Management System (LMS), with certificates, admin reporting and leaderboards.
Who needs training?
A common misconception is that AML training is only necessary for fee-earners and partners. Under Regulation 24 of the Money Laundering Regulations 2017, relevant employees must be made aware of the law relating to money laundering and terrorist financing.
The SRA expects training to be given to anyone whose work could mitigate or expose the firm to money laundering risks. This includes:
Partners and Directors: To set the culture from the top down.
Fee earners and paralegals: Who handle transactional work and client onboarding directly.
Accounts and finance staff: Who monitor funds coming in and out of client accounts.
Front-of-house and support staff: Receptionists and administration teams are often the first point of contact and may spot initial “red flags” regarding client behaviour or documentation.
That is not to say that all these people should receive the exact same AML training. In most cases, that would be inappropriate. The SRA expects AML training to be highly relevant to the learner’s role, so you need to think about modular training options.
The risks and consequences of inadequate AML training
The SRA is significantly increasing its audit activity, and under the FCA, that trend is likely to continue. Training is frequently one of the first areas compliance officers are asked to evidence. Failing to maintain robust AML training standards leaves your firm highly vulnerable.
Beyond the immediate risk of a client account being exploited by criminals, the SRA has the power to issue substantial financial penalties for systemic compliance failures. In recent years, we have seen a sharp rise in fines levied against firms for failing to adhere to the MLR 2017. Furthermore, a finding of non-compliance can lead to severe reputational damage, impact your professional indemnity insurance premiums, and disrupt your day-to-day operations. Lenders really don’t like their panel firms being sanctioned by the regulators.
Protecting your business requires moving beyond passive compliance and establishing an active, well-documented training culture.
FAQs
How often does the SRA require AML training?
- While the Money Laundering Regulations 2017 do not state a strict expiration date, the SRA expects training to be conducted “regularly.” For most firms, an annual refresher is the baseline standard. However, additional targeted training should be delivered whenever there are updates to legal requirements, changes to the firm’s risk profile, or when a staff member changes roles.
What must be included in a law firm’s AML training record?
- To satisfy an SRA auditor, your training records should include the date the training took place, a detailed summary or copy of the training content, a list of all attendees, and the results of any assessments or tests used to confirm understanding. This can all be automated in a Learning Management System.
Is generic online AML training enough for SRA compliance?
- Generally, no. While online modules can provide an excellent foundation for core legal concepts, the SRA explicitly states that training must be tailored. To be compliant, your training programme must explicitly reference your firm’s specific firm-wide risk assessment (FWRA) and your internal policies, controls, and procedures. Ensure your online training provider has an option to tailor the courses to your firm.
