Share
Answers for law firms
What are AML checks for law firms?
AML checks are the anti-money laundering checks a law firm carries out on a client before it acts. Under the Money Laundering Regulations 2017 the firm identifies and verifies the client and any beneficial owner, understands the purpose of the matter, checks whether anyone is a politically exposed person (PEP) or subject to sanctions, and checks where the money comes from when the risk calls for it.
| Question | Answer |
|---|---|
| The law | Money Laundering Regulations 2017 (MLR 2017) |
| Who it applies to | Firms that take part in property, company or financial transactions for clients, and firms providing trust, company or tax services |
| When | Before the business relationship is established (regulations 27 and 30) |
| What the checks cover | Identity, beneficial owners, the purpose of the matter, PEP and sanctions status, and source of funds where needed |
| After onboarding | Ongoing monitoring for as long as the relationship lasts (regulation 28(11)) |
| Records | Kept for five years after the relationship ends (regulation 40) |
What do AML checks include?
- Identity. The firm identifies the client and verifies who they are (regulation 28(2)).
- Beneficial owners. For a company or trust, the firm identifies the people who own or control it and takes reasonable measures to verify them (regulation 28(4)).
- Purpose. The firm assesses the purpose and intended nature of the matter (regulation 28(2)(c)).
- PEPs and sanctions. The firm checks whether the client or a beneficial owner is a politically exposed person (regulation 35) and whether anyone involved is subject to UK sanctions.
- Source of funds. Where the risk calls for it, the firm checks where the money for the matter comes from. See How should a law firm check source of funds?
- Risk. How deep each check goes follows the firm’s assessment of the client and the matter.
When must a firm do AML checks?
Before it establishes the business relationship (regulations 27(1) and 30). In practice that means before the firm starts work or receives money on the matter.
The firm checks again at other appropriate times on a risk-based approach, and whenever it learns that the client’s circumstances have changed (regulation 27(8)).
How long do AML checks take?
An electronic identity check can usually be done in one sitting. Source of funds takes longest, because it depends on the client sending bank statements and other evidence, and on the firm examining them.
How long are AML checks valid for?
The regulations set no fixed expiry. The firm renews due diligence on a risk-based approach and when something changes, such as the client’s identity or beneficial owner, a transaction that does not fit what the firm knows about the client, or the purpose of the relationship (regulation 27(9)). The firm’s own policy should say when that happens.
Who pays for AML checks?
The regulations put the duty on the firm and say nothing about who bears the cost. Some firms absorb it and others pass it on to the client. Either way, set it out in the client care letter before the checks start.
What did the SRA find?
In its SRA anti-money laundering annual report 2025/26, the SRA reviewed 6,592 files. 20% had no evidence of PEP screening and 21% had no evidence of sanctions screening. 9% of the files that needed source of funds checks had none, and 36% of the firms it visited or reviewed had ineffective client and matter risk assessments.
What records must the firm keep?
The evidence and the record of every check, kept for five years from the end of the business relationship, or from the completion of a one-off transaction (regulation 40).
Kord runs identity, PEP, sanctions and source of funds checks for law firms and records them on the matter, so the evidence for each check sits in one place. The firm’s MLRO still makes the decisions. See AML checks on Kord.
More in Answers for law firms, including what an AML risk assessment needs.
Questions firms ask
Do solicitors have to do AML checks?
Yes, for work in the regulated sector. That covers most property and company transactions, trust and company services and tax advice. Outside it, the firm must still identify who it is acting for (SRA Code of Conduct for Solicitors, paragraph 8.1).
What is the difference between AML and KYC?
KYC, know your customer, is the identity part. AML is the wider duty, which adds beneficial owners, the risk assessment, source of funds, ongoing monitoring and reporting suspicions.
Can a firm rely on another firm’s AML checks?
For identity, yes, under regulation 39, if the other firm agrees and will provide the evidence on request. The firm stays responsible and adopts the result into its own assessment.
What happens if a check finds a problem?
The firm applies enhanced checks, escalates to its MLRO and, where it knows or suspects money laundering, makes a suspicious activity report.
What if the client will not complete the checks?
The firm cannot complete due diligence, so it must not go ahead with the matter and must consider whether to make a suspicious activity report (regulation 31).