The Government published its Anti-money laundering and asset recovery strategy 2026–2029 this week, setting out its plans for strengthening the UK’s response to money laundering and recovering more criminal assets.
So, what does it mean for SRA-regulated law firms?
No immediate new AML requirements
The strategy is principally a Government plan for how the UK’s AML system will develop over the next three years. It does not introduce new AML requirements for law firms.
There is therefore no immediate requirement for firms to make wholesale changes to their AML policies and procedures simply because the strategy has been published.
It would, however, be sensible for firms to consider the strategy when next reviewing their firm-wide risk assessment, particularly the emphasis it places on emerging technologies, professional services being used as enablers of money laundering, intelligence sharing and the need for a more targeted, risk-based approach.
The direction of travel is important
Perhaps the most significant message for law firms is the continued move towards a more data-driven and intelligence-led approach to AML supervision.
The strategy emphasises the need for better use of data, stronger information-sharing between the public and private sectors and more effective use of intelligence to identify and disrupt money laundering. It also describes the regulated sector as the “first line of defence”, with firms expected to apply effective controls and generate intelligence through suspicious activity reporting.
This is consistent with the Government’s planned reform of AML supervision, under which the FCA will become the AML supervisor for legal, accountancy and trust and company service providers. The transition is expected to take several years, with legislation and implementation still required.
The FCA has already indicated that its future approach will be intelligence-led and risk-based, making greater use of data and technology to identify higher-risk firms and activities.
What should firms be doing now?
There is no need to overreact to the publication of the strategy. However, it is a useful opportunity for firms to consider whether they can demonstrate that their AML arrangements are not simply in place, but are effective and proportionate to the risks they have identified.
In particular, firms may wish to consider:
- whether their firm-wide risk assessment properly reflects current and emerging risks;
- whether their client and matter risk assessments are being used meaningfully rather than simply completed as a formality;
- whether the firm can demonstrate how identified risks feed through into its AML controls;
- whether its AML training reflects current risks and typologies;
- whether the firm is making appropriate use of available information and intelligence when carrying out due diligence;
- whether its SARs processes are effective and whether lessons are being learned from matters referred to the MLRO; and
- whether its AML records would enable the firm to demonstrate to a future supervisor why particular decisions and controls were considered appropriate.
This does not mean that every law firm needs to invest in sophisticated AML technology. The Government’s strategy itself emphasises the importance of proportionate, risk-based controls rather than blanket or excessive measures.
Looking ahead to FCA supervision
The transition to FCA AML supervision is still some way off. The Government’s current timetable anticipates legislation in 2027/28 and the movement of firms to the FCA in 2028/29, subject to parliamentary time.
Nevertheless, the new strategy reinforces a direction of travel which has already been evident from the work of the FCA and OPBAS: AML supervision is becoming increasingly focused on risk, intelligence, data and demonstrable outcomes.
For law firms, the message is therefore less about making immediate changes to their AML framework and more about ensuring that the framework they already have is genuinely risk-based, properly embedded and capable of demonstrating its effectiveness.
Our view: firms should certainly take account of the new strategy when reviewing their AML arrangements but there is no need to treat its publication as a new set of rules. The more important question is whether the firm’s existing AML systems and controls are robust enough to stand up to the increasingly data-driven and intelligence-led supervisory environment that is developing.
