The SRA published new guidance on anti-money laundering policies, controls and procedures on 22 October 2026. The guidance provides a clear indication of what the SRA expects to see when assessing whether a firm’s AML arrangements are effective.
The guidance follows the SRA’s review of more than 2,200 firms’ AML policies over the last three years. Its findings highlight some familiar weaknesses, including generic policies that have not been tailored to the firm, missing mandatory requirements and procedures that are documented but not followed in practice.
A policy alone is not enough
The SRA emphasises the distinction between policies, controls and procedures. A policy sets out the firm’s approach to AML; controls are the measures used to manage risk; and procedures explain the steps staff must follow in their day-to-day work.
These elements need to work together. Firms must be able to demonstrate that their AML arrangements reflect their own business, systems and risk profile, and that staff follow the documented procedures.
The SRA found that 46% of the 934 AML policies reviewed in 2025–26 were either partially compliant or non-compliant.
Common omissions included provisions relating to new products and technologies, reliance on third parties for customer due diligence, simplified due diligence, Companies House discrepancy reporting, sanctions and the identification of unusual or complex transactions.
Monitoring compliance is a key focus
The guidance places particular emphasis on the need to monitor whether AML policies and procedures are being followed. This is an existing requirement under regulation 19(3)(e) of the Money Laundering Regulations 2017.
The SRA identifies several ways firms can demonstrate effective monitoring, including documented AML file reviews, file checklists, case management system controls and automated alerts. Higher-risk matters and less experienced staff may warrant more frequent checks.
Reviews should specifically consider AML compliance, rather than concentrating solely on other aspects of file management. Firms should also record identified weaknesses, agree corrective action and monitor whether that action has been completed.
What should firms do now?
Firms should use the new guidance as an opportunity to review their existing AML arrangements. In particular, they should check that:
- Their AML policy covers all mandatory requirements and reflects the firm’s actual working practices.
- Their policies and procedures address the risks identified in their firm-wide AML risk assessment.
- Staff understand and follow the required procedures.
- AML compliance is monitored and the results are documented.
- Policies are reviewed and updated when necessary, with changes recorded and communicated to staff.
The SRA has published an AML policy checklist and a file-review form to assist firms with these tasks. Both are useful resources, but they do not replace the need to tailor arrangements to the individual firm.
Read the SRA’s full guidance on AML policies, controls and procedures.
How Legal Compliance Services can help
At Legal Compliance Services we support SRA-regulated firms with practical AML compliance, including AML policies and procedures, firm-wide AML risk assessments, independent AML audits and file reviews.
The new guidance reinforces the importance of having arrangements that are not only documented correctly but also effective in practice. We can help you review your existing arrangements, identify gaps and determine what needs to be addressed.
If you would like to discuss reviewing your firm’s AML compliance arrangements, please get in touch.
