The SRA has today published updated guidance on sanctions regime firm-wide risk assessments, offering detailed expectations for how firms should identify, evaluate and mitigate sanctions-related risks across their business.
Sanctions compliance is now recognised not as a niche responsibility but as a core part of modern legal practice. Given the expanding scope of the UK sanctions regime, having an up-to-date and effective firm-wide risk assessment is more important than ever.
What Is a Firm-Wide Sanctions Risk Assessment?
A firm-wide sanctions risk assessment is a documented evaluation of the risks your entire business faces under the UK sanctions regime. Although not a statutory obligation in itself, the SRA strongly recommends it as best practice for protecting your firm from regulatory, financial and reputational harm.
Unlike a matter-level risk assessment — which looks at individual clients or transactions — a firm-wide assessment takes a holistic view of your firm’s exposure to sanctions risk and forms the foundation for effective policies, procedures and controls.
Why the SRA Emphasises Firm-Wide Risk Assessments
The UK sanctions regime operates on a strict liability basis — firms can be held responsible for breaches even if they result from innocent mistakes. Robust risk assessments, however, can meaningfully mitigate enforcement outcomes if issues arise, as regulators such as the Office for Financial Sanctions Implementation (OFSI) are likely to take preventative measures into account.
The SRA highlights that sanctions risk is not confined to specialist practices. Even firms with no apparent sanctions-focused work may unknowingly encounter risk through:
- Multi-jurisdictional matters and offshore connections
- High-value asset transactions
- Complex ownership structures
- Services such as trusts or fiduciary arrangements
For these reasons, firms of all sizes are encouraged to assess their exposure and implement proportionate controls.
Core Elements of a Strong Sanctions Risk Assessment
According to the updated SRA guidance, an effective firm-wide sanctions risk assessment will mirror the qualitative approach used in anti-money-laundering risk assessments under the MLR 2017. It should consider the following risk categories:
1. Clients and Counterparties
Assess the risk profile of your clients and the extent to which counterparties may present sanctions exposure. Ask questions such as:
- What types of clients and counterparties do we act for?
- How well are fee earners equipped to identify unusual profiles or ownership structures?
2. Geographical Risks
Evaluate whether your firm operates in regions with sanctions regimes or where ownership and control might be obscured through offshore structures.
3. Products and Services
Consider the legal services you offer and whether they could attract sanctions risk — for example, high-value asset transactions, corporate structuring or fiduciary services.
4. Delivery Channels
Review how services are delivered (face-to-face, remote, third-party intermediaries) and the associated risk exposures.
5. Transactions
Assess the nature of financial and non-financial transactions your firm handles, including client account movements, escrow arrangements and cross-border transfers.
Practical Steps to Conduct Your Assessment
To make your sanctions risk assessment effective and useful:
- Tailor the assessment to your firm’s profile — avoid generic templates that don’t reflect your business.
- Involve senior management in approving and reviewing the document.
- Link risk themes to controls such as screening processes, training and escalation procedures.
- Keep it up to date — sanctions risk evolves rapidly as designations and geopolitical pressures change.
The SRA also points out that if your firm is already subject to AML obligations under the MLR 2017, you may integrate sanctions risk into your existing risk framework rather than creating a separate document.
Misconceptions to Avoid
Firms often mistakenly believe sanctions risk only arises when dealing with “non-UK” or “high-risk” jurisdictions. The SRA emphasises that sanctions apply to individuals and entities on the consolidated list, including some who may appear domestic or benign. Risk assessments must therefore be nuanced and evidence-based rather than based on geographic stereotypes.
Why This Matters for Your Firm
Failing to identify and mitigate sanctions risk can have serious consequences:
- Regulatory enforcement action from OFSI or the SRA
- Financial penalties and corrective measures
- Damage to your firm’s reputation and client relationships
A documented and dynamic firm-wide risk assessment demonstrates to regulators and partners that your firm has taken reasonable and proactive steps to understand and manage its sanctions exposure.
How Legal Compliance Services Can Support You
Developing or enhancing a sanctions risk assessment can be challenging — particularly when balancing it with existing AML frameworks and operational demands.
Legal Compliance Services provides tailored support for firms to:
- Draft and review sanctions risk assessments
- Integrate risk frameworks with AML controls
- Train fee earners and support staff
- Support documentation and regulatory readiness
If your firm is reviewing its risk frameworks or needs help aligning with the latest SRA expectations, we’re here to help.
