The SRA's 2025/26 AML report: Supervision has moved from the policy to the file

The SRA's AML annual report for 2025/26, published on 22 October, leads with better compliance: across 966 assessments, the largest proactive programme the regulator has run, the share of firms rated non-compliant fell from 32.4% to 21.9%. Much of that came from firms putting a firm-wide risk assessment and written policy in place for the first time, which tells large and international firms with long-established frameworks very little.

Those firms should read the report for how the SRA now supervises: it reads up to twelve files per firm and interviews fee earners at the largest practices on their grasp of AML procedures. On a three-year cycle it also reviews the independent audits of the biggest firms, and this year it sent nine of the 26 it reviewed for further supervisory work after the firms’ own auditors found weaknesses. Controls now have to work consistently on every matter, which is harder when policy is written centrally and applied by hundreds of fee earners across several offices.

Enforcement lags behind: matters closed with an internal outcome rose from 137 to 256, including 145 regulatory settlement agreements worth just over £2m, which the SRA puts down to investigations opened in earlier years now concluding. This year’s file review findings are likely to drive the outcomes reported in 2027 and 2028.

Quick check 

1. Pull twelve files across practice groups and read them the way the SRA does, checking that each risk rating and source of funds conclusion has its reasoning on file.
2. Pick fee earners from your largest practice groups and ask them to walk through the AML steps on a live matter, as the SRA does at the largest firms.
3. Reread your last independent audit and confirm every weakness it found has been closed, since the SRA sent nine of the 26 audits it reviewed for further work on the strength of auditor findings.

Source of funds failures now sit at the matter level, not in the policy

Source of funds is now the second most common reason for referral from proactive supervision, at 29% of referrals against 21% the year before, and 67% of the firms referred for source of funds failures on files had a defined process in their policy.

Of 5,349 files that needed source of funds checks, 9% had none and 18% held evidence nobody had interrogated, which puts the larger problem in scrutiny rather than collection (Eloise Butterworth at All Things Risk notes the 18% is unchanged from last year). The SRA’s examples are everyday matters for a large firm: corporate funds from a company whose accounts show limited profits, or third-party funding with thin evidence behind it. Other files held bank statements with large deposits nobody queried, and in 6% the funding recorded at onboarding did not match the client ledger, which on complex transactions often means the funding route changed mid-matter and nobody revisited the assessment.

The same gap shows up on higher-risk clients: in June the SRA settled with a firm that had acted for a non-domestic PEP across 66 matters without adequately establishing source of wealth or source of funds, and it fined another over its checks on a non-domestic PEP across 194 matters, mostly residential property purchases.

Internal assurance has the same blind spot: 36% of inspected firms running internal file reviews left source of funds out and checked only that CDD had been completed, so their reviews will pass the policy on exactly the files the SRA would mark down. Second-line review should test whether the reasoning behind each source of funds conclusion is on file as well as the documents.

Quick check

1. Sample recent files where source of funds evidence was collected and flag any where it was never interrogated, such as large deposits with no recorded query.
2. Reconcile the funding recorded at onboarding against the client ledger on live complex matters, and reopen the assessment wherever the funding route has changed.
3. Add source of funds reasoning to the internal file review template if the review currently stops at CDD completion.

Risk ratings are now being second-guessed, and inconsistency is the exposure

Missing client and matter risk assessments fell from 16% of files to 9%, and the SRA has turned to the quality of the ones that exist. It disagreed with the firm’s rating on 10% of files, usually because the rating should have been higher, and judged client and matter risk assessments ineffective at 36% of firms reviewed because ratings were recorded without the reasoning behind them or any account of how the risk would be managed.

It also found firms whose firm-wide risk assessment (FWRA) named particular activities or jurisdictions as higher risk while matters involving those same factors were rated low with no recorded rationale. In a firm with many practice groups, each with its own intake habits and sometimes its own templates, that divergence builds quietly unless someone measures it. Firms holding client and matter risk assessment data in structured form can test for it directly by comparing matter ratings against the FWRA’s high-risk factors and investigating the mismatches.

The strongest FWRAs the SRA saw were built on management information such as internal SAR volumes, high-risk client numbers, overseas instructions and transaction values, and it is now checking that matter data feeds the FWRA and the FWRA anchors matter ratings.

Quick check

1. List the activities and jurisdictions your FWRA names as higher risk, then pull every matter involving them that is rated low and check for a recorded rationale.
2. Change the client and matter risk assessment template so a rating cannot be saved without the reasoning and a note on how the risk will be managed.
3. Check which management information the FWRA draws on, and add internal SAR volumes and overseas instruction numbers if they are missing.

The SRA has named passporting as a risk, and the EU AMLR puts it into law

The report’s emerging risks include passporting, which the SRA defines as moving a client from one office or jurisdiction to another within the same firm, and it applies the same concern to clients moving between departments. International firms do this routinely, for example when a client onboarded in one office for a corporate mandate later instructs a UK team on a property acquisition with the identity documents already on file. Since 91% of the firms the SRA met run CDD on every client, in or out of scope, reuse is easy, and the SRA considers it safe only when the transfer itself prompts someone to revisit the risk assessment and source of funds for work of a different nature.

The EU’s Anti-Money Laundering Regulation (AMLR), which applies from July 2027, puts that question into law for firms with European offices. An EU office can rely on CDD performed elsewhere in the group but keeps responsibility for it, and the group-wide requirements may extend equivalent standards to the UK branches of EU-headed groups. Most large UK firms plan to respond by applying the higher EU standard across every office, so each office needs to see what another has already established and to what standard. Those firms expect source of funds to be where the divergence bites hardest, and it is also where the SRA found the most weakness on file.

Since June 2026, mandatory EDD under the MLRs has applied only to jurisdictions under a FATF Call for Action (Iran, North Korea and Myanmar, unchanged at the October 2026 plenary), while the EU’s high-risk third country list reaches further. A firm running one global standard has to decide which list drives EDD across the group. The SRA has been explicit that countries outside the Call for Action list should not be assumed low risk, so the decision belongs in the FWRA with reasoning that will stand up at inspection.

Quick check

1. Open a test matter for an existing client in a different office or department and see whether anything forces a fresh risk assessment and source of funds check.
2. Decide which country list drives EDD across the group now that the MLRs mandate it only for Iran, North Korea and Myanmar, and record the decision with its reasoning in the FWRA.
3. If you have EU offices, map where UK and EU source of funds standards differ before AMLR applies in July 2027.

Verification technology is widely used and rarely tested

Moving CDD between offices depends increasingly on technology that firms rely on more than they understand. Almost 93% of the firms the SRA met use electronic identity verification or similar tools in CDD, but only 48% test them for accuracy, up from 35% last year. Those that test run known PEPs and newly designated names through the system to see what comes back, and one MLCO found their provider was missing some PEPs. The SRA’s view is that an electronic report is only as reliable as the reviewer’s understanding of what the tool can detect, and that no verification result replaces a client and matter risk assessment.

Regulators on both sides of the Channel are now defining what counts as a reliable tool. February 2026 guidance from HM Treasury and DSIT says digital verification services not certified on the DVS register cannot reliably be deemed suitable for MLR identity verification, while AMLR recognises eIDAS-compliant electronic identification and AMLA’s technical standards, now with the European Commission, set the attributes it needs at each level of due diligence. For a firm applying one standard across UK and EU offices, provider certification has moved from procurement into compliance.

The report also flags AI-generated deepfakes and fabricated documents as a growing risk in remote onboarding and source of funds evidence, yet regulation 19(4)(c), which requires firms to assess the risks of new technologies, was the most common PCP gap in both desk-based reviews (41%) and inspections (20%). Testing against known positives with recorded match thresholds, documented and repeated at each vendor review, is the most defensible way to show the SRA that understanding.

One in five files held no evidence of PEP screening and 21% had no sanctions screening. For firms that screen every client the gap usually sits between the screening platform and the matter record, but a reviewer cannot tell a check that went unrecorded from one that was never run. Under the FCA’s 2025 guidance, which LSAG uses as its benchmark, domestic PEPs start from a lower risk position than foreign PEPs, so each match also has to be classified with the reasoning recorded, which is exactly what the SRA found missing from client and matter risk assessments.

Quick check

1. Run a set of known PEPs and newly designated names through your screening provider and record what it returns against what it should.
2. Update the new technology risk assessment required by regulation 19(4)(c) for your verification tools, covering how they handle deepfakes and fabricated documents and what reviewers do when a result is borderline.
3. Check that PEP and sanctions screening results land on the matter record, with each PEP match classified as domestic or foreign and the reasoning recorded.

Sanctions breaches are administrative, which makes them harder to spot 

Cases involving sanctions failures tripled this year, and the SRA attributes most of them to human or administrative error rather than deliberate misconduct. Its 12 inspections of firms acting for designated persons show how that happens where controls are established: between them the firms had acted for 35 designated persons over 24 months and used a general licence 24 times, and 11 of the 12 were assessed as compliant. The licence breaches it found were procedural, either fees paid by a linked company that went unreported or fees reported after the licence deadline, and in both cases the firm’s controls stopped short of the full payment lifecycle.

The SRA wants finance and compliance working closely on every payment to or from a designated person, with the matter team involved and one person accountable for licence terms and deadlines. In large firms those functions usually report through separate lines, and licence conditions tend to fail at the hand-offs. The move to a single UK sanctions list and the introduction of General Licence INT/2025/7323088 during the period also required policy updates, which the SRA flagged repeatedly in its bulletins.

That licence has since been replaced twice, by INT/2026/9512597 in April 2026 and INT/2026/11112108 from 29 October 2026. The current version touches both areas where the SRA found breaches: reporting is now monthly, due within 14 days of each month end, and a designated person can now pay for legal services provided to another designated person in the same group. Each licence runs for six months and OFSI states that none mirrors its predecessors, so a control built around the last one’s terms will be out of date within six months.

Quick check

1. Confirm whoever owns licence compliance is working to INT/2026/11112108 and has the monthly reporting deadline, 14 days after each month end, in the diary.
2. Ask finance how a payment from a company linked to a designated person would be flagged, and whether it would reach the licence report.
3. Diarise 28 April 2027, when the current licence expires, with enough lead time to read the replacement in full before it applies.

Controls that rely on someone remembering will eventually fail

One cause the SRA identifies behind this year’s breaches is system design: processes that let funds arrive or a matter move on without an automated stop when part of CDD is incomplete. Senior oversight and fee earner training also feature in its list, but system design is where the file data is clearest. Identification and verification, the control systems most often enforce, was missing on only 5% of files, which the SRA credits to system-led stops, while the gaps sit in controls that depend on individual judgement and recording, above all source of funds scrutiny and the reasoning behind client and matter risk assessments. An MLRO at a large firm should know which of those steps the firm’s workflow would let a matter proceed without.

PCPs should also reflect two changes in force since 30 June 2026 before the next independent audit: regulations 19(4) and 33(1)(f)(i) now refer to “unusually complex” transactions instead of “complex” ones, and the high-risk third country definition covers only the FATF Call for Action list.

Quick check

1. Walk a test matter through the workflow and note every point where funds can be received or the matter can progress with CDD incomplete.
2. Rank those gaps and start with source of funds scrutiny and risk assessment reasoning, where the SRA found most failures.
3. Update PCPs for “unusually complex” in regulations 19(4) and 33(1)(f)(i) and for the narrower high-risk third country definition before the next independent audit.