The short answer
A firm wide risk assessment is the written document, required by regulation 18 of the Money Laundering Regulations 2017, in which a firm identifies and assesses the money laundering and terrorist financing risks its own business faces. It must be in writing, kept up to date, and given to the SRA on request. It must cover five risk factors: clients, geography, products and services, transactions and delivery channels. Not having a compliant one is a breach of the regulations in itself, and failures relating to firm wide risk assessments are among the most common AML failings identified by the SRA.
What regulation 18 requires
- In writing, kept up to date, and provided to the SRA on request
- Five mandatory risk factors: clients, countries or geographic areas, products and services, transactions, delivery channels
- Record your working: the steps taken to prepare the assessment must themselves be recorded
- Take account of the SRA’s sectoral risk assessment, which regulation 18(2)(a) requires
- It feeds everything else: the policies, controls and procedures required by regulations 19 to 21 are built on it
What the firm wide risk assessment actually is
Regulation 18(1) of the Money Laundering Regulations 2017 requires a relevant person to take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject. For a law firm, that means a document about your firm: the clients you actually act for, the work you actually do, the places your money actually comes from.
It is not a policy document and it is not a client file check. Those are separate obligations. The firm wide risk assessment sits above them, and the SRA’s warning notice on firm risk assessments describes it as the backbone of the policies, controls and procedures required under regulations 18 to 21. It should also set out the firm’s appetite for higher-risk work, which is what makes it useful rather than ceremonial: it tells fee earners where the firm’s line is before they are standing at it.
The obligation is not satisfied merely by having a document. The assessment must meet regulation 18’s requirements and accurately set out the risks to which the firm is exposed. The SRA’s warning notice also says that firms must record the steps taken to prepare the assessment.
The five risk factors you must cover
Regulation 18 sets a minimum. Your assessment must consider the risk arising from each of these, and the SRA’s warning notice gives worked examples:
- Clients. Including whether any are politically exposed persons, or family members or known close associates of PEPs
- Countries or geographic areas you operate in. Including anywhere carrying corruption risk or classed as a high-risk third country
- Products or services. Conveyancing is the SRA’s own example, and it recurs through the enforcement decisions
- Transactions. Including whether any are of a larger size
- Delivery channels. Including online work or work conducted without face-to-face contact
On top of these, regulation 18(2)(a) requires firms to take into account information made available by their supervisory authority. The SRA has said it has a broad concern that firms are not taking its sectoral risk assessment into account as the regulation requires. Firms should therefore be able to demonstrate that the sectoral risk assessment has been taken into account when preparing and updating their own assessment.
What the SRA found when it read 400 of them
The regulator called in and reviewed 400 firm wide risk assessments. It took follow-up action on around 20% that did not meet the required standards. That is one in five failing on a document the firm knew was being inspected.
Three findings are worth taking personally. The SRA saw broad use of templates, some still carrying prepopulated specimen text, and in some cases near-identical assessments submitted by different firms. It found many assessments simply omitted required factors, most often high-risk jurisdictions, transactions and delivery method. And it found widespread misunderstanding of PEP obligations, singling out a specific move: firms stating that they do not act for PEPs. That does not discharge the obligation, because you still have to be able to identify a PEP and have controls ready if one walks in.
The regulator’s position on consequences is unambiguous. Failing to have an assessment in place is a significant breach, and it says it will take robust enforcement action where a firm has none, where the one it has is insufficient, or where breaches are not fixed immediately. If you are unsure how your firm would fare on a review of this kind, the SRA Compliance Readiness Score gives a risk rating and a priority action plan.
How this shows up in enforcement
The pattern is visible in the SRA’s published outcomes. Corbin & Hassan (UK) LLP agreed a £4,631 penalty plus £600 costs after the AML Proactive Supervision team’s desk-based review found failings in its firm wide risk assessment, its client and matter risk assessments and its source of funds checks, with no compliant firm wide assessment maintained until March 2025. Kirkwoods agreed a £3,476 penalty plus £600 costs over long-running AML failures. Its firm wide risk assessment failing ran from 26 June 2017 to 11 January 2022. Separately, the SRA found that from 26 June 2017 to 11 February 2025 the firm failed to regularly review, update and maintain a written record of its policies, controls and procedures. KTP Solicitors was fined over an AML risk assessment compliance breach in July 2026.
Two things stand out across these. The penalties are modest, but the published settlement agreement is not, and it stays searchable against the firm’s name. And the failures are long-running: these are not firms caught on a bad month, they are firms whose assessment stopped reflecting the business years before anyone looked.
Worth noting alongside this: a breach of the money laundering regulations does not automatically amount to professional misconduct. In Dentons UK and Middle East LLP v SRA [2026] EWCA Civ 508, which concerned breaches of the Money Laundering Regulations 2007, the Court of Appeal held that a breach must be sufficiently serious to amount to professional misconduct under the relevant SRA standards. The court nevertheless upheld the quashing of the tribunal’s original decision and remitted the matter to a freshly constituted tribunal to apply the correct test. That distinction concerns the disciplinary consequences of a breach, not the underlying obligation to comply with the regulations.
Frequently asked questions
Who needs a firm wide risk assessment?
Every firm within scope of the Money Laundering Regulations 2017. Regulation 18 applies to relevant persons without a size exemption, so a sole practice doing conveyancing needs one as much as a large commercial firm.
How often should it be reviewed?
The regulations require it to be kept up to date rather than reviewed on a fixed calendar. In practice that means reviewing it whenever the firm’s client base, practice areas, geographic exposure or delivery methods change, and recording that you did. Enforcement decisions have turned on assessments left static for years.
Can we use a template?
A template can be a starting structure, but the SRA found near-identical assessments submitted by different firms and prepopulated specimen text left in place. An assessment that does not describe your firm’s actual risks does not meet regulation 18, whatever its source.
What is the difference between a firm wide risk assessment and a client and matter risk assessment?
The firm wide assessment covers the risks the business as a whole faces. Client and matter risk assessments apply that thinking to individual clients and retainers. Enforcement decisions frequently find both missing together, because the second is built on the first.
What happens if we do not have one?
The SRA treats the absence of a compliant firm wide risk assessment as a significant breach of the regulations and has said it will take robust enforcement action, including where an assessment exists but is insufficient. Recent outcomes have been financial penalties plus investigation costs, published by name.
What to check in yours this week
Open the document and find the date it was last reviewed. Then check it against the work the firm actually did over the last twelve months, not the work it did when the assessment was written. Confirm all five regulation 18 factors are addressed rather than mentioned, that the SRA’s sectoral risk assessment is reflected, and that any statement about PEPs describes how you would identify one rather than asserting you have none. If the document contains a sentence you would not be able to explain to an inspector, that sentence is the problem.
For a wider view of where the firm stands, our SRA Compliance Readiness Score covers AML alongside seven other compliance dimensions, with each question tied to the rule behind it. It takes about eight minutes and needs no account.