AML Essentials for Solicitors: What UK and Ireland Firms Need to Know

Every solicitor's firm handling property, company or trust work sits inside the Money Laundering Regulations 2017 whether a fee earner has ever thought about it or not. That makes AML compliance one of the few areas where getting the basics wrong is a personal, not just a firm-level, problem — and it sits alongside other client-money duties firms are already managing, including the SRA Accounts Rules and client money controls that govern how that money is held once it arrives. Here's what actually falls in scope, what the core obligations are, and where UK and Irish supervision diverge.

Who's actually in scope

Not every piece of legal work is caught by the Money Laundering Regulations 2017. The regulations apply to solicitors acting as "independent legal professionals" on specific types of business: buying and selling property or business entities, managing client money and assets, opening or managing bank and securities accounts, and creating or managing companies, trusts or foundations. Tax advice is also in scope. Litigation and advocacy are generally treated as out of scope, as is most employment law work and straightforward stamp duty processing.

The nuance that catches firms out is that there is no fixed, definitive list of in-scope and out-of-scope work — a matter that starts outside scope can move into it, for example if trust or company work emerges partway through a retainer. In practice, conveyancing, commercial and corporate transactions, trust and company work, most tax work, and probate involving asset management are the areas fee earners should assume are in scope by default.

The core obligations, in outline

Once a matter is in scope, four things need to happen: a firm-wide risk assessment that reflects the SRA's own sectoral risk assessment; customer due diligence on the client and the matter, scaled to the assessed risk; ongoing monitoring for the life of the matter, not just a one-off check at the start; and a suspicious activity report where something doesn't add up. Each of these has enough depth to warrant its own guide — our firm-wide AML risk assessment guide covers what MLR 2017 Regulation 18 actually requires in the risk assessment itself, and our guide to SARs and tipping off covers when a report has to be filed and the offence you commit by alerting the client to it.

Client due diligence: the basics every fee earner needs

Standard due diligence means verifying who the client actually is and, for companies and trusts, who ultimately owns or controls them — not just who signs the engagement letter. Enhanced due diligence kicks in for higher-risk scenarios: politically exposed persons, complex or unusually structured transactions with no obvious legitimate purpose, and clients connected to jurisdictions the FATF has flagged for action (a list that, as of mid-2026, sits at just three countries, though firms still need to weigh other geographic risk factors separately). Where money is involved, source of funds and source of wealth are two different questions that get conflated far too often — our guide to source of funds and source of wealth checks sets out the distinction and the red flags that should prompt a closer look.

The most common failure point isn't fraud detection — it's simply not doing CDD at all on a matter that quietly became in-scope, or doing it once at the start and never revisiting it as a transaction evolves. A five-minute "is this still the same risk picture" check at key milestones catches far more than any single onboarding form.

UK and Ireland: who supervises you, and where reports go

In England and Wales, the SRA is the AML supervisor for solicitors under MLR 2017, working within the Legal Sector Affinity Group (LSAG), whose guidance is approved by HM Treasury and was last substantively updated in 2025. Suspicious activity reports go to the National Crime Agency, and the Money Laundering Reporting Officer is the person who files them.

In Ireland, the Law Society is the competent authority for solicitor AML supervision under the Criminal Justice (Money Laundering and Terrorist Financing) framework, most recently updated by regulations that took effect in September 2026. Irish solicitors report suspicious transactions through the goAML portal and file separately on the Revenue Online System, rather than to the NCA. The obligations are broadly parallel — risk assessment, CDD, reporting — but the reporting infrastructure and the specific legislation differ, which matters for any firm operating across both jurisdictions.

FAQ

Does every solicitor need AML training, even if they don't handle conveyancing or company work?
If a firm has any in-scope business anywhere in it, both the SRA and the Law Society of Ireland expect firm-wide training, including for staff who don't personally handle regulated matters — a large share of AML failures start with someone outside the transaction team missing a red flag.

What's the difference between customer due diligence and enhanced due diligence?
Standard CDD verifies identity and ownership at a baseline level for every in-scope client. Enhanced due diligence adds extra verification steps and senior sign-off for higher-risk clients or transactions, such as those involving politically exposed persons or unclear sources of funds.

Who do I report a suspicion to?
Internally, to your firm's Money Laundering Reporting Officer (or Money Laundering Compliance Officer), not directly to a regulator. The MLRO then decides whether to file externally — to the National Crime Agency in the UK, or via the goAML portal in Ireland.

Can a matter become in-scope partway through if it didn't start that way?
Yes. There's no fixed list of exempt work, and a matter that begins as straightforward advice can move into scope if it develops into, for example, trust or company work. CDD and risk assessment should be revisited whenever the nature of the matter changes materially.

AML compliance for solicitors isn't a single course or a single checklist — it's a set of habits that has to hold up across risk assessment, due diligence, ongoing monitoring and reporting, at both firm and individual level. Learnsignal's Legal CPD training covers each of these building blocks in depth, mapped to both the SRA and Law Society of Ireland frameworks.