AML Essentials for Solicitors: What UK and Ireland Firms Need to Know

A firm that provides certain services to clients by way of business, such as property, company or trust work, sits inside the Money Laundering Regulations 2017 (MLR 2017) whether a fee earner has ever thought about it or not. That makes AML compliance one of the few areas where getting the basics wrong is a personal, not just a firm-level, problem — and it sits alongside other client-money duties firms are already managing, including the SRA Accounts Rules and client money controls that govern how that money is held once it arrives. Here's what actually falls in scope, what the core obligations are, and where UK and Irish supervision diverge.

Who's actually in scope

You are inside MLR 2017 when your firm provides certain services to others by way of business, not simply because it is a firm of solicitors. Under regulation 12, a firm counts as an independent legal professional when it provides legal services while taking part in financial or real property transactions, such as buying and selling land or business entities, handling client money or assets, or setting up or managing trusts and companies. The Solicitors Regulation Authority (SRA) also supervises firms as trust or company service providers and as tax advisers. According to the SRA, there is no definitive list of work that is out of scope, in-house legal services do not trigger the requirements, and there is no de minimis for small transactions. You decide matter by matter. Some work, such as litigation, may be out of scope, but a matter can be drawn in, for example if setting up a trust arises within it.

The nuance that catches firms out is that there is no fixed, definitive list of in-scope and out-of-scope work — a matter that starts outside scope can move into it, for example if trust or company work emerges partway through a retainer. In practice, conveyancing, commercial and corporate transactions, trust and company work, most tax work, and probate involving asset management are the areas fee earners should assume are in scope by default.

The core obligations, in outline

Once a matter is in scope, four things need to happen: a firm-wide risk assessment that reflects the SRA's own sectoral risk assessment; customer due diligence on the client and the matter, scaled to the assessed risk; ongoing monitoring for the life of the matter, not just a one-off check at the start; and a suspicious activity report where something doesn't add up. Each of these has enough depth to warrant its own guide — our firm-wide AML risk assessment guide covers what MLR 2017 Regulation 18 actually requires in the risk assessment itself, and our guide to SARs and tipping off covers when a report has to be filed and the offence you commit by alerting the client to it.

AML training: what regulation 24 requires

The legal source of AML training for solicitors in England and Wales is regulation 24 of MLR 2017. A firm in scope must take appropriate measures so that its relevant employees, and certain agents, are made aware of the law on money laundering, terrorist financing and proliferation financing and of the data protection requirements that apply, and are given regular training on recognising and dealing with suspicious activity. It must also keep a written record of these measures, in particular the training given. A "relevant employee" is someone whose work is relevant to the firm's compliance with the Regulations, or who could help identify or mitigate its risks or prevent or detect these crimes. What counts as appropriate depends on the size and nature of your business and its money laundering risks.

The regulation does not set a number of hours or a fixed interval. For the SRA's expectations, see its thematic review of AML training, published on 30 October 2024:

• Who: relevant employees and agents such as contractors or temporary staff, including support staff. The SRA says you may treat all employees as relevant, and that training only some teams, such as conveyancing, is not good practice.
• How often: at "regular and appropriate intervals" on a risk basis. The SRA notes that Legal Sector Affinity Group guidance says relevant employees should take high-level awareness or refresher training annually. New staff should be trained as soon as possible, ideally at induction and before regulated work.
• What: content tied to your firm-wide risk assessment, policies, due diligence, source of funds and wealth checks, and reporting. The SRA says that solely asking fee earners to read the AML policy would not satisfy regulation 24.
• Records: a written record of all training, including materials, attendance, dates and assessment results.
• Money laundering reporting officers: there is no explicit requirement for extra training, but the SRA found firms were around 50 per cent more likely to be compliant where the compliance officer had additional training. That is an association seen in inspections, not proof of cause.

Separately, paragraph 4.3 of the SRA Code of Conduct for Firms requires you to ensure managers and employees are competent to carry out their role and keep their knowledge and skills up to date. For a fuller walk-through, see our guide to AML training requirements for solicitors and law firms.

Client due diligence: the basics every fee earner needs

Standard due diligence means verifying who the client actually is and, for companies and trusts, who ultimately owns or controls them — not just who signs the engagement letter. Enhanced due diligence (EDD) applies on top of standard checks in higher-risk situations. Under regulation 33 of MLR 2017 these include where the client is a politically exposed person (PEP) or a family member or known close associate of one, where a transaction is unusually complex or unusually large, forms an unusual pattern or has no apparent economic or legal purpose, and where a person is established in a "FATF call for action country". Since 10 January 2024, domestic PEPs start from a lower risk position than non-domestic PEPs, so lighter EDD can apply unless other enhanced risk factors are present. And since 30 June 2026, the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 limit the mandatory country trigger to FATF "call for action" jurisdictions, which the SRA says are currently North Korea, Iran and Myanmar. FATF updates its lists regularly, so check the current list, and wider geographic risk, including FATF mutual evaluations, still belongs in your risk assessment. Where money is involved, source of funds and source of wealth are two different questions that get conflated far too often — our guide to source of funds and source of wealth checks sets out the distinction and the red flags that should prompt a closer look.

The most common failure point isn't fraud detection — it's simply not doing CDD at all on a matter that quietly became in-scope, or doing it once at the start and never revisiting it as a transaction evolves. A five-minute "is this still the same risk picture" check at key milestones catches far more than any single onboarding form.

England, Wales and Ireland: who supervises you, and where reports go

England and Wales

The SRA supervises the solicitors' firms it regulates for AML compliance under MLR 2017, and its guidance sits alongside the Legal Sector Affinity Group (LSAG) guidance. The latest LSAG revision was approved by HM Treasury and took effect on 23 April 2025. Suspicions are reported to the National Crime Agency, usually through your money laundering reporting officer.

The supervisor will change in future. The government has decided that the Financial Conduct Authority (FCA) will become the single professional services AML supervisor, replacing the professional body supervisors including the SRA. According to the SRA, no transition date had been set when we checked, and the Office for Professional Body AML Supervision (OPBAS) continues to oversee professional body supervisors during the transition, ceasing once the FCA takes full responsibility. Until the transfer happens, follow your current supervisor's requirements.

Ireland

The Law Society of Ireland is the competent authority for solicitors under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, as amended. According to the Law Society, the Solicitors (Money Laundering and Terrorist Financing) (Amendment) Regulations 2026 took effect on 1 September 2026, add no new obligations for solicitors and do not change its role. Reports of suspicious transactions go to FIU Ireland, part of An Garda Síochána, through the goAML portal, and also to the Revenue Commissioners through Revenue's Online Service (ROS). They do not go to the National Crime Agency. Our guides on suspicious transaction reports in Ireland and AML training under section 54 cover the detail. The obligations are broadly parallel to England and Wales (risk assessment, due diligence, reporting), but the reporting channels and legislation differ, which matters for any firm operating in both jurisdictions.

FAQ

Does every solicitor need AML training, even if they don't handle conveyancing or company work?
Regulation 24 requires training for relevant employees, meaning staff whose work is relevant to compliance or who could help spot or prevent money laundering. The SRA says you may treat all employees as relevant and that training only some teams is not good practice.

How often must AML training be repeated?
The regulation says "regular" training and does not set a fixed interval or number of hours. The SRA expects training at regular and appropriate intervals based on risk, and notes that LSAG guidance points to annual refresher training for relevant employees.

Will the SRA stay my AML supervisor?
Not permanently. The government has decided the FCA will become the single professional services supervisor, but the SRA had set no transition date when we checked.

What's the difference between customer due diligence and enhanced due diligence?
Standard CDD verifies identity and ownership at a baseline level for every in-scope client. Enhanced due diligence adds extra verification steps and senior sign-off for higher-risk clients or transactions, such as those involving politically exposed persons or unclear sources of funds.

Who do I report a suspicion to?
Internally, to your firm's Money Laundering Reporting Officer (or Money Laundering Compliance Officer), not directly to a regulator. Your MLRO then usually decides whether to file externally, to the National Crime Agency in the UK, or through the goAML portal (and Revenue's Online Service) in Ireland.

Can a matter become in-scope partway through if it didn't start that way?
Yes. There's no fixed list of exempt work, and a matter that begins as straightforward advice can move into scope if it develops into, for example, trust or company work. CDD and risk assessment should be revisited whenever the nature of the matter changes materially.

AML compliance for solicitors isn't a single course or a single checklist — it's a set of habits that has to hold up across risk assessment, due diligence, ongoing monitoring and reporting, at both firm and individual level. Learnsignal's Legal CPD training covers each of these building blocks in depth, mapped to both the SRA and Law Society of Ireland frameworks.

This article is general information, not legal or compliance advice. Check the current legislation and your regulator's guidance before relying on it.