AML Training Requirements for Solicitors and Law Firms

Anti-money laundering training shows up on almost every list of what regulators expect law firms to get right — and almost every list of what they get wrong. For solicitors in England and Wales and Ireland, AML isn't a once-a-year e-learning module to clear before renewing a practising certificate; it's a recurring, risk-based control that both the SRA and the Law Society of Ireland treat as a core part of firm compliance, and a frequent subject of inspection.

Why AML training for law firms looks different from generic finance training

Generic AML training built for banks or accountancy firms misses most of what actually matters in a law firm context. Solicitors encounter money laundering risk through a specific set of transaction types: high-value residential and commercial conveyancing, where large sums move through client account in a single transaction; private client and probate work, where the source of an estate's wealth may span decades and multiple jurisdictions; and business sales or company formation work, where corporate structures can be used to obscure beneficial ownership. Training that doesn't address these scenarios directly — that stays at the level of generic red flags — leaves fee-earners unable to spot the patterns that actually show up in their files.

This is why risk-based, role-relevant training matters more than blanket completion of a single module. A conveyancing fee-earner needs deep familiarity with source of funds evidence and the red flags specific to property transactions. A private client solicitor needs to understand source of wealth assessment for long-accumulated assets. A firm's MLRO or MLCO needs training that goes well beyond either — covering the firm-wide risk assessment, suspicious activity reporting, and how to escalate concerns raised by fee-earners.

What regulators are actually checking

Both the SRA and the Law Society of Ireland treat AML compliance as a standing supervisory priority, not a periodic exercise. Inspections and thematic reviews tend to probe whether a firm's training is actually tailored to its risk profile — does a firm doing significant conveyancing work have training that reflects conveyancing-specific risk, or has it bought the same generic package regardless of practice mix? Firms that can show training content mapped to their own risk assessment are in a materially stronger position than those relying on a single standardised course completed once a year.

This connects directly to how client money is handled day to day. AML risk and financial control aren't separate concerns in practice — a firm with weak client due diligence is also more exposed to the kind of client account risk covered under the SRA Accounts Rules, since money laundering typically depends on moving funds through legitimate-looking client accounts.

What good AML training actually covers

Effective AML training for a law firm goes well beyond definitions. It needs to give fee-earners practical ability to carry out customer due diligence properly, understand when enhanced due diligence is required and what that looks like in practice, recognise the difference between source of funds and source of wealth and know which evidence is appropriate for each, and understand their firm's specific escalation route when something looks wrong. It should also be refreshed regularly rather than delivered once at induction and never revisited — AML typologies change, and a fee-earner trained three years ago on today's red flags is working from an outdated picture.

Firm-wide risk assessments deserve specific attention in training too. Every firm regulated for AML purposes is required to maintain a written risk assessment covering its client base, geographic exposure, service lines and delivery channels — and training should explain how that risk assessment actually shapes day-to-day due diligence decisions, rather than existing as a document nobody below partner level has read.

Sanctions and AML: related but distinct

AML and sanctions compliance overlap but aren't the same discipline, and training that conflates the two risks leaving gaps in both. AML training is fundamentally about detecting and reporting suspicious activity connected to the proceeds of crime; sanctions compliance is about screening clients and counterparties against constantly-updated designated-persons lists and knowing what to do when a match comes up. A firm that treats sanctions screening as a subsection of its AML training, rather than a distinct process with its own triggers and escalation route, is more likely to miss a sanctions match that wouldn't otherwise raise standard AML red flags.

Building a defensible training programme

A defensible AML training programme for a law firm needs three things: content genuinely tailored to the firm's practice areas and risk profile, a clear record of who has completed what and when, and a refresh cycle that keeps pace with changing typologies and regulatory guidance rather than a fixed once-a-year slot. For firms building or reviewing their CPD and compliance training, AML should sit alongside — not underneath — the firm's other core compliance training, given how directly it bears on regulatory risk.

How often should law firm staff complete AML training?

AML typologies and regulatory expectations change regularly, so effective programmes refresh training at least annually and supplement it with updates when significant new risks or guidance emerge, rather than relying on a single induction session.

Is generic AML training enough for a law firm?

Generic AML training built for other sectors typically doesn't cover the transaction types most relevant to solicitors, such as high-value conveyancing, probate and private client work, or business sales. Risk-based, role-relevant training tailored to a firm's actual practice mix is more defensible and more useful.

Who needs the deepest AML training within a firm?

Fee-earners handling high-risk work — conveyancing, private client, business sales — need practical, scenario-specific training, while the firm's MLRO or MLCO needs broader training covering the firm-wide risk assessment, reporting obligations and escalation handling.

What's the difference between AML training and sanctions training?

AML training focuses on detecting and reporting suspicious activity connected to proceeds of crime. Sanctions training focuses on screening clients and counterparties against designated-persons lists. They overlap but require distinct processes and should not be treated as a single combined module.

AML compliance in a law firm succeeds or fails on whether training actually reflects the firm's real risk — not on whether a module has been technically completed. Firms that invest in role-relevant, regularly refreshed training put themselves in a far stronger position, both for regulatory inspection and for actually catching the transactions that matter.

What the SRA found when it inspected nearly 400 firms

The SRA published a thematic review of AML training drawing on nearly 400 onsite inspections between April 2022 and April 2024 — 151 in 2022–23 and 237 in 2023–24 — together with a roundtable of 65 of the largest firms it supervises and interviews with 13 training providers. It is the clearest published picture of what the regulator actually looks for, and it is more specific than the regulation.

Of the 151 firms inspected in 2022–23, 42 were non-compliant with one or more regulations, and 19 of those 42 — about 45% — were given directions specifically on training and training records. The review presents that as evidence that weak training is not an isolated failing but a predictor of wider non-compliance.

One finding is worth acting on directly: firms whose money laundering compliance officer had undertaken additional training were around 50% more likely to be rated compliant than firms whose MLCO had not. The highest-return training decision in a small firm may be the compliance officer’s own.

The six failure patterns the review identified

• No AML training at all in some firms. Fee earners there were often unclear on source of funds and source of wealth checks, and on enhanced due diligence.
• No record of who had completed it, and no follow-up with staff who had not.
• Reliance on generic accreditation-scheme training, which the review says gives only a brief awareness of risks rather than usable competence.
• No training on the firm’s own AML policies. The consequence showed up in the files: client and matter risk assessments were often simply missing, which the review describes as a breach of the regulations.
• Training only some departments — conveyancing being the common example — in firms offering other in-scope services.
• Tick-box annual completion, with firms buying standard packages rather than tailoring them to the risks in their own practice.

What regulation 24 actually says

It is short, and most firms over-read the training half and under-read the records half.

Regulation 24(1) requires a firm to ensure relevant employees are aware of the law relating to money laundering, terrorist financing and data protection; are regularly given training in how to recognise and deal with transactions and other activities that may relate to money laundering or terrorist financing; and are able to identify and report suspicions. Note the data protection limb — it is in the regulation and is routinely left out of training packages.

Regulation 24(1)(b) requires a comprehensive written record of the training: the materials used, who attended, the dates, and the results of any assessment. A completion certificate from a provider is not that record. If you cannot produce materials, attendance, dates and assessment outcomes on request, the record is incomplete whatever the training itself was worth.

What good looks like, on this evidence

Tailored to the firm’s own risk assessment and its own policies rather than bought off the shelf. Delivered to everyone in scope, not only the department where the risk feels most obvious. Recorded with materials, attendance, dates and assessment results. Repeated often enough to be current rather than annual by habit. And with the compliance officer trained beyond the firm-wide baseline, which is the one variable the review found correlated with a compliant rating.

For the regulation in isolation, what HMRC and the SRA check under regulation 24 goes through it line by line. For the Irish equivalent, which is drafted differently, section 54 of the Criminal Justice Act 2010 sets out the obligation there. And because the SRA’s competence regime is changing in ways that interact with this, SRA continuing competence covers the 2026 consultation and what it would require from 2027/28.

The SRA is not going to be your AML supervisor for much longer

Everything above describes the regime as it stands. It is being replaced.

In October 2025 the Government announced that the Financial Conduct Authority will become the single AML and counter-terrorist financing supervisor for the legal and accountancy sectors and for trust and company service providers. The Law Society's own summary of the reform describes the FCA becoming the single professional services supervisor and significantly reducing the role of the SRA.

The FCA puts the affected population at around 60,000 businesses and sole practitioners, of which roughly 7,500 are law firms currently supervised by a professional body. The timetable it has published is deliberately long: planning work through 2026, an operating model review in 2027 once the enabling legislation has passed, the start of a phased transition in late 2028, and the remaining professional body populations moving across by 2030. The Office for Professional Body Anti-Money Laundering Supervision, which currently oversees the nine legal-sector supervisors alongside thirteen in accountancy, will be closed down once the transition is complete.

Three points matter for a firm planning its training now.

• Nothing changes yet. The FCA has been explicit that firms should keep following their existing AML processes and take questions to their current supervisor. The SRA remains the SRA until it does not.
• The SRA keeps its other functions. Practising certificates, conduct, the Standards and Regulations and the continuing competence obligation are unaffected. What moves is AML supervision specifically.
• Legal professional privilege is preserved. The FCA has said it will not use its information-gathering powers to obtain legally privileged material.

Funding will come initially from the Economic Crime Levy and then from fees charged to supervised firms, with a consultation on the fee approach promised before the FCA takes the role on. No figures have been published.

The practical consequence is the same one the SRA's inspection findings already point to. A firm whose training programme is genuinely good but only informally documented has been getting the benefit of a supervisor that knows it. A handover to a supervisor with no history with the firm removes that. The records described earlier in this guide — dated, per-person, tied to the firm-wide risk assessment — are what will carry across. Accountancy practices face the identical change on the identical timetable, covered in our guide to AML training for accountants.