SRA AML Enforcement in 2026: Why Fines and Inspections Have Surged

Anti-money laundering compliance has always sat near the top of the SRA's regulatory priorities, but 2026 has seen a marked and measurable escalation in how actively the regulator is checking firms are meeting their obligations. Proactive AML engagements — the SRA's term for its own initiated reviews of firms' AML controls, as opposed to reactive investigations triggered by a complaint or report — have nearly doubled compared with the previous reporting period, and the fines being issued off the back of these reviews are both more frequent and, in some cases, substantially larger.

For firms that have treated AML compliance as a box-ticking exercise completed once and left largely unrevisited, 2026's enforcement data is a clear signal that approach no longer holds up. This guide sets out the scale of the enforcement increase, the specific failures the SRA keeps finding, and what firms need to do differently.

The scale of the increase

The SRA carried out 935 proactive AML engagements in the most recent reporting period, almost double the 545 recorded in the previous period. Alongside this, the regulator has issued more than 35 financial penalties totalling in excess of £565,000, with individual fines ranging from £658 for narrower, isolated failings up to £300,000 for the most serious cases involving sustained, multi-year compliance gaps. This is not simply a story of a handful of large fines skewing the total — the sheer number of proactive engagements shows the SRA is casting a much wider enforcement net than before, meaning far more firms are being actively checked, not just the small number that end up publicly named in the largest penalty cases.

Where firms are actually falling short

The pattern of failures the SRA is finding is instructive, because it points to specific, fixable gaps rather than wholesale non-compliance across the board. Client and matter risk assessments were found to be ineffective in up to 39% of files reviewed — meaning firms had a risk assessment process on paper, but it wasn't being applied with real rigour to individual client relationships and matters. Source of funds documentation was frequently inadequate, a persistent weak point across AML compliance generally, since verifying where a client's money has actually come from is one of the most fundamental — and most often under-resourced — elements of client due diligence. Outdated firm-wide risk assessments accounted for 70% of the fines issued in early 2025, and deficient AML policies and procedures more broadly were cited in 67% of fines. Taken together, roughly a third of firms reviewed were found to be fully non-compliant, with a further 54% only partially meeting requirements — leaving a genuine minority of firms reviewed in full compliance.

Why "we have a policy" is not the same as compliance

The recurring theme across these failure categories is the gap between having AML documentation in place and that documentation actually reflecting live, current practice. A firm-wide risk assessment written several years ago and never revisited does not meaningfully protect a firm if the nature of its client base, practice areas, or risk exposure has shifted since. Similarly, a policy document that sets out the right procedures on paper does nothing if individual fee earners aren't applying client and matter risk assessments with real substance on live files. The SRA's enforcement pattern in 2026 suggests it is specifically probing this gap between paper compliance and operational reality, rather than simply checking that a policy document exists.

What firms should be doing differently

• Treat risk assessments as living documents. Both firm-wide and individual client/matter risk assessments should be reviewed and updated on a genuine cycle, not written once and left untouched — an outdated firm-wide risk assessment was behind 70% of early 2025 fines.
• Strengthen source of funds verification. Given how consistently this is flagged as a weak point, firms should review whether their source of funds checks go beyond a client's own assertion to genuine, evidenced verification proportionate to the transaction risk.
• Invest in ongoing, not one-off, training. Quarterly training with clear escalation procedures for fee earners who identify a potential AML concern helps close the gap between documented policy and day-to-day practice.
• Consider automation for routine checks. ID verification, sanctions screening, and consistent data capture are all areas where automated tools can reduce the human error and inconsistency that manual processes are prone to.
• Prepare for closer scrutiny ahead of FCA supervision. The legal sector's AML supervision is expected to transition toward FCA oversight in time, and firms should expect that transition to bring increased documentation demands and greater partner-level accountability for AML failures, rather than treating current SRA enforcement levels as a ceiling.

How this connects to wider SRA compliance priorities

AML is one strand of a broader tightening across SRA regulatory expectations in 2026, alongside developments like the strengthened continuing competence requirements and updated expectations on diversity, equality and inclusion. Firms treating each of these as isolated compliance projects risk missing the common thread: the SRA's overall posture in 2026 has shifted toward more active verification that documented policies are genuinely operating in practice, not simply toward new rules on paper.

Frequently asked questions

How many proactive AML engagements has the SRA carried out?

935 in the most recent reporting period, almost double the 545 recorded in the previous period.

What is the most common AML compliance failure the SRA is finding?

Ineffective client and matter risk assessments, found in up to 39% of files reviewed, alongside inadequate source of funds documentation and outdated firm-wide risk assessments, which accounted for 70% of early 2025 fines.

Is legal sector AML supervision moving to the FCA?

A transition toward FCA supervision for the legal sector's AML oversight is expected in time, and firms should anticipate this bringing increased documentation demands and greater partner-level accountability.

The scale of the increase in SRA proactive AML engagements makes clear that 2026 is not the year to treat AML compliance as a static, once-written policy — the firms being fined most heavily are consistently the ones whose documentation had gone stale relative to their actual practice. Learnsignal's CPD courses cover AML compliance and the wider set of SRA regulatory developments affecting solicitors through 2026.