28 August 2026

What law firms need to know about changing UK AML rules

Matthew Borg

Director

Two separate changes are landing on UK law firms at the same time. One is already in force, and one is still working its way through Parliament. Together they represent the biggest shift in how firms are expected to manage financial crime risk in years.

Neither change is optional to ignore. One is already binding law, and the other will eventually replace the regulator most firms have known their entire careers.

What's already changed: the MLR 2026 amendments

On 30 June 2026, the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 took effect. These are targeted, technical amendments to the existing Money Laundering Regulations 2017. It’s not a wholesale rewrite, but several changes matter immediately for how firms operate day to day.

Monetary thresholds have moved from euros to sterling, so figures like the €1,000 threshold for occasional transactions are now expressed in pounds. The trigger for enhanced due diligence has been narrowed. Firms must now notify the FCA of certain material breaches within 30 days. This is a genuinely new obligation with a hard clock attached. High-risk third countries have been redefined too: they're now limited to countries on the FATF's "call for action" list, rather than the broader list that previously also included FATF's "increased monitoring" countries. Firms that operate pooled client accounts also face a new, specific duty: assessing and documenting the money-laundering risk of each customer using the account, not just the account itself.

None of this is proposed or pending. It's already the law firms are expected to be following today.

What's changing over the longer term: AML supervision itself is moving

Separately, the way legal sector AML compliance is supervised is being rebuilt from the ground up. In October 2025, the UK government confirmed that the Financial Conduct Authority (FCA) will become the single professional services supervisor for AML and counter-terrorism financing, replacing the current patchwork of 22 professional body supervisors, including the SRA.

This is not a small administrative handover. The SRA currently supervises around 5,569 firms for AML compliance; the move to the FCA will add roughly 60,000 legal, accountancy and trust-and-company-service-provider entities to a regulator that already supervises about 17,000. The Financial Services and Markets Bill enabling the transfer was introduced to Parliament in May 2026, with Royal Assent not expected until around mid-2027, and full transition – including firm registration, fit-and-proper assessments, and a new FCA AML Handbook – expected to run through 2027 and into 2028. The SRA keeps its AML supervisory role throughout 2026 and into 2027.

The concern raised across the profession isn't really about the destination. Most accept that fragmented supervision was a genuine weakness the UK needed to fix ahead of its next FATF evaluation. But the FCA's approach is widely expected to be more data-driven and less forgiving than the SRA's guidance-led style. One analysis noted the FCA rejected 44% of firm applications in a recent year, against the SRA's effective 100% acceptance rate. Firms are being told, in effect, to expect sharper scrutiny once the transition completes – even though we don’t yet know exactly when that will be.

Why this matters right now, not just eventually

Here's the part firms shouldn't wait on: enforcement under the current regime is already intensifying, well ahead of any FCA takeover. The SRA's own Anti-Money Laundering Annual Report for 2024–25 recorded 935 proactive AML engagements, nearly double the 545 in the previous period, with 833 firms subject to an onsite inspection or desk-based review. Despite that scrutiny, the underlying picture the report paints isn't reassuring: roughly one in three firms remain non-compliant, and around half are only partially compliant.

The failures keep repeating in the same places. Recent enforcement decisions show firm-wide and client-matter risk assessments – done poorly, or not properly recorded – as the most consistent problem, with individual fines reaching £25,000 and beyond for exactly this gap. Across recent settlements, defective policies, controls and procedures contributed to roughly two-thirds of fines issued, and MLRO or MLCO oversight was found deficient in around one in five investigated cases. Conveyancing remains the practice area the SRA treats as highest risk.

Put simply: the regulator that exists today is already tightening its grip, and the regulator taking over tomorrow is expected to be stricter still.

Where Breeio LMS helps firms manage this

None of the changes above are really a training-content problem, though training materials do need to be updated to reflect the changes. Firms don't fail AML inspections because nobody has heard of risk assessments; they fail because the evidence that training happened, that it reflected the current rules, and that oversight was genuinely active is scattered, stale, or simply doesn't exist in a form a supervisor can review quickly.

That's precisely where Breeio's compliance training tracking, automated reminders and firm-wide dashboards earn their keep. Breeio is an efficient, easy-to-use LMS platform designed for professional development and easy-to-prove compliance. Training records can show not just that AML training was completed, but that it reflects the current Legal Sector Affinity Group guidance and the specific 2026 amendments, rather than a generic module rolled over from a previous year. Lapsed or overdue training becomes visible automatically, reminders are sent to solicitors and team leaders, instead of surfacing for the first time during a file review. Because AML obligations genuinely differ by role, training and evidence can be organised by role too. A fee earner, a member of support staff, and an MLRO don't need identical training, and a system that treats them identically will under-serve someone.

The firm-wide view matters just as much as the individual one. An MLRO or COLP asked to certify that the firm is meeting its obligations shouldn't be relying on informal assurances from managers. Breeio’s live, firm-wide reporting dashboard is what allows that certification be made with confidence rather than hope. And because the highest-risk practice areas are already well known – conveyancing chief among them – training and refreshers can be targeted where the real exposure sits, rather than applied uniformly across a firm regardless of risk.

Whatever the FCA's eventual AML Handbook ends up requiring in detail, firms with clean, current, well-evidenced training records won't be starting from zero when it lands. The work of building that evidence base now is the same work that satisfies today's SRA scrutiny and tomorrow's FCA expectations.

Feel free to get in touch with us at Breeio if you’d like to discuss how Breeio and our Anti-money Laundering courses for Solicitors and Support Staff can help your firm start building your evidence base now.

Sources:

This article describes AML regulatory changes as they stood in August 2026. The MLR 2026 amendments are in force; the transfer of AML supervision from the SRA to the FCA is a multi-year process still in progress and not yet complete.