CILEx Regulation’s latest Sectoral Risk Assessment 2025-2026 examines the money laundering, terrorist financing and proliferation financing risks facing the firms it supervises. While the wider UK legal sector continues to be assessed as Medium Risk, CRL has assessed its regulated firms as being as Low Risk, reflecting the nature of services provided, predominantly UK-based client bases, limited exposure to higher-risk work, and continued improvements in AML controls and compliance standard.
Key findings
The assessment found that most CRL-supervised firms operate in lower-risk practice areas including wills and probate, estate administration, family law, litigation and advocacy services. Exposure to higher-risk activities such as conveyancing, complex corporate structures, Trust and Company Service Provider (TCSP) services and high-risk jurisdictions remains limited. Firms also predominantly act for UK-based individual clients, with minimal exposure to Politically Exposed Persons (PEPs), sanctioned individuals and international transactions.
Supervisory activity identified significant improvements across the sector, including stronger AML governance and oversight, improved Customer Due Diligence (CDD), enhanced sanctions compliance frameworks, better quality Practice-Wide Risk Assessments (PWRAs) and increased use of electronic identity verification and screening tools.
Risk areas identified
Despite the positive overall picture, several residual risks remain:
Source of Funds (SoF) and Source of Wealth (SoW) checks continue to present the most significant risk. Although firms are generally carrying out these checks, supervisory reviews identified inconsistencies in the scope of enquiries, supporting evidence obtained and how findings are recorded. This is particularly relevant in probate and estate administration matters involving significant client funds.
Training and governance frameworks also remain a medium-risk area. While AML training is taking place across the sector, firms do not always maintain sufficient records demonstrating training completion, content covered, competency assessments and compliance with regulatory requirements.
Client and Matter Risk Assessments (CMRAs) the assessment found that quality and depth can vary, with weaknesses identified in risk analysis, residual risk assessments, ongoing monitoring records and documenting the rationale behind risk-based decisions.
In addition, while sanctions and PEP screening is widely undertaken, firms do not always maintain clear audit trails showing what screening was completed, the outcome of checks, escalation decisions and ongoing monitoring activities. Smaller firms may also be more vulnerable to key-person dependency.
Emerging risks
The assessment highlights several developing threats that firms should continue to monitor and incorporate into their risk management frameworks. These include:
- AI-enabled fraud, including the use of deepfake technology and fraudulent documents.
- Cyber-enabled crime such as business email compromise, ransomware and payment diversion fraud.
- Sanctions evasion and increasing geopolitical instability.
- Cryptoassets and associated financial crime risks.
- Proliferation financing risks and evolving regulatory expectations.
- Personnel changes that can create governance and compliance gaps if key AML responsibilities are not effectively transferred.
What firms should do
CRL encourages firms to use the findings of the assessment to strengthen their AML frameworks by:
- Keeping Practice-Wide Risk Assessments under regular review.
- Enhancing Source of Funds and, where appropriate, Source of Wealth procedures.
- Ensuring AML training remains current, relevant and appropriately documented.
- Maintaining robust audit trails for sanctions and PEP screening.
- Improving the quality of Client and Matter Risk Assessments and ongoing monitoring records.
- Considering emerging risks, including AI, cybercrime, sanctions evasion and cryptoassets, within policies, procedures and staff training programmes.
Why it matters
Although the legal sector continues to be regarded nationally as Medium Risk, the findings suggest that CRL-regulated firms are generally operating at a lower level of risk and are continuing to improve their AML controls. Maintaining this position will require firms to remain vigilant, particularly in relation to Source of Funds checks, sanctions compliance, training and governance, cyber-enabled crime and emerging financial crime threats. The assessment provides an important resource for firms when reviewing their AML policies, risk assessments and compliance frameworks, helping ensure they remain effective, proportionate and responsive to an evolving risk landscape.
