The Future of AML Audits Will Be About Evidence, Not Documentation

For years, AML audits have largely focused on policies, procedures and paperwork.

Do firms have a risk assessment?

Do they have a compliance framework?

Do they have customer due diligence records?

While these questions will remain important, they are unlikely to be enough in the years ahead.

The legal sector is preparing for one of its biggest regulatory transformations as AML supervision moves towards a future FCA-led model. At the same time, criminal threats are becoming more sophisticated, digital and international.

The result is a fundamental shift in what regulators are likely to expect.

Increasingly, firms won't simply need to show that compliance controls exist. They'll need to demonstrate that those controls are effective.

The Warning Signs Are Already There

The latest compliance data suggests many legal firms still have work to do before reaching that level of maturity.

More than 450 AML compliance reviews were conducted by the SRA in 2024-25. Of those reviewed, 62% of firms were found to have at least one compliance gap. The most common failings included inadequate Source of Funds checks (38%), poor record keeping (31%) and insufficient risk assessments (27%). More than 180 firms required remedial action plans and 23 firms were referred for enforcement action.

Those figures suggest many firms are still focused on basic compliance foundations while regulators are already looking towards a more outcomes-based future.

The National Risk Register Paints a Clear Picture

The National Risk Register highlights a range of threats expected to affect the UK over coming years.

Three stand out for legal firms:

Economic Crime

Financial crime continues to evolve through increasingly complex ownership structures, international networks and sophisticated laundering techniques.

Law firms remain attractive targets because of their role in property transactions, corporate structures and high-value client relationships.

Fraud

Fraud remains one of the most significant risks facing UK organisations.

With Failure to Prevent Fraud legislation approaching, businesses are being encouraged to demonstrate that prevention is embedded within their operations rather than treated as an afterthought.

Cyber-Enabled Crime

Criminals are increasingly combining cyber attacks, stolen identities and AI-generated fraud.

Traditional manual controls may become less effective against these newer threats.

The implication is clear.

Future AML audits will need to assess not only compliance procedures but also resilience against emerging risks.

What AML Audits Could Look Like by 2030

We expect regulators to focus on five key areas.

1. Continuous Monitoring

Rather than assessing firms based solely on onboarding controls, regulators will increasingly examine how firms monitor risks throughout customer relationships.

2. Data Quality

Poor quality data creates blind spots for compliance teams.

Future audits are likely to focus heavily on whether firms can produce accurate, consistent and auditable records.

3. Digital Audit Trails

Manual files and fragmented systems make evidencing decisions difficult.

Digitised compliance systems provide regulators with greater transparency and accountability.

4. Risk-Based Controls

The FCA has already demonstrated its preference for tailored, risk-based frameworks rather than one-size-fits-all compliance approaches.

5. Technology Adoption

Technology alone will never guarantee compliance.

However, firms continuing to rely entirely on manual processes may find it increasingly difficult to justify those approaches as industry standards evolve.

Preparing Today for Tomorrow's Expectations

Our research shows that 55% of AML checks within legal firms remain manual while only a minority are leveraging AI-driven risk scoring or sanctions screening.

The firms best positioned for the future will begin:

• Digitising onboarding
• Improving Source of Funds verification
• Strengthening audit trails
• Introducing automated monitoring
• Enhancing risk assessments
• Building FCA-ready compliance frameworks

The future AML audit will not ask whether compliance exists.

It will ask whether compliance works.