Colp & Cofa

The SRA’s findings on gaps between written AML policies and everyday practice are consistent with Lexsure’s findings during the independent AML audits it has carried out over the last 12 months. Having documented procedures does not establish that staff understand them, apply them consistently or recognise when a matter requires further investigation.

For COLPs, COFAs and the firm’s senior management, this raises a practical question: what evidence reaches management to demonstrate that the AML framework is working?

A policy approval date, a training attendance record and a completed checklist each provide useful information. None, in isolation, establishes that the firm is identifying and managing the risks on its client matters.

What the SRA’s review means for management

The SRA’s October 2026 presentation on AML policies, controls and procedures identifies a disconnect between documented requirements and what happens in practice. It also highlights firms that had procedures but lacked controls to establish whether those procedures were being followed.

The distinction is important. A policy sets the firm’s approach. A procedure explains how staff should act. Controls help ensure that the required action happens and that failures are identified.

Management should therefore ask more than whether the latest policy has been approved. It should ask who checks its implementation, what those checks reveal and how unresolved weaknesses are escalated.

Our article on why COLPs need to keep compliance policies up to date addresses maintaining the documentation. The next step is establishing whether the approved wording changes what people do.

What Lexsure’s independent AML audits reveal

Lexsure’s independent AML audits have identified practical weaknesses that are consistent with the SRA’s concern about the gap between policy and implementation. Examples include:

• Missing client and matter risk assessments.
• Assessments that do not reflect the actual transaction or funding arrangements.
• Risk ratings that lack a clear explanation.
• Source-of-funds evidence retained without sufficient recorded scrutiny or a conclusion.
• Identified risks without corresponding mitigation measures being evidenced.
• Retrospective assessments that do not demonstrate how risk informed earlier decisions.

These findings arise from individual audits. They illustrate why reviewing the policy document alone cannot establish whether the firm’s AML arrangements are effective.

For the conveyancing file perspective, see About Conveyancing’s guide to what independent AML audit file testing should reveal.

Keep the responsibilities clear

The COLP, COFA, money laundering compliance officer and money laundering reporting officer have distinct responsibilities. One person may hold several roles, but that does not make the roles interchangeable.

• The COLP has responsibilities concerning the firm’s compliance with its regulatory obligations.
• The COFA has responsibilities concerning compliance with the SRA Accounts Rules. Issues involving receipts, payments and client account can also expose weaknesses requiring coordination with the AML officers.
• The MLCO oversees the firm’s compliance with the Money Laundering Regulations.
• The MLRO receives and considers internal suspicious activity reports and manages the firm’s external suspicious activity reporting.

The SRA’s AML enforcement topic guide explains these responsibilities and the potential accountability of managers.

A useful management arrangement identifies who owns each control, who reviews its operation and who has authority to address a failure. Responsibility should not disappear between departments because each assumes another has completed the check.

Ask for evidence of exceptions, not just completion rates

A report stating that 98% of risk assessment forms are complete may appear reassuring. Management still needs to understand whether the assessments are timely, accurate and supported by the matter evidence.

Useful management questions include:

• How many assessments were completed after substantive work had already started?
• Which files contained information inconsistent with the recorded risk assessment?
• Were required approvals obtained before the relevant decision or transaction step?
• Which weaknesses recur across different fee earners or offices?
• How many corrective actions remain overdue?
• What did subsequent reviews establish about whether earlier improvements worked?

For example, a firm might record that every sampled file contains bank statements. A closer review might reveal that several files contain substantial credits without an adequate explanation. Counting documents would not expose that weakness.

This is an illustrative management example, rather than a report of a particular client matter.

What should the COFA look for?

The accounts team can encounter information that differs from the funding explanation recorded by the legal team. A payment may arrive from an unexpected person, a company may provide money previously described as personal savings, or instructions may be received to send funds to a different recipient.

The COFA should consider whether the firm’s financial controls provide a clear route for raising those discrepancies with the appropriate fee earner and AML officer.

Practical questions include:

• Can the accounts team identify the payer and compare the receipt with the expected funding?
• What happens when the payer or amount differs from the instructions?
• Who determines whether further investigation or an internal report is required?
• How is an authorised decision communicated to the people handling the payment?

A discrepancy does not automatically establish money laundering. It requires an appropriate response rather than an assumption that someone else has already considered it.

Any communication and record-keeping arrangements must also respect confidentiality and the restrictions surrounding suspicious activity reporting. Sensitive reporting information should not be circulated through ordinary management reports.

When a control fails, establish why

Simply reminding everyone to follow the policy may leave the underlying problem untouched.

A missed check could result from unclear instructions, an ineffective case-management workflow, insufficient supervision, a training gap or commercial pressure. Different causes require different responses.

A practical management review should record:

1. The finding: what failed and the evidence supporting that conclusion.
2. The extent: whether the issue affects other live or completed matters.
3. The immediate response: what must happen on affected matters while the issue is investigated.
4. The cause: why the existing procedure or control did not work.
5. The corrective action: the person responsible, resources required and deadline.
6. The follow-up: how the firm will check that the revised approach works.

Where appropriate, the review should also consider regulatory reporting obligations. An internal action plan does not replace a reporting duty that has arisen.

Updating the policy is one part of the response

Where the written procedure is incomplete or outdated, the firm needs to address the wording. Where the wording is adequate but is not followed, the response must address implementation.

Firms reviewing their documentation can browse the AML policies and procedures available from POLICYmonitor. Templates should be selected and adapted to the firm’s work, risks, systems and responsibilities.

For ongoing drafting support, Lexsure’s AML Policy Update Service provides suggested amendments for firms to consider. Each relevant change should be assessed, approved and communicated, with corresponding changes to workflows or training where necessary.

Where the review identifies weaknesses in sanctions procedures, firms can also consider the dedicated Sanctions Policy. Sanctions controls need their own practical assessment and should not be treated as satisfied merely because a general AML check has been completed.

Independent scrutiny should support management action

An independent AML audit can help management assess both the adequacy of its documented arrangements and their effectiveness in practice.

Regulation 21 requires an independent audit function where appropriate to the size and nature of the business. It does not impose a universal requirement for every firm to buy an annual external audit.

Where an audit is commissioned, management should agree how findings will be reported, who will own the resulting actions and how implementation of recommendations will be monitored. A report delivered and filed away provides limited practical value.

The question for the next management meeting is straightforward: what evidence would show that an AML procedure is not being followed, and how quickly would that evidence reach the people able to act?