SRA AML desk-based review: the ten-day checklist for a small firm, from the letter to the file sample

"SRA AML desk based review", "firm wide risk assessment template", "source of funds checks SRA": the searches that spike when the letter lands are partner-only searches, and the clock they are typed against is ten calendar days. This checklist is for that fortnight.

Free tool

SRA AML desk-based review checklist: the ten-day deadline, the documents asked for, and the gaps to close first

Date of the SRA's letter Firm-wide risk assessment, reviewed in the last 12 months, describing the work the firm actually doesYesNo Proliferation financing risk assessment (can sit inside the FWRA)YesNo AML policies, controls and procedures, matching how staff actually workYesNo Template client and matter risk assessment, completed on filesYesNo List of fee earners whose work is in scope of the MLRsYesNo Open and closed matter lists exportable from the case systemYesNo Source of funds and wealth evidence on purchase files, not just a bank statementYesNo Enhanced due diligence recorded where the client is a PEP or linked to a high-risk third countryYesNo Training records for all relevant staff, datedYesNo Independent audit of the AML function (reg 21), where the firm's size and nature require oneYesNo

Works in your browser. Nothing you type leaves this device.

What the letter asks for

The SRA's desk-based review asks for a fixed set of documents within ten calendar days: the firm-wide risk assessment, the proliferation financing risk assessment (which can be a section of the FWRA), the AML policies, controls and procedures, the firm's template client and matter risk assessments, a list of the fee earners whose work is within scope of the Money Laundering Regulations, and lists of open and closed matters. From the matter lists it chooses 10 to 12 files and asks for them.

Ten calendar days means weekends count. A letter dated Thursday 1 October 2026 is due Sunday 11 October 2026, so the practical deadline is Friday 9 October.

The order to work in

Day one: what exists. Tick the checklist honestly. The commonest missing document in small firms is the proliferation financing assessment, required since 2022 and often never written; the second is the in-scope fee earner list, which takes an hour.

Days two to four: the FWRA against reality. The failing the SRA names most is a generic document. A risk assessment that could describe any firm describes none; one that says "we do residential conveyancing in Kent, 60% purchases, 30% with gifted deposits, and 10% of clients are overseas" is the document they want. Rewrite from the matter list, not from a template.

Days four to six: the policies against practice. Read the PCPs beside what the fee earners actually do. Where the policy says enhanced due diligence is approved by the MLRO and in practice the fee earner just proceeds, change one or the other and date the change. Inconsistency between document and practice is the second named failing.

Days six to nine: the file sample. Pull your own twelve most recent in-scope matters, because that is roughly what they will pull. On each: identity verified and recorded, a completed client and matter risk assessment, and on purchases, source of funds and wealth with the fee earner's note that it is consistent with the client. A bank statement showing a balance is not source of funds; the question is where the balance came from.

Day ten: send, with gaps named. A response that says "the independent audit under regulation 21 has not been done; it is booked for November" does better than silence. Outcomes range from recommendations to a compliance plan, remedial measures and enhanced monitoring, and the firm's candour is part of what decides which.

What the numbers say

The 32% non-compliance rate is across all firm sizes, and the failings listed are not exotic: generic documents, policies not matching practice, CDD gaps, weak client and matter risk assessments, weak source of funds and wealth work, and thin enhanced due diligence and monitoring. All six are visible in the twelve-file sample, which is why preparing your own sample is most of the work.

Who signs

The MLRO owns the response and signs it. The COLP is told and records it. The checklist prints a Pass or Fail against each item with the fix, so the MLRO's meeting with the partners on day one has an agenda. An AI File Opener set up by Overlyft keeps the client and matter risk assessment and the source of funds note on every new file as it opens, which is what makes the sample survivable when the letter comes; the file-opening checklist is the day-to-day version of this page, and the transparency rules guide covers the other thing the SRA checks from its desk.

Regulated work: the MLRO and a supervising solicitor review everything here before it goes to the SRA. This is general information from the published rules and one adviser's account of SRA practice, not legal advice.