Compliance Webinars | Teal Compliance

Why the boiling frog syndrome speaks to law firm AML compliance needs

The Boiling Frog of AML Compliance

Anti-Money Laundering, Audit, Blogs, Compliance Webinars, Legal Compliance, Regulatory Compliance, Risk Management / Mark

Imagine a frog in a pot of water that warms imperceptibly over time. It’s a familiar parable about gradual danger, and it offers a stark lesson for law firms on the subject that we know and love … AML compliance!

In practice, poor anti-money laundering controls usually creep in slowly. Look, we’ve all been there in any walk of life with managing risk, however, small risks accumulate until one day you realise you’re in hot water.

Solicitors, lawyers and senior partners may grow used to cutting a corner here or there, for example, delaying full risk assessments on every small conveyancing deal or skipping a detailed client check to close a sale, and find nothing bad happens, so they think it’s safe. All the while, your compliance officer is trying to juggle the balls and spin the plates without being aware there are niggling potential risks and breaches going on behind the scenes.

Our very own Amy Bell recently ran a webinar for Locktons and spoke passionately about Client Matter Risk Assessments and the need to be proactive.

We have to remember that the regulatory temperature is rising. The SRA reminds firms that any matter in scope triggers obligations…

“no matter how short in duration or scope… the appropriate level of client due diligence and a risk assessment must be carried out”

SRA

In other words, there is no de minimis exception. If firms relax standards bit by bit – trusting the status quo, relying on old practices, or failing to update their policies – they risk essentially sitting in tepid, heating water without noticing.

How do you know if you’re in scope? Read the SRA’s guidance HERE.

Money Laundering’s Slow Burn

Money laundering itself can be surprisingly mundane and routine. The work is insidious, yet subtle.

Economic and financial criminals (or the #baddies as Amy Bell calls them) increasingly move large sums through seemingly legitimate channels. How delightful are your client accounts for them? Sadly, the usual targets for money launderers are property purchases or corporate transactions, where dirty money is effectively “laundered” into the system.

In an era of high-value deals, even honest clients may inadvertently carry illicit funds, and it’s our job, as legal professionals, to spot them. Sadly, we’ve seen all too often, when firms become complacent there is a danger that suspicious activity is seen as a normal part of business, not a warning sign.

Cultural norms can creep in. If you’re a lawyer in a busy commercial team you might think that because you’ve dealt with a well paying client for years it’s ok to maybe wing the CDD and SOF checks.

You know them, have a great working relationship with them, might be a top biller because of that relationship. Why bother with lengthy ID checks every time? It’s the source of funds and the source of wealth you really do need to verify. If you are a junior associate or new to the role of COLP or MLRO, are you brave enough to challenge a partner’s relationship with a client who brings in vast amounts of funds into the firm?

Colleagues may joke about being bureaucrats or delay refreshers on training, reinforcing the idea that compliance is low priority. This is exactly the mindset that lets the pot warm up unnoticed. The SRA’s fining powers are in full use and rather than being complacent, wouldn’t it be better to maintain continual vigilance?

If AML controls slack then your risk indicators could drop to the bottom of the pile or worse, be forgotten.

Over time, your firm’s overall money-laundering deterrence is weaker, even though the actual work and transaction values stay high.

Our TEAL TRACKER is perfect for continued and effective reminders and alerts.

How to Master the Tricky World of the Source of Funds and Wealth

This is a great blog to read to help you with any awkward conversations!

Law Firm AML Complacency, Culture and Drift

By the time someone in the firm notices a problem, the culture of complacency may be too rooted as there’s been a resistance to change. Recent SRA enforcement highlights firms that have languished in non-compliance for years before a regulator stepped in.

We get it, practicing law, dealing with clients, dealing with partners, dealing with the other side and let’s not get started on the billable targets are exhausting enough, but whether you like it or not, compliance is your best friend.

You probably have read cases such as the law firm who repeatedly omitted conveyancing (75% of its work) from its firm-wide risk assessment. That omission persisted even after the firm had told the SRA its risk assessment was compliant back in 2020. It only implemented proper controls after an SRA inspection – long after the drill of neglect had set in.

The regulator noted that this firm’s failures (no independent audit, weak transaction monitoring, even a lack of partner training) “showed a disregard for statutory and regulatory obligations”. In blunt terms, the SRA said the firm’s problems “could have been avoided” by doing a proper risk assessment from the start . It fined them £20,000 and raised the fine to send a deterrent message.

So when we talk about the boiling-frog metaphor, the above example is a classic.

The firm didn’t collapse suddenly. Instead, year after year it failed to address its internal gaps. The First AML analysis of 2025 disciplinary cases makes the same point that firms with “systemic gaps” and “long-standing… compliance failures” have faced the harshest penalties. The highest fine to date was £27,813 – given for “widespread AML failures” including inadequate risk assessment, precisely the kind of entrenched lapse that happened slowly over time.

In total,16 out of 50 SRA disciplinary decisions recently related to AML breaches, with over £61k in fines imposed. The takeaway is clear in that persistent neglect of AML duties is now being punished, but it really doesn’t have to be onerous with training updates, easy software reminders, or outsourced compliance (see our SORTED programmes for different sized firms). Problems often build silently (thanks to shifting workplace culture or understaffing), but ultimately the SRA will notice and step in.

Regulatory Guidance and Enforcement

Fortunately, the guidance is clear – if only firms heed it, plus we are here, literally guiding and holding your hand.

In April 2025 the Legal Sector Affinity Group published a new AML guide (approved by HM Treasury), officially governing SRA firms. This updated LSAG guidance reiterates the basics that every firm needs a firm‑wide risk assessment, clear policies and procedures, up‑to-date CDD (customer due diligence) processes, and continuous training.

If you or your colleagues have received any of our training you’ll know that we really are experts and give practical advice that goes above and beyond the tick box boring exercises.

Regulators now stress that proactive compliance is the norm, it’s just how it is, which is why Amy and the whole team here at Teal Compliance are passionate about supporting firms and allowing their compliance officers a safe space to comply.

Analysts advise firms to focus first on a comprehensive, regularly-reviewed risk assessment (covering the firm itself and each type of client/matter).

Your policies and internal controls should be robust and embedded in daily work, not siloed documents on a shelf.
Staff training must be ongoing – the guidance emphasises that AML education is not a one-off checkbox but a continual process (for everyone from juniors up to partners).

The SRA underscores that being in scope is about the services provided, not simply holding client money, meaning that your law firm can’t slip below the radar by reclassifying work. Don’t forget, the SRA explicitly warns firms that even a short, simple matter can trigger full obligations.

What does this mean in practice? Simply put, law firms seriously have to work on cultivating an alert, risk-based culture, with the “tone from the top” view of compliance as an integral part of quality practice.

Our webinar with Amy Bell and Simon McCrum and what a partner looks like when it comes to culture, cashflow and compliance is worth a watch. WATCH HERE.

If a potential red flag arises (for instance, unusually large cash payments in conveyancing, or a client reluctant to provide full information), it must be treated as out-of-ordinary, not routine.

Time to Jump out of the Boiling Pot?

None of this blog is intended to alarm you and your colleagues, rather, it’s a wake-up call wrapped in a familiar metaphor.

By considering where your firm stands in that rising temperature, you can decide whether it’s time to jump. Are you reviewing risk assessments as new risks emerge (for example, new regions, new products, or new high-value clients)? Are your AML procedures championed by leadership, not seen as a grudge task? Do teams feel able to raise concerns (flipping the narrative from “Why question this again?” to “Yes, we need to check”)?

“Jumping out” means acknowledging any complacency or resource squeeze and taking action early. Can you add more staff to your compliance team? Does your current compliance officer cover COLP, COFA and MLRO and if so, what training and support do they receive? Can you organise refresher training? Are you in a firm that allows honest conversations about a healthy culture and therefore better risk management?

The updated SRA/LSAG guidance is on your side because it offers case studies and practical checklists to help identify seemingly innocuous, yet insidious gaps.

Why not embrace our advice and that of the SRA and the LSAG, by keeping your pot of water at a comfortably warm temperature, rather than a lethal one! In the end, reminding ourselves of the boiling‑frog fable isn’t scaremongering – it’s about staying vigilant.

What we recommend firms do is to stop and feel the temperature, is the heat rising without being noticed? If so, now’s the time for a quick dive or a firm clear-out of old habits. Jump before it’s too late, not after the pot is boiling.

The Boiling Frog of AML Compliance Read More »

Managing Risk with Mental Health Tips - Teal Compliance support Mental Health Awareness Week May 2025

Managing Risk with effective Mental Health Tips

Anti-Money Laundering, Audit, Blogs, Compliance Webinars, Legal Compliance, Regulatory Compliance, Risk Management / Mark

Reminder that we are not only your training partner but also your outsourced compliance and regulatory partner – find out more here.

The Law Gazette flagged up how the SRA’s got their eye on AML breaches this April, and seeing as it’s Mental Health Awareness Week an’ all, we thought we’d chip in with our two pence. Looking after yourselves and your staff isn’t just a nice thing to do, it’s a smart move for keeping your firm on the straight and narrow with AML and regulatory compliance.

Let’s make sure we’re not ending up on the SRA’s naughty step by keeping an eye out for each other.

With that in mind, here are our Handy Hints for risk management when it comes to culture and mental health.

Make it Safe to Talk - Risk Management Tip No. 1

We strongly recommend that you organise (yes, even prioritise) firm-wide discussions or workshops during Mental Health Awareness Week specifically linking well-being to work performance and error reduction.

We can’t emphasise enough that stress, anxiety, and burnout can significantly impair concentration and judgement. We’ve all been there at different times in our working lives. Working under pressure and in a stressful environment increases the risk of overlooking crucial compliance steps or making mistakes in complex AML processes like Source of Funds checks or client due diligence.

Working in a healthy culture where staff feel comfortable acknowledging when they are struggling is so important! LawCare Charity insights show that those under pressure or in a culture where they are afraid to talk in a safe environment are potentially more likely to make errors due to mental fatigue or stress.

If you don’t believe us, just are your PII contacts!

Promote Practical Wellbeing Strategies for High-Pressure Tasks - Risk Management Tip No. 2

Practical tips and tools to manage stress and improve focus, especially during peak workload periods (e.g., completion deadlines in conveyancing) can be really helpful.

This could include mindfulness exercises, time management techniques, or signposting to Employee Assistance Programs (EAPs) if you have them. Often we see in our audits that targets cause stress, together with the billable hour and WIP not being paid. Do you have mentoring systems in place to alleviate too many matters for one person? It’s easy to take your eye off the ball on one matter, where the SOF hasn’t been checked because the client has been with the firm for many years. Are they a priority? Yes, their checks are a priority, just as practising the law is.

When it comes to AML and regulatory compliance, why not frame the above strategies as tools to enhance accuracy and reduce errors in high-stakes compliance tasks? For example, really simple things like taking short breaks can improve concentration during complex AML risk assessments.

Lead by Example - Risk Management Tip No. 3

As law firm partners we encourage our clients who are senior partners, together with the MLRO/COLPs, to actively participate in Mental Health Awareness Week initiatives and openly discuss their own well-being.

When senior leaders demonstrate that mental health is a priority, it sends a powerful message that compliance and well-being are both valued.

Sending the message throughout the business (and your firm is a business), can reduce the stigma associated with seeking support and encourage staff to prioritise their own mental state. If you know your boss prioritises well-being and family for example, it ultimately leads to more careful and considered compliance practices overall.

By leading by example, senior management teams can foster a supportive and open culture where well-being is seen as integral to professional responsibility at all levels.

Empower with Knowledge - Risk Management Tip No. 4

Why not share resources (internal or external) during the week that explain the connection between mental health and cognitive function, particularly in detail-oriented tasks like regulatory compliance. The NHS has their 10 Stress Busters HERE .

Lockton has some great blogs on Mental Health and how a healthy culture helps keep a law firm’s claims at arm’s length.

In one of their articles, they talk about Psychological Safety.

“Supervision plays a vital role in helping supervisees feel psychologically and emotionally supported at work. In addition to supervising the quality of work, supervisors should encourage discussions about any worries, concerns, near misses, or development needs that their supervisees have. Creating a psychologically safe environment where supervisees feel confident to raise questions or concerns with their supervisor will not only help to mitigate ethical risks but also identify pressures that might be having a negative impact on wellbeing. “

Why HR and Risk Management Teams Should Collaborate on Wellbeing READ HERE

Did you know that conditions like anxiety or depression can affect memory, focus, and the ability to follow complex procedures, such as SAR reporting or adherence to SRA Accounts Rules?

As our own CEO does with Team Teal, why not educate staff on why prioritising their mental health isn’t just a personal matter but a crucial element of maintaining a safe and compliant work environment?

Thanks for reading and if you have any questions on how mental health and compliance are partners for the good, or would like to take advantage of our ASK TEAL service, you can get in touch HERE.

Team Teal

Managing Risk with effective Mental Health Tips Read More »

Regulation 21 and ongoing monitoring article from Teal Compliance

Regulation 21 and Ongoing Monitoring – an AML Compliance Reminder

Anti-Money Laundering, Audit, Blogs, Compliance Webinars, Legal Compliance, Regulatory Compliance, Risk Management / Mark

Rhiannon Davies, Associate and specialist in AML and Regulatory Compliance. This article is a debrief of the webinar and transcript I ran on 2 April 2025. You can watch the recording HERE.

Let’s kick off with AML audits and what the regulations say. Specifically, we’re looking at Regulation 21. It has a few key requirements, but I’ll focus on the part about independent audits.

You can read here about our outsourced AML Compliance and Regulatory Compliance SORTED programmes that cover the requirements too.

Regulation 21 and Independent Audits

We started off the webinar AML audits and what the regulations actually say.

Key requirements of Regulation 21
The role and purpose of independent audits
Defining “independent” and “size and nature”

The first requirement is appointing a Money Laundering Compliance Officer (MLCO). This must be someone in senior management, like a Board Director or equivalent (e.g. senior management). Why? They need to have enough authority to enforce policies, update training, and even decide on the firm’s risk appetite for clients and work types.

The second requirement involves screening employees—both before they join and during their tenure with the firm. I won’t go into detail on this today, but if you’re curious, LSAG 9.4 has some excellent guidance on how to approach it.

Now, onto the third part of Regulation 21—the independent audit function (there are loads of different terms for this function). This is where it gets interesting! Essentially, the audit assesses the adequacy and effectiveness of your firm’s AML policies, procedures, and controls within the firm. If issues are identified, the auditor provides recommendations and follows up to ensure compliance.

But here’s the thing—what does ‘independent’ really mean? And how does ‘size and nature’ factor into whether your firm needs this function? These are questions we get all the time.

‘Size and nature’ isn’t strictly defined in the regulations, which can make it tricky. The SRA, however, suggests that the majority of firms will require an independent audit function. For instance, if your firm handles conveyancing work, it’s almost certain you’ll need one. On the other hand, if you’re a sole practitioner without staff, you can probably justify not implementing one.

As for ‘independent,’ it doesn’t always mean external. That said, achieving true independence internally can be challenging. The auditor mustn’t be someone who sets or follows the firm’s AML policies, however, it needs to be someone with enough knowledge of AML which rules out many internal staff. Often, firms find they need to bring in external specialists to meet this requirement.

So, in summary to this section of the webinar, I said that if your firm doesn’t already have an independent audit function, now’s the time to assess your needs. And if you’re unsure where to start, I’m happy to point you toward some useful resources. Please feel free to email us: hello@tealcompliance.com

Introduction to Ongoing Monitoring

I’m grouping this with the previous topic because it’s a key area where we often find firms struggle, particularly fee earners. During our AML audits, we consistently observe challenges with the implementation of effective ongoing monitoring procedures. So, I’m going to delve into this in a bit more detail, referencing the regulations themselves.

Ongoing Monitoring: A Deeper Dive

Defining ongoing monitoring and its components
SRA guidance on ongoing monitoring
Challenges in implementing ongoing monitoring

Ongoing monitoring is split into two parts, firstly from a transaction point of view, where you need to keep an eye on the level of risk that the matter and the client is posing to the firm throughout the whole of the matter.

Secondly, it’s the reviewing identification documents for your existing clients and making sure you’re keeping them relevant and up to date. So any of those documents that you’re relying on, if they’ve expired, you’re getting new ones.

When we talk about ongoing monitoring, it involves both of those components.

Defining Ongoing Monitoring

Here’s a summary of the definition of ongoing monitoring – comprising two key components.

Transaction monitoring: this means continuously assessing the level of risk that the matter and the client pose to the firm throughout the duration of the case.
Periodic reviews of client identification documents to ensure their validity. Expired documents, for example, must be replaced.

Therefore, ongoing monitoring encompasses both the scrutiny of transactions and the maintenance of up-to-date client documentation.

SRA Guidance on Ongoing Monitoring

The SRA emphasises the mandatory nature of ongoing monitoring, as stipulated in Regulation 28(11) of the Money Laundering Regulations.

The SRA’s guidance highlights that any communication with a client has the potential to alter the risk profile of the matter, the client, or both.

Consequently, risk assessments should be re-evaluated at appropriate intervals and to reflect any changes in circumstances, such as alterations in beneficial ownership, the nature of the client’s business, or their address.

It’s worth noting that the SRA stresses the significance of ‘any communication‘ in this context. This underscores the need for comprehensive AML training for all staff, including support and reception personnel, as any interaction with a client could reveal suspicious activity. Essentially if any staff has a touch point with your clients, they need training.

The phrase ‘re-evaluated at appropriate intervals‘ requires careful consideration, as its interpretation can vary. While it’s clear that a reassessment is necessary when material changes occur (e.g., third-party funding, newly discovered links to high-risk countries etc), the challenge lies in demonstrating ongoing monitoring when no such changes are apparent.

Challenges in implementing ongoing monitoring

Why do we see so many firms struggle with ongoing monitoring? From our experience and training it looks like this:

Not understanding the purpose of ongoing monitoring
Doing it but not evidencing it, especially where nothing has changed
Not sure when it should be done
Ticking boxes without providing rationale
Not wanting to bother clients further
Forgetting about LSAG

We often hear about re-evaluation at appropriate intervals in ongoing monitoring.What does that exactly mean though, because there’s no definition!

“Best practice and with a risk based approach”, it could mean different things to different people and firms. Ultimately, it means there needs to be an update if anything on the matter has changed. For example, if a third party is now providing funds for the transaction, or say you’ve suddenly discovered the client’s got links to a country outside of the UK that would generally prompt you to relook at the risk assessment. This seems obvious right?

However, what about when nothing’s changed? How do you evidence that? How do you prove you’ve done your ongoing monitoring when absolutely nothing’s changed on the matter and you’re still as comfortable with the risk as you were at the very beginning of the matter?

That’s the bit where we often find we don’t have the evidence when we’re running an AML audit; so when we’re doing some of the file reviews, as a minimum, we’d recommend the following guidance via three points.

Three point ongoing monitoring guidance

Our three point guidance is where you assess the risk and emphasis is on the word minimum.

Think of it as a story because it has a beginning, a middle and an end.

Beginning stage: file opening

At this point, is there anything that you’ve seen or been told that doesn’t quite sit right with you? Are you not sure whether you want to proceed with the matter? Do you need some more information to make yourself more comfortable? Or are you happy to proceed at this time?

Either way, it needs to be noted on your risk assessment. And I must say, the majority of firms that we audit, the opening risk assessment is the one that’s often carried out well.

It’s the next stage where we see failures.

Middle stage – review of CDD documents

I’d normally suggest this part of your ongoing monitoring story is once you’ve reviewed the CDD documents from your client. This is the point when due diligence checks around your client’s evidenced source of funds (SOF) and source of wealth (SOW) are with you.

At this point, you’d be looking if anything has changed at all, i.e. have any risk factors changed from what you decided at the beginning? Does the evidence from your client match what they told you at the beginning? Does everything still make sense? And again, if not, you might need to ask further questions, or you might need to see some further evidence.

If everything is hunky dory, carry on and proceed with your matter. HOWEVER, don’t forget to document and evidence your checks and confirmations.

Even if nothing’s changed, documenting that you have still assessed that risk again, would evidence ongoing monitoring. Then I suggest a final risk assessment.

End stage – last minute changes

An assessment of the risk again, before you proceed with whatever it is that you’re doing that could end up being money laundering.

Before the actual transaction takes place (e.g. in conveyancing), before any money’s moved you have evidenced your final risk assessment.

Remember, the baddies are waiting for any last minute changes in the hope that you don’t ask any questions.

Financial criminals and money launderers thrive on last-minute transaction changes, banking on lawyers being under pressure to push deals through without thorough scrutiny. They count on urgency preventing deeper AML checks, allowing them to disguise their true source of funds or wealth. The pressure conveyancers were under in March because of the changes to Stamp Duty, was horrific, the baddies would have been rubbing their hands with glee.

Come what may, you have to maintain vigilance with risk assessments and ongoing monitoring whilst documenting every step to justify risk ratings. If it’s not written down and evidenced, in essence, it didn’t happen. You hear time and time again about SRA inspections and their fining powers when swooping in to check.

Practical Guidance on Risk Assessment Frequency

As a reminder on some practical tips to help with your ongoing monitoring for risk assessments, we’d say never to focus on thinking that after your initial first step of onboarding CDD to continue checking on changes or documents that don’t match your original docs.

Our recommendations would be:

Initial Assessment: This is conducted when the file is opened. At this stage, the primary focus is on determining whether to accept the client and, if so, the appropriate level of Customer Due Diligence (CDD). Any initial concerns or uncertainties should be thoroughly documented.
Interim Assessment: We advise conducting this assessment after reviewing the client’s CDD documentation, including source of funds and source of wealth evidence. The aim is to verify the consistency of the evidence with the client’s initial representations and to identify any emerging risk factors.

LSAG offers helpful guidance on documenting ongoing monitoring, including the issues considered, actions taken, reasons for decisions, and details like dates and individuals involved. Monitoring also involves reviewing and renewing client identification documents, especially for ongoing or long-term clients. Having said that, when reviewing client identification documents, it doesn’t mean you need to ask the client for them again for every matter but they must be reviewed for relevance and validity, such as checking for expired documents.

Challenges in Implementing Ongoing Monitoring

Changes in beneficial ownership, particularly further up the corporate structure, may not be immediately apparent, which makes ongoing monitoring crucial.

For corporate clients, drawing up a structure chart at the beginning of the relationship and confirming it at each new matter is really good practice. This would help with ensuring the beneficial ownership remains consistent. If a change is identified, such as a new beneficial owner, then you must follow appropriate identification and verification processes in line with your firm’s policies and procedures.

We get it, struggling with ongoing monitoring is common, which is why my colleagues and I want to support you and your colleagues.

Challenges range from a lack of understanding of the actual purpose of ongoing monitoring, assumptions based on long-standing client relationships, and inadequate documentation. For instance, staff might simply tick a box to indicate monitoring without detailing the rationale or evidence. There’s also a hesitation to bother clients for updated information, fearing complaints or loss of business.

My advice is clear, would you go to prison for a client? No – it’s not worth it.

I hope you found this blog helpful, and do watch the recording if you have time.

Rhiannon

Regulation 21 and Ongoing Monitoring – an AML Compliance Reminder Read More »