aml compliance Archives - Teal Compliance

Open Banking Landscape for Law Firms in 2025

Anti-Money Laundering, Blogs, Legal Compliance, Risk Management / Mark

Head of Legal at Armalytix, Tom Lyes, joined Amy Bell for a Coffee Conversation to discuss what the Open Banking landscape for Lawyers looks like in 2025.

The following is an abridged version of the webinar and I am jumping to the questions that came at the end of the webinar to start off this blog as they will set the pace for the rest of it!

In the webinar, Tom discussed:

Where are we now with Open Banking?
What’s next?
How the cases for lawyers are maturing beyond resi property into new disciplines such as Family Law and Commercial
How Armalytix has evolved by delivering the same output to a lawyer irrespective as to whether a client can use Open Banking or not
Open Banking in other jurisdictions

I was thrilled that Tom joined me in the conversation of open banking because I am an advocate for leveraging technology in law firms. I’ve known Tom for ages and value his insights and experience and this blog gleans information and guidance from our Coffee Conversation held on 20 March 2025.

At its core, open banking is all about making it easier and safer for businesses to connect directly with banks. Think of it as a way to share financial data and access bank services, like setting up payments, without all the usual hassle. The whole idea is to make things more transparent and generally simpler for businesses, and their clients / customers.

The back story is that open banking came about when Europe brought in the law called PSD2 back in 2018. The aim was basically three things:

to give people more control and understanding of their finances;
to offer more payment options; and
to boost competition and innovation, which ultimately leads to a better experience for everyone.

When we talk about law, finance, regulations, risk management and couple them with innovation that’s when we really shake things up in the legal sector. For Armalytix, it means they can set up lawyer payments using what they call a ‘straight-through’ process. Which means payments can go directly from A to B, with way less paperwork and faff. It’s making things much smoother, and honestly, it’s about giving clients back time they more often than not, don’t have much of.

You can catch up on the full recording HERE.

As always, the questions came in fast and furious at the end of the webinar, and I wanted to start with a couple of topics that were pertinent to the whole conversation and are trending too; AI and Training being the two most stand out.

I’ve literally been asked about AI policies so many times for law firm compliance in conjunction with regulations. The question of what AI processes Armalytix use was always going to come up. As I am in the midst of drafting AI policies I was also intrigued as to what Tom and his team were doing on this subject.

Question: What function does AI have in Armalytix technology, and how does the law firm and their client gain confidence that the AI is not “imagining” experimental data?

Tom’s response: Most of our open banking journeys don’t really use AI. AI is probably used in our statement scanning, in that we’ve taught the machine to be able to recognize a bank statement from a bank. This means we can recognize that it’s a (for example) Monzo bank statement. We ask it if we can recognize if the documentation is a Nationwide bank statement. That’s where AI comes in.

One of the questions that we get asked is around obvious use cases that we see in the legal sector around AI, being the summarising of information. We could, in theory, run these reports and start to teach AI to provide written summaries of those. Further to Teal’s innovation day and conversations around AI last year however, clients and our wider audience seemed really nervous about that the summarisation aspect. In particular, from an AML point of view, the response to our summarisation proposal was the worry that AI would read the summary but not look at the underpinning data.

Broadly speaking, and from the feedback Teal received, as yet, we haven’t pursued anything further on this front, although I think over a period of time, AI and people’s perceptions will change as they become more comfortable with AI summarisations of large amounts of information.

On this topic, it led me to another question. As an auditor and adviser to law firms, I find myself talking to clients about the software they bring in to assist with their AML and also for use cases. One of Teal’s leading questions for clients implementing software seems simple, do you know how it works? I always ask who trains who in the firm and does it come from the source?
I put this question to Tom.

Question: What are the key things that you would say a user needs to make sure they’ve done with training in this regard, and would they know how to explain it, say, if I came knocking at their door as an auditor?

Tom’s response: We would break the onboarding project into two parts.

If you’re going to bring any technology or process into a firm, you’ve got to align that with what you’re telling your clients, and you also have to align that internally so people know why.

I can see that the best run projects are where the people leading the projects can clearly explain to people internally, “why are we doing this”? It might only be two or three key points, but people just need to understand that. Get your team to come on the journey with you

The second part is around training. Lawyers get reports, but they don’t necessarily understand how to interpret that data, so the need for training is key. I always say that the focus of the training is on what the report is telling you at a high level.

Question: What do you define as risky in a firm wide risk assessment?

Tom’s Response: We have something called our Risk Insight, which is unique to each firm, i.e., not from our analytics. We give people the ability to build those insights within our environment, so that when someone reviews a report, they’re effectively reviewing something initially that says these are the risks in our practice that they deem risky.

Tailored risk insights help a firm to get a flavour as to what they are going into before they are thrown into the analytics. For example, overseas money coming into client account on a residential property transaction.

From going into firms to audit my associates and I see instances where training can decrease its efficiency. By this I mean that sometimes we see firms who rely on their own staff to train new colleagues coming into the firm. Training from the source should be for everyone. We ask our clients if everyone in the firm has received the same level of training as the people who initially received it?

Armalytix runs its Analytics 101, which is a bi-weekly session where firms who have new users are invited to bring those new users along. It’s an open training session. All new users can find out exactly how the reporting side of things work, and with bigger firms, we do a slightly more nuanced and customised version of that as well.

Essentially training is absolutely crucial, because if you’re a team that’s responsible for delivery of a project, it’s probably going to fall back on you if the training has become diluted.

Whenever a firm brings in new technology, there are always going to be teething issues but technology evolves too. So, the challenges come in a two-pronged process that requires consistent decisions around training and investing highly in that.

That’s not to say everybody’s appetite for risk is the same, but from my experience, if you give structure and consistency your risk is less.

Tom spoke about monitoring and in particular, the AML world – what does it look like from his perspective in terms of end client support requests? He said that if he could see a firm that was onboarded recently as a client of Armalytix, they have a barometer on what the monitoring should look like.

We went onto speak about evolving products for open banking, AML and risk management. Simply put, we all need refresher courses from time to time, including new features as an example. But also, and this goes for any software, what I see is firms expecting their current users to train any new colleagues coming in, as if by osmosis. I mentioned this above I know, but it is a real issue Teal is seeing. What if I come in to audit and ask you or your colleagues to explain to me how a search works in an audit? And what does the audit check? I might ask how they know what to do with the results of the search? I could go on, but it highlights to me that all training ideally for risk management, should always come straight from the source, and by the provider.

Question: How long does Armalytix store data? Is it stored outside the UK? Is it done via an app? And if so, do clients need to keep the app on their phone?

Tom’s response: No, it’s not an app, we are web based, which means that clients can do the journey on a desktop and on their mobile (and it’s fully mobile compatible). From a data storage point of view, we store it for what we’re legally asked to store it for in terms of number of years, because it’s our journey and different to the law firm, as the end client is our end client. When the client comes into our analytics, they have to sign up at the end of the journey, or once the firm has shared a report. They could request at any point for their data to be deleted.

In those instances, we’d naturally make sure that we would communicate with the end client’s law firm to make sure they have a copy of the report downloaded for their own purposes. We would confirm that the end client has requested directly from Armalytix to delete the data.

All the data is stored within the EU at the AWS, which is a well-versed method of data storage, using Amazon web servers.

Teal Tracker is a software service and I understand Tom’s procurement questions because as providers we have to have everything ready to go to those who might need to view it for due diligence purposes. The SRA are becoming increasingly interested in what due diligence law firms are carrying out on their suppliers too, which is why I was particularly interested to hear what Tom was saying about regulations and the differences in regulation. The notes on this are further down in the blog.

As a law firm and if you’re using a provider for open banking or another service, if you don’t know firstly, that provider’s regulatory stance, and second how many parties are involved in the delivery of that service, and you aren’t aware of their processes it can be extremely detrimental to your risk management policies.

Tom and I were agreeing that if a software a law firm uses “goes down” and you can’t get access to the data, it may not be the analytics that’s crashed, it may well be the bank (as an example). There are layers to verify and check. If the SRA comes knocking asking you if you’ve done your due diligence on your service provider, will you have the reports at hand?

From a supplier perspective, Tom said that they have a data pack that sets out 90% of what Armalytix would expect to be asked as part of a DPI. He said he would expect law firm suppliers to be proactive on this front if you asked that question. It’s a pretty good sign of what type of supplier you’re working with, if they’re proactive about covering this topic! Worth a conversation with your current supplier maybe?

Question: If we’re using open banking software, do you still recommend obtaining original ID documents? Can we just rely on the ID docs being uploaded through the checks?

Amy’s response: I think his question is probably for me. I think the question might be about ID and Verification, as in the identity of a client, which is out with your service. If you’re going to use a software provider to help with the identification verification step of your client’s due diligence and you’re only going to use that software service, it has to be in accordance with the regulations; it has to be secure from fraud and misuse.

Now, if the reality is that those systems are using a biometric check or a document verification by looking at the image of the document, combined with external data lookups then it is actually going to be much more robust of a check. It’s more effective than you eyeballing a document that you’ve been given and you don’t know if it’s a forgery or not.

Often these software solutions have multiple anti-fraud steps built in, which is, of course, why you had to get the original documents in the first place to make sure it wasn’t a fraud!

The only caveat I’d give is that some firms are still concerned about the wording in the UK Finance mortgage lenders’ handbook for conveyancers (around seeing and taking a copy of a document), which tends to infer that you’ve actually handled the original and you’ve taken a copy of it.

Open Banking and User ID and Verification

It’s all about interpretation and managing risk when it comes to the UK Finance Handbook. We are hoping that UK Finance will amend their handbook to take into account this, because that wording has been there since I’ve been a solicitor (too long to remember!).

I do know that a request has gone into UK Finance for them to review those ID requirements, which are essentially anti-fraud measures and on the fraud subject, I think it was super interesting in the webinar when Tom talked about Armalytix using it to discharge a Dreamvar fraud (if you’re not a conveyancer or into vendor fraud, Dreamvar was a small property firm who unknowingly purchased a house from a fraudster who impersonated the true owner, leading to a £1.1 million loss and legal repercussions for involved solicitors).

In the Coffee Conversation webinar, Tom referred to the process where you have to make sure you’re sending the money to a bank account properly constituted in the name of the client for the last 12 months. I was so happy to hear that he and his team do this, because a lot of people are still focused solely on the Safe Harbour Id checks that look for the biometric check of the passport, which is an anti-fraud measure. If you’re in conveyancing you’ll get this but if you’re not, Safe Harbour is a set of really solid guidelines and standards that HM Land Registry put together, based on this UK Government Good Practice Guide, GPG 45.

Areas of law and fraud opportunities

I was thinking about Tom’s comments in our online event about which departments in a law firm or service area where lawyers would be looking at bank accounts in particular for their clients. Commercial litigation and embezzlement zoned into my thoughts.

When it comes to forensic accounting and examination of this example, we often see litigators or criminal lawyers double checking when their clients are accused of money laundering. Could you imagine a time when software could be used to defend people accused of money laundering?!

When it comes to software, which departments in your law firm waste time looking at bank statements, when they could be using software instead? Software would be more accurate (humans and numbers when you’re under pressure!), and time efficiency, making the whole process more cost effective for everyone.

I did say to Tom that I did think they might have some aspects to think about when it came to white collar fraud, especially private prosecutions, because lawyers would be pouring over financial data (including the bank statements!).

Open Banking Landscape for Lawyers in 2025

Where does open banking support lawyers?

I’m going to talk a little bit about the open banking landscape for lawyers in 2025, and Amy mentioned other use cases where open banking is supporting lawyers, rather than just something that powers and supports an AML type journey.

Open banking is the technology that empowers us in law firms. For that to happen, we have to be directly regulated by the FCA. In layman’s terms it means that we directly connect into 90% of UK current accounts through the big nine banks.

We’ve really focused over the last few years on raising the bar in terms of new innovations around open banking and source of funds.

AML is broadly our background. That’s what we’re most well known for. And lots of you will know that open banking can be really supportive in a source of funds check in terms of that middle piece of understanding, does that client have the money you need to see for that transaction and analysing the data that’s contained within.

Through open banking, you can get a set amount of data, whether that be 3, 6, 12 months or even longer on some higher risk matters. What open banking is able to do is analyse the data on cash, incoming transactions, and outgoing transactions.

We try to really focus on how we can do a better job at collecting as much as we can from the end client in that initial data grab. We’re one of the first providers to get access to Metro, and also for the Co-op which is now live, which is something we are proud of.

There are now 11.7 million active users of open banking enabled products in the UK that would cover use cases like ours, where we’re doing a one off to go get some information. If you think about how you might make a payment to an account number and sort code on your mobile (where you set someone up as a payee) open banking can speed up that, and there are businesses that have started to use that technology to really harmonise payments’ process.

When we looked at AML affordability investigation, or whatever you’re using open banking for, there are some key principles to get early client adoption from.

How to get law firm clients to come on board with open banking?

My first piece of advice would be to brace enough to TELL your clients, not ask them.

You’re the lawyer, you’re in control of the process, not your client. So, I’d say you have to be brave enough to tell your clients where vulnerabilities might come in.

If you have vulnerable clients or clients with no capacity then you require a Plan B.

I would say however, if you can get that message clear about you controlling the process and focusing on vulnerabilities, as well as understanding your client demographic, you should be looking to achieve an 80% to 90% success rate of sign-ups. I always say to law firms that if they can get their clients to understand the why, what’s the use case, why they have to do what you’re asking of them, when’s it going to happen, what it looks like, etc., they are more likely to understand the process and adopt the on boarding process of open banking with you.

New law firm client security questions

Security around finances and software are important to all of us.

For example, you might want to talk about security to your clients and how moving from manual to digital is safer. You might say that previously they would have emailed you their bank statements. It’s not particularly secure or safe for them or you as a firm. By giving your client an effective secure framework understanding, will mean they will be more likely to agree to open banking.

Law Firm Training for AML and Client Buy In

It’s no good adopting new technology into a firm if your staff don’t know how it works, and more importantly understand what the data is telling them.

When we work with firms who have centralised teams, we actually focus a bit more there on the “how things work” training angle, showing them what the user journey looks like, and what are some of the core messages around that?

If I was training a group of lawyers who would just purely be reviewing the reports, I would focus on reading the data and understanding what it is telling them.

Our feedback that we receive from leadership levels is about our articulated creation and of the consistency and process that we deliver. MLROs I speak to who will be at the top of the top of the chain for any queries, and will often say that when they get a report now, they’re broadly able to answer it much faster because it comes to them in a consistent format.

Come what may, I think it’s important to choose a provider that is FCA regulated, and who can handle any of the support queries generated. We focus all that on live chat.

What's next in the open banking world?

Many of you may have heard about “open finance” because the subject has been around for some while now. The term broadly represents an evolution of open banking beyond traditional banking to gather financial data.

The progression of open finance in the UK is linked closely to legislative development called the Data (Use and Access) Bill READ HERE) which is at the House of Lords stage and galloping towards Royal Assent at a fast pace (as at 1 April 2025).

This bill covers an awful lot of things around the ecosystem of financial data, and hopefully, what we in the professional services’ sector are hoping for here is that it creates structure and a framework as to what the future of open finance may look like.

Bear in mind, even when the bill becomes an act, changes won’t be immediate. Open finance is also a big cost for businesses to open up their API infrastructures without necessarily a reward, so although open finance is exciting in general for progress, just don’t expect anything too quickly.

We are also starting to see people grasp that open banking can be used for better verification of data. Many of our clients put their clients through an open banking journey with us, and therefore when it comes to 12 months of bank statement checks in a conveyancing matter for example, we can immediately report to our client as to whether their client’s bank account has actually been open for 12 months, as well as who the account owner is and what type of account it is.

What about those who can't or won't use open banking?

Good looks like 80% to 90% of those able to use open banking, but what about those people who fall out of that in all of the use cases?

We understand that not all clients can connect via open banking, and when they don’t, people are left dealing with a manual process which leads to delays in accuracies, more admin and less time for the good stuff. Earlier this year, we began embarking on our process of rolling out statement scanning, which is used as a combination of OCR and AI, but is generally used to support cases where open banking doesn’t work.

Family Law and Open Banking

Armalytix does a lot of work in the accountancy sector, especially working with insolvency practices. There’s a real clear use case here where in insolvency, the bank accounts may have been frozen, therefore they can’t be used through open banking. An insolvency practice will have those physical statements needed for some analysis, and the easiest way for them to do that is uploading them in the residential property world, you’re probably looking at things like gift donors, and vulnerable clients here.

Certainly, the technology is used more broadly in accounting than it is legal. But our main focus in the legal sector at present is in the family law space.

When asked about GDPR when requesting bank statements from the other side, it’s worth remembering that you, as the family lawyer, become the data controller, and as a data controller, you have a right to appoint a sub processor, and that agreement has to naturally cover that.

What jurisdictions are open banking processes in?

One of the questions I get frequently asked is open banking and jurisdictions other than the UK, and this is very appropriate as Amy is currently sat in the middle of Sydney, Australia!

As a provider, we currently only connect into UK bank accounts. There’s a number of reasons behind this, but if I start with Europe and post-Brexit, it has become more difficult for UK companies to obtain open banking licences, because of regulations and legal changes, such as having to have a presence in Europe etc. Unless you have a big European client base, the overall demand is pretty low (from our client base), so we never really pressed on with moving over jurisdictions.

If we start going a bit further afield, the jurisdictions that you might love us to give you some analysis on but probably never will be able to because they won’t open their doors to open banking are countries like China and Dubai, and I don’t anticipate them onboarding this process any time soon.

Outside the EU, two major jurisdictions that have opted for a regulatory-driven approach when it comes to open banking are Hong Kong and Australia. Australia’s open banking initiative, known as the Consumer Data Right (CDR), focuses on data sharing and consumer control.

I’m really keen to see how Australia handles the prescriptive side of Source of Funds (SOF) requirements. I’m sure Amy will keep us updated on the work she and AML Sorted are doing there. What’s fascinating about Australia, compared to the UK or Europe, is their banking landscape. It’s more consolidated, with their four major banks all mandated to implement these standards. Plus, even the smaller banks have followed suit, and they had some of the necessary infrastructure already in place. It’s quite different from the US, which is far more complex due to the sheer number of banks.

This link is totally independent to the work we do but it’s handy for a global look at which countries use open banking. https://www.openbankingmap.com/

What areas of law does open banking support?

Instead of tackling one problem at a time, firms are now using Open Banking to significantly reduce the time spent on bank statement analysis across multiple departments. By focusing on individual areas, they can achieve quicker and more impactful results.

What we are seeing more of are firms who offer:

Family and Divorce law
Conveyancing
Probate and Estate Administration
Commercial Litigation
Insolvency and Bankruptcy
Criminal Law (Financial Crime)

You can watch the full recording HERE.

Armalytix is an FCA regulated entity that works with Lawyers and Accountants to help them understand their clients’ finances.

Catch Up! You can watch all of Teal Compliance’s previous legal webinars here.

CLICK HERE TO WATCH

This link is totally independent to the work we do but it’s handy for a global look at which countries use open banking. https://www.openbankingmap.com/

Need Support or Advice?

If you would like to get hold of Tom, please email him directly: tom@armalytix.com, and if you have any questions of me or my associates, just drop me a line. My door is always open!

GET IN TOUCH HERE.

You're not alone, Teal Compliance is your partner in compliance and risk management support.

Start with your legal compliance audit
Anti-money laundering | Data Protection | Regulatory Compliance

Click Here

Open Banking Landscape for Law Firms in 2025 Read More »

Law Society Risk and Compliance Conference 2022 Teal Compliance Key Takeaways

Risk and Compliance March 2025 Key Takeaways

Anti-Money Laundering, Blogs, Compliance Training, Legal Compliance, Regulatory Compliance, Risk Management / Mark

Eilish Cullen, Teal Compliance’s Head of the Partnerships and our Data Protection Subject Matter Expert attended the Law Society Risk and Compliance Conference on 12 March 2025, here are her takeaways.

As ever, the sector is shifting big time, and we all need to be ready for it – whether managing complex and evolving regulations, ensuring data security, adapting to the rise of AI, and navigating economic pressures, all while building a positive culture and driving new business.

So this is something we all need to keep a close eye on, especially for COLPs and MLROs as the challenges we in AML and risk management are facing is going to dramatically ramp up with more and more complexities to navigate.

Here are Amy Bell’s Handy Hints for those new to the role of COLP & MLRO – READ HERE

The agenda for the rest of the day looked like this, and each delegate was offered 2 out of the 4 workshops:

TED talk: Is the legal profession fit for the 21st century?
SRA: Regulatory priorities in a changing legal landscape
Plenary 1: AI on trial This session delves into the risks and opportunities of AI in legal practice.
Workshop A1: Cybersecurity for small and medium-sized firms (run under Chatham House Rule)
Workshop A2: Social conflict and reputational risk
Plenary 2: Economic crime concerns
Workshop B1: Handling client money Post Axiom Ince the SRA proposes
Workshop B2: Risk management 101 Essential risk management strategies and best practices for process mapping and policy development.
Plenary 3: Code of conduct and culture What is your role as a compliance officer in shaping conduct and culture?
Reputational risk in law: Defending your reputation Join Jacqueline McKenzie, human rights and immigration lawyer, for an insightful keynote on managing reputational risk.

Eilish’s Key Takeaways:

Is the Legal Profession Fit For the 21st Century?

Kirin Kalsi, General Counsel, Compliance Officer and Data Protection Officer at E.ON UK, gave us a Ted Talk on the subject.

With the focus on law firms and their lawyers being focused on the billable hour and money, the potential for risk is high, to the client, to the reputation of the law firm, and of course to the law firm employees.

Kirin went on to talk about how the training of juniors/trainees hasn’t really changed in 20 years. The same methods are being used, but how do we come together as a legal sector to change that approach for training our new generation.

From training new generations coming into the profession and how the culture of the sector as a whole, as well as firmwide, is key to long term growth. New entrants to the profession say work/life balance is really important, their outlook on what’s important is different and Kirin said that potentially the profession is still way behind on this.

As attendees, we were asked is it within our power to change this? A conversation that I am taking back to the team at Teal and asking ourselves how we can support change.

As the Post Office Scandal, ‘Biggest Miscarriage of Justice’, is still very much in our front of minds, seeing Lee Castleton speak at various events, and knowing that 900 Post Masters were prosecuted, Kirin asked what can we learn from it in our risk and compliance efforts, both as consumers of law and of practitioners.

On a side note away from Kirin’s talk, the SRA confirmed it has more than 20 live investigations into solicitors and law firms who were working on behalf of the Post Office/Royal Mail Group. In a statement it says “We will take action where we find evidence that solicitors have fallen short of the standards the public expects”.

If you haven’t already read this, I urge you to: Post Office Horizon Inquiry – human stories

The need to ‘speak up’ and remind ourselves of our professional obligations. Attendees were asked if we have carried out our own firm’s internal training/briefings when it came to ensuring there will never be another Post Office Scandal (in terms of aggressive litigation, dehumanisation, bullying).

If you haven’t, then it’s time to have the conversation as to why we and/or our bosses feel it’s irrelevant?

It didn’t take long for the talk to turn to the use of AI and technology. As a profession we need to be forward thinking and proactive, especially when it increases efficiency and time. For example, our Teal Tracker, is built for efficiency and risk management. It’s accessible and easy to use. Amy Bell wrote this software and had it built specifically for the holes that appear in a firm’s AML compliance, data protection and regulatory processes.

TEAL TRACKER – you can read more about our software by clicking on the link HERE.

The takeaways on the subject of AI from Kirin’s Ted Talk for me were that in 2025, lawyers and colleagues in firms are more efficient and self-sufficient, arguably due to the software firms currently have in place.

As with technology and change, with AI there is an element of firms being both delighted at what AI can assist with in tandem with fear that it will replace their jobs.

There is still a concern regarding the reliability of AI (still in experimental phase) but the stark reality is that it is improving every day. We can’t afford to be dinosaurs.

When it comes to law firm risk and compliance, human risk has always been present (ask any insurer!), and therefore accuracy and reliability has always been a concern even without the use of AI.

All of us in the legal sector need to consider human risk -v- risk of AI getting it wrong.

Concern regarding whether a firm’s insurance covers the risk surrounding using AI – a reminder to firms to have that open conversation with their PII provider.

Regulatory Priorities in a Changing Legal Landscape (Aileen Armstrong, SRA) “We are Looking Forward”

Aileen Armstrong, Executive Director, Strategy Innovation and External Affairs at the SRA, focused on their priorities when it came to client money, high volume claims, and governance & regulation of AI.

Client Money Consultation

The SRA received hundreds of written responses from the legal profession on this as well as insights and opinions from their round table and focus groups.

In terms of alternatives to firms holding client money, some firms did agree that third party managed accounts (TPMAs) may present less risk.

However, firms had concerns that using TPMAs could increase the risk of cyber crime due to the amount of funds in them. Costs of their use and visibility were also a key concern in this respect. Other firms thought that changes to the current regulations surrounding accountant reports should be strengthened, perhaps in favour of annual declarations.

The SRA knows that any change won’t happen immediately and no decisions have been made at present. An executive speaker for the SRA stated that it may be a case that a tech solution may be the answer, something which may not even be in existence yet.

It’s a case of watching this space.

Handling Client Money - Residual Balances

We talked to Karen Edwards, Head of Professional Development at the ILFM, who found the conversation on residual balances intriguing.

Jayne Willetts, solicitor advocate, said that there is likely to be tightening up by the SRA on the issue of residual balances in the form of warning notices or additional guidance notes, but in her view she didn’t think the SRA will amend the Accounts Rules.

If you need Residual Balance Training – look no further – CLICK HERE.

High Volume Consumer Claims

The SRA currently has 60 live cases regarding law firms on this issue. They have published

guidance to consumers on this point, which you can READ HERE.

The SRA realise that these types of funding (no win no fee as an example) are a vital access to justice for so many, especially when other funding methods are not available.

The flip side is that there simply has to be better consumer protection overall. There have been significant problems and failings in this area, namely unstable funding models, lack of supervision, how ‘no win no fee’ models are sold/marketed to clients, as well as cold-calling and failings surrounding ATE/keeping clients up to date.

The SRA however does recognise that there are many claims’ firms doing a grand job, but the continued risks to consumers must be monitored and controlled.

Governance & Regulation of AI

The SRA recognises the importance of innovation in general.

In many ways we are still at the bottom of the hill however in terms of our understanding of this fast evolving landscape. In terms of what the SRA is doing in this area, it was said that it is producing guidance to help, whilst working with tech providers. The SRA is conscious that different firms/departments will have different AI needs.

The regulator says it has also been working with the Law Society on legal tools and the need for regulation surrounding this.

Question to SRA: What can the SRA do to win hearts and minds?

Answer: They recognise that the regulator must play its part and it recognises the need to engage with the sector… “talking and hearing”. This is why they wanted to do the Client Money Consultation differently rather than just set out proposals. They wanted to look at all of the evidence.

Question to SRA: Supervision. Is the SRA just concerned about supervision on high volume claims or in general?

Answer: Obligation to supervise must happen across the board.

On a side point, I read a post from John Hyde, Reporter at the Law Society Gazette.

He reported that the SRA insisted, on his questioning, that no decisions had been made on the future of the client account. He went on with his opinion post saying when asked how much money is held in law firm client accounts, the response was that the SRA didn’t know off the top of their head right now.

Hyde said that given that it was fundamental to the whole topic of client accounts, he might have imagined that the figure would be a key one. He concluded his short LinkedIn post saying,

“The SRA is acting without truly understanding the profession or acquiring sufficient evidence”.

Plenary 1: AI On Trial: Felix Zimmerman from Simmons & Simons (and others)

Felix specialises in negligence claims in firms, specifically surrounding AI use.

Conveyancing & Artificial Intelligence

The data came first in this talk.

There were 1.2 million property transactions in the UK last year and an increase is anticipated.

There is a drop in conveyancers so this means less people doing more work. The conveyancing industry has a reputation for doing things slowly. However, exciting for this area of property transactional law is development with the use of AI Agents to assist (multi models) which can control the mouse and key board, log into peoples inboxes, draft emails and then put them in their draft inbox ready for the staff member to check and send out.

This is designed to improve efficiency, Teal Compliance will be keeping its ear and eyes open with regard to risk in this regard.

Litigation & AI

There is now the ability to look at pleadings and review the prospects of success, thus reducing fee earners time on this.

Compliance & AI

There is a plethora of data online Felix said, and reviewing all of this can take time. AML compliance, risk management etc, can cause frustration for everyone, with fee earners and lawyers who just want to get on with their own client work, as well as partner feedback explaining they are worried about their firm’s bottom line, time constraints, fees and the possible impact on client relations due to delays.

All of these stresses around compliance can significantly impact job satisfaction.

Replacing Staff?

The average demographic of junior lawyers is 30 years and up now. There are concerns that they might be replaced by AI.

Ultimately, AI is being built to empower and assist with the “heavy lifting” in a law firm. It’s important for the legal sector as a whole to understand that AI should not be delegated tasks which are not appropriate for it, and that will negatively impact their clients and the firm’s reputation whilst keeping the insurer satisfied.

The reality is that the next set of laptops being bought will have AI chips built into them, it’s a language model training tool.

It was suggested that if we are having to double check the work of AI assistance, is it worth it in the first place?

Arguably yes, as it will still cut down a lot of time.

Question: Could firms face negligence claims for their failure to use AI?

Answer: Felix says yes potentially- for example in commercial litigation. ‘Relatively’ software is commonly used in these departments to review disclosure and can provide much better selection than any team of paralegals would.

Question: Environmental Consequences -v- Commitment to Net Zero.

Answer: Yes, recognise that there is a big environmental impact regarding use of AI e.g. use of water coolers for hard drives.

Question: What Training Should Firms Put in Place for AI Safety?

Answer: An overview of solutions, limitations etc.

Economic Crime Concerns.

The panel consisted of Colette Best (Kingsley Napley), Anita Clifford (Red Lion Chambers) Andy Donovan (Vinci Works), Harriet Holmes (Thirdfort) and Nicola Kirby (Latham and Watkins).

The Dentons case was one of the first topics discussed. Let’s face it, it wasn’t a great result for the legal profession. HOWEVER, the saving grace is that it highlighted only serious breaches will result in the SDT getting involved.

The headline from the Law Society Gazette (article dated 11 March 2025) is:

“SRA overturns Dentons acquittal in AML case”

You can read the article written by Bianca Castro HERE. The judgment from the High Court, said the ‘only evaluation’ required by the SDT ‘was whether or not the firm had complied with regulation 14 of the MLRs 2007’.

Source of Funds (SOF) and Source of Wealth (SOW):

There are no anticipated changes to the legislation for source of funds / source of wealth.

The legislation states get it from the source “where necessary” so we are left to look at the LSAG Guidance.

SOW is needed where a client is a PEP or in high risk jurisdiction. The difficulty with SOF/SOW is that a lot of it is a judgement call, making it a tricky area. Similarly, the legal profession is using terms interchangeably, which isn’t helpful.

Generally speaking, getting six months of documentation, as a starting point, but with the possibility of having to go back several years for higher risk areas. Teal and the team will update any changes and of course we always have updates and webinars on this subject.

The panel said that documenting decision making is important with decision making, information considered and action taken as a result.

Law Society’s 2025 focus on Risk and Compliance

The Law Society outlined their Formal Response to the SRA Consultation on Client Money with the following points:

Government considerations were discussed including the question, should we dispose of Enhanced Due Diligence (EDD) for high risk jurisdictions i.e. make it more risk based? Should we have lower risk factors?

The SRA has said that sanctions need to be in FWRA, either within the AML one or a separate one.

Trade sanctions should also be considered, especially if firms are at risk.

The SRA is carrying out sanction visits on law firms it regulates. This is mostly following on from its earlier sanctions questionnaires. It’s usually a 1 day visit, with policies and interviews taking place. Do check with the SRA on this point if you have any concerns.

Accountants’ Reports – there was talk about asking firms to submit these every 3 years (at present law firms need to obtain an accountant’s report within six months of the end of each accounting period if they hold or receive client money; and this report should only be submitted to the SRA if it is qualified, meaning it identifies issues with compliance regarding client fund).

Enforcements – we should expect SRA enforcements to continue and don’t think the ‘change of guard (Paul Philip leaving) will change this!

SRA Thematic Review on AML Training October 2024 Findings:

There is a distinct and direct link between the quality of AML training and findings on files. Firms and the legal sector as a whole must move beyond “Tick-Box” training, something that Teal Compliance has been passionately focused on for a long time now.

The SRA is concerned that some firms treat AML training as a mere formality, rather than a crucial tool for preventing financial crime. The regulator stresses the need for training to be relevant, engaging, and tailored to the specific risks faced by each firm.

TEAL COMPLIANCE TRAINING – find out more of how our tailored, relevant and engaging training can support your law firm policies and procedures.

As mentioned a few times throughout the day, ‘Off the shelf’ training probably isn’t going to cut it. The SRA wants to see that the training is tailored to real life scenarios. AML training should be at the very least carried out annually.

It was said that there needs to be systems in place for when someone misses AML training, including seniors management and partners.

In terms of specific training, there was a recommendation for training that is interactive such as ‘have a look at this” examples and “ who do you think is the beneficial owner?”’ i.e. pin the tail on the beneficial owner type of situation. Great to know that Teal Compliance is doing this and more in all our training sessions.

Someone came out with this statement, which I loved: “If it has a heart beat, train it’.

It was concluded that treating templates as a final solution is wholly inadequate. Use them as a base, yes, and then meticulously adapt them to your firm’s specific requirements. This is one of the themes we see at Teal Compliance, a firm’s assumption that a template is enough. It’s not.

Have a look at our Policy Review and Writing HERE.

Regarding ongoing monitoring, Harriet Holmes said there was a necessity to document ongoing monitoring, even if there have been no changes to client or matter risk, and to make sure everyone understood the tools and technology they are using. She pointed out that if you get alerts, look at them in a timely fashion and solve any issues as otherwise it leaves you and your firm exposed.

Have you downloaded your TEAL TRACKER?

Code of Conduct and Culture in Law Firms

This session had panel speakers, Paul Bennett (Partner at Bennett Briegal LLP), Clare Hughes-Williams (Partner at DAC Beachcroft), Pearl Mosses (Head of Regulatory Compliance at Setfords Law Ltd), and Elizabeth Rimmer (CEO at LawCare).

Between the above speakers, it was agreed that firms need to have strong HR support and buy in to the employees, not just their employers

Great leadership means leading by example, ensuring your team has trust in you, whilst having a transparent organisation that has the ability for staff to call out poor behaviour. HR and supportive teams must communicate throughout the firm what your culture is and embed it firmly. This should never be just a website policy saying how great you are with your culture and DEI, you have to show it through actions.

The following were suggested to manage risk as well as look after your staff and colleagues:

Anti-Bullying and Harassment training.
Performance reviews should be part of your culture.
Survey staff to find out what is the drive and motivations within your culture.

Elizabeth Rimmer, CEO of Lawcare, reminded us that the charity was there for everyone in the legal sector. It’s a place of confidentiality and no judgement.

Lawcare has been in place since 1997 and 2024 was their busiest year apart from 2020 (lock down).

The charity findings say that a review of your hierarchy behaviours could flag up some vital change requirements as they are seeing a culture in many firms on the premise that “it’s how things are done round here” which isn’t sustainable for retaining great staff or business growth.

With the topic of psychological safety at work, questions that you might ask yourself are:

Do you and your colleagues feel valued?
Is constructive criticism in place?
Is there a fear of raising mistakes (i.e., if I own up to a mistake, might I lose my job or be judged?)
How do we learn from this as a culture (when mistakes happen – because they will happen!)?
Is there a subtle blame culture?
What are our inherent risks that might hinder our staff’s mental health?
Is there a lack of supervision when it comes to bullying and harassment?

Overall, this was a really great session to bring the day to a close. ·

Eilish Cullen’s Conclusion of Risk & Compliance Conference Talks

For me, I found the conversations and topics around the evolving risk and compliance landscape to be as follows:

There is an increasing complexity of risk and compliance for law firms, not only traditional AML and regulatory risks, but also reputational risks, which are now receiving greater scrutiny.

The role of risk and compliance professionals is evolving to encompass a wider range of responsibilities.

When it came to culture and legal ethics it was very evident that the SRA is placing greater emphasis on firm culture and well-being. We know from speaking with our friends in insurance that this is a big factor for protecting firms against risks because having a strong moral and ethical culture is seen as essential for reducing errors and improving client outcomes.

Discussions also focused on the need to balance regulatory priorities with lawyers’ ability to advocate for their clients.

The conference underscored the insufficiency of generic compliance templates. Law firms must recognise this and develop tailored AML strategies to meet the demands of the current regulatory environment.

If you’d like to chat with me directly or find out how my colleagues can support you, please

do get in touch with me: eilish@tealcompliance.com or you can get hold of any of us HERE.

Risk and Compliance March 2025 Key Takeaways Read More »

Teal Compliance debate the topic of law firm client accounts and the use of TPMAs

The Future of Client Accounts: Should Law Firms Move to Third-Party Managed Accounts?

Anti-Money Laundering, Blogs, Data Protection, Legal Compliance, Regulatory Compliance, Risk Management / Mark

The management of client accounts has come under increased scrutiny in recent years, with the Solicitors Regulation Authority (SRA) questioning whether law firms should continue to handle these accounts themselves.

One alternative that has been proposed is the use of third-party managed accounts (TPMAs). But is this the right move for law firms? I know this is a contentious topic, but it’s well worth exploring the potential benefits if we’re forced into change, as well as the challenges of relying on TPMAs.

Legal Futures’ article dated 25 February 2025, with an alarming headline here:

“Time to act” on scrapping client accounts, consumer panel says

It includes statements from the Legal Services Consumer Panel regarding law firms holding client monies on account and commenting on the SRA’s Consultation, Mr Hayhoe, Panel Chair of the Legal Services Consumer Panel (LSCP), said “the consultation on the model of solicitors holding client money “disproportionately” focused on residual balances and interest, rather than the “central issue” of misappropriation.”

The Case for Third-Party Managed Accounts

If you’re not sure exactly what third-party managed accounts (TPMAs) are then here’s a quick definition:

TPMAs are accounts managed by third-party providers that are regulated by the Financial Conduct Authority (FCA). These providers* offer a range of services, including secure handling of client funds, compliance with anti-money laundering (AML) regulations, and protection against cyber threats.

One of the key benefits of using a TPMA is that it should reduce your firm’s risk associated with client accounts, since you’re not holding any money.

Since TPMAs are managed by specialists with advanced security measures, they could be better equipped to prevent fraud and cyber attacks because that’s vital for them in their service to you.

For instance, a TPMA provider might invest more heavily in cybersecurity than a typical law firm, hence the deterrent for baddies.

Additionally, TPMAs could alleviate some of the administrative burdens and headaches that come with managing client accounts.

Law firms could focus on their core legal work while the TPMA provider would handle the complexities of management the funds, including compliance with regulatory requirements.

TPMAs offer some potential advantages for law firms, but they’re certainly not a silver bullet. I’d suggest that as a firm (especially in property law and corporate) you need to carefully consider your needs as well as your circumstances before deciding whether to switch to a TPMA.

*there aren’t that many providers

The result of the SRA’s consultation should provide further clarity and I will be sending out updates as and when.

Pros of TPMAs for Law Firms

Reduced Risk: Less chance of law firms breaching the SRA Accounts Rules, and as TPMAs are regulated by the FCA (Financial Conduct Authority), law firms will have less direct responsibility for compliance with the SRA Accounts Rules. This can reduce the risk of accidental breaches, disciplinary action, and claims against professional indemnity insurance.

Lower risk of fraud and theft: TPMAs will have invested more funds into security measures than a law firm could. This might potentially reduce the risk of cybercrime and financial fraud compared to managing client accounts in-house.

Increased Efficiency: Will this be the end of legal cashiers? Probably not as we all need bookkeepers but if you don’t operate double ledgers, then this may change your accounting. TPMAs would streamline the accounts’ processes, freeing up time, plus no more manual reconciliation of client accounts! Do keep in contact with the ILFM for their updates and support in the meantime.

Faster transactions: Some TPMA providers offer faster transaction speeds, which will always be helpful for time-sensitive transactions (that said, Friday Afternoon Fraud is a concern due to the amount of transactions that happen, see below!).

Improved Client Experience including transparency and convenience. TPMA providers have online portals where clients can track their funds in real-time. Also, it will be interesting to see how TPMAs integrate with other legal tech solutions you might use already.

Right, that’s the upside of using TPMAs, but in reality, are we a long way from a mass changeover?

The Challenges of TPMAs for Law Firms

Despite the potential benefits I mentioned above, of course the whole conversation around TPMAs isn’t so clear cut and there is the continued debate around pitfalls and challenges of using TPMAs.

One of the most significant is cost.

TPMAs typically charge fees for their services, which can add up, particularly for smaller firms. These costs may include fees for each transaction, as well as ongoing account management fees.

Currently it looks like typical costs are between 0.25% and 1.5% of the funds held, depending on the transaction size, complexity, and the TPMA provider.

Another challenge is the potential for increased administrative work. While TPMAs handle many aspects of fund management, as a law firm, you are still responsible for ensuring that the TPMA meets the required standards. This might involve additional due diligence and compliance checks, which could offset some of the administrative savings.

On top of that, there is the issue of trust. Some of your clients may feel uncomfortable with their monies being managed by a third party rather than the law firm they have instructed.

Transparency and openness is key when it comes to consumer protection. The SRA is hot on that, as you will know!

Law firms will have to communicate clearly with their clients about the benefits of using a TPMA and provide assurances about the security and oversight in place.

TPMAs, Law Firms and SRA Accounts Rules

TPMAs will need to abide by SRA Accounts Rules 2019 to an extent although they are primarily regulated by the FCA.

Rule 11 of the SRA Accounts Rules specifically addresses TPMAs, requiring firms to ensure the provider is FCA-regulated, the client understands the arrangement, and that accurate records are maintained.

The key difference is that the TPMA provider takes on the primary responsibility for compliance with the detailed rules on holding and managing client money.

Have you had a compliance audit recently?

Whether you’d like to read Teal’s brochure or want to dive in and get a legal compliance audit done now, you can read all about how we support you, your reputation and your clients. CLICK HERE

Aggregation Risks

There may be an aggregation risk associated with TPMAs. If the legal sector were to move en-masse to TPMAs, this could create a concentration of client funds into a few large providers.

While this might reduce potential risks in individual law firms, it could also give a greater focus to financial criminals on their concentration of targeting TPMAs, as well as cybercriminals.

The potential for a large-scale breach of a TPMA could have catastrophic consequences.

Are insurers prepared to underwrite?

Is the Shift to TPMAs the Solution?

While TPMAs offer some clear advantages, they’re not a panacea for the risks associated with client accounts.

The decision to move to a TPMA should be made extremely carefully, weighing the benefits against the costs and potential risks.

For some law firms, particularly larger ones with significant resources, managing client accounts in-house might still be the best option. These larger law firms should have the capability to invest in advanced security measures in order to maintain rigorous compliance standards.

Teal Compliance offers expertise back-up with Data Protection Compliance support in this regard.

For smaller firms, however, TPMAs could offer a valuable solution, provided they can manage the associated costs and maintain client trust.

While the adoption of TPMAs offers potential benefits, particularly for smaller legal practices, it’s crucial to understand that it doesn’t absolve firms of their fundamental responsibilities.

Maintaining robust compliance and risk management protocols, prioritising client safety, safeguarding your firm’s reputation, and ensuring adequate insurance support remain paramount. Only after these foundational elements are firmly in place would I suggest you consider the budgetary and ROI implications of a TPMA transition.

Small law firm SORTED Programme support and all compliance services and training can be found HERE.

Switching to a TPMA means different things to different MLROs, COLPs and Managing Partners.

Who do you want to hold funds?
Would using a TPMA be less time consuming?
Is it a convenient way to offer full transparency to your clients?
Are you fee earners and legal cashiers on board with the requirements?

Insurers' thoughts

Marc Rowson and Brian Boehmer, partners at insurance brokerage Lockton, discussed the implications on the profession, explaining how law firms can confidently navigate this evolving legal landscape.

Further to the SRA consumer protection review, and the talk about client accounts, Brian said he believes that mandating the use of TPMAs would be “a reactionary response to a few bad apples”, while Marc questions whether using TPMAs could entirely prevent the improper use of client money: “I suspect if someone wants to game the system, they’d find a way.”

If you want to read more about what Marc and Brian think you can read their thoughts HERE.

Quotes on Client Accounts and SRA Plans

"Kneejerk and disruptive": The Joint V law societies (representing 15,000 legal professionals) criticized the SRA's plans, stating they show a lack of understanding of the legal profession and could add a whole new level of risk.

Law Gazette

"Time to act": The Legal Services Consumer Panel urged the SRA to take decisive steps towards scrapping client accounts and mandating TPMAs, arguing that the current framework doesn't offer adequate consumer protection.

Legal Futures

"Disproportionate and poorly justified": The Law Society expressed similar concerns, arguing that the proposals are disproportionate and not justified by the evidence. They also highlighted the potential for increased costs and delays for clients.

Law Society Website

"Resistance to change": The Consumer Panel also criticised the SRA's "conservatism" and resistance to change, suggesting that embracing TPMAs could modernise the handling of client funds.

Legal Futures

Financial transactions in the legal sector will always be a target for financial and economic criminals. If you directly hold client funds and make use of the interest, being forced to take reasonable steps to change to a TPMA facility will be jarring.

As the legal sector continues to evolve, the debate over the future of client accounts is likely to continue, with firms exploring various options to protect client funds and maintain compliance. I, for one, will be here to support any changes for Teal Compliance clients.

Catch up on Teal Compliance’s Legal Webinars

CLICK HERE

Need Help?

Did you know that Teal provides specialist training to both COLPs and MLROs? If you want to find out more, simply GET IN TOUCH HERE.

You're not alone, Teal Compliance is your partner in compliance and risk management support.

Start with your legal compliance audit
Anti-money laundering | Data Protection | Regulatory Compliance

Click Here

The Future of Client Accounts: Should Law Firms Move to Third-Party Managed Accounts? Read More »

Hidden costs of inadequate risk management in a uk law firm by AMY BELL

The Hidden Costs of Inadequate Risk Management in Law Firms

Anti-Money Laundering, Legal Compliance, Regulatory Compliance, Risk Management / Mark

What keeps a lawyer up at night? The answer will depend on where they sit in their role in a law firm. As a solicitor and AML compliance specialist, I get it.

Senior partners might focus on cashflow and reputation. Newly qualifieds might be struggling with imposter syndrome. Practice managers may be spinning their plates with software integration and IT headaches, whereas compliance officers will have their own plethora of worries.

From my experience, it depends on whether you’re specifically a COFA, COLP, or MLRO (of course many small high street firms have one person covering all the compliance and risk management pathways in a firm whilst fee earning).

Does your firm focus on conveyancing and private client work? You’ve got a whole host of challenges just by default. Are you involved in litigation and dispute resolution? Then you’ve got the “sham litigation” scenarios abounding. Onboarding overseas’ clients from possible “risk” territories? You’ve got some serious CDD work there. Have a senior partner that also holds the role of the compliance officer and looks after client accounts? Let’s not even go there…

It’s great that I’m seeing so many more firms come to me and my team asking for support in compliance training, more onboarding with our Teal Tracker software and generally being more proactive with their firm’s visibility in understanding and staying compliant, but there are so many that are still focused on the pounding billable hour and 100% client focused, rather than 85% on client work and 15% training and compliance.

The concept of “sustainable effort” is the idea of working at 85% capacity, as we can maintain the perfect equilibrium of high performance and well-being, i.e. if you are working at 100% then this leads to burnout, which of course leads to risk. McKinsey’s Burnout Tool is handy HERE.

It’s too easy to use AML templates and not tailor them to your firm, your clientele, and of course your employees and colleagues. I designed our AML software, TEAL TRACKER, with you in mind….if you’re reading this, then why not have a look at our software HERE.

We can all rely on those basic templates, ask new employees to read the policy online, run a tick box exercise, but what happens when it’s too late? When risk has crashed through your door.

Ultimately, overseeing risk management in your law firm is about finding a balance that works for you and your employees, whilst seriously considering factors like workload, regulator fines, insider (and outsider) threats, and workplace culture.

As the CEO of Teal Compliance and Chair of the Law Society’s Money Laundering Task Force, I can only continue to support my peers in the legal profession and impart my insights and expertise.

Sometimes if you look at scenarios and work backwards it helps to identify the stages of how to feel secure in your firm’s compliance processes and controls. Know the saying “I never thought it would happen to me?”. My advice is to assume it will be you and deter the baddies whilst appeasing the regulators.

Some of the “hidden costs”, i.e. consequences of inadequate risk management include:

Regulatory penalties: Firms that fail to comply with AML regulations can face significant fines and penalties. All you need to do is look at the SRA’s website or a search in Legal Futures to hear the latest. The law firm Ashfords LLP had a largely unblemished regulatory and disciplinary history and so it is regretful that they were then fined more than £100,000 for failing to comply with AML regulations
Reputational damage: A firm’s “brand” reputation can be devastatingly damaged if it has been involved in money laundering or other illegal activities, whether or not the crime was due to naivety or planned. We are in a digital age where social media and Google reviews can be detrimental, leading to a loss of clients, difficulty attracting new business, and a decline in overall firm value – you want succession and have worked so hard but then you’re fined, possibly struck off and another firm sweeps in at a price that’s hard to swallow.
Client money losses: The responsibility for client account monies falls on the law firm and its managers, including the Compliance Officer for Finance and Administration (COFA) and the Compliance Officer for Legal Practice (COLP). If client monies are stolen or laundered, and the SRA finds out, the firm and its responsible individuals can face serious consequences, including disciplinary action and potential referral to the Solicitors Disciplinary Tribunal (SDT). If the loss of client money is due to dishonesty or negligence by your firm, then you and your firm would be responsible for reimbursing the client. Consequences are hidden from this obvious painful financial strain, but brand reputation, personal life stresses and recruitment are key players.
Cybersecurity threats: Inadequate risk management can leave firms really open and vulnerable to dreaded cyber-attacks and data breaches. These can cause significant financial losses, including the cost of remediation, legal fees, and potential fines.
Internal fraud: This is a painful one because it forces us to look at insider threats. Common types of internal fraud include administering the accounts of individual clients where a single person has sole authority, and unofficial “borrowing” from client account or billing fraud. Billing fraud is where fee earners might inflate time spent and/or fees charged to meet or exceed targets. In the latter scenario it goes back to the pressures put on lawyers and therefore workplace culture might need more looking into.
Increased scrutiny: Time in a law firm is hard to come by, especially if there aren’t enough fee earners to cover the amount of work. It’s back to the balance of 85% output. If your firm has a history of compliance issues that aren’t rectified or evidenced to be doing more to manage risk, that firm faces increased scrutiny from the regulators. That is time-consuming in itself, as well costly. Your firm might be incurring higher costs to bring your practice into a healthy compliance model after failing to manage all risks adequately.
Difficulty obtaining insurance: If you have poor compliance records then it stands to reason that you might find it more difficult to obtain professional indemnity insurance or cyber insurance, or may face higher premiums. Insurers prefer continued transparency and openness. They better serve you when you come to them quickly with a possible breach. If they see you are in communication with them with anything seemingly risky, they’ll be able to help you navigate the process better.
Recruitment and Talent: Ask anyone in law and they’ll tell you that recruiting is a headache but then keeping great people in your firm is a migraine. A poor risk management culture leads to employee dissatisfaction, burnout, and ultimately, loss of your talented peers and colleagues. You don’t want to see your colleagues heading off to a competitor who offers continued training that’s engaging, and focuses on the 85% model at work do you?
Operational Inefficiencies: Practice managers have many plates to spin, therefore if part of their role is to ensure the operational running of your firm lacks effective risk management the plates begin to drop. Billing errors, CMS glitches, delayed disbursements, increased administrative workloads, and no controls to track and measure for compliance policies and processes.
Clients: We are all consumers of law in some way or another, yes, even us solicitors, i.e. we are all human. We observe, we listen, we trust, we lose trust…. clients may lose trust in a firm that fails to manage risks effectively. Remember social media, and insider gossip? It happens, people talk. If there’s a local newspaper with a budding journalist reading to crawl the disciplinary pages or court documents for their “business section”, and you’re in a firm of high street residential conveyancers, before you know it, the reputation is damaged, leading to loss of business and an impact on your firm’s market value. Whether you might be thinking of succession or investment, poor risk management has many hidden costs that include your future.

It’s never too late to invest in your firm’s compliance and manage risk effectively.

Amy

The Hidden Costs of Inadequate Risk Management in Law Firms Read More »