What the SRA's 2024/25 AML report reveals about small law firms

Every autumn the Solicitors Regulation Authority publishes its Anti-Money Laundering Annual Report, and every autumn it reads a little more like a warning. The 2024/25 edition, published in October 2025, is the sharpest yet. Behind the headline statistics is a clear message for smaller firms: the era in which an under-resourced compliance function could quietly pass unnoticed is over.

The numbers, and what changed

In 2024/25 the SRA reviewed 5,873 individual client files across inspections and desk-based reviews (SRA AML Annual Report 2024/25). The compliance picture it drew from them was stark. Only around 13% of firms were assessed as fully compliant; roughly 54% were partially compliant and about 32%, nearly one in three, were non-compliant (SRA AML Annual Report 2024/25). Put another way, close to 86% of firms were not fully compliant with the Money Laundering Regulations.

The enforcement response scaled up to match. The SRA recorded 151 enforcement outcomes in the year (137 internal and 14 at the Solicitors Disciplinary Tribunal, SDT), up from 78 the previous year (SRA AML Annual Report 2024/25). Total AML-related fines reached roughly £1.5 million (£1,498,983), the highest the regulator has recorded. Referrals to the SDT rose to 14, returning to a level not seen for several years.

Nearly one in three inspected firms was assessed as non-compliant, and total AML fines hit a record £1.5m.

The supervisory machine behind those outcomes has grown too. The SRA carried out 935 proactive AML engagements (inspections, desk-based reviews and thematic assessments), up from 545, an increase of around 72% (SRA AML Annual Report 2024/25). Some 270 firms were assessed as non-compliant and dealt with accordingly. The regulator is not just fining more; it is looking at far more firms.

Why this lands hardest on smaller firms

None of this is aimed specifically at small firms, but the structural reality is that smaller practices feel it most. A firm with two or three fee-earners rarely has a full-time MLRO, a dedicated compliance officer, or the budget for external audit. The same partner who bills the work often owns the risk assessments, the training log and the file reviews. When the SRA turns up, and it is turning up far more often, those firms have the least slack to absorb the scrutiny.

The most common failings the SRA reports are not exotic. They are the foundational documents that every firm is supposed to have: firm-wide risk assessments, client and matter risk assessments, and evidence of source-of-funds checks. Around 950 files (16%) reviewed had no client and matter risk assessment at all, or only an incomplete one (SRA AML Annual Report 2024/25). These are not sophisticated money-laundering typologies slipping past clever criminals; they are gaps in basic record-keeping.

The economics have shifted

Until recently, the SRA's internal fining power was capped at £25,000 for most firms. Since the Economic Crime and Corporate Transparency Act 2023 took effect in March 2024, that cap no longer applies where a breach relates to the prevention or detection of economic crime, which includes money laundering (SRA, Further changes to the fining regime). In practice this means AML failings can now attract fines far larger than the old ceiling. The regulator's largest AML-related penalty to date, £300,000, was issued in 2025 under these expanded powers.

For a small firm, a five-figure fine is not a line item; it can be existential. And AML penalties carry a particular sting: professional indemnity insurance generally does not cover regulatory fines, so the money comes straight off the bottom line.

What the report is really telling you

Read together, the 2024/25 figures describe a regulator that has industrialised its supervision and hardened its penalties at the same time. The probability of being looked at has gone up. The cost of being found wanting has gone up. And the failings being penalised are, overwhelmingly, ordinary documentation gaps rather than active complicity in crime.

There is a quiet unfairness in that last point. A firm can have no involvement whatsoever in money laundering and still be fined heavily for failing to demonstrate that it took the required steps. The SRA's position is consistent and well-established: the obligation is to have compliant systems and to evidence them, not merely to avoid facilitating crime. A clean conscience is not a defence to a missing risk assessment.

Why it matters

The 2024/25 report is not a story about a handful of bad actors. It is a story about a large tail of ordinary, honest firms, many of them small, whose paperwork does not keep pace with what the regulations require. The enforcement surge means the gap between "we comply in spirit" and "we can prove we comply" has become the gap between business as usual and a record-breaking fine.

For a sub-20-fee-earner firm, the practical takeaway is uncomfortable but simple: the systems the SRA now inspects are exactly the ones that smaller practices have historically found hardest to resource, and the penalties for falling short have never been higher. Understanding where those gaps sit, and closing them before an inspector finds them, is no longer a nice-to-have. It is the difference between a routine visit and a headline.