What a PWRA is, and why the SRA calls it something else.

A PWRA is a practice-wide risk assessment: the written, firm-level assessment of money-laundering and terrorist-financing risk that Regulation 18 of the Money Laundering Regulations 2017 requires every in-scope firm to hold. If your firm is regulated by the SRA, you will not see the term "PWRA" in the SRA's own guidance. The SRA calls the same document a firm-wide risk assessment, or FWRA. They are the same underlying legal duty, described with different labels by different regulators.

What a PWRA has to cover.

Regulation 18(1) of the MLR 2017 requires a relevant person (a firm within scope of the regulations) to "take appropriate steps to identify and assess the risks of money laundering and terrorist financing" to which its business is subject. Regulation 18(2) sets out the specific risk factors the assessment must consider, taking into account information made available by the firm's supervisory authority:

• Its customers.
• The countries or geographic areas in which it operates.
• Its products or services.
• Its transactions.
• Its delivery channels.

Regulation 18(3) requires the assessment to take into account the size and nature of the firm's business, so a two-partner conveyancing practice and a 200-partner commercial firm are not expected to produce documents of the same scale, only documents proportionate to their own risk profile. Regulation 18(4) requires the firm to keep an up-to-date written record of the steps it took to produce the assessment, and Regulation 18(6) requires the firm to provide that assessment to its supervisory authority on request.

Why the SRA calls it a firm-wide risk assessment, not a PWRA.

Terminology for this document varies across the bodies that supervise different parts of the UK's regulated sector under the MLR 2017. The SRA's own guidance page on this duty is titled "Firm-wide risk assessments" and uses that term, or "firm risk assessment," throughout; it does not use "practice-wide risk assessment" or "PWRA" anywhere. The Council for Licensed Conveyancers, another legal-sector AML supervisor, titles its own equivalent guidance "AML Practice-wide risk assessment." Accountancy-sector AML supervisors and general AML training materials also commonly use "PWRA." The regulation being described, Regulation 18 of the MLR 2017, is identical regardless of which term a given supervisor prefers.

If your firm is SRA-regulated, the safe approach is to use "firm-wide risk assessment" or "FWRA" in anything you file with, or say to, the SRA, since that is the term its own guidance and its own AML Annual Report use. "PWRA" is worth recognising if you encounter it in a training course, a piece of AML software, or guidance written for a different regulated sector, because it refers to the same document.

How a PWRA or FWRA differs from a client and matter risk assessment.

This is the distinction firms most often get wrong, and it matters because the two documents are checked separately and neither substitutes for the other. A PWRA or FWRA assesses risk across the whole practice: the kinds of clients it acts for generally, the services it offers, the jurisdictions it touches. A client and matter risk assessment (CMRA), required separately under Regulation 28(12)-(13), applies that same thinking to one specific client and matter (see our full explainer on MLR 2017 Reg 28). A firm needs both. A strong firm-wide assessment does not excuse a missing matter-level one, and vice versa.

How often UK firms get the firm-wide risk assessment wrong.

The SRA's 2024/25 AML Annual Report gives an exact picture. Of the 833 firms it assessed, 19 had no firm-wide risk assessment at all, despite the underlying duty having existed for more than seven years, and were referred for investigation on that basis alone. Of the 814 firm-wide risk assessments the SRA did review (the 833 firms called in, minus the 19 with none), 47% were rated compliant, up from 43% the year before, and 9% were rated non-compliant, broadly flat against 8% the prior year (SRA AML Annual Report 2024/25).

Nineteen firms had no firm-wide risk assessment at all in 2024/25, despite the duty dating back more than seven years.

How a PWRA relates to a proliferation financing risk assessment.

These are two separate documents, and firms sometimes conflate them. The firm-wide risk assessment under Regulation 18 covers money laundering and terrorist financing risk generally. A separate proliferation financing risk assessment has been required under Regulation 18A since 1 April 2023, specifically addressing the risk that a firm's services could be used to finance the proliferation of weapons. In 2024/25, 646 of the 833 firms the SRA assessed (78%) had completed one (SRA AML Annual Report 2024/25). Having a strong firm-wide risk assessment does not, by itself, satisfy the separate Regulation 18A duty.

Why it matters.

A firm that only ever hears the term "firm-wide risk assessment" from the SRA, and separately encounters "PWRA" in a training course or a piece of software, can be left unsure whether it is looking at one duty or two. It is one duty. The practical risk is not conceptual confusion, it is a firm assuming a document referred to by an unfamiliar name is something additional it has not yet built, when in substance it may already have the right document under a different label, or, just as often, assuming a document exists because the term sounds familiar when in fact nothing has actually been written down.

Frequently asked questions.

Is a PWRA a legal requirement.

Yes. Whatever term is used to describe it, the underlying document is required under Regulation 18 of the Money Laundering Regulations 2017 for every firm within scope of the regulations.

Does the SRA use the term PWRA.

No. The SRA's own guidance and its Anti-Money Laundering Annual Report both use "firm-wide risk assessment" (FWRA). "PWRA" appears in guidance from other AML supervisors, including the Council for Licensed Conveyancers, and in general AML training materials, describing the same Regulation 18 duty.

How is a PWRA different from a CMRA.

A PWRA (or FWRA) assesses risk across the whole firm. A client and matter risk assessment (CMRA) assesses risk for one specific client and matter. Both are required, under different parts of the regulations, and one does not substitute for the other.

How often does a PWRA need to be reviewed.

The regulations do not set a fixed interval, but a PWRA should be reviewed whenever a material change occurs, such as a new practice area, a new type of client, or a change in the jurisdictions the firm deals with, and at least annually as a baseline.

What happens if a firm has no PWRA at all.

Based on the SRA's 2024/25 findings, firms with no firm-wide risk assessment at all were referred for investigation. The duty has existed since Regulation 18 took effect in 2017, so its absence is treated as a longstanding compliance failure, not an oversight.