Does the AI train on our client data?

No. Client data is never used to train any AI model. Inference runs via AWS Bedrock (eu-west-2, London) with zero data retention (ZDR): Bedrock does not retain prompts or outputs after the API call completes. Files are processed in memory and discarded. A data processing agreement (DPA) is provided before any client data is processed.

Is this SRA compliant?

The product is designed to be consistent with the SRA's AI Risk Outlook guidance. Every AI output is a clearly-labelled draft requiring review and explicit sign-off by a named MLRO or COLP (with their SRA reference logged); no AI output is auto-filed; the firm remains the regulated entity and responsible party; and an append-only audit log of all AI outputs and human decisions is maintained. This does not constitute legal advice about a specific firm's obligations.

What happens when AML supervision transfers from the SRA to the FCA?

The FCA will inherit the files and procedures firms create today. The underlying MLR 2017 obligations remain unchanged; only who supervises changes. The FCA is expected to adopt a more data-driven, forensic inspection approach. Evidence packs are designed to be legible to both the current SRA inspection format and the FCA's anticipated forensic style.

Where is client data stored, and can it leave the UK?

All data is stored in AWS eu-west-2 (London). No data transits to US or non-UK/EU infrastructure. AI inference runs via Bedrock EU endpoints. ISO 27001 certification is planned before general availability (currently in design phase). Cyber Essentials Plus is planned (after initial pilots). The certification timeline is published transparently; no certifications are claimed that are not yet held.

Which practice management systems do you integrate with?

The product is PMS-agnostic and designed to sit above the existing stack, not replace it. Integration roadmap: Clio, LEAP, Actionstep, and Osprey. Reads from Thirdfort, Amiqus, and ComplyAdvantage for ID verification and sanctions data. Integration does not require replacing the existing PMS.

Does the AI file SARs (Suspicious Activity Reports) automatically?

No. Filing a SAR is a legal act with serious consequences. The AI can identify indicators that a matter may warrant SAR consideration and draft supporting analysis, but the MLRO must review the analysis, make the decision independently, and file via the NCA's SARS Online portal. The system logs that the consideration occurred and who made the decision; it never acts on it.

How do you handle the tipping off prohibition?

SAR-consideration workflows are partitioned from fee-earner views. Once a SAR consideration is open, the matter is flagged internally to the MLRO only; fee earners see a general hold instruction without the reason. This is enforced at the access-control layer, not just the UI layer.

What is the cost of the service?

Currently in pre-launch, conducting paid-intent discovery calls. Intended model: free 30-minute compliance health-check with no commitment, then a one-month free pilot with written success criteria and an end date, then a minimum 6-month subscription. Pricing is a transparent subscription, calibrated to be a fraction of the cost of a single avoided AML fine. Accessible to firms of any size, not enterprise-gated.

Will you sign a data processing agreement (DPA)?

Yes. A DPA is required before any client data is processed. The DPA covers: lawful basis for processing, sub-processor chain (AWS, Bedrock), data residency guarantees, retention and deletion schedule, and breach notification obligations. Client data will not be processed without a signed DPA.

Is the AI output protected by legal professional privilege?

This is a live area of law. AI-assisted outputs directed by a qualified lawyer, used in preparation for legal proceedings, and subject to MLRO review and adoption, may be capable of attracting privilege, but this has not been authoritatively decided. Firms should treat AI compliance outputs as records that assist the fee earner's own work product, not as privileged communications in their own right. This is not legal advice.

The product.

Book a health-check

SRA AML inspections last year

+72% on the year before

firms referred for further investigation

£0

the SRA's maximum penalty

Source: SRA Anti-Money Laundering Annual Report 2024/25.

Risk-assessed in under a minute.

Retibo drafts the Client & Matter Risk Assessment under MLR 2017 Reg 28, the first thing an SRA inspector checks. Your MLRO reviews and adopts it; the software never decides.

Retibo

Compliance layer

Firm compliance

Action required

1 matter with red gaps needs action.

Search matters, clients or references…

J. Carter

MLRO / COLP

Mr Daniel Okafor

CONV/2026/0481

Residential conveyancing£895,000Action required

Assessment

Gaps

Evidence

Client & Matter Risk AssessmentAction required

DRAFT. Requires review and adoption by a named, qualified person before it may be relied upon.

Client risk

High

Matter risk

High

Risk score

100 / 100

Reasoning

Residential purchase funded in part from outside the client's own resources. The file evidences identity verification but not that the source of the purchase monies was scrutinised. Third-party contributions and a high purchase value elevate the money-laundering risk before completion.

Retibo

Compliance layer

Firm compliance

Action required

1 matter with red gaps needs action.

Search matters, clients or references…

J. Carter

MLRO / COLP

Mr Daniel Okafor

CONV/2026/0481

Residential conveyancing£895,000Action required

Assessment

Gaps

Evidence

Gap report: Action required2 red · 0 amber · 1 green

Red: action required (2)

Source of funds not evidenced

MLR 2017 Reg 28(11)–(13); LSAG 2025 §5.4

The file records the deposit and balance figures but contains no evidence that the source of the purchase monies was obtained or scrutinised, a mandatory CDD element for a property purchase.

Recommended action

Obtain 12 months of bank statements for the deposit and balance, plus a gifted-deposit declaration, and record the MLRO's source-of-funds assessment before exchange.

Officer-amended by Mandeep Officer (MLRO / nominated officer)

Enhanced due diligence recommendedMLR 2017 Reg 33

Every gap, cited to the rule.

It finds the gaps an inspector would raise and cites each to the exact provision, not a judgement call you defend from memory.

Drafted for your MLRO to sign.

The software only ever drafts; a named MLRO reviews, signs and owns it. It never adopts a risk rating and never files a SAR.

Retibo

Compliance layer

Firm compliance

Action required

1 matter with red gaps needs action.

Search matters, clients or references…

J. Carter

MLRO / COLP

Mr Daniel Okafor

CONV/2026/0481

Residential conveyancing£895,000Action required

Assessment

Gaps

Evidence

Draft, not yet adopted.

Amend any finding, then adopt & sign to make this the firm's own record.

Findings: edit or dismiss before sign-off

REDSource of funds not evidenced

Edited by Mandeep Officer (MLRO / nominated officer)

Edit / dismiss

REDThird-party contribution not documented

AI-drafted

Edit / dismiss

GREENIdentity verification present

AI-drafted

Edit / dismiss

Retibo

Compliance layer

Firm compliance

Action required

1 matter with red gaps needs action.

Search matters, clients or references…

J. Carter

MLRO / COLP

Alerts

Continuous monitoring across open matters.

REDUnresolved red gapCONV/2026/0481

Mr Daniel Okafor

The latest assessment surfaced a RED gap not yet cleared or escalated by the nominated officer.

Rule:MLR 2017 Reg 28 (CDD) & Reg 35 (EDD); POCA 2002 s.330 (consider a SAR)

AcknowledgeSnooze

AMBERStale / missing assessmentPROB/2026/0233Acknowledged

Estate of Mrs Joan Whitfield, dec'd

The latest assessment is 120 days old (older than the 90-day refresh window).

Monitored, not forgotten.

AML duty doesn't end at onboarding. Retibo re-checks open matters and flags when a re-assessment is due, at no extra cost.

Inspection-ready, always.

Every assessment, gap and sign-off is date-stamped in a tamper-evident log. When the SRA letter lands, the evidence is already assembled.

Retibo

Compliance layer

Firm compliance

Action required

1 matter with red gaps needs action.

Search matters, clients or references…

J. Carter

MLRO / COLP

Mr Daniel Okafor

CONV/2026/0481

Residential conveyancing£895,000Action required

Assessment

Gaps

Evidence

Download PDFPrint

Client & Matter Risk Assessment: Evidence Pack

Firm

Example & Co Solicitors LLP

Matter reference

CONV/2026/0481

Client

Mr Daniel Okafor

Matter value

£895,000

Generated

16 June 2026

Audit log: tamper-evident

Assessment drafted16 Jun, 12:11 · Retibo

Finding amended16 Jun, 12:14 · Mandeep Officer (MLRO)

Adopted & signed16 Jun, 12:18 · Mandeep Officer (MLRO)

[ Founder message placeholder ]

Jacob Styles

Co-founder · Qualified solicitor, England & Wales

“When we started building Retibo, the thing that bothered us most was how many tools stop at telling you there's a problem. That's the easy part. Anyone can flag a gap. Actually doing something about it is where the real work is, and that's what we cared about getting right. So we built it so that when it finds a gap, someone's name goes against it, and a second person has to check the fix before it is ever marked as closed. We also knew from experience that no two matters look alike, so it learns that a conveyancing file isn't judged the same way a probate one is. And because we hated the thought of anyone rekeying details that are already sitting in a document, it reads the file and pulls them out for you to confirm. None of that came from a roadmap someone handed us. We added it because it is what we would want if we were still the ones sitting with the file late on a Friday.”

Arvind Manimaran

Co-founder · SQE-qualified, England & Wales

FAQ

Honest answers, sourced where possible. We do not claim certifications we do not hold. We do not minimise legal questions.

Read our compliance guides

Book a compliance health-check.

We run a sample of your actual matters through the system and produce the gap report, every gap cited to the exact rule, before you commit to anything. No fee, no obligation; just evidence of what the product does on your files.

Book a free health-check Read our security posture

UK-hosted, UK law

Zero data retention (ZDR) on launch

Synthetic data in all demos

MLR 2017 Reg 28(11) compliant design