Money laundering, conflicts and the due-diligence checks that actually bite

A new client walks into a mid-size London law firm asking for help buying a portfolio of residential properties in cash, through a British Virgin Islands holding company, with funds wired from a bank in a jurisdiction the compliance team has never processed before. The partner is excited. The deal is worth a six-figure fee. Then the file hits the risk team, and it sits there for eleven days while someone tries to figure out who actually owns the BVI company. This is where most laundering attempts through law firms either die quietly or get waved through by a firm that didn't look hard enough.

Law firms are attractive to launderers precisely because they are trusted intermediaries: money that passes through a client account (a firm's regulated bank account for holding client funds, sometimes called an IOLTA account in the US, "Interest on Lawyers' Trust Accounts") looks cleaner on the other side. That trust is exactly what regulators now force firms to interrogate before a partner signs an engagement letter.

The regulatory backbone

In the UK, the key regime is the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (MLR 2017), which implements anti-money laundering (AML) standards set globally by the Financial Action Task Force (FATF), an intergovernmental body based in Paris. Law firms doing certain "regulated activities" (conveyancing, company formation, managing client money, trust and tax structuring) fall under supervision, typically by the Solicitors Regulation Authority (SRA).

In the US, the picture is more fragmented. The Bank Secrecy Act (BSA) and USA PATRIOT Act impose AML duties on financial institutions, but lawyers have historically had a narrower direct obligation, a long-standing gap flagged by the FATF's mutual evaluation of the US. That gap is closing: the Corporate Transparency Act (CTA), administered by the Financial Crimes Enforcement Network (FinCEN), now requires many US companies to disclose beneficial owners (the real individuals who ultimately own or control an entity, even through layers of shell companies), which directly affects the entity-structuring work law firms do for clients.

Across the EU, the 6th Anti-Money Laundering Directive (6AMLD) and the new Anti-Money Laundering Authority (AMLA), headquartered in Frankfurt and becoming operational through 2025-2026, are pushing toward a single EU rulebook rather than country-by-country transposition.

The three checks that actually bite

Not every check on a compliance checklist matters equally. Three tend to be where deals genuinely stall or die.

1. Client due diligence (CDD) and beneficial ownership

CDD means verifying who the client is and, for entities, who stands behind them. Under MLR 2017, firms must identify anyone owning or controlling more than 25% of a company. For layered structures (a BVI company owned by a Cayman trust owned by an individual in a third country) this can take weeks, not hours.

Enhanced Due Diligence (EDD), a deeper version of CDD, is triggered automatically for Politically Exposed Persons (PEPs), people holding prominent public functions, or their family members and close associates, because they carry higher corruption risk. A former deputy minister buying a London flat through a shell company is a textbook EDD trigger, even if every document checks out.

2. Source of funds and source of wealth

Source of funds asks: where did *this specific money* come from (sale proceeds, loan, inheritance)? Source of wealth asks the bigger question: how did this person accumulate their overall net worth? A client can produce a clean bank statement showing a wire transfer (satisfying source of funds) while the underlying wealth traces back to an unexplained fortune in a high-risk jurisdiction (failing source of wealth). Firms increasingly ask for tax returns, business sale contracts, or probate documents, not just bank statements.

3. Conflict of interest searches

This is not primarily an AML control, but it is a financial risk control: a firm that acts for two clients on opposite sides of a deal, or against a former client using confidential information, exposes itself to negligence claims, disgorged fees, and reputational damage. Firms run new-matter names through a conflicts database covering all current and historical clients firm-wide, often before the partner is even allowed to quote a fee. In cross-border M&A, this check alone can take longer than the AML file.

Where the money actually gets stopped: a worked walk-through

Take the property purchase from the opening scene.

1. Client take-on: SRA rules require ID verification (passport, proof of address) before work begins. Cost of getting this wrong: SRA fines against firms have run into the hundreds of thousands of pounds in recent enforcement actions (estimate, based on published SRA disciplinary outcomes, see SRA's published decisions).
2. Beneficial ownership trace: the BVI company's register isn't public. The firm must obtain certified ownership documents and, often, use a corporate services provider to confirm the ultimate individual.
3. Source of funds request: the client provides a wire confirmation. Compliance asks for the underlying sale contract of the asset that generated the cash. It doesn't match the wire amount by roughly 40%. Question raised, not yet resolved.
4. PEP screening: an automated screening tool (commercial platforms like those from LexisNexis or Refinitiv World-Check are commonly used) flags a name match against a foreign politically exposed person. Manual review determines it's a false positive, different person, same common name.
5. Decision point: with the source-of-funds discrepancy unresolved, the Money Laundering Reporting Officer (MLRO), a mandatory role at UK regulated firms, files a Suspicious Activity Report (SAR) with the UK's National Crime Agency (NCA) and the firm declines to act until the discrepancy is explained, or declines the client entirely.

This is the pattern in real life: it's rarely a dramatic "we caught a criminal" moment. It's a mismatched number that never gets satisfactorily explained, and a firm choosing the fee it walks away from over the fine, or criminal liability, it risks keeping.

The financial risk to the firm itself

Beyond fines, three financial risks sit behind every weak check:

• Regulatory fines: SRA and equivalent bodies can fine firms and individual solicitors; in the EU, AMLA-coordinated penalties are expected to harmonize and, in some cases, raise maximum fines as the new regime beds in through 2026.
• Uninsurable losses: professional indemnity insurance often excludes claims arising from knowing or reckless AML breaches, meaning the firm, not the insurer, absorbs the loss.
• Partner personal liability: MLROs and partners can face personal criminal liability under UK law (the Proceeds of Crime Act 2002) for failing to report suspicions, separate from any firm-level fine.

A simple way to see the economics: if a firm takes on ten clients like the one above per year at an average fee of £50,000, and enhanced checks cost roughly £2,000-£5,000 per file in compliance staff time and third-party screening tools (estimate, varies significantly by firm size and jurisdiction), that's £20,000-£50,000 in direct cost against £500,000 in fee revenue, a cost firms accept precisely because a single AML failure can wipe out far more than that in fines and reputational damage.

Key Takeaways

• Law firms sit inside AML regulation (MLR 2017 in the UK, BSA/CTACTAEin Button, Link oder eine Botschaft, die Nutzer zu einer bestimmten Handlung auffordert: registrieren, kaufen, herunterladen oder mehr erfahren.Vollständige Definition ansehen → in the US, 6AMLD/AMLA in the EU) because client accounts and entity structuring are attractive laundering tools.
• The three checks that most often stop or flag deals are beneficial ownership verification, source of funds/wealth checks, and conflict of interest searches, the last being a financial and reputational risk control, not just an AML one.
• Enhanced Due Diligence for PEPs and mismatched source-of-funds documentation are the most common real-world reasons files stall before an engagement letter is signed.
• The financial logic for firms is asymmetric: modest compliance costs per file are cheap insurance against fines, uninsurable losses, and personal liability for partners and MLROs.
• Expect convergence and tightening through 2026 as the EU's AMLA and the US's beneficial ownership regime under FinCEN mature, narrowing the historical gaps launderers have used across jurisdictions.