Anti-money laundering rules and the client due diligence law firms must run

A conveyancing partner in London gets a call: a new client wants to buy a £4 million flat, in cash, closing in ten days. Before 2003, the firm would have opened the file and started drafting. Today, that partner cannot touch the matter until someone runs client due diligence (CDD), the process of verifying a client's identity and the source of their funds. If the checks aren't done, the firm risks criminal liability, not just a bad client. This is what it means for law firms to be "gatekeepers": AML law now makes lawyers part of the state's financial crime detection apparatus, whether they like it or not.

Why lawyers became AML gatekeepers

Money laundering is the process of disguising illegally obtained money as legitimate. Criminals need professionals (lawyers, accountants, bankers) to move money through trusts, property purchases, and corporate structures. Regulators realized that banks alone couldn't catch this, because by the time money reaches a bank, it may already look clean.

Law firms sit at the exact points where dirty money gets laundered: buying real estate, forming companies, setting up trusts, moving funds through client accounts. So global AML frameworks pulled lawyers into the regulated sector.

The two anchor regimes every professional should know:

• FATF (Financial Action Task Force): the intergovernmental body that sets global AML standards through 40 Recommendations. It doesn't have direct enforcement power, but it names countries with weak controls ("grey list" and "blacklist"), which pressures national governments to legislate. FATF's guidance defines "Designated Non-Financial Businesses and Professions" (DNFBPs), a category that explicitly includes lawyers and notaries doing certain work. FATF's official recommendations are the reference text.
• EU Anti-Money Laundering Directives (AMLD): the EU has issued six directives since 1991, progressively tightening rules. The 4th and 5th AMLD brought lawyers firmly into scope for specified activities; the 6th expanded criminal liability. From 2027, a new EU AML regulation and a dedicated authority, AMLA (Anti-Money Laundering Authority), based in Frankfurt, will directly supervise higher-risk entities across the bloc, marking a shift from directive-based (national implementation) to regulation-based (directly binding) enforcement.

In the US, the relevant law is the Bank Secrecy Act (BSA), enforced by FinCEN (Financial Crimes Enforcement Network), a bureau of the US Treasury. Notably, US law firms have historically had lighter direct AML obligations than their UK/EU counterparts, though this is changing: FinCEN's 2024 rule on real estate and its ongoing work on a "gatekeeper rule" for lawyers and other professionals signals convergence with European standards. As of early 2026, proposed rules extending BSA-style obligations to certain legal services remain under Treasury review, professionals should treat this as a live regulatory area, not settled law.

In the UK, the relevant instrument is the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (MLRs), supervised for law firms by the Solicitors Regulation Authority (SRA) and the Legal Sector Affinity Group (LSAG), which issues sector guidance.

What CDD actually requires in practice

"Client due diligence" is not a single form. It's a layered process:

1. Identify the client. For an individual: passport or government ID, proof of address (utility bill, bank statement) dated within a set window (commonly three months). For a company: certificate of incorporation, register of directors, and crucially, the beneficial owner, the natural person who ultimately owns or controls the entity (typically defined as owning 25%+ of shares or voting rights).

2. Verify, don't just collect. Firms must independently confirm the documents are genuine, often using electronic verification tools that cross-check ID against government or credit databases. Simply photocopying a passport is not verification.

3. Establish source of funds and source of wealth. Source of funds asks: where is the money for *this transaction* coming from (sale of another property, inheritance, loan)? Source of wealth asks a broader question: how did this client accumulate their overall wealth? A client buying a £4 million flat with cash and no plausible income history should trigger deeper inquiry, not a shrug.

4. Risk-rate the client and matter. Firms apply Simplified Due Diligence (SDD) for low-risk situations (e.g., a listed company as client), standard CDD for typical matters, and Enhanced Due Diligence (EDD) for high-risk indicators: politically exposed persons (PEPs, meaning holders of prominent public functions and their close associates), clients from FATF-flagged jurisdictions, complex ownership structures, or unusual transaction patterns.

5. Ongoing monitoring. CDD isn't a one-time gate. Firms must monitor the relationship for the life of the matter and flag inconsistencies, like a client whose transaction suddenly doesn't match their stated business purpose.

The activities that trigger AML obligations

Not all legal work is in scope. Under UK/EU rules, obligations generally attach to what's called "regulated activity," including:

• Real estate transactions
• Company formation and management
• Managing client money, securities, or other assets
• Setting up or managing trusts
• Certain tax advisory work

Pure litigation advice is typically outside scope, unless it involves handling funds, since AML frameworks target *transactional* work where money physically moves.

Reporting: SARs and the tension with privilege

When a lawyer suspects money laundering, most regimes require filing a Suspicious Activity Report (SAR), in the UK to the National Crime Agency (NCA), in the US to FinCEN. Filing a SAR often means the firm cannot proceed with the transaction without consent from the authority (in the UK, this is a "Defence Against Money Laundering," DAML request).

This creates real tension with legal professional privilege (attorney-client privilege in the US), the principle protecting confidential legal advice from disclosure. AML law generally does not override privilege for genuine legal advice, but it does override client confidentiality for facts learned during transactional work that aren't privileged communications. Getting this line wrong is a recurring source of professional negligence claims and regulatory sanctions against firms.

Penalties and what's actually at stake

Failures are not hypothetical. UK solicitors have faced SRA fines and Solicitors Disciplinary Tribunal strike-offs for inadequate CDD on property deals. EU regulators have fined notary and law firms for onboarding shell companies without verifying beneficial ownership. Individual compliance officers, not just firms, can face personal liability: many regimes require firms to appoint a Money Laundering Reporting Officer (MLRO), who carries direct accountability for the firm's AML program and can be personally sanctioned.

The cost calculus is simple: a firm with poor CDD risks regulatory fines, reputational collapse (being named as the law firm that laundered a sanctioned oligarch's money is existential), and in serious cases, criminal prosecution for the firm and individual lawyers under money laundering offenses that don't require proving the lawyer *intended* to launder money, only that they failed to make required checks or ignored red flags.

🎬 [VIDEO: "What is Money Laundering and How Does AML Work?" — youtube.com/results?search_query=what+is+money+laundering+aml+explained — a primer on the mechanics of laundering and why regulated professionals sit at the chokepoints]

Key Takeaways

• AML law makes law firms "gatekeepers": lawyers doing transactional work (real estate, company formation, trusts, client money) are legally required to run client due diligence before and during a matter, not just banks.
• The core global standard-setter is FATF; in the EU, AMLD (moving to a directly-binding regulation and the new AMLA authority from 2027) governs; in the UK, the MLRs 2017 supervised by the SRA apply; in the US, FinCEN under the Bank Secrecy Act is extending obligations to legal services, though the rules are still evolving as of 2026.
• CDD means verified identity, beneficial ownership disclosure, and documented source of funds/wealth, scaled up to Enhanced Due Diligence for PEPs and high-risk jurisdictions.
• Suspicion of laundering generally triggers a mandatory Suspicious Activity Report, which can legally require pausing the transaction, creating real friction with client confidentiality (though not with genuine legal advice privilege).
• Non-compliance carries personal liability for lawyers and MLROs, not just firm-level fines, making AML process design a top-tier risk management priority, not a paperwork afterthought.