Mastering the FCA AML Audit: Is Your Law Firm Ready?

The regulator is changing — the rules are not.

That distinction is being missed by many law firms as AML supervision moves from the SRA to the Financial Conduct Authority. While the shift toward an FCA AML audit regime feels significant, the underlying legal obligations remain firmly rooted in the existing Money Laundering Regulations.

The government’s consultation response makes this clear. Firms that are already compliant should not need to rebuild their AML frameworks from scratch. For those with strong, risk-based controls, the priority is refinement and assurance — not reinvention. Firms that prepare early will enter a future FCA AML audit from a position of control rather than reaction.

Why an FCA AML Audit Will Feel Different

Although the regulations stay the same, supervision will not. The SRA’s approach has traditionally emphasised professional standards and remediation. The FCA, by contrast, operates an evidence-led, enforcement-capable model designed to deter financial crime.

An FCA AML audit will focus on whether a firm presents a money laundering risk and what proportionate supervisory or enforcement action is justified. That shift matters. Internal reviews alone will no longer be enough. An independent challenge is expected.

For most law firms, a Regulation 21 independent AML audit is the most effective way to meet this expectation. It provides credible assurance without the disruption,or reputational risk, of learning through regulatory intervention.

The Preparation Window Law Firms Should Use

This transition will not happen overnight. The consultation on supervisory powers is expected in November 2025, with the FCA transition plan likely to follow in 2026. A phased implementation period is expected after that.

This creates a valuable window. Firms can strengthen documentation, evidence how controls operate in practice, and test their frameworks independently. Conducting a Regulation 21 independent AML audit now allows gaps to be identified and addressed discreetly, ensuring firms are ready when FCA AML audit scrutiny begins.

What a Single FCA AML Audit Regime Changes

Today, AML supervision is fragmented across more than 20 professional bodies. This has led to inconsistent enforcement and unclear expectations. Moving to a single FCA AML audit framework introduces greater consistency and clarity.

A consolidated model brings:

• Clearer and more consistent supervisory expectations
• Defined accountability at senior management level
• More efficient and predictable oversight

Three Practical Steps to Prepare for an FCA AML Audit

1. Strengthen Data and Evidence

An FCA AML audit is evidence-driven. AML policies alone are not enough. Firms must show how controls operate day-to-day. This is the moment to modernise record-keeping, improve management information and data quality, and ensure audit trails are clear and accessible..

2. Re-test Client Matter Risk Assessments

Client Matter Risk assessments sit at the core of AML compliance and will be central to any FCA AML audit. They must be data-led, current, and clearly linked to client due diligence and ongoing monitoring. A Regulation 21 independent AML audit is the most reliable way to confirm that these assessments genuinely drive the firm’s AML framework.

3. Prepare for Targeted Supervision

The FCA applies supervision proportionately. Higher-risk areas especially property, international work, and trust structures. Larger firms should review governance and senior oversight arrangements now..

Anticipated Timeline

• November 2025: Consultation on FCA supervisory powers
• 2026: Publication of the FCA transition plan
• Post-2026: Phased implementation and transfer of supervision

What This Means for Law Firms

The move toward FCA oversight reflects a broader trend: more transparent, data-driven, and enforceable AML supervision. Firms that invest early in governance, evidence, and independent assurance will be best placed to adapt.

Commissioning a Regulation 21 independent AML audit is one of the most effective steps a law firm can take now. It delivers regulatory assurance with minimal disruption and positions the firm confidently for FCA AML audit expectations.

Lexsure supports law firms in England and Wales with AML risk assessment tools and audit-ready reporting designed to withstand FCA AML audit scrutiny. Contact us to learn how to use this transition period to your advantage.