Automated KYC for Law Firms: Client Onboarding and AML Compliance

In 2024, the SRA (Solicitors Regulation Authority) identified a compliance rate below 40% in firms with fewer than 20 solicitors on their AML/CTF obligations. The SRA and HMRC have intensified inspections: 127 firms were subject to targeted reviews in 2024-2025, resulting in 34 formal warnings and 8 disciplinary sanctions. The problem is not ignorance of obligations — solicitors know the regulatory framework — but the lack of tools adapted to the dual constraint of KYC and legal professional privilege.

This article is for informational purposes only and does not constitute legal, financial or regulatory advice.

KYC obligations specific to law firms

Solicitors are subject to AML/CTF obligations for certain activities only. This limited scope, often poorly understood, is the primary source of compliance failures.

The regulatory framework in 2026

Three layers of legislation overlap:

• European level: the AMLR regulation (2024/1624), directly applicable from July 2027, and the AMLD6 directive (2024/1640) governing supervision. AMLA (the European Anti-Money Laundering Authority) in Frankfurt sets technical standards that national bodies must integrate.
• UK level: the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017), as amended, transpose EU directives into UK law. The Proceeds of Crime Act 2002 provides the criminal framework.
• Professional level: SRA guidance on AML compliance, updated in 2025 to integrate AMLD6 developments, and the SRA Codes of Conduct which set out practical requirements.

For an in-depth analysis of the implications of AMLD6 for obliged entities, consult our dedicated guide.

When the duty of vigilance applies

Solicitors are not subject to KYC for all their activities. The scope is strictly defined:

The distinction is binary: either the activity falls within AML/CTF scope and KYC applies, or it falls under pure advisory and litigation, where legal professional privilege prevails entirely.

Concrete due diligence measures

When the activity is in scope, the solicitor must:

1. Identify the client — natural person (name, date of birth, address, nationality) or legal entity (name, legal form, registered office, company number)
2. Identify the beneficial owner — any person holding more than 25% of capital or voting rights (threshold lowered to 15% for high-risk entities under AMLR)
3. Verify on documentary evidence — valid identity document, Companies House certificate, articles of association, PSC register
4. Assess the risk — risk-based approach: client profile, nature of the transaction, country of origin, structural complexity
5. Report suspicion — file a SAR (Suspicious Activity Report) with the NCA (National Crime Agency) via the firm's MLRO (Money Laundering Reporting Officer)
6. Retain documents — 5 years after the end of the business relationship (Regulation 40, MLR 2017)

For obligations specific to AML reporting, consult our article on KYC for lawyers and AML obligations.

The unique challenge: KYC without compromising legal professional privilege

The legal profession is the only one that must reconcile document verification obligations with legal professional privilege of public order. This tension is not merely a theoretical debate: it determines the technical architecture of any KYC solution deployed in a firm.

The boundaries of privilege in KYC matters

Legal professional privilege (LPP) protects the entirety of solicitor-client communications. But this protection does not cover data collected under KYC obligations. The compartmentalisation is strict:

• Protected: the nature of the case, legal strategy, consultations, correspondence
• Not protected under KYC: the client's identity, identification documents, the verification result
• Grey area: the transaction purpose (required for KYC, but may reveal the client's strategy)

Implications for choosing a KYC tool

These constraints impose specific technical requirements on any document verification tool deployed in a firm:

• Data compartmentalisation: KYC data must be physically separated from case files — distinct databases, differentiated access controls
• End-to-end encryption: identification documents must only be accessible to authorised persons (partner in charge of the matter, firm compliance officer)
• Sovereign hosting: data must remain in the UK or EU to satisfy SRA recommendations
• No sharing with third parties without consent: unlike banks, solicitors cannot share verification results with other obliged entities
• Non-intrusive logging: the audit trail must prove the verification was conducted without revealing case content

Essential features of a KYC solution for law firms

Client identification and document verification

The technical foundation reprises KYC fundamentals, adapted to the legal context:

To understand the stakes of PEP screening, consult our dedicated guide to politically exposed persons.

Beneficial ownership identification (UBO)

Beneficial ownership identification is the main friction point for solicitors. Complex estate structures — cascading holding companies, offshore trusts, nominee arrangements — require investigative work that consumer-facing tools do not cover.

A suitable solution must:

• Automatically reconstruct the ownership chain from articles of association and public registers (PSC register, Companies House)
• Calculate direct and indirect holdings to determine whether the 25% threshold is met
• Identify non-capital control mechanisms (shareholder agreements, multiple voting rights)
• Flag opaque structures requiring enhanced due diligence

Risk scoring adapted to the profession

A law firm's risk matrix differs fundamentally from a bank's. Profession-specific risk factors:

• Transaction type: a business acquisition presents an inherently higher risk than a residential lease
• Jurisdiction: transactions involving high-risk countries (FATF list)
• Client profile: PEPs, entities with opaque structures, high-net-worth clients
• Amount: different thresholds according to the nature of the transaction
• History: new client vs existing client with a compliance track record

Audit trail and retention

The tool must produce a complete compliance file per client, exportable during an SRA or HMRC inspection, containing:

• The date of establishing the relationship
• Documents collected and verification results
• The risk score and justification
• Any enhanced due diligence measures applied
• Periodic updates (frequency according to risk level)

Comparison of solutions adapted to the legal sector

The market for KYC solutions for law firms is narrower than for the banking sector. Few platforms natively integrate data compartmentalisation and the MLRO reporting mechanism.

Finding: solutions born in the financial sector (Onfido, ComplyAdvantage) offer powerful screening engines but do not manage solicitor-client compartmentalisation or SAR workflows via the MLRO. Solutions dedicated to the legal sector cover these needs but may lack depth on advanced document verification.

Typical workflow: from first contact to ongoing monitoring

Step 1: transaction qualification

Before any data collection, the solicitor determines whether the transaction falls within AML/CTF scope. This step is decisive: a KYC check launched unnecessarily on a litigation matter wastes time and collects personal data without a legal basis.

The ideal tool offers a qualification questionnaire in 3 to 5 questions that automatically routes to the correct workflow:

• Pure litigation → no KYC, archive the qualification questionnaire
• Transaction in scope → launch the full KYC workflow
• Grey area → alert for human decision by the partner

Step 2: secure document collection

The client receives a secure link (dedicated portal or encrypted email) to upload their identification documents. The portal must be sober, reassuring and explain the purpose of the collection (AML/CTF obligation, not solicitor curiosity).

Documents collected:

• Natural person: identity document, proof of address
• Legal entity: Companies House certificate < 3 months, up-to-date articles, PSC register confirmation, representative's ID
• High-risk transaction: source of funds declaration, supplementary evidence

Step 3: automated verification

The tool conducts verifications without human intervention:

1. OCR extraction of identity data
2. Cross-referencing with official databases (Companies House, PSC register)
3. PEP and sanctions screening
4. Risk score calculation
5. Verification report generation

Step 4: validation and engagement

The partner in charge reviews the report and validates the client engagement. In case of high risk, they apply enhanced due diligence measures (additional documents, second partner approval, SAR if suspicious).

Step 5: ongoing monitoring

KYC does not stop at engagement. The platform must:

• Reassess the risk score on trigger events (director change, sanctions list addition, ownership structure change)
• Trigger periodic review (annual for high-risk clients, every 3 years for standard risk)
• Alert on document expiry (identity documents, Companies House certificates)

ROI for a firm of 10 to 50 solicitors

The cost of non-compliance

Sanctions for AML/CTF failings are not theoretical. The SRA can impose:

• A written rebuke
• A fine (up to £25,000 for individuals, unlimited for firms)
• Conditions on the practising certificate
• Suspension or strike-off from the roll

Beyond disciplinary sanctions, the maximum fine under the MLR 2017 is unlimited for serious breaches. For a 20-solicitor firm with £3.4 million turnover, even a moderate fine represents a significant proportion of revenue — without counting reputational damage.

Quantifiable automation gains

ROI calculation for a 20-solicitor firm

Assumptions: 300 new matters/year within AML/CTF scope, average hourly rate £210.

• Annual manual cost: 300 matters × 1h × £210 = £63,000 in solicitor time
• Annual automated cost: platform subscription (£3,000) + residual time (300 × 0.15h × £210 = £9,450) = £12,450
• Annual saving: £50,550
• ROI: positive from month 2

The main gain is not financial: it is peace of mind during an SRA or HMRC inspection, and the certainty that every matter is documented.

Frequently asked questions

Does the KYC tool access the content of the firm's legal files?

No. A correctly architected solution never touches the case file. It operates in a separate silo containing only client identification data and verification results. The compartmentalisation must be physical (distinct databases, separate servers if necessary), not merely logical. This is a knockout criterion during selection.

Does legal professional privilege prevent a solicitor from making a SAR?

No, but the mechanism differs from banks. The solicitor files the SAR with the NCA via their firm's MLRO. For pure litigation activity, no report is required or possible — legal professional privilege is absolute.

Do you need to conduct KYC for every new matter from an existing client?

No, provided the identification elements remain current. The initial KYC remains valid as long as documents have not expired and no trigger event necessitates a reassessment. However, each new transaction within AML/CTF scope must be subject to a transaction-specific risk assessment.

What is the document retention period for a solicitor's KYC records?

5 years after the end of the business relationship, in accordance with Regulation 40 of the MLR 2017. The "end of the business relationship" corresponds to the closure of the last active matter, not the last transaction within AML/CTF scope.

Can a firm share KYC tools with other firms?

Technically yes, but with precautions. Verification data from Firm A's client must never be accessible to Firm B, even if the client is shared. Shared hosting (same infrastructure) is acceptable if logical and physical compartmentalisation is guaranteed. LLP structures and law firm groups can share subscriptions provided access rights are strictly separated by entity.

Does AMLD6 change KYC obligations for solicitors?

The AMLR regulation (2024/1624), applicable from July 2027, harmonises obligations at the European level without national transposition. For solicitors, the main changes are: the UBO threshold lowered to 15% for high-risk entities, enhanced due diligence obligations for cross-border transactions, and extension of the monitoring scope to crypto assets. The MLRO reporting mechanism is preserved.

How long does deployment take?

For a firm of 10 to 50 solicitors, deployment takes 2 to 4 weeks: 1 week for configuration (risk matrix, workflows), 1 week for team training, 1 to 2 weeks of parallel operation (old and new process). Integration with practice management software (LEAP, Clio, PracticeEvolve) is via REST API.

---

This article is for informational purposes only and does not constitute legal, financial or regulatory advice.

For further reading, consult our article on automating KYC and legal professional privilege for law firms and our guide to document verification by industry.