Beyond the recap: three things worth talking about after the Economic Crime Conference

Eloise Butterworth · 23 September 2026 · a four-minute read

There's no shortage of LinkedIn posts this week recapping the Law Society's Economic Crime Conference. Good ones, too, so I won't add to the pile. What I want to do instead is pull on three threads that came up in the room but haven't had much airtime since.

Your policies aren't the problem. Your controls are.

According to the update given by the SRA on the day, half of all SRA involvement following an AML audit or a raised concern traces back to control failures - not inadequate policies, not poorly drafted processes. Processes that simply weren't followed and nobody picked up on it.

That distinction matters - as you are obligated under the Money Laundering Regulations to ensure your policies, controls and procedures are effective, not simply that they are in place. A control failure is a different animal to a policy gap, and it gets a different kind of attention. Policies and processes are the plan. Controls are the proof the plan actually happened and an alert system if it didn't. Financial services have been building control libraries for years precisely because "we have a policy for that" was never going to be a good enough answer to a regulator. Legal is only starting to catch up - with the focus in recent years very much on policies and risk assessments.

That has a direct implication for how you think about your own governance functions. Your file reviews, your AML audits, the checks you run as a matter of course - these should be controls, not adjacent to them. What we heard from the regulator at the conference suggests that in a lot of firms, they aren't functioning that way. If your file review can't tell you whether your policy is actually being followed, it isn't doing its job as a control - it's simply a compliance tick-box exercise.

Privilege and AML reporting

Legal professional privilege (LPP), ethics and AML reporting - never an easy conversation to have. Legal professional privilege is of course a hot topic, following this week's High Court judgment in Carter-Ruck Solicitors and another v Solicitors Regulation Authority [2026] EWHC 2416 (KB). That decision related to SRA investigations - Mr Justice Butcher held that section 44B of the Solicitors Act 1974 doesn't give the SRA the power to compel disclosure of material protected by a client's unwaived legal professional privilege.

At the conference we were tackling another similarly thorny issue around legal professional privilege: what do you actually do when LPP and your AML obligations pull in opposite directions?

The honest answer is that there often isn't a clean one. A quick answer is usually required. A right answer isn't always available. There is a lot to juggle. You've got the common law principle of LPP as well as the Proceeds of Crime Act's "privileged circumstances". That's two separate considerations, not one. Confidential doesn't mean privileged - another common oversight. And then there is the iniquity exception - a high bar - but the question still has to be asked and worked through before you can reach any conclusion.

Nor should the basics get lost in the complexity: are you operating in the regulated sector, do you actually have a suspicion, and is the casual-sounding question you're about to be asked really a formal disclosure in disguise?

As with everything in this space, showing your working is what protects you.

And privilege applying doesn't mean you're free to carry on. You can end up genuinely stuck: unable to disclose because of LPP, but unable to secure a defence against money laundering to proceed - which leaves ceasing to act as your only real option.

One AML framework doesn't survive contact with two jurisdictions

The third thread spilt over from the session aimed at international firms to the coffee break and post-conference drinks: firms with multi-jurisdictional offices, sitting across different AML regimes, trying to meet all of them at once.

The instinct for many firms is to build a checklist and run it everywhere. It doesn't hold up, however, where you are a multi-jurisdictional firm. What holds up is a framework robust enough to be defensible - one where what you obtained, or chose not to obtain (equally important), and why, is the thing that survives scrutiny, not whether every box got ticked. Multi-jurisdictional firms need more tolerance built into that framework, and their AML architecture and tech support will - and should - look materially different from a firm operating solely under the UK Money Laundering Regulations.

Passporting risk between jurisdictions remains a genuine tension, and ongoing monitoring controls need more creativity to stay effective across borders than within one. The arrival of the EU's new AML regulations applying from July 2027 was a live topic in the breakout conversations, and some tech providers have already done useful mapping work showing where firms will need to focus planning and scrutiny. If you'd like pointers to any of that, get in touch and I'll point you in the right direction.

Before we wrap up - two dates for the diary

The SRA's annual AML report and its annual thematic review - this year on the disconnect between policies, controls and procedures and what happens on the ground - are both due out in October, with a webinar on each scheduled for 19 October. Given everything above, I'd firmly recommend registering for both.

As with all things risk, the nuance is where the real conversation lives - and the depth of expertise on display at this year's Economic Crime Conference was, once again, unrivalled.