Supervision up again, compliance genuinely improved, referrals down, fines up, and the same four failures still topping the referral list. Today’s webinar figures, annotated, with the report-only numbers marked TBC.
Distilled and annotated by Eloise Butterworth, FCILEX
SHOWING: THE 2025-26 REPORT · PUBLISHED 22 OCTOBER 2026
The SRA presented this data at its webinar on 19 October; the written report published on 22 October 2026. I have reconciled every figure on this page against it: the webinar numbers all held, and the gaps the webinar left are now filled below. For last year’s full picture, the 2024-25 edition is here.
of assessments concluded fully compliant (206 of 937), up from 13.4% last year
£2.6m
in fines across 165 firms
336
referrals for investigation, down from 426
6,592
client files read, up from 5,873
Source: the SRA’s Anti-Money Laundering Annual Report 2025-26, published 22 October 2026, covering 6 April 2025 to 5 April 2026. The compliance table counts the 937 inspections and desk-based reviews with a compliance outcome; the SRA also reviewed 26 firms’ independent audits and ran 19 thematic engagements within its 985 proactive engagements.
Compliance actually improved, with a caveat worth having
CompliantPartially compliantNot compliant
206
525
206
Fully compliant outcomes went from 13.4% to 22.0% (206 of 937 assessments this year), and not compliant fell from 32.4% to 21.9%, the report’s own headline. One comparability note: last year counted firms, this year’s table counts assessments, and a firm checked twice appears twice, so compare the two with a pinch of salt; the direction is unambiguous, and the SRA said so plainly. Real movement, in the right direction. My caveat from the room: the yardstick has moved too. The regulator’s idea of what good looks like has sharpened considerably in recent years, from good policies to effective ones, so year-on-year comparisons are not quite like-for-like, and the improvement is probably slightly better than the numbers demonstrate.
2024-25
47%
→
2025-26
60%
Firm-wide risk assessments rated compliant
2024-25
38%
→
2025-26
54%
Policies, controls and procedures rated compliant
The report’s FWRA detail: of 931 risk assessments reviewed, 560 were compliant, 304 partially and 67 not; six firms had no FWRA at all, nine years into the requirement, and were referred. The themes behind the failures are unchanged: transaction risk unassessed (378 pieces of feedback), services misdescribed (365), templates not tailored. New this year: only 83% of firms could show a documented proliferation financing risk assessment, mandatory since April 2023.
Supervision rose again, and the question mark gets its answer
966 proactive engagements: a smaller jump than last year’s leap, but the sixth consecutive rise and well past a near-quadrupling in six years. And it lands on a shrinking target: the population of firms in scope of the regulations fell again, to 5,422. More scrutiny, fewer firms to spread it across: the odds of a visit have never been shorter.
The regulator looks more than three times harder than it did five years ago.
Referrals fell, and the rate fell further
336 firms referred for investigation, down from 426. Set it against the extra supervision and the real story is sharper: referrals per engagement fell from 0.49 to 0.35. More looking, fewer findings per look. That is what a sector improving under scrutiny looks like, and the SRA said as much.
256
Enforcement outcomes nearly doubled again, from 137 to 256, and fines reached £2.6m: 145 regulatory settlement agreements totalling £2,003,759, 14 SRA-adjudicated fines totalling £363,726, and six fines at the Solicitors Disciplinary Tribunal totalling £228,000, with 90 letters of advice, 5 warnings and 2 rebukes alongside. No contradiction with falling referrals: the report says it plainly, outcomes reflect when investigations conclude, not when conduct occurred, so this year’s penalties are largely earlier years’ record caseload clearing the pipeline. Expect elevated fines for at least another year before the calmer referral numbers reach them.
Why firms get referred: the same four reasons, again
The most common reasons, as presented. If these look familiar, that is the point: the sector has been having this same conversation for years.
No client or matter risk assessment
115
No source of funds check
111
Inadequate or ineffective PCPs
83
Inadequate firm-wide risk assessment
76
What the files said
9%
of files lacked a client and matter risk assessment or held an incomplete one, improved from 16%. Four firms had no CMRA process at all, and 42% of referrals trace to CMRA failures.
10%
of files had a risk rating the SRA disagreed with, against 5% rated too low last year (the measures are worded differently, the direction is the same). Fewer missing assessments, more arguments about the ones that exist: the scrutiny is moving from existence to judgement.
18%
of files held source of funds information nobody had scrutinised. Exactly the same figure as last year. Collecting is still not checking.
9%
of files requiring source of funds checks contained none (of 6,592 files read, 5,349 required them), barely moved from 10%, and 29% of referrals related to source of funds. The detail that stings: 67% of those firms had a defined process. The documents exist; the desk is not following them.
36%
of firms carrying out internal file reviews still ignore source of funds within them, a year after the SRA flagged precisely this. The regulator is pointing a big red hand at where to look, and the data says firms are not looking: what your file reviews are quietly missing, still.
20%
of files contained no evidence of PEP screening, and 21% no evidence of sanctions screening. These two are new in this year’s report, and they are tomorrow’s referral categories arriving on schedule: write them down now.
5%
of files had no evidence the client was identified and verified (336 of 6,592). The strongest-performing control in the set, and the report credits system-led stops that block work until CDD is done.
The SRA reviewed 260 SARs from 128 firms and rated the quality generally good. It also submitted 24 SARs of its own, exceeding £102m in suspected value, up again in number. My read: when the regulator keeps finding suspicion the firms themselves did not report, the sector is not reliably recognising when a suspicion arises. Two misconceptions do a lot of that damage, and both are wrong: ceasing to act does not remove the obligation to report, and work outside the scope of the money laundering regulations can still require a SAR. The SRA’s own submissions this year included out-of-scope work, which rather proves the point.
Independent audits: the finding holds
The report covers independent audits in two places, and both moved. Across the general population, checked at inspection: 63% of firms had carried out an independent audit, up from 48% last year, and 18% of those audits were not compliant with Regulation 21, down from 32%, still mostly for the same reason, reviewing the policies without testing any files. The SRA’s words: it observed higher compliance among firms that had undertaken a compliant audit. Separately, its cyclical review of 26 of the largest firms found all 26 with an audit process, 24 audited within two years, and nine referred onward because their own audits had surfaced weaknesses, which is the regulator treating an audit that finds things as the system working. Audits are mainstreaming, and the gap is now quality, not existence. Do you actually need one? →
Also presented, deliberately not covered here
The report carries a substantial financial sanctions section: 949 proactive sanctions engagements across the whole regulated population, compliance described as strong overall, and one line that earns its own headline: cases of failure to comply with sanctions regimes tripled this year. Sanctions is a separate regime with its own rules and its own failure modes, so that story gets its own piece, coming shortly, rather than a footnote here.
The five-year view, as a white paper
This page is one year. The pattern is five. Five years of SRA AML supervision, 2021-22 to 2025-26 lines up the regulator’s own numbers across the window: supervision more than tripled, enforcement outcomes up sixfold, and the compliance dip that turned into a recovery. Free, no form, no email gate. Download the white paper (PDF) →
Reconciled against the published report, 22 October 2026. If this year’s numbers made you want to check your own, that conversation costs nothing. Let’s talk.
Get in touch
Let's talk about where you're trying to get to.
No pitch, no jargon, nothing open-ended. Email eloise@itsallthingsrisk.com, find All Things Risk on LinkedIn, or start with a fifteen-minute call.
