(0)20 3051 2049
AML Audit and Certification Under Regulation 21
Examine | Evaluate | Refine | Recommend
Legal Eye provides independent AML audits for law firms, examining whether your anti-money laundering and counter-terrorist financing policies, controls and procedures (PCPs) are adequate and effective. Our audit identifies compliance gaps, tests how your controls operate in practice and provides clear, practical recommendations for improvement.
Following the audit, your firm will receive a detailed report and, where the relevant criteria are met, Legal Eye AML Audit Certification.
Request an AML audit consultation
Does your law firm need an independent AML audit?
- Under Regulation 21 of the Money Laundering Regulations 2017, a firm must establish an independent audit function where appropriate, having regard to the size and nature of its business.
- The audit should examine and evaluate the adequacy and effectiveness of the firm’s AML policies, controls and procedures and make recommendations for improvement.
- Firms should take a risk-based approach and record how they have determined whether an independent audit function is appropriate. Legal Eye can help firms assess their position and carry out an independent review where required.
Why AML audits matter
The SRA continues to identify significant weaknesses in firms’ AML controls. In its SRA AML Annual Report 2024/25, the regulator reported that 32.4% of firms receiving a proactive AML inspection or desk-based review were assessed as not compliant.
Firms should also consider the risks identified in the SRA’s current Sectoral Risk Assessment when reviewing their own AML arrangements and risk exposure.
An independent AML audit can help identify gaps between written procedures and day-to-day practice before they develop into more serious regulatory issues.
What will your firm receive?
Following the audit, your firm will receive a report evaluating whether its AML policies, controls and procedures are adequate and operating effectively.
The report will identify areas of non-compliance, explain the associated risks and set out practical recommendations and corrective actions. Where the certification criteria are met, Legal Eye will issue an AML Audit Certificate. What does the independent AML audit include?
Clear findings and practical recommendations
The audit evaluates whether your firm’s AML policies, controls and procedures are appropriate to its risk profile and whether they are working effectively in practice.
We identify areas of non-compliance with the Money Laundering Regulations 2017 or the firm’s own procedures and provide specific, practical recommendations for improvement. Any necessary corrective actions are clearly explained and prioritised.
AML audit certification and recertification
Where the certification criteria are met, the Legal Eye AML Audit Certificate is issued for one year.
Following the initial audit, Legal Eye carries out a remote recertification review in year two and biennially thereafter. The review considers the firm’s progress, any changes to its risk profile and whether its AML controls continue to operate effectively.
Staff interviews and file reviews
Staff interviews and file reviews help us establish whether the firm’s written AML procedures are understood and followed in practice. Depending on the agreed scope, the recertification review may include:
• Interviews with selected members of staff
• Reviews of selected client and matter files
• A review meeting with the firm’s MLRO or MLCO
Once completed and independently confirmed by Legal Eye – your AML Audit Certificate will be issued.
Why choose Legal Eye for your independent AML audit?
Frequently Asked Questions
What does the independent AML audit include?
Legal Eye will examine and evaluate the adequacy and effectiveness of the firm’s anti-money laundering and counter-terrorist financing policies, controls and procedures (PCPs) and provide recommendations for improvement.
The audit report can then be used as a monitoring tool to track the firm’s progress against the recommendations made.
How long does the independent AML audit take?
A minimum of two and a half days is required to complete the audit.
What happens if corrective actions are identified during the audit?
If corrective actions are required, the firm will have 28 days to complete them. Legal Eye can provide a separate quotation to carry out the work needed to resolve the corrective actions.
Alternatively, the firm may complete the corrective actions internally. Legal Eye will then review the completed work and, if the required criteria are met, issue an AML Audit Certificate.
How long is AML certification valid?
The AML Audit Certificate is valid for one year, subject to the firm continuing to meet the required criteria.
Following the initial AML audit in year one, Legal Eye will carry out a recertification review in year two and every two years thereafter. The review is completed remotely and takes approximately half a day.
What will my firm receive following the audit?
Following successful completion of the audit, your firm will receive an AML Audit Certificate and will be able to use the Legal Eye AML Accreditation logo. Please refer to the logo usage guidelines for further information.
What is not included in the audit?
The SRA Accounts Rules and a Technical Legal Review do not form part of the AML audit and certification.
What criteria must be met for recertification?
The certificate is valid for one year, subject to the firm continuing to meet the following criteria:
- The firm has adopted any relevant changes to AML regulations.
- The firm has not merged with or acquired another practice.
- There have been no significant changes to the scope of the firm’s legal services, such as a substantial increase in the conveyancing team, the introduction of new legal services or the use of new delivery channels.
- The firm’s regular file reviews have identified no significant AML compliance failures. Failure to undertake regular file reviews may invalidate the AML Audit Certificate.
- AML training is up to date for all relevant members of staff.
- The firm’s Regulation 18 firm-wide risk assessment is up to date.
- No material corrective actions remain outstanding following the review.
