The SRA assessed 833 firms last year. Only 13.5% were fully compliant. Your firm-wide risk assessment is the first thing they check.
MLR 2017 Regulation 18 requires every in-scope firm to maintain a written firm-wide risk assessment. The SRA's 2024-25 AML Annual Report found that only 47% of firms were compliant with FWRA requirements, 44% were partially compliant, and 9% were non-compliant. Missing or inadequate firm-wide risk assessments accounted for 122 of the reported deficiencies. The FWRA must contain: all legal services offered with individual AML risk assessment, service delivery methods, detailed client profile information, transaction data, jurisdictional risk analysis, and integration with the SRA's sectoral risk assessment. Most small firms use generic templates that don't match their actual practice profile — which the SRA specifically flags as deficient. Your agent drafts a practice-specific FWRA from your firm data, maps it to the SRA's risk factors, and flags when it needs updating.
What Your Agent Actually Does
Your agent drafts a practice-specific firm-wide risk assessment from your actual firm data — not a generic template the SRA will flag as deficient.
Drafts from your actual practice profile
Your practice areas, client demographics, jurisdictions you deal with, transaction types and values, delivery methods (in-person vs remote) — your agent builds the FWRA from your real practice data, not from a one-size-fits-all template. The SRA specifically flags generic templates as deficient.
Maps to SRA sectoral risk factors
The SRA publishes a sectoral risk assessment identifying high-risk activities (property, trust, company/commercial). Your agent maps your services against these risk categories and ensures your FWRA addresses each one that applies to your practice.
Integrates LSAG guidance
The Legal Sector Affinity Group guidance (updated April 2025, approved by HM Treasury) is the authoritative AML guidance for solicitors. Your agent ensures your FWRA references current LSAG guidance and incorporates its risk indicators.
Flags when updates are needed
New practice area opened? FATF updated the high-risk country list? SRA published new guidance? Your agent monitors for changes that require a FWRA update and drafts the amendments — ensuring your risk assessment is always current, not a document that was comprehensive when written and hasn't been touched since.
Produces SRA inspection-ready evidence
When the SRA conducts a proactive engagement — 935 last year, a 72% increase — your FWRA is the first document they request. Your agent ensures it's current, comprehensive, and ready to present, with version history showing regular review.
The real numbers.
| AML compliance consultant (annual review and update) | £1,500–£3,000 |
| COLP time drafting and maintaining FWRA | £500–£1,500/year |
| SRA enforcement risk (fine if non-compliant) | Variable (£658–£114,000+) |
| Realistic annual cost | £2,000–£5,000 |
| Agent build (one-off, configured to your practice profile) | £2,000–£3,500 |
| Monthly running costs (hosting + AI usage) | £60–£120/month |
| LSAG and SRA guidance updates | Included in first year |
| Realistic first-year total | £2,720–£4,940 |
The firm-wide risk assessment is the foundation of your AML compliance — and the SRA's 2024-25 data shows it's where most firms fail first. 53% of firms had FWRAs that were either partially compliant or non-compliant.
The problem isn't that COLPs don't understand the requirement; it's that drafting a genuinely practice-specific risk assessment that meets the SRA's expectations requires time that fee-earning COLPs don't have. Your agent does the heavy lifting; your COLP applies the professional judgement.
Good fit / not a fit.
This works brilliantly for:
- Firms within scope of MLR 2017 (conveyancing, probate, company/commercial, trust work)
- COLPs who know their FWRA is generic, outdated, or incomplete
- Firms that have not updated their FWRA since the April 2025 LSAG guidance changes
- Sole practitioners and small firms without dedicated compliance staff
This probably isn't for you if:
- You retain a specialist AML compliance consultant who maintains your FWRA
- Your firm does not fall within scope of MLR 2017
- You have a recently completed, practice-specific FWRA you're confident in
Let's talk.
We'll start with your practice areas, whether you have a current FWRA, and when it was last reviewed. Usually a 15-minute conversation.
hello@nimblecroft.com