SystemLaw Firm Risk, Intake & Compliance

Law Firm AML Risk Assessment

A law firm AML risk assessment that counts each risk factor from the firm's open matters, cites the passage behind each rating and leaves the decision to the reporting officer.

Watch it work Book a walkthrough

Open the register and follow one recount ↓

Watch with transcript →

The problem

The assessment is last year's document with this year's date on it

Each spring the reporting officer's team pulls reports from the practice system, rereads the regulators' guidance and retypes last year's Word document. Nobody counts how many matters now involve overseas money, politically exposed clients or high-risk countries, so the ratings sit where they sat.

When the firm's work changes, the assessment trails behind. A new office opens under a new regime with no program written for it. Meanwhile a closed service keeps its procedure in the manual, and a regulator reading the file at its desk finds specimen text where the firm should be. That finding lands on the officer who signed it.

Built forReporting officersCompliance officersGeneral counselRisk analysts

The Problem Today

Most firms copy last year's risk assessment forward, so the ratings never move when the work does.

4 in 10: firm-wide assessments one regulator reviewed fell short published
6 weeks: of the reporting officer's evenings for each refresh our estimate

Retyped from scratch each year

Reports
Guidance
Ratings
Policies

Counts nobody takesOverseas money and listed countries never recounted
A new office, no programA new regime arrives with nothing written for it

The Solution

Exposure countedEach risk factor the rules name, counted from the firm's open matters
Each rating citedA rating rests on a quoted regulator passage and the matters behind it
A moved rating, a new redlineWhen a count crosses its threshold, the policy section is redrafted
Reporting officer signsThe compliance officer reviews the redline; the reporting officer signs

Built-in controls

Each rating decided by a named officer
Agents read matter fields, not privileged files
The firm's matter data trains no model

What You Get

The firm hands its regulator an assessment it can trace to real matters, and each office meets its own rules.

Program gaps, owned and datedEach office checked against its own rules before they start
Recounted when the work changesA factor that moves is recounted before the next review
One page for the partnersWhat changed and why, with the sign-off chain on file

Nine screens, one assessment

The law firm AML risk assessment, counted from 6,840 open matters

Nine parts of the assessment year on their own screens: the steps behind each, and whose problem it takes off the desk.

01Risk register
A law firm AML risk assessment kept as a register of counted factors
How it works
- 23 factors sit in the five categories the rules name: services, clients, countries, delivery channels, transactions
- Each row reads its exposure from matters, such as 1,184 matters, 96 with money from overseas, 41 cash buyers
- The change since last year, the regulator's view and the proposed rating sit beside it
Money laundering reporting officerOpens the assessment on what the firm's open matters show today, with the one stale count flagged before she rates anything.
02Countries recount
A recount that rebuilds a stale factor from each matter's countries
How it works
- 28 matters opened since the last count touch a listed country, so the row reads count due
- The recount reads the client, payer and counterparty countries on all 2,841 in-scope matters
- It matches them against the high-risk country lists and counts 47 matters in 9 countries
- Only then does it propose a rating: 1.7% against the firm's 1% threshold
Risk analystNo report pulled from the practice system and pasted into a spreadsheet. The count is rebuilt from matter fields, and the list of matters stays behind it.
03Proposed rating
A proposed rating that shows its arithmetic and waits for the officer
How it works
- 47 of 2,841 in-scope matters is 1.7%, over the firm's 1% threshold
- Last year's count was 19 of 2,853, or 0.7%
- The scale moves from medium to high, and the row reads your decision
- She accepts or overrides; an override needs her reason in writing
Money laundering reporting officerDecides each rating on a count she can defend, and an override carries her reason into the assessment and the trail.
04Matters behind the count
The matters behind a count, split by office and by service
How it works
- Count over in-scope matters gives the share, beside the regulator's view and the proposal
- By office the split is 29 and 18; residential conveyancing leads the services with 17
- Each matter is listed with its client, service, office, list and opening month
- 31 enhanced checks are complete and 16 are due for refresh
Money laundering reporting officerCan say which matters drive a rating, one by one, when the partners or a reviewer ask what the number stands for.
05Regulator sources
A quoted regulator passage behind each rating, opened from its row
How it works
- Nine sources, from the money laundering rules to sector risk assessments and the international lists
- The passage is quoted as published and never passed off as the firm's own view
- The firm's own evidence sits beside it: 38 internal suspicion reports, 9 external, 52 open exceptions
Risk analystStops rereading the regulators' guidance each year to find the line a rating rests on, because the citation opens it.
06Ratings history
Three years of ratings side by side, each move with its reason
How it works
- 2024, 2025 and 2026 ratings for each factor, as H, M and L
- Company formation reads service closed, 64 to 11 matters
- High-risk countries reads 19 to 47 matters against a 1% threshold
General counselShows the partners how the firm's risk has moved over three years without opening three Word documents.
07Policy redline
The policy section a moved rating touches, redrafted in tracked changes
How it works
- Enhanced checks for high-risk countries: approval by the matter partner and the reporting officer
- Source of wealth added for each client and payer, and review every 6 months instead of 12
- Company formation retired, its 11 legacy matters reviewed once a year until closed
- Each redline states why: the rating rose on 47 matters, 1.7% of in-scope work
Compliance officer for legal practiceSees which procedure moves with each rating, in tracked changes, before anything reaches the general counsel for approval.
08Program gaps
Each office checked against its own rules, every gap owned and dated
How it works
- The first office's program checks clean; the second shows 5 gaps under its new regime
- 386 of the second office's 1,121 matters are designated services
- Each gap carries the rule, the evidence, an owner and a due date
- A runway plots each due date against the partners' meeting and the day obligations start
Practice managerKnows what the anti-money laundering and counter-terrorism financing (AML/CTF) program still lacks, who writes each part and by when, before the office becomes a reporting entity.
09Annual pack
A partners' pack that opens on what changed and why
How it works
- Assembled from the register into 14 pages; page 1 names the two ratings that moved and why
- Sign-off checks show what is done and what still waits for review
- The reporting officer signs, and the general counsel approves before the partners see it
General counselTakes one page of what changed and why into the partners' meeting, with the sign-off chain on file behind it.

Around the register

Third-party payers, a quoted passage and the trail behind each count

More of what the officer, the analyst and the office owners open during the refresh.

Risk register filtered to services, residential conveyancing selected with its exposure, regulator view, control and an unchanged high rating — **Services, each on its own count**Residential conveyancing stays high on 1,184 matters, 96 with money from overseas and 41 cash buyers, against a regulator view of high.

Transactions factors in the register, payments from third parties selected at 61 matters, up 13, rated high and unchanged — **Third-party payments, still high**Payments from third parties rose from 48 to 61 matters. The rating stays high, and its control, third-party payer checks, needs no change.

Sector risk assessment passage opened over the register from a row's citation, listing the factors it is used for and who checked the mapping — **The passage, one click from the row**A row's citation opens its passage, the factors that passage supports, and who mapped and checked it.

Program gap cards with the suspicious matter reporting gap marked drafted: an internal report route with a privilege check, owner and due date shown — **A gap drafted for its owner**For the suspicious matter reporting gap, the drafter adds a route for internal reports with a privilege check before any report. Its owner approves before it is adopted.

Audit trail of 14 entries, agent recounts, proposals and redrafts beside the analyst's draft and last year's signatures, each with time and screen — **Agents and people, apart in the trail**14 entries: counts, proposals and redrafts by agents, preparation and decisions by people. Kept 5 years with the assessment; nobody can edit an entry.

Settings with each office's regime, the refresh cycle, roles that may view, and the measures and thresholds that turn six factors high — **Thresholds the firm sets**Each factor's measure and when it turns high: over 1% of in-scope matters for countries, over 50 matters for third-party payments, always for politically exposed clients.

Two of 23 ratings moved this year, and each moved on a count

Five factors from the register, last year's count beside this year's.

Factor	Last year	This year	What the count shows
High-risk third countries	Medium, 19 matters	High, 47 matters	1.7% of in-scope matters, over the 1% threshold
Company formation and registered office	Medium, 64 matters	Low, 11 matters	Service closed; legacy files only
Payments from third parties	High, 48 matters	High, 61 matters	Still high; payer checks unchanged
Clients never met in person	Medium, 2,014 matters	Medium, 2,236 matters	Electronic ID with liveness on each
Open due-diligence exceptions	Medium, 71 matters	Medium, 52 matters	Fewer, with each matter frozen at 30 days

What it reads

Matter fields, the client ledger and the suspicion log, counted

The records the counts come from, each read for fields and totals.

Practice system matter fieldsService, office, the countries of clients, payers and counterparties, and how each client was onboarded.

Client intake and identity checksPolitically exposed clients, ownership layers and checks still open past their deadline.

Client account ledgerLarge receipts, payers who are not the client, and settlements paid through client account.

Sanctions screening resultsMatters touching sanctions-linked jurisdictions, and whether each screened clear.

Suspicion report logCounts of internal and external reports only; their contents stay with the reporting officer.

Regulator and government publicationsSector risk assessments, the money laundering rules and the international country lists, quoted and linked.

Who prepares

Agents count, cite and redraft; the signature stays with the officer

What each prepares for the officer, and the step it is barred from taking.

Matter profiler

Counts each factor's exposure from matter, client and ledger fields, and keeps the list of matters behind each number.

Never reads privileged documents
Never rates

Regulator mapper

Maps each factor to the passages that speak to it, and checks the sources for updates.

Quotes and links; never speaks for a regulator

Rating agent

Proposes each rating from the regulator's view, the count against the firm's threshold and the control in place.

Never sets a final rating

Gap finder

Checks the program against the rules in force for each office and lists each gap with its rule.

Never declares the firm compliant

Policy drafter

Redrafts the section a changed rating touches, and drafts a program section for each open gap.

Never publishes a policy

Pack agent

Assembles the partners' pack from the register, page by page.

Never sends the pack
Never edits a signed rating

Questions a reporting officer raises before signing the assessment

What is a law firm AML risk assessment?

A law firm AML risk assessment is the firm's written record of how exposed it is to money laundering and terrorist financing through its services, clients, countries, delivery channels and transactions. This solution counts each factor from the firm's own matters, cites the passage behind each rating, and leaves each rating to the reporting officer.

Can it replace our firm-wide risk assessment template?

The register holds the factors a template lists, but each row carries a count drawn from the firm's matters and the passage behind its rating. The next refresh starts from this year's counts.

Does it read privileged documents?

No. The agents read matter fields: the service, the office, the countries of clients, payers and counterparties, and how a client was onboarded. Suspicion reports are counted, and their contents stay with the reporting officer.

What happens when a rating moves during the year?

The firm decides when a factor is recounted early: when its count moves sharply, or when a regulator updates its view. The proposed rating goes to the reporting officer, and the policy section it touches is redrafted for the compliance officer's review.

How does it handle an office that practices under a different regime?

Each office is checked against the rules in force where it practices. Each gap is listed with its rule, its evidence, an owner and a due date, and the policy drafter can prepare the program section for its owner to approve.

Who signs the assessment?

The reporting officer accepts or overrides each rating and signs. Policy changes are reviewed by the compliance officer for legal practice and approved for the partners by the general counsel. An analyst prepares the draft and holds no signature.

Law Firm Risk, Intake & Compliance