Supplier and customer compliance for law firms: what to check and what a mistake costs

Law firms are gatekeepers. They set up companies, move money through client accounts, act on property and corporate transactions and advise people with significant assets. That role is why anti-money laundering and sanctions rules apply directly to many legal services, and why regulators have stepped up enforcement against firms of every size, from local practices to global names.

Why law firms are exposed

Client money. Firms that hold and transfer client funds can be used to move the proceeds of crime or to pay sanctioned persons, even unintentionally.

High-value transactions. Conveyancing, M&A, trusts and company formation are recognised money laundering risk areas.

Complex ownership. Clients often act through holding companies, trusts and foreign vehicles, which can conceal the real owner.

Fast-moving sanctions. Since 2022, many wealthy individuals and companies have been designated. Existing clients can become sanctioned in the middle of a matter.

What to check

Sanctions lists (EU, US, UK, UN)

Screen every client, counterparty and payee against the UK OFSI consolidated list, the EU consolidated list, the US OFAC lists and the UN list. Check again before every payment out of the client account, and apply ownership and control rules to corporate clients.

Politically exposed persons (PEPs)

Money laundering regulations require enhanced due diligence on PEPs, their family members and known close associates, including scrutiny of the source of funds and source of wealth.

Insolvency

Clients and counterparties in insolvency proceedings raise fee recovery risk and may signal transactions at undervalue. Suppliers such as experts and agents should also be monitored.

Adverse media and legal proceedings

Reports of fraud, corruption, money laundering or regulatory action against a client should trigger a review of the relationship and the matter.

Beneficial owners

Identify and verify the individuals who ultimately own or control each corporate or trust client. This is a core requirement of client due diligence, not an optional step.

Real cases: what a mistake cost

Herbert Smith Freehills Moscow: GBP 465,000 (OFSI, 2025)

In March 2025 HM Treasury's Office of Financial Sanctions Implementation (OFSI) announced a GBP 465,000 penalty against Herbert Smith Freehills CIS LLP, the Moscow entity of an international law firm. OFSI found that it made six payments, worth a total of about GBP 3.9 million, to designated persons subject to an asset freeze under UK Russia sanctions. The penalty notice cited inadequate due diligence and sanctions screening, and errors made during the rapid closure of the Moscow office. A voluntary disclosure earned a 50% reduction.

Sources: UK government press release and OFSI penalty notice, 20 March 2025

Tolhurst Fisher LLP: GBP 120,000 (Solicitors Disciplinary Tribunal, 2025)

In April 2025 the Solicitors Disciplinary Tribunal approved an agreed outcome ordering Tolhurst Fisher LLP, a firm based in Southend-on-Sea, to pay a fine of GBP 120,000. The allegations brought by the Solicitors Regulation Authority included breaches of the Money Laundering Regulations and of the SRA's codes of conduct and principles.

Sources: SDT case 12720 and SRA register entry

These cases show that both sanctions authorities and professional regulators now treat screening and client due diligence failures as serious matters, whatever the size of the firm.

Practical checklist

• Screen every client and counterparty at intake, before work begins.
• Screen every payee before any payment out of the client account.
• Re-screen the full client base daily against UK, EU, US and UN lists.
• Identify and verify beneficial owners of corporate and trust clients.
• Identify PEPs and apply enhanced due diligence on source of funds and wealth.
• Keep a firm-wide risk assessment and matter risk assessments up to date.
• Monitor adverse media and proceedings for existing clients.
• Check the insolvency status of clients, counterparties and key suppliers.
• Have a clear process for stopping work and payments when a match appears.
• Record every check and decision so you can show it to a regulator.

How to automate it

Client bases change, and so do the lists. Unicorn Intelligence runs automatic, daily compliance checks on all your clients and suppliers: sanctions, PEPs, insolvency, adverse media and proceedings, and beneficial owners, with alerts delivered straight into your CRM.

The test is free, and new accounts also get 50 $ of credit.

Informative content: decisions and legal obligations remain yours.