Regulatory Overload: Keeping Up with AML Changes Without Losing the Plot
If there’s one thing you can count on in the world of AML, it’s change. And not the calm, predictable kind, more like the “is that another update already?” kind.
Honestly, the struggle is real. I see it time and time again in the law firms I support, keeping pace with AML updates is a genuine challenge. You finally get your AML policies in shape, your risk assessments reviewed, your staff trained and then boom, a new piece of guidance lands in your inbox and it’s back to the drawing board.
April’s Legal Sector Affinity Group guidance update is a perfect example. For those of you who might have missed it (it’s easy to do!), the LSAG finally got Treasury approval for its updated AML guidance, (a link to the full guidance can be found here). This update provides further clarity on areas firms have historically found tricky, such as source of funds, identifying and verifying beneficial owners and supply chain risk.
Another area that quietly changes more often than people realise is the High Risk Third Countries (HRTCs) list. The UK maintains its own list, however it mirrors the work of the Financial Action Task Force (FATF). But here’s the bit many firms miss: FATF holds three plenaries a year, and those sessions usually lead to updates in the list of jurisdictions under increased monitoring (the “grey list”) and high-risk jurisdictions (the “black list”). Once FATF publishes its findings, the UK’s HRTC list automatically updates to reflect those changes.
If you don’t have a process in place to track those changes, you could easily miss when a client’s country suddenly jumps from low to high risk and that has knock-on effects for your client due diligence, risk assessments, and enhanced due diligence (EDD) procedures.
It’s a lot to stay on top of, especially for smaller firms without the luxury of in-house compliance teams. But here’s the thing, the regulators don’t really care how big (or small) your firm is. They expect you to know the rules, apply them properly, and keep up with the changes.
I get it, it’s exhausting. The sheer volume of updates, the complexity of cross-border expectations, and the way different regulatory bodies interpret risk, it’s enough to make anyone’s head spin. But we have to keep going, because this isn’t just about ticking a box. It’s about protecting the integrity of the legal profession and ensuring our services aren’t misused.
So, what can you do to stay ahead?
Make regular guidance reviews a habit
Even scanning your regulator or FATF’s website once a month can help you catch key updates early.
Schedule policy and FWRA reviews
Don’t wait until your regulator’s knocking. Treat AML policy and PWRA reviews as a rolling process not a once-every-three-years panic. And if something changes before your next scheduled review? Update your policy as soon as possible. Don’t hang around waiting for a diary date.
Keep a look out for FATF’s plenaries
They take place every February, June, and October and often lead to changes in the UK’s High-Risk Third Countries (HRTC) list. If a country moves onto the list, that triggers enhanced due diligence. So don’t miss them, build these dates into your compliance routine.
Lean on tech
Let’s be honest, keeping on top of every update, EDD trigger and policy amendment manually isn’t scalable. Platforms like Binderr are built with law firms in mind, automating workflows, flagging changes and storing key client data securely in one place. It won’t replace your judgment, but it’ll give you back the headspace to use it.
Sign up to sector newsletters
Subscribe to updates from those known for keeping on top of AML developments (and no, not just me, though I’m always happy to share!).
Make the most of LinkedIn
It’s not just for job hunting. It’s a goldmine for AML content, commentary, and reminders about guidance changes.
Join webinars
There are plenty of brilliant free ones out there, often hosted by regulators, consultants, or legal networks. A great way to keep learning and stay connected.
Invest in meaningful training
Not just the “read this policy and sign here” sort of training. Training should be engaging, practical, and reflect the real risks your team faces.
AML compliance isn’t a “set it and forget it” task. It’s a living, breathing part of your firm’s risk framework. The trick is to keep it manageable, make it practical and yes, even a little bit fun where you can.