[Research] What risk leaders at the UK’s largest law firms are thinking about EU AMLR 2027

First AML surveyed 60 senior risk professionals at the top 160 UK law firms, including 44 from Top 50 firms. Most plan to apply the higher standard globally. Making it work across the firm will be harder.

Large UK law firms have spent decades, sometimes centuries, becoming international businesses. Their clients, matters and lawyers move readily across borders. Their compliance obligations remain stubbornly local.

The gap will widen when the EU’s Anti-Money Laundering Regulation (AMLR) applies from July 2027. European offices will face more prescriptive requirements in areas including beneficial ownership, enhanced due diligence, and source of funds and source of wealth. 

While each establishment must follow the rules where it operates, AMLR also requires group-wide risk assessments, policies, controls and information sharing. EU-headed groups may need to extend equivalent standards to branches and subsidiaries in countries with less stringent rules, including Britain. Some networks and partnerships may face similar requirements where management or compliance is shared.

The result is an awkward combination of local accountability and group-wide consistency. For some firms, a higher group standard will be partly a legal requirement. Others will adopt one to avoid running separate compliance systems across an otherwise global business.

72% intend to apply a higher standard globally, accepting a degree of over-compliance in the UK.

First AML surveyed 60 senior risk professionals at leading UK law firms to understand how they plan to respond. Some 72% intend to apply the higher standard globally, accepting a degree of over-compliance in the UK. Another 15% expect to decide case by case. Only 13% plan to maintain separate UK and EU compliance flows. None are still deciding.

A common standard is easier to govern, train and audit. It also reduces the number of jurisdictional decisions a firm must make as a matter develops. A transaction may be opened in London, staffed in Paris and involve a company controlled elsewhere. The applicable AML regime depends on which establishment is performing the regulated work, not the client’s nationality or where the matter began.

Separate processes therefore require reliable matter routing. The firm must know which entity accepted the engagement, which offices are involved and when that involvement changes the applicable requirements. Applying the higher standard globally may avoid some of this complexity, but on the flip side, may also mean collecting more information from more clients, including where local law might not otherwise demand it.

57% expect source of funds and source of wealth  as the area of UK–EU divergence most likely to cause their firm pain.

Respondents expect source of funds and source of wealth to be the main pressure point, with 57% identifying it as the area of UK–EU divergence most likely to cause their firm pain. The next largest concern, high-risk third countries, was selected by 18%.

More than half expect friction when explaining why information is required. Some 43% anticipate problems obtaining source of funds or source of wealth evidence, while 40% expect difficulties involving cross-border clients and foreign documents.

A firm may apply an EU-level requirement in London, leaving its British clients facing requests that another adviser does not make. The choice that creates consistency inside the firm can create different expectations from one adviser to the next.

Entity and beneficial ownership complexity is expected to be the most common CDD challenge, cited by 48% of respondents.

Entity and beneficial ownership complexity is expected to be the most common CDD challenge, cited by 48% of respondents. Cross-border verification concerned 42%, while 40% pointed to the difficulty of resourcing CDD at the scale of a large firm.

When asked to choose the single technological capability that would have the greatest impact, 38% selected beneficial-ownership and entity mapping. Better sharing of previously collected CDD information came second at 18%.

The two are closely connected. Firms need to understand how companies, trusts and individuals relate to one another, as well as what has already been established, by which office and to what standard.

AMLR permits an EU office to rely on CDD performed elsewhere, including within their group. Responsibility remains with the office relying on it. It must be able to obtain the underlying information, determine whether it meets the applicable standard and collect anything missing.

Many firms hold that information across intake, document, matter-management and finance systems. Ownership structures may sit in PDFs attached to individual matters. Evidence and risk decisions are difficult to reuse when they cannot be retrieved elsewhere in the firm.

Almost every respondent believed better technology could improve compliance culture and the adoption of new regulation.

Almost every respondent believed better technology could improve compliance culture and the adoption of new regulation. Implementation is the constraint. Procurement and security reviews were cited by 57% of respondents. Half pointed to integration with existing systems, and the same proportion cited the time needed to evaluate and implement technology. Budget concerned only 17%.

Most large firms have chosen one higher standard. Their remaining problem is making client data, evidence and decisions travel far enough across the firm to support it.