There’s been a lot written about the FCA taking over AML supervision from the SRA, and most of it ends in the same place.
Review your governance. Map your AML responsibilities. Make sure you can evidence that your controls work, not just that you have a policy saying they should.
That’s sound advice.
But I’ve spent ten years placing risk and compliance professionals into UK law firms, and when I look at this change, I don’t just see a regulatory problem. I see a people problem.
Some roles are going to change. A few responsibilities will become proper jobs where they’re currently bolted onto someone else’s role. And if several thousand firms reach the same conclusion at roughly the same time, the hiring market gets tight very quickly.
That’s the part of this change I think firms need to start thinking about now.
What we know
- The FCA will become the Single Professional Services Supervisor for anti-money laundering and counter-terrorist financing.
- The change replaces the current model of professional body supervisors, including the SRA.
- Around 6,500 SRA-regulated firms sit within the scope of the Money Laundering Regulations.
- The FCA’s AML-supervised population is expected to increase from roughly 17,000 firms to more than 60,000.
- HM Treasury published its response to the powers consultation in June 2026; the enabling clauses sit in a Bill introduced in May.
What isn’t decided yet
- There is no confirmed transfer date.
- Implementation still requires the relevant legislation, funding and a transition plan.
- The exact treatment of MLRO and MLCO roles, including any FCA approval requirements, has not been decided.
- The detail of how existing SRA AML registrations will transfer is not yet finalised.
The timeline most coverage gets wrong
This is not happening next year.
Implementation needs primary legislation to pass, funding to be confirmed and a transition plan to be agreed. Commencement is tied to the availability of parliamentary time.
The current expectation is that legislation is unlikely to complete before late 2026, with the transfer not expected to start before 2028 and then being phased over the following two to three years. A lot of people in the sector are working to a 2029 assumption.
So there is time.
But I think firms can make two mistakes here. Panic and spend money before they need to; or do nothing because the change feels years away.
The second is the bigger risk.
The danger isn’t that firms have three years to prepare. It’s that thousands of firms think they have three years to prepare, then all start hiring for the same skills at roughly the same time.
That’s when a manageable hiring problem becomes a difficult one.
You’ll have two regulators, not one
The reform doesn’t consolidate regulation for law firms. It splits it.
The FCA takes AML and CTF. The SRA keeps conduct, client money, practising certificates and everything else. Firms within scope of the Money Laundering Regulations will therefore be dealing with both.
That matters from a people perspective.
Somebody in your firm has to own the relationship with the FCA. They will need to field information requests, respond to thematic work and understand what a more data-led supervisory relationship looks like.
Nobody in a law firm risk team has done that exact job before, because it hasn’t existed.
The guidance around mapping responsibilities across the MLRO, MLCO, COLP and COFA is therefore more than a governance exercise. It’s job design.
If you map the responsibilities properly, you may find that your existing job descriptions don’t actually describe the function you will need.
From guidance-led to evidence-led
The FCA’s supervisory approach is more risk-based, data-led and evidence-focused.
That means firms are likely to need more capability around proactive data provision, documented decision-making and evidence that controls have actually operated over time.
Someone has to produce the management information. Someone has to test whether controls are working. Someone has to maintain an audit trail that stands up when a supervisor used to looking at banks and insurers comes and looks at you.
In a lot of mid-market firms, those things aren’t defined roles. They’re things a stretched Head of Risk picks up alongside everything else.
That’s a headcount gap, not a policy gap.
What changes role by role
AML Analyst
Client due diligence, source of funds and source of wealth work becomes more than a task that closes a file. The evidence needs to stand up later.
The quality bar is likely to rise, and the changes to the Money Laundering Regulations in June 2026 put more emphasis on the firm’s own risk assessment. That means you need AML analysts who can reason and make judgements, not just complete a checklist.
AML Manager
This is the layer I think firms should pay particular attention to.
Control testing, quality assurance and management information all need an owner. In some firms that capability exists already; in others it is spread across several people.
If I had to pick the role most likely to become harder to hire for, this would be near the top of my list.
MLRO
This is where things get particularly interesting.
One of the biggest open questions is whether MLRO and MLCO roles in law firms will require FCA approval, or be treated as something closer to a senior management function. That hasn’t been decided.
If the answer goes that way, the hiring implications are significant. Approval before appointment could add time to hiring processes. Fit and proper requirements could increase the scrutiny on candidates. And greater personal exposure could change the conversation candidates have about taking the role in the first place.
There’s another question firms need to ask themselves now: is the MLRO actually a standalone role, or is it a responsibility bolted onto a partner, COLP or someone with an already full-time job?
From what I see, only around 20% are standalone. The rest sit with a partner alongside a full-time job.
Personal liability has been part of that conversation for years. Senior financial crime candidates are often reluctant to take the title, because the extra risk and responsibility rarely comes with anything that makes it worth taking on. I’ve seen a Director of Risk on £150,000 offered £160,000 to pick up MLRO. They said no and told the firm to leave it where it was.
Where the MLRO sits with a managing partner earning several times that, the personal exposure doesn’t land the same way. That’s part of why the arrangement has held for so long.
COLP and COFA
These responsibilities stay with the SRA, but they will sit alongside an FCA-supervised AML function. The boundary between those responsibilities needs to be clear and documented.
Someone will also need to own the interface between the two regulatory environments. That is a new competency and there isn’t an established pool of people who have already done exactly that job.
Business Acceptance and Conflicts
Client and matter risk assessment is central to the AML framework, and business acceptance has already been moving from an administrative function towards a genuine risk function.
I think this change accelerates that trend.
If the process becomes more important to demonstrating that the firm’s controls work, it becomes harder to justify staffing it at a purely administrative level. The same applies to conflicts.
I’m not seeing that in pay yet. Business acceptance salaries have been climbing steadily, but that’s the wider market rather than anything to do with the FCA. Most firms haven’t changed what they pay, or the profile of person they’re hiring, because most firms haven’t started acting on this at all.
That’s the bit I’d watch. When it does land, I’d expect a scramble for the same people.
Risk Lawyer and Head of Risk
Regulatory relationship management becomes a more valuable skill.
Managing the SRA is a known quantity for established law firm risk teams. Managing the SRA while building a relationship with the FCA is different.
That experience will become increasingly valuable, particularly at senior level, and it changes what a risk lawyer career looks like from here.
Risk and Compliance Manager and Director of Risk
The senior team will have greater accountability for demonstrating that the AML programme actually works.
This is also where financial services experience becomes more interesting. Someone who has spent years working inside an FCA-supervised environment suddenly has experience that is much more directly relevant to the firm’s future supervisory relationship.
What this means for the hiring market
The FCA change could redefine what ‘relevant experience’ means
I’ve said before that firms can get too hung up on direct law firm experience.
In practice we place almost nobody from financial services into a law firm. It isn’t that the candidates are weak. It’s that the answer is usually a hard no before anyone has read the CV properly. Financial services AML gets treated as too narrow to transfer.
Where firms have flexed is real estate. We’ve placed several people from that background into law firm risk and compliance teams and they’ve picked it up quickly and done well. The objection was the same one, and it didn’t hold.
This reform makes the financial services argument harder to wave away. If your supervisor is the FCA, people who have spent their careers being supervised by the FCA start to look relevant in a way they didn’t before.
That doesn’t mean law firm experience stops mattering. There are obvious differences between the sectors. But ‘must have law firm experience’ becomes a filter firms need to justify rather than assume, and the ones who keep it will be fishing in a much smaller pond.
When does the hiring pressure actually start?
This is the question I’m most interested in.
It isn’t in client briefs yet. Plenty of hiring managers raise it in conversation, but none of them have changed what they are actually recruiting for.
There are two reasons for that. There’s still no clarity on exactly what is happening or when. And BAU teams are stretched, so firms are hiring for the pressure they have now rather than the supervisor they will have later. In practice that means law firm experience, quickly.
When legislation progresses and firms have greater clarity, several thousand businesses could start looking for the same fairly small group of people who can evidence AML controls, manage assurance and operate confidently in a more data-led supervisory environment.
That’s when I would expect the market to move.
And I’d expect the manager, MLRO and assurance end of the market to move first because those are the roles with the most obvious capability gap.
What could happen to salaries?
The simple answer is supply and demand.
Our salary benchmarks already show a meaningful spread across the legal risk and compliance market. The current guide puts Compliance Manager roles at £60,000–£101,000 in London and £48,000–£81,000 across regional UK; Senior Compliance Manager roles at £72,500–£117,000 in London and £57,500–£93,500 regionally. Risk and senior leadership roles sit higher again.
I wouldn’t try to predict exactly where salaries will land after the transfer. But if several thousand firms start competing for a small group of people with AML management, assurance and supervisory experience, I would expect those roles to move first.
That’s another reason to think about the structure of the team before the market gets busy, rather than trying to react to it afterwards.
What I’d do with the runway
I’m not saying firms need to start hiring an entire new AML team tomorrow.
I’d do four things instead.
- Work out who owns the FCA relationship. Not because the transfer is imminent, but because it is better to know now than discover the gap during implementation.
- Build the assurance layer ahead of need. An AML manager or control-testing role is useful under the current SRA model too, so this isn’t a hire that only makes sense if the timetable stays on track.
- Be honest about the MLRO arrangement. If it’s a bolt-on to someone’s day job, think about whether that remains sensible as the supervisory environment changes.
- Don’t rebuild your AML programme unnecessarily. The supervisory transfer changes who supervises compliance and how; it doesn’t mean a good existing programme suddenly becomes a bad one.
If I were prioritising one hire out of all of this, it would be the assurance layer.
I’d start looking in the next twelve months rather than the next three years.
It’s the role with the smallest candidate pool and potentially the longest lead time. More importantly, it’s useful whether the legislation lands exactly when expected or takes longer.
The firms that prepare well won’t necessarily have the biggest teams
They’ll be the firms that work out which responsibilities need to become proper jobs before they become regulatory problems.
That’s the bit I think is easy to miss in all the coverage of the FCA takeover.
This isn’t just a change to who supervises AML. It’s potentially a change to how law firms structure, recruit and value their risk and compliance teams. You can see how those roles connect in our legal risk and compliance career pathways.
And if you’re waiting until the transfer is imminent to work that out, you may find everyone else is looking for the same people at the same time.
We work exclusively in legal risk and compliance recruitment for UK law firms. If you’re working out what your risk function needs to look like on the other side of this, give me a shout.
Frequently asked questions
When will the FCA take over AML supervision from the SRA?
There is no confirmed date. The transfer requires primary legislation, funding and an agreed transition plan, with commencement dependent on parliamentary time. The current expectation is that the transfer will not begin before 2028 and will then be phased over the following two to three years. Much of the sector is working to a 2029 assumption.
Will law firms be regulated by both the FCA and the SRA?
Yes. The FCA will take AML and counter-terrorist financing supervision. The SRA will retain conduct, client money, practising certificates and its other existing responsibilities. Firms within scope of the Money Laundering Regulations will therefore answer to both.
Does this change the Money Laundering Regulations?
The supervisory transfer does not itself change the firm’s underlying obligations under the Money Laundering Regulations. What changes is who supervises compliance and the approach to supervision. The MLR changes made in June 2026 are a separate development.
Will MLROs need FCA approval?
Not decided. Whether MLRO and MLCO roles in law firms require FCA authorisation or are treated as senior management functions remains an open question. The final position will have a material impact on how firms structure and recruit for these roles.
Should we be hiring for this now?
Not urgently because the transfer is still several years away. There is, however, a case for building capability ahead of the change. AML management, control testing and assurance are useful under the current SRA model too, and hiring before the market tightens could give firms more choice.
What happens to our SRA AML registration?
Firms carrying out MLR-regulated activity will need to register with the FCA. The detail of how existing approvals will be recognised or transferred is not yet finalised. Treasury has said it wants to minimise duplication.
