16 minutes read
Most advice about law firm compliance requirements starts with a checklist. That's the problem. A checklist can tell you to review access permissions, reconcile trust accounts, and train staff. It won't tell you whether a remote paralegal can download an entire matter folder, whether a cloud vendor retains client data after termination, or whether anyone can produce evidence that your AML controls worked.
Regulators care about execution. In the UK, the Solicitors Regulation Authority reported that 5,569 of 9,149 authorised firms were within the scope of money laundering regulations as of 5 April 2025, and it completed 935 proactive AML engagements, up from 545 in the prior reporting period. Among 833 reviewed firms, only 112 were fully compliant, while 270 were not compliant, representing 32.4% of those reviewed. The report also found that 47% of reviewed firm-wide risk assessments were compliant, up from 43% in 2023/24. Those findings show how regulators test controls in practice.
The message is uncomfortable but useful. Your compliance program needs owners, logs, training records, tested workflows, and evidence. A polished binder is fine. A working system is what keeps the binder from becoming exhibit A.
A policy manual is not a compliance program. It's a set of promises, and regulators increasingly want proof that your people and systems keep those promises when work gets messy.
The weak version of compliance looks familiar. A partner downloads a policy before an audit, staff click through an annual training module, and someone insists that the firm's cloud provider is “secure.” Nobody checks whether a former contractor still has access, whether staff use personal messaging apps for client discussions, or whether the incident-response plan has ever been tested.
That approach fails because compliance lives in daily decisions. A paralegal working remotely may handle identity documents, privileged correspondence, and settlement information from a different country. A lawyer may move a file between a practice-management platform, a document-signing service, and a cloud storage account. A client may send sensitive material through an unapproved channel because the approved portal is inconvenient. Your policy won't stop any of that by itself.
A serious review looks for operational evidence:
A firm can have an immaculate manual and still fail because nobody can answer those questions. Regulators don't need dramatic evidence of misconduct. They need to see that your controls are either operating or merely decorative.
Practical rule: If a control matters, assign it to a person, record the action, and retain evidence that someone checked the result.
Start by building a simple control register. Give every requirement an owner, a system location, a review frequency, and an evidence type. Link the relevant policy to the actual workflow, whether that's your practice-management system, identity-verification platform, accounting software, or ticketing system.
For firms using distributed support, document the boundaries clearly. Your compliance documentation workflow should show who may access which information, what approvals remote staff need, and how the firm reviews activity. Don't confuse flexibility with informal access. Remote work needs more structure, not less.
The firms that pass reviews consistently tend to share one habit: they treat compliance as an operating process. They don't wait for an auditor to ask who approved access. They already know where the record sits.
Trust accounting mistakes don't usually begin with criminal intent. They begin with rushed deposits, unclear instructions, weak segregation, or a spreadsheet nobody reconciles properly. The consequences can still be severe.
Under ABA Model Rule 1.15, lawyers must keep client funds separate from firm money, maintain complete records of trust transactions, and promptly deliver funds to the client or third party when due. In most US jurisdictions, client money belongs in an IOLTA account, not the operating account. The trust-accounting requirements are summarized here.
Commingling is the obvious one. Firm money, filing fees, settlement funds, and client retainers get mixed because someone deposits everything into the account they use most. Keep the account structure boring and separate. Boring is exactly what you want when client money is involved.
Timing errors create another trap. Staff deposit funds before confirming how they should be held, or they disburse before funds have cleared and before the matter ledger supports the payment. The fix is a written deposit-and-disbursement workflow with a named reviewer, not a verbal “check with accounting.”
Incomplete records make every other problem worse. A bank statement doesn't explain which client owns a balance, why a transfer occurred, or whether a payment was authorized. Maintain a client ledger for every matter, preserve the supporting instructions, and record transfers between trust subaccounts or matters.
Use a three-part control:
Don't let the person entering transactions be the only person checking them. That isn't efficiency. It's an invitation for a small mistake to become an unexplained balance.
Train receptionists, paralegals, bookkeepers, and lawyers who touch trust funds. Training should use the firm's own forms and scenarios, including what to do when a client demands an urgent transfer or a settlement arrives without clear allocation instructions.
Retain deposit slips, payment confirmations, client instructions, approval records, reconciliations, correction notes, and correspondence supporting each transaction. If an auditor asks why money moved, your answer should be a document, not a partner's memory.
AML and KYC controls start before anyone opens a matter. A policy folder does not satisfy a regulator if the remote paralegal handling intake cannot apply it consistently in the cloud. The firm must risk-assess its business, clients, and matters, identify and verify clients and beneficial owners, check sources of funds and wealth where relevant, train staff to recognise red flags, and appoint a money laundering reporting officer to report suspicion to the National Crime Agency. The SRA's AML guidance sets out these core responsibilities.
For US firms subject to the customer due diligence rule, beneficial-owner verification follows a defined structure. When a covered financial institution opens an account for a legal-entity customer, it must identify and verify individuals who own 25 percent or more of the equity interests, together with one individual with significant control over the entity. The rule's definition appears in 31 CFR 1010.230.
Do not turn every client into a private-investigation exercise. Set a consistent, risk-based process that staff can complete from a remote workstation without bypassing controls.
Confirm the client's identity and authority first. Establish who is instructing the firm, who controls the entity, and whether the person giving instructions has authority. Record the matter's purpose, expected transaction activity, relevant source of funds or wealth, jurisdictional exposure, and red flags.
For an entity, obtain ownership information that supports the beneficial-owner assessment. A tidy organisational chart is not enough if it leaves control unclear. Record the documents reviewed, unresolved questions, and the person who approved proceeding.
Give the intake team a clear escalation route. Staff must know when to pause onboarding, request further information, and refer a concern to the MLRO. Configure these steps in the intake system, with required fields and an auditable approval record. “Get the client in first” is how verification gaps become audit findings.
Australia is a major 2026 planning issue. Australian law firms providing designated services must be ready by 1 July 2026 to maintain an AML/CTF program, appoint a compliance officer, train staff, perform client due diligence on every new matter, and keep risk assessments and procedures current. The Australian changes are outlined by By Lawyers.
UK firms also need to monitor 2026 developments involving expanded identity verification at Companies House, recordkeeping expectations, and proposed SRA changes concerning annual filing of accounts and eligibility for COLP and COFA roles. Use one matter-level control map rather than separate jurisdictional silos. It should show which rules apply, who owns each decision, which system stores the evidence, and how exceptions reach the responsible lawyer.
Store KYC records securely, limit access to staff who need it, and apply retention rules deliberately. The Law Society's GDPR guidance explains why AML information is processed under a lawful-basis regime rather than optional consent.
Client confidentiality doesn't stop at the office door. It follows the matter to the home workstation, the cloud application, the vendor support desk, and the mobile device used during a late-night emergency.
Remote operations create a chain of dependencies. Secure transmission protects data while it moves. Access controls limit who can open it. Backups preserve availability. Tested response procedures help the firm act when something goes wrong. Miss one link and the policy becomes wishful thinking.
New York City ethics guidance says lawyers working remotely must make reasonable efforts to prevent unauthorized access to client information, with safeguards covering secure transmission to remote devices, backed-up confidential data, and tested cloud-storage protocols. Weak device, backup, or transmission controls can create professional-responsibility problems. NYCLA Opinion 754 explains these remote-work obligations.
Start with identity. Require multifactor authentication, prohibit shared accounts, and grant matter-level access based on role. Remove access promptly when a person leaves, changes role, or no longer supports a matter. Review permissions regularly, especially for remote paralegals and external vendors.
Then secure the device. Use managed devices where practical, encryption, screen-lock requirements, patching, endpoint protection, and restrictions on local downloads. A confidentiality agreement matters, but it won't stop an unsecured laptop from exposing a client file.
Cloud tools need the same discipline. Maintain an inventory of every platform that handles client information, document what each vendor receives, identify subprocessors where relevant, and confirm contractual protections. A vendor data-processing agreement should match the firm's privacy and client-contract obligations, not sit in a folder untouched after signature.
The control isn't “we use a secure cloud.” The control is knowing which data enters it, who can reach it, how access is logged, and how the firm responds when the vendor reports an incident.
Remote staff also need practical training. Show them how to use approved file-sharing tools, report suspected phishing, handle printed documents, protect conversations in shared spaces, and escalate a lost device. Annual slides won't cover the awkward moments that cause real incidents.
For firms that lack internal security expertise, managed IT for legal firms can help translate professional obligations into device management, access controls, backup testing, and monitoring requirements. Use outside support to strengthen ownership, not to outsource accountability.
Document the firm's data flows and procedures in a format staff can follow. A practical data security protocol for remote legal teams should identify approved tools, prohibited practices, access rules, incident contacts, and review dates. Then test the plan. If nobody knows who disables a compromised account or contacts a client, you don't have an incident-response program yet.
Marketing creates compliance exposure before a lawyer ever opens a matter file. The risky language usually sounds harmless: “guaranteed result,” “specialist” without support, “best firm,” or a case-result statement stripped of its limitations.
Compare the channels, not just the slogans. A website claim is durable and searchable. A social-media post can be reshared without its original context. A paid advertisement may need jurisdiction-specific disclaimers. A referral arrangement can raise fee-sharing and solicitation concerns even when everyone calls it a marketing partnership.
Build a claims library for website copy, social posts, email campaigns, testimonials, and paid ads. For each statement, record who approved it, what supports it, where it may be used, and when it needs review. Don't let a freelancer invent legal claims from a template designed for another state.
Client testimonials require care. Obtain appropriate permission, avoid revealing confidential facts, and don't imply that one result predicts another. Case studies should explain material context rather than present a favorable outcome as a promise. If a jurisdiction requires disclaimers, place them where the audience can see them, not in microscopic footer text.
Referral fees deserve the same scrutiny. Confirm that the arrangement is permitted, document the relationship, disclose what clients must know, and ensure the agreement doesn't create an improper payment or conflict. “Everybody does it” is not a compliance position.
A compliant intake process should capture contact details, adverse parties, matter type, referral source, urgency, fee structure, and conflict-check information before the firm makes substantive commitments. It should also tell prospective clients whether an engagement exists. An inquiry is not automatically a representation.
Use a conflict workflow with a clear stop point. Search the names, related entities, adverse parties, and known affiliates against the firm's records. Record the result, reviewer, date, and any waiver or escalation decision. Never let marketing pressure push intake staff past an unresolved conflict.
Engagement letters should state scope, fees, expenses, communication expectations, termination terms, and responsibilities in plain language. For contingency matters, explain the fee calculation and costs clearly. For hourly work, define billing practices and retainer handling. The letter should reflect the actual relationship, not a template copied from a matter with different risks.
Your website, advertisements, intake forms, and engagement letters should tell the same story. If the ad promises immediate access but the engagement letter limits service, clients will remember the ad and regulators may examine both.
A remote paralegal opens a cloud matter file, an accountant processes a trust deposit, and a lawyer approves a new client from another jurisdiction. Your program must control each handoff, not merely describe firm policy. Clear ownership, usable procedures, and recorded evidence make compliance workable across distributed teams.
Step one is a firm-wide risk assessment. List matter types, jurisdictions, client profiles, payment flows, remote-work arrangements, vendors, cloud tools, and staff with access to sensitive information. Rank risks by potential harm and likelihood. Address the largest exposures first, especially where a cloud permission, remote device, or cross-border handoff could expose client information.
Step two is ownership. Name the COLP, COFA, MLRO, privacy lead, security owner, and operational deputies where your jurisdiction or structure requires them. A partner may hold formal responsibility, while a trained operations professional maintains evidence, chases reviews, and flags exceptions. A title without time or authority leaves controls unattended.
Step three is usable procedure. Write short instructions for intake, identity verification, trust deposits, disbursements, access approval, offboarding, vendor review, incident response, and advertising approval. Every procedure should state who acts, what they do, where they record it, and when they escalate. Build those steps into the tools your teams use, including matter-management, cloud storage, and communication systems.
Run role-specific training rather than one annual presentation. Accounting staff need trust workflows. Intake staff need KYC and conflict procedures. Remote support needs confidentiality, device, and communication rules. Lawyers need supervision, client communication, and escalation judgment.
Keep attendance records, quiz or acknowledgement results where appropriate, refresher dates, and follow-up actions. If a control changes, train the people who use it. A revised policy sitting unread in a shared drive has no operational value.
Set recurring checks for access permissions, trust reconciliations, vendor inventory, training completion, open incidents, and unresolved intake exceptions. Store evidence in a controlled location with a clear naming convention and retention rule. Test access removal for departing staff and review permissions across cloud tools, not just the office network.
Bring in outside compliance or security advice when the firm lacks technical expertise, handles cross-border matters, has experienced an incident, or cannot independently test its controls. Request prioritized findings, owners, deadlines, and verification of closure. A polished report that nobody implements is wasted money.
A small firm can run a credible program. It just can't pretend that one busy partner can personally operate every control.
In Q1, refresh the firm risk assessment, review vendors, confirm compliance ownership, and test access removal. Assign each task to a named person, set a deadline, and store evidence where the team can retrieve it. A calendar entry without an owner will not survive a busy quarter.
The annual cycle should cover training, access testing, trust-account review, incident exercises, policy updates, and file sampling. For Australian designated services, record the 1 July 2026 readiness date and prepare the AML/CTF program, compliance officer appointment, staff training, client due diligence, and current risk assessments. The Australian timetable was described earlier by By Lawyers.
| Quarter | Priority Tasks | Risk Level |
|---|---|---|
| Q1 | Refresh the firm risk assessment, review vendors, confirm compliance ownership, and test access removal | High |
| Q2 | Deliver role-specific training, review trust workflows, and test incident-response contacts | High |
| Q3 | Recheck cross-border requirements, sample matter files, and validate cloud and backup procedures | High |
| Q4 | Review policies, close audit findings, confirm retention practices, and approve the next review cycle | Medium |
Before a new hire receives matter access, verify the role, confidentiality obligations, approved systems, access scope, training, and manager approval. For each vendor, document the data involved, purpose, access, contractual protections, incident duties, and exit process.
For an incident, preserve evidence, restrict access, notify the internal owner, assess affected matters, and follow applicable client and regulatory notification requirements. Don't let staff investigate on personal devices or delete suspicious messages. Keep the investigation inside approved systems.
For audit readiness, sample actual files rather than reviewing policies alone. Check for identity evidence, approvals, training records, access decisions, transaction support, and exception handling. Good audit trail management turns scattered activity into evidence an auditor can follow.
If resources are tight, prioritize trust accounting, AML intake, privileged-data access, remote-device controls, and incident response. These controls protect client money and confidential information while giving the firm evidence of competent supervision. The ping-pong table can wait.
Compliance is the operating discipline that lets a firm use remote talent, cloud systems, international vendors, and modern intake channels without losing control. Start this quarter by assigning owners, mapping data and access, testing one high-risk workflow, and documenting the result. If your team needs qualified remote legal support with compliance guidance around hiring, payroll, and distributed operations, review how HireParalegals supports law firms building remote teams.
