Last updated: September 2026 · Reviewed by ID-Pal
Key takeaways
- Client due diligence is only part of the obligation. Supervisors also expect a firm-wide risk assessment, documented policies, controls and procedures, and a client and matter risk assessment on every file.
- The most common enforcement theme is evidence. Firms are penalised less for failing to check than for being unable to show what was checked, when, and on what basis.
- Corporate and trust clients are where files break down, because the firm has to identify the individuals behind the structure and screen each of them.
- ID-Pal delivers KYC, KYB and AML compliance, configurable to the firm’s own risk rules with a complete audit trail per submission, covering 16,000+ identity documents across 250+ jurisdictions.
- Source of funds and source of wealth remain the firm’s assessment. A verification platform supplies the identity and screening evidence that assessment sits on.
What does SRA-supervised client due diligence actually require?
A firm supervised by the Solicitors Regulation Authority (SRA) must, where its work is in scope, identify the client, verify that identity from a reliable independent source, understand the purpose and intended nature of the retainer, identify beneficial owners where the client is an entity, screen against sanctions and politically exposed person lists, and keep the information current for the life of the matter.
That obligation is applied through a documented chain rather than a single check: a firm-wide risk assessment, written policies, controls and procedures, a risk assessment for each client and matter, then due diligence proportionate to the risk that assessment identifies. The scope of the regulated work matters too, since not every matter a firm handles falls within the Money Laundering Regulations. Firms should confirm their in-scope activities and requirements against their supervisor’s current guidance.
Where do firms most often fall short?
Enforcement patterns point at documentation rather than intent. Firms generally do the checks. What they cannot always do is produce, months later, the record that shows which check was applied to which matter and why.
Four recurring gaps:
Risk assessments that exist but are not applied. A firm-wide assessment on file, with matter-level assessments that are generic, undated, or completed after the work started.
Enhanced due diligence triggered inconsistently. A politically exposed person or a higher-risk jurisdiction is identified in one file and missed in another, because the trigger depends on who opened the matter.
Beneficial ownership taken at face value. The registered owner of a corporate client is recorded, and the individuals behind an intermediate holding company are not followed through.
Evidence scattered across systems. Identity documents in a case management system, screening results in a separate tool, the decision in an email. Reconstructing that under review is slow and rarely complete.
What has to be verified, and on whom?
| Client type | What the firm establishes |
|---|---|
| Individual client | Identity confirmed from a government-issued document, matched to the live person, with address verification |
| Corporate client | Registration and status, plus identification of beneficial owners and persons with significant control through any intermediate entities |
| Trust or similar arrangement | The parties to the arrangement and the individuals who ultimately control it |
| Every client and every relevant individual | Sanctions, politically exposed person and adverse media screening, with the outcome recorded |
| Higher-risk matters | Enhanced measures, including the firm’s assessment of source of funds and, where relevant, source of wealth, with senior sign-off |
| The file | A dated record of each check, the decision that followed, and the basis for it |
What factors most influence a law firm to shortlist a solution vendor?
Seven criteria decide it for a law firm.
- Individuals and entities in one case. A corporate client produces a list of people to verify. Those two jobs belong in one workflow with one audit trail.
- Ownership resolution through structures. Following control through holding companies, nominees and trusts, rather than reporting the first registered name.
- Screening that continues. A matter can run for months. Sanctions and politically exposed person status changes inside that window.
- Evidence built for scrutiny. A single case view showing every check, decision and document, exportable when a supervisor asks.
- Certified anti-fraud. Remote onboarding is now standard in legal work, which makes independently certified liveness detection and defence against document manipulation a requirement rather than a feature.
- Configurable risk rules. Standard and enhanced cases should not run the same check, and the platform should evidence which was applied.
- Fit with how the firm already works. Deployment out of the box for firms without engineering capacity, an API and SDK for those with it.
How does ID-Pal meet those criteria?
ID-Pal delivers KYC, KYB and AML compliance, configurable to the firm’s own risk rules, so a firm verifies the individual, resolves the entity behind a corporate client and screens everyone involved in one case with one audit trail.
| Criterion | How ID-Pal covers it |
|---|---|
| Individual verification | Document authentication across 16,000+ identity documents, thousand-dimension biometric facial matching, and address e-verification |
| Corporate and trust clients | KYB compliance with ultimate beneficial owner and PSC identification through intermediate structures |
| Screening | AML screening against sanctions, politically exposed persons and adverse media |
| Ongoing risk | Customer monitoring keeps screening live for the life of the retainer |
| Anti-fraud | Liveness detection independently certified to iBeta Level 1 and Level 2 under ISO 30107-3, with injection attack detection |
| Evidence | Single case view with a complete audit trail per submission |
| Configurability | Rule-based engine applying different checks by risk, with the applied path recorded |
| Assurance | ISO 9001 and ISO 27001 certified, GDPR compliant |
Ownership resolution for corporate and trust clients follows the integration of NorthRow’s KYB platform. ID-Pal’s work in the sector was recognised at the British Legal Technology Awards 2023, winning Innovation in Legal Services.
Where does a platform stop and the firm’s judgement begin?
A platform supplies verified identity, resolved ownership and screening results. The firm makes the risk decision, assesses source of funds and source of wealth where enhanced due diligence applies, and takes responsibility for the retainer.
That line matters when choosing a vendor. Any platform claiming to deliver source of funds assessment is describing something the firm still has to own. What good software does is remove the collection and reconciliation work underneath the judgement, and evidence the judgement once it is made.
What about client experience?
Client due diligence is the first thing a new client experiences. A process that asks for certified copies by post, or requires an office visit, sets a tone before any legal work starts.
Remote verification handles the routine case in minutes and reserves partner time for the files that genuinely need it. For firms acting on property, corporate and private client matters where clients are frequently overseas, remote capability decides whether the client can be onboarded at all.
Frequently asked questions
Which law firm activities fall within the Money Laundering Regulations?
The Regulations apply to defined activities, including conveyancing, company and trust formation or management, tax advice, and managing client money or transactions. Not every matter a firm handles is in scope, so firms should map their in-scope work against their supervisor’s current guidance.
Is client due diligence the same as a client and matter risk assessment?
No. The risk assessment determines what level of due diligence a matter requires. The due diligence is then carried out to that level. Supervisors expect both, dated and documented, and expect them to be consistent with each other.
When does enhanced due diligence apply?
Enhanced measures generally apply where risk is higher, for example a politically exposed person, a link to a high-risk jurisdiction, or a complex or opaque ownership structure. It means going further, including on source of funds and where relevant source of wealth, with senior sign-off and closer ongoing monitoring.
How should a firm verify a corporate client?
Confirm the entity is registered and active, identify the beneficial owners and persons with significant control including through intermediate entities, then verify and screen those individuals. Registry data alone often does not resolve the real controller.
Does verification have to be repeated during a long matter?
Information has to be kept current, and screening should stay live rather than stopping at onboarding, so a change in a client’s status is caught while the retainer is running.
Can one platform cover both individual and corporate clients?
Yes. Running both on one platform gives a single case view and one audit trail per client, which is materially easier to evidence than reconciling two systems. ID-Pal delivers KYC, KYB and AML compliance, configurable to the firm’s own risk rules.
What evidence should a firm be able to produce on request?
Which checks were run, on whom, on what date, what the screening returned, what risk rating was applied, who approved it, and the documents relied on. If any of that sits outside the file, the record is incomplete.
