On 4 June 2025, the Solicitors Regulation Authority (SRA) issued Update 140, highlighting the findings of the Office of Financial Sanctions Implementation (OFSI) in its first-ever Legal Services Threat Assessment [1]. The report outlines the key sanctions compliance risks facing the legal sector and urges firms—especially those in high-risk areas—to take immediate action.
For small law firms and sole solicitors, this update is a timely reminder that sanctions compliance is not just for large, international firms. The risks are real, the obligations are strict, and the consequences of non-compliance can be severe.
This blog post breaks down the key findings of the OFSI report, what the SRA expects from firms, and how small practices can strengthen their sanctions compliance frameworks.
Why This Matters: The Legal Sector’s Exposure to Sanctions Risk
Since the start of the Russia-Ukraine conflict in 2022, the UK’s sanctions regime has expanded rapidly. According to OFSI, the legal sector now accounts for 16% of all suspected sanctions breach reports, second only to financial services [1].
This is a significant statistic—and one that should prompt all firms, regardless of size, to review their exposure. OFSI’s report identifies several recurring issues:
- Underreporting of breaches, particularly by Trust or Company Service Providers (TCSPs)
- Misuse of complex structures and trusts to conceal ownership by designated persons (DPs)
- Breaches of licence conditions, such as exceeding value limits or failing to report in time
Key Sanctions Risks Identified by OFSI
1. Complex Ownership Structures
Designated persons often use layers of corporate ownership, offshore entities, and nominee arrangements to obscure their involvement in transactions. Small firms handling property, corporate, or trust matters may unknowingly facilitate these structures.
Action point: Review client files involving complex ownership or offshore elements. Ensure you understand the ultimate beneficial owner and document your findings.
2. Breaches of Licence Conditions
Many sanctions breaches involve firms exceeding the scope of a licence, such as going over a financial threshold or failing to report within the required timeframe.
Action point: If your firm relies on OFSI licences, ensure you understand the conditions and reporting obligations. Use OFSI’s new online forms to streamline submissions and reduce errors.
3. Underreporting by TCSPs
OFSI believes that underreporting by Trust or Company Service Providers is highly likely. This is particularly relevant for small firms offering company formation or trust administration services.
Action point: If your firm acts as a TCSP, ensure you have a clear process for identifying and reporting sanctions breaches. Include this in your AML and sanctions risk assessments.
What the SRA Expects from Law Firms
The SRA has made it clear that sanctions compliance is a regulatory priority. In Update 140, it urges all firms to:
- Review client files, especially those involving complex ownership or links to Russian DPs
- Improve internal controls and staff awareness around sanctions compliance
- Report suspected breaches promptly to OFSI
- Stay up to date with OFSI guidance and licensing conditions [1]
Sanctions Compliance: A Strict Liability Regime
Unlike AML regulations, the UK’s sanctions regime operates under strict liability. This means that intent is not required for a breach to occur. Even an unintentional failure to comply can result in:
- Financial penalties
- Reputational damage
- Regulatory enforcement
Implication for small firms: You cannot afford to assume that sanctions don’t apply to your practice. Even a single matter involving a designated person could expose your firm to significant risk.
Firm-Wide Sanctions Risk Assessments
While not mandatory, the SRA strongly recommends that firms conduct a firm-wide sanctions risk assessment—especially those at higher risk [2]. This assessment should:
- Identify areas of exposure (e.g. property, corporate, trust work)
- Evaluate client demographics and geographic links
- Set out mitigation measures (e.g. due diligence, training, reporting procedures)
Tip: The SRA provides a template risk assessment that can be tailored to your firm’s size and services.
High-Risk Clients and Red Flags
The SRA and OFSI highlight several characteristics that may indicate a client is a designated person or linked to one:
- High net-worth individuals with opaque wealth sources
- Clients connected to sanctioned jurisdictions (e.g. Russia, Iran, Myanmar)
- Use of multiple intermediaries or family offices
- Requests involving high-value, transportable assets (e.g. art, yachts, property)
Action point: Train staff to recognise these red flags and escalate concerns. Use enhanced due diligence where appropriate.
Practical Steps for Small Law Firms and Sole Solicitors
1. Review and Update Your Sanctions Policies
Ensure your sanctions compliance policy is up to date and reflects the latest OFSI guidance and SRA expectations.
2. Conduct a Firm-Wide Risk Assessment
Even if you’re not required to, this is best practice. Tailor it to your firm’s size, services, and client base.
3. Train Your Team
Provide training on:
- Identifying designated persons
- Using OFSI’s consolidated list
- Reporting obligations and licence conditions
4. Use OFSI’s Online Forms
OFSI’s new digital forms make it easier to:
- Apply for licences
- Report breaches
- Submit frozen asset reports
Start using them now to streamline your compliance processes.
5. Monitor OFSI and SRA Updates
Sanctions regimes evolve quickly. Subscribe to OFSI and SRA alerts to stay informed about:
- New designations
- Licence changes
- Enforcement actions
Final Thoughts
The SRA’s Update 140 and OFSI’s Legal Services Threat Assessment are a wake-up call for the legal profession. For small law firms and sole solicitors, the message is clear: sanctions compliance is not optional, and ignorance is not a defence.
By reviewing your client files, updating your risk assessments, and training your team, you can protect your firm from financial, reputational, and regulatory harm. Sanctions compliance is now a core part of legal practice—and small firms must be just as vigilant as their larger counterparts.
References
[1] SRA | SRA Update 140 sanctions risks | Solicitors Regulation Authority
[2] Sanctions regime – firm-wide risk assessments – Guidance