Does the AI train on our client data?

No. Client data is never used to train any AI model. Inference runs via AWS Bedrock (eu-west-2, London) with zero data retention (ZDR): Bedrock does not retain prompts or outputs after the API call completes. Files are processed in memory and discarded. A data processing agreement (DPA) is provided before any client data is processed.

Is this SRA compliant?

The product is designed to be consistent with the SRA's AI Risk Outlook guidance. Every AI output is a clearly-labelled draft requiring review and explicit sign-off by a named MLRO or COLP (with their SRA reference logged); no AI output is auto-filed; the firm remains the regulated entity and responsible party; and an append-only audit log of all AI outputs and human decisions is maintained. This does not constitute legal advice about a specific firm's obligations.

What happens when AML supervision transfers from the SRA to the FCA?

The FCA will inherit the files and procedures firms create today. The underlying MLR 2017 obligations remain unchanged — only who supervises changes. The FCA is expected to adopt a more data-driven, forensic inspection approach. Evidence packs are designed to be legible to both the current SRA inspection format and the FCA's anticipated forensic style.

Where is client data stored, and can it leave the UK?

All data is stored in AWS eu-west-2 (London). No data transits to US or non-UK/EU infrastructure. AI inference runs via Bedrock EU endpoints. ISO 27001 certification is planned before general availability (currently in design phase). Cyber Essentials Plus is being applied for in parallel. The certification timeline is published transparently — no certifications are claimed that are not yet held.

Which practice management systems do you integrate with?

The product is PMS-agnostic and designed to sit above the existing stack, not replace it. Integration roadmap: Clio, LEAP, Actionstep, and Osprey. Reads from Thirdfort, Amiqus, and ComplyAdvantage for ID verification and sanctions data. Integration does not require replacing the existing PMS.

Does the AI file SARs (Suspicious Activity Reports) automatically?

No. Filing a SAR is a legal act with serious consequences. The AI can identify indicators that a matter may warrant SAR consideration and draft supporting analysis, but the MLRO must review the analysis, make the decision independently, and file via the NCA's SARS Online portal. The system logs that the consideration occurred and who made the decision — it never acts on it.

How do you handle the tipping off prohibition?

SAR-consideration workflows are partitioned from fee-earner views. Once a SAR consideration is open, the matter is flagged internally to the MLRO only — fee earners see a general hold instruction without the reason. This is enforced at the access-control layer, not just the UI layer.

What is the cost of the service?

Currently in pre-launch, conducting paid-intent discovery calls. Intended model: free 30-minute compliance health-check with no commitment, then a one-month free pilot with written success criteria and an end date, then a minimum 6-month subscription. Pricing is per fee-earner per month, calibrated to be a fraction of the cost of a single avoided AML fine. Accessible to firms of any size — not enterprise-gated.

Will you sign a data processing agreement (DPA)?

Yes. A DPA is required before any client data is processed. The DPA covers: lawful basis for processing, sub-processor chain (AWS, Bedrock), data residency guarantees, retention and deletion schedule, and breach notification obligations. Client data will not be processed without a signed DPA.

Is the AI output protected by legal professional privilege?

This is a live area of law. AI-assisted outputs directed by a qualified lawyer, used in preparation for legal proceedings, and subject to MLRO review and adoption, may be capable of attracting privilege — but this has not been authoritatively decided. Firms should treat AI compliance outputs as records that assist the fee earner's own work product, not as privileged communications in their own right. This is not legal advice.

Retibo — Find Your AML Gaps Before the SRA Does

Enforcement is rising fast.

Every figure is from the SRA's own AML report, 2024/25. Not projections. Not estimates. Real fines, real inspections, real firms.

Source: SRA AML Annual Report 2024/25.

not fully compliant

only 14% are — 32% non-compliant, 54% partial

files reviewed

by the SRA in 2024/25 — nearly double the prior year

£0.0m

in fines

issued in 2024/25 alone — fining power now unlimited under ECCTA 2023

enforcement actions

up from 10 in 2017/18 — a sevenfold rise in seven years

Layer it.

Integrate with the tools you already use — Clio, LEAP, Actionstep, Osprey — and your AML rail (Thirdfort, Amiqus, ComplyAdvantage). We sit on top of your stack. No rip-and-replace.

UK-hosted
Zero data retention
Built for UK law
PMS-agnostic
Human-signed
No training on client data
Integrates with your stack
Sits above your rail

See your AML gaps before the inspector does.

In a free 30-minute compliance health-check, we review a sample of your live matters and show you exactly what an SRA AML inspection would flag. No cost, no commitment, no sales pressure.

Book a free compliance health-check