The client and matter risk assessment: the first thing an SRA inspector checks.

Ask anyone who has been through an SRA anti-money laundering inspection what the reviewer reached for first, and the answer is almost always the same: the client and matter risk assessment. It is the document that determines everything that should follow on a file, which makes it the natural starting point for any assessment of whether a firm's AML controls actually work. It is also, consistently, one of the areas where firms fall short.

What is a client and matter risk assessment.

A client and matter risk assessment (CMRA) is the matter-level risk judgement the Money Laundering Regulations 2017 require before, or as, a firm takes on a piece of work: who the client is, what the matter involves, and how much money-laundering risk the combination carries. It is grounded in Regulation 28 of the Money Laundering Regulations 2017, which requires customer due diligence to reflect the level of risk in each case (Reg 28(12)). In assessing that risk, firms apply the same risk factors the regulations set out for the firm-wide assessment under Regulation 18(2): the type of customer, the countries or geographic areas involved, the products or services, the transaction itself, and the delivery channel. The SRA's own guidance draws these together into the CMRA a firm should complete before, or during the establishment of, a business relationship.

Crucially, this is a matter-level obligation, distinct from, and additional to, the firm-wide risk assessment under Regulation 18 (sometimes called a practice-wide risk assessment, or PWRA, in guidance outside the legal sector; see our companion piece on what a PWRA is). The firm-wide assessment sets the overall picture of the risks the practice faces; the CMRA applies that thinking to the specific engagement in front of the fee-earner. A firm can have an excellent firm-wide assessment and still fail comprehensively at the matter level, because the two do different jobs.

The regulations also expect the assessment to be recorded where the firm is required to keep such records, and to be capable of being provided to the regulator. An assessment that lives only in a fee-earner's head satisfies neither the letter nor the purpose of the rule.

Why SRA inspectors check the CMRA first.

There is a logic to reaching for the CMRA first. It sits at the top of the causal chain. The risk rating it produces is supposed to drive the level of customer due diligence, the depth of source-of-funds enquiry, whether enhanced due diligence applies, and how closely the matter is monitored. If the CMRA is wrong, missing or superficial, everything downstream is built on sand.

So an inspector opening a file with the CMRA is effectively asking a single diagnostic question: did this firm decide, in a reasoned way, how risky this matter was, and did it then behave accordingly? The answer to that predicts the quality of the rest of the file with uncanny reliability.

How often UK firms get the CMRA wrong.

The SRA's own data shows this is not a marginal problem. In 2024/25, across the 5,873 files it reviewed, around 950 files, roughly 16%, had no client and matter risk assessment at all, or only an incomplete one (SRA AML Annual Report 2024/25). And that understates the issue, because a further 39% of the assessments reviewed existed but did not effectively evaluate the money-laundering risk (SRA AML Annual Report 2024/25). Combine the two, and a striking share of files lacked a CMRA that actually functioned.

The gap also shows up at firm level, not just file level. Of the 270 firms the SRA assessed as non-compliant in 2024/25, 135 (50%) were referred specifically for a lack of CMRAs on file. That figure needs one honest qualifier: of those 135 firms, 111 actually had a CMRA process in place that simply was not being followed, rather than no process at all (SRA AML Annual Report 2024/25). The distinction matters, because "we never built the process" and "we built it and stopped using it" point to different fixes.

Around 950 files, one in six reviewed, had no client and matter risk assessment, or only an incomplete one.

That failure rate is precisely why the CMRA is such an efficient starting point for an inspector. Statistically, it is one of the most likely places to find a problem.

What happens when the CMRA fails.

The reason a weak CMRA is so damaging is that its failures do not stay contained. They propagate through the rest of the file.

It miscalibrates due diligence.

If a genuinely higher-risk matter is rated low, or not rated at all, the firm applies standard, or minimal, due diligence to a situation that demanded enhanced measures. The source-of-funds enquiry that should have happened does not. The senior sign-off that should have been triggered is not. Each downstream step inherits the original error.

It breaks the audit trail.

When there is no reasoned risk assessment at the front of the file, there is nothing for the rest of the file to be consistent with. An inspector cannot trace a coherent line from "we judged this risk to be X" to "so we did Y." The file stops telling a story, and an incoherent file is a finding waiting to happen.

It undermines ongoing monitoring.

Ongoing monitoring under Reg 28(11) is supposed to be calibrated to risk (see our companion piece on ongoing monitoring). Without a reliable initial rating, the firm has no sensible baseline against which to spot when a matter's risk profile changes. The obligation to keep watching becomes untethered from any starting point.

It exposes the firm even where nothing went wrong.

Perhaps most importantly, a defective CMRA is a breach in itself, regardless of whether any money laundering occurred. The firm can have handled an entirely legitimate matter and still be sanctioned for failing to assess and record the risk it was required to assess. Innocence of the underlying conduct is no answer to the absence of the document.

Why it matters.

The client and matter risk assessment is small, often a single page, but it carries disproportionate weight. It is the hinge on which risk-based compliance turns, the first thing an inspector reads, and the failing the SRA's data shows firms are most likely to commit. When it is done well, it makes the rest of the file defensible. When it is thin, absent or box-ticked, its weakness spreads through every subsequent step and leaves the firm exposed on a matter it may have handled perfectly honestly.

For any firm wondering where to focus limited compliance attention, the evidence points to an unglamorous answer: start where the inspector starts.

Frequently asked questions.

Is a CMRA a legal requirement, or best practice?

It is a legal requirement. Regulation 28(12) and 28(13) of the Money Laundering Regulations 2017 require customer due diligence to reflect a documented assessment of the risk in each particular case, which is what a CMRA records.

How is a CMRA different from a firm-wide risk assessment?

The firm-wide risk assessment (Reg 18) assesses the risk across the whole practice: the types of clients it acts for, the services it offers, the jurisdictions it touches. The CMRA applies that same thinking to one specific client and matter. A firm needs both, and one cannot substitute for the other.

What should a CMRA record?

At minimum: the client risk factors (who they are, their business, source of wealth, PEP or sanctions status), the matter risk factors (transaction type, value, jurisdictions involved), the resulting risk rating, and any enhanced due diligence the rating triggers. It should be dated and signed by the responsible fee-earner or the MLRO.

Does a CMRA need updating once the matter is underway?

Yes, where the matter's circumstances change materially. The initial CMRA sets the starting risk rating; the ongoing monitoring duty under Reg 28(11) is what keeps that rating current as the matter develops.

What happens if an inspector finds a missing or weak CMRA?

Based on the SRA's 2024/25 findings, it is treated as a serious compliance gap in its own right, separate from whether anything actually went wrong on the matter. Firms have been referred for investigation on this basis alone.