Law firm KYC document verification means checking whether client evidence supports identity and, where required, the origin of funds. For solicitors handling work within the Money Laundering Regulations, a practical workflow combines independent identity verification, risk-based source-of-funds review and scrutiny of supporting documents. Record unresolved concerns and the reason for acceptance or escalation. A PDF score is not a compliance decision.
This article focuses on SRA-regulated firms in England and Wales. The SRA’s source-of-funds thematic review makes the practical problem clear: holding documents is not the same as scrutinising them. A folder full of bank statements is little comfort if nobody has checked what they actually prove.
Why solicitors sit in the crosshairs of AML regulators
The SRA’s thematic review explains why legal services attract misuse: solicitors are trusted, can process large sums and can make transfers appear legitimate. Fraudsters know the value of that access.
For the 2024/25 reporting period, the same review records inspections or desk-based reviews of 833 firms and checks of 5,873 files. Of those files, 5,026 required source-of-funds or source-of-wealth checks. These are supervisory review counts, not a measure of fraud across all law firms.
The SRA’s 2024/25 AML annual report describes firms collecting savings account statements without understanding how the money had accumulated. That is the gap an onboarding process needs to close.
What SRA AML rules actually require you to verify
The Money Laundering Regulations 2017 set out the framework for customer due diligence (CDD). They apply to defined activities, not automatically to every legal instruction. For work in scope, use the current amended regulations and applicable legal-sector guidance to determine the checks required. The main questions are:
- Who is the client, and what reliable independent evidence verifies their identity?
- Who ultimately owns or controls a corporate client or trust, beyond the named signatory?
- Where did the funds for this transaction come from, where that check is required?
- How did the client build their overall wealth, where enhanced due diligence requires that check?
The SRA’s source-of-funds review distinguishes source of funds from source of wealth and explains their overlap under enhanced due diligence. A bank statement can be evidence, but possession of one does not explain how the balance accumulated.
Collecting evidence is the easy part. You still have to test it, resolve gaps and record why your firm accepted it.
Source of funds vs source of wealth - the distinction that trips up even experienced partners
A thick CDD file can still leave the basic question unanswered. Source of funds and source of wealth tell you different things.
Source of funds is transaction-specific. Take a hypothetical commercial property purchase for £2.4 million: the question is where that £2.4 million is coming from. A bank statement showing the funds in the account is part of the answer.
But where did those funds arrive from? You need to trace the money back to a credible origin, whether that is a business sale, savings built over twenty years or a loan from a connected party.
Source of wealth explains how the client built their overall financial position. If a self-employed contractor lists only “business income”, the firm may need more detail and evidence depending on the risk assessment. The SRA review explains when these two checks overlap.
Clients submit documents to support both claims. Those documents can be faked. We cover the most common document fraud red flags every compliance officer needs to know in detail elsewhere, but “this looks fine” is a poor basis for accepting a bank statement as evidence.
Where document forensics fits, and where it stops
A review might involve a passport, bank statements or company accounts. Treat the identity check and the supporting financial evidence as separate questions: does this identify the client, and does this explain the transaction?
VerifyPDF’s document forensics for law firms checks PDF metadata and content layers for signs of manipulation. That page explains the checks and API integration options, useful when deciding where a forensic step belongs in your intake process.
Looking at the rendered page alone does not show all of those internal signals. But a software result does not establish where the money came from. A genuine statement can still leave an unexplained transfer, and a warning needs a reviewer rather than automatic rejection.
This is the trade-off: automated checks add evidence, but exceptions still take time. Before adding a vendor, review confidentiality, data handling and access controls against your firm’s requirements. Decide who will investigate warnings rather than leaving them in an unattended queue.
AML checks, fraud controls and PDF checks overlap, but they are not the same legal duty. We would not treat a software result as proof that a firm is compliant. Your workflow needs to connect these checks while keeping their limits clear.
A law firm KYC document verification workflow
The practical objection is fair: asking for ten documents before anyone reviews the first one makes onboarding harder than it needs to be.
Do the checks as evidence arrives, not after the whole pack lands.
A practical workflow puts verification early:
-
Ask for original PDFs downloaded from the issuer’s portal when they exist. Our explanation of why screenshots limit document forensics covers the signals lost when a document becomes an image. Provide an alternative review path for clients who cannot supply a native PDF.
-
Run document forensics before substantive review. Use the result to guide the reviewer, not replace their judgment or the firm’s matter-level risk assessment. The SRA’s annual report stresses that firms must understand the technology they use and the reports it produces.
-
Compare the documents with each other. For example, a payslip showing net pay of £8,500 gives you an amount to reconcile with the bank statement, allowing for payment timing or split deposits. Compare names, dates, account details and the client’s explanation before deciding whether a mismatch is innocent or material.
-
Keep the original file, the verification result, the questions raised and the reason for acceptance or escalation. Another reviewer should be able to reconstruct your decision without guessing.
Collect evidence in proportion to risk and check it early, so fee earners can spend their time on exceptions. The aim is to find unanswered questions before completion, not promise that every client will clear onboarding immediately.
What to do when a law firm KYC check raises a flag
A forensic flag is a prompt to investigate, not a finding that the client committed fraud. First confirm that the firm received the original file. Check the file’s handling history before attributing a warning to the client.
Then compare the flagged detail with other evidence. Where client clarification is appropriate under the firm’s escalation procedure, ask a narrow question and record the answer.
If concerns remain, follow the firm’s escalation process. Involve the money laundering reporting officer where appropriate before further client communication, and assess any reporting obligations and tipping-off restrictions. The SRA’s thematic review connects scrutiny of evidence with identifying suspicious activity. A score alone cannot explain why your firm accepted or escalated the evidence.
Stop collecting documents and start verifying them
Asking for a bank statement gives you a file. Due diligence means testing its authenticity, tracing the relevant money and recording your decision. Combine risk-based CDD with better source documents, automated forensic checks and human escalation. No single check proves compliance, but that documented process gives you much more to rely on than a folder full of untested PDFs.
Ready to test the forensic step? Create a VerifyPDF trial account to inspect supporting PDFs and review the results before planning an API integration. Use files your firm is authorised to upload, and assess the warnings alongside your existing CDD process.