AML Compliance in 2026 — Why Your KYC Should Live Inside Your Case Management System

The SRA's AML enforcement is sharper than ever in 2026. Fines are up, interventions are up, and the regulator is no longer just asking whether you did a KYC check — it's asking when, how, where the evidence is stored, and whether it was done before work began.

The gap between firms that handle AML well and firms that don't is rarely about intent. It's about workflow. Most firms use a competent KYC provider. Most firms understand the legal requirement. What separates the compliant from the exposed is whether the check is woven into the matter workflow or bolted on as an afterthought.

The problem with disconnected KYC

Here's what the typical KYC workflow looks like in a firm that uses a standalone verification tool alongside a separate practice management system:

1. Open the matter in the case management system
2. Open a separate browser tab and log in to the KYC provider
3. Enter the client's details manually — name, email, phone, date of birth
4. Send the verification request to the client
5. Wait for the client to complete the check
6. Log back in to the KYC provider to check the result
7. Download the verification report as a PDF
8. Switch back to the case management system
9. Upload the PDF to the matter file
10. Record that the check has been completed

That's ten steps. Each one is a chance for delay, error, or simply not happening. And the worst failure mode isn't doing it wrong — it's not doing it at all, because the process is so tedious that it gets deferred "until after we've got the matter moving."

The SRA does not accept "we were going to do it next week" as a defence.

Why the gap matters more in 2026

The SRA's 2025–2026 AML supervisory strategy has three priorities that directly affect how firms should think about KYC workflow:

1. Timing. The regulator is checking whether CDD was completed before any work began on the matter — not just whether it was done at some point. If your workflow lets the fee earner start drafting letters before the KYC check is back, you have a compliance gap.

2. Evidence. The SRA wants to see the verification report, the timestamp, and the decision trail. If your KYC evidence lives in a separate system that only one person in the firm can access, you have an audit problem. If that person leaves, you have a bigger one.

3. Source of funds. For conveyancing, private client, and any high-value transaction, source of funds verification is under particular scrutiny. Generic "we checked their ID" is no longer sufficient — the regulator wants to see specific source of funds evidence attached to the matter.

All three of these priorities are easier to meet when KYC is part of the matter, not a separate process running alongside it.

What integrated KYC looks like

When KYC is built into the case management system — triggered from the matter, results filed to the matter, enforced by the matter — the workflow collapses from ten steps to two:

1. Open the matter and click "Start KYC check"
2. The results arrive and are filed automatically

The client's details pass directly from the matter record to the KYC provider. No re-keying. The client completes the verification on their phone — ID scan, selfie, source of funds upload — and the results come back to the matter file with a timestamp and outcome. No downloading, no uploading, no switching between systems.

This is how Checkboard by Kord works inside OrdoLux. The check is triggered from the matter workspace, the client completes it through the Checkboard by Kord portal, and the results — identity verification, PEPs and sanctions screening, source of funds evidence, adverse media — are filed to the matter's SharePoint document folder automatically. The audit trail records when the check was triggered, when it was completed, and what the outcome was.

The compliance gate

The most important feature of integrated KYC isn't speed or convenience — it's enforcement. When KYC is a separate manual process, compliance depends on the fee earner remembering to do it. When it's integrated, the system can enforce it.

OrdoLux supports a compliance gate: the firm can configure which matter stages require a completed KYC check before progression. If the check hasn't been done — or has returned a fail — the matter cannot proceed to exchange, billing, or any stage the firm chooses to gate.

This isn't about adding bureaucracy. It's about removing the possibility of the most common compliance failure: simply forgetting.

Where this matters most

Conveyancing. Source of funds checks are non-negotiable for property transactions. The conveyancing process starts with KYC at instruction, and the check must be complete before exchange. Integrated KYC means the check is triggered the moment the matter is opened, and the compliance gate prevents exchange without it.

Private client and probate. Beneficiaries receiving funds from an estate need to be verified. When KYC is integrated, you trigger checks for each beneficiary from the matter, and the results are filed alongside the estate documents.

New firms. For firms setting up in 2026, the temptation is to start with a free KYC tool and a separate practice management system, then "integrate later." The reality is that later rarely comes — the firm gets busy, the separate systems stay separate, and the compliance gap grows. Starting with integrated KYC from day one means the workflow is correct from the first matter.

A practical checklist

If you're reviewing your firm's AML workflow, here's what to check:

• Is KYC triggered at matter opening? Not "at some point during onboarding" — at the point the matter is created. If it's a separate manual step, it will be missed.
• Are results filed to the matter automatically? If someone has to download from one system and upload to another, the evidence trail has a gap.
• Is there a compliance gate? Can a matter proceed to exchange or billing without a completed check? If yes, you're relying on people, not process.
• Can the SRA auditor see the full trail? When the check was triggered, when it was completed, what the outcome was, and where the evidence is stored — all in one place.
• Is source of funds verification attached to the matter? Not just in the KYC provider's portal — in the matter file itself, where it belongs.

If any of these answers is "no" or "I'm not sure," that's the gap to close.

Where OrdoLux fits

OrdoLux integrates Checkboard by Kord directly into the matter workspace. The fee earner triggers the check from the matter, the client completes it through the Checkboard by Kord portal, and the results are filed to the matter's SharePoint folder with a full audit trail. A configurable compliance gate prevents matter progression without a completed check.

OrdoLux also includes Stripe for card payments, SharePoint document storage, built-in e-signature, 350+ HMCTS court forms, and time recording — all in one matter-centric workspace.

See all features or book a demo.

---

Related: The Conveyancing Process — A Step-by-Step Guide · AI and Conflicts / KYC Checks · AML Compliance Checklist