Client and Matter Risk Assessment
A free, editable Word client and matter risk assessment for law firms in England & Wales, built around the factors the money laundering regulations actually name: the purpose of the retainer, the level of assets, and the regularity and duration of the relationship, with low, medium and high ratings and the due diligence applied because of them on the same page.
What's inside
A complete, UK-drafted client and matter risk assessment
- Client identification, beneficial owners over 25%, politically exposed persons and sanctions screening
- The purpose of the retainer, the value involved, and the expected duration, the three factors the regulations name
- Geography, and when a high-risk country triggers enhanced due diligence
- Delivery channel, source of funds and source of wealth, with the mismatch question that catches most cases
- Low, medium and high ratings that match what Writford's risk register records
- The due diligence applied because of the rating, recorded next to it rather than elsewhere
- An eight-point red flag checklist and what to do before speaking to the client
- Review triggers, a review log, and sign-off with supervisor approval where the rating is high
How it works
- 1
Tell us where to send it
Enter your name, work email and organisation. We email you an editable Microsoft Word (.docx) file, personalised with your name.
- 2
Fill in the bracketed fields
Open it in Word, Google Docs or LibreOffice and complete every [bracketed] field with your details and commercial terms.
- 3
Review and adapt before use
Adapt the clauses to your circumstances and have it reviewed by a qualified solicitor before you sign or publish it.
This template is not legal advice. Writford is a software company, not a law firm, and is not regulated by the SRA. This document is a starting point that must be reviewed, adapted and approved by a qualified solicitor before use. It was last reviewed on 5 September 2026.
Get the free template
We email you an editable Word copy, personalised with your name. No account needed.
Looking for something else? Browse all templates.
Does a law firm have to do a written risk assessment for every matter?
The money laundering regulations require the due diligence you apply to match the risk you assessed, and require you to be able to demonstrate that to your supervisor. They do not use the word 'written', but an assessment nobody recorded cannot be demonstrated, so in practice it has to be written down.
- What factors must the assessment consider?
- The regulations name three: the purpose of the account, transaction or business relationship, the level of assets involved or the size of the transaction, and the regularity and duration of the relationship. Others apply depending on the client, the country and how you took the instructions.
- How is this different from the firm-wide risk assessment?
- The firm-wide assessment covers your practice as a whole: your customers, countries, products, services, transactions and delivery channels. This one covers a single client and a single matter, and it should reflect the firm-wide one rather than repeat it.
- What happens if a matter has no rating at all?
- An unrated matter is not low risk, it is unassessed, and that is the gap an inspection finds first. It is worth being able to list every matter with no rating on it, which is exactly what a risk register is for.
- Is a rating on its own enough?
- No, and this is where most assessments fall down. The requirement is that the due diligence reflects the risk and that you can demonstrate it, so the rating and the measures you took because of it need to sit together. A form that records 'high' and stops proves nothing.
- When does enhanced due diligence apply?
- Where a politically exposed person is involved, where a high-risk third country features, where a transaction is unusually large or complex without an obvious purpose, and in any case you have rated high. It typically means more identity evidence, establishing source of wealth, senior approval to act, and closer ongoing monitoring.
- When should the form be completed?
- At the point the retainer begins, not when the file is reviewed months later. An assessment written after the work was done cannot have informed the due diligence that was applied, and a supervisor will make that point.