A law firm can follow its own compliance process and still end up facing professional misconduct. That is the risk exposed by the Dentons anti-money laundering case, now heading back toward the Solicitors Disciplinary Tribunal after a ruling from the Court of Appeal of England and Wales.
The timing matters. Regulators are applying increasing scrutiny to law firm AML controls, particularly where firms inherit high-risk clients through mergers, acquisitions or lateral hires. What looks like a contained compliance issue can quickly become a question about professional standards, reputational exposure and whether the firm’s systems actually changed behaviour when risk was identified.
The dispute between Dentons and the Solicitors Regulation Authority does not turn on whether rules were broken in the abstract. It turns on something more uncomfortable: when does a failure that appears inadvertent, or even carried out in good faith, cross the line into conduct serious enough to justify disciplinary sanction?
The Court of Appeal’s answer is deliberately narrow, but its implications are not. A breach of regulatory obligations does not automatically amount to professional misconduct. There is an inherent requirement of sufficient seriousness before a finding can be made under the SRA’s principles. That protects firms from the idea that every technical breach must lead to disciplinary liability.
But the same judgment removes a defence many firms quietly rely on. The court upheld the decision to set aside the earlier dismissal of the allegation relating to Principle 7 and allowed that part of the case to be reconsidered by a newly constituted tribunal. In doing so, it questioned how a failure to ask relevant source-of-funds questions in a high-risk matter could be characterised as “entirely inadvertent.”
That tension is where the real risk sits. Compliance failures rarely present themselves as obvious misconduct at the time they occur. They tend to emerge from files where the risk was visible, the client was categorised, and the work continued under assumptions that were never fully tested.
The allegations centred on a client identified in proceedings as “Client A”, widely understood to be Jahangir Hajiyev, a former chair of the International Bank of Azerbaijan. The client relationship was not new in the ordinary sense. It had been inherited through the acquisition of Salans’ London office in 2013. The firm initially identified the client as a politically exposed person and high risk, but went on to act in multiple matters, including a significant UK property transaction. Years later, the client was convicted of serious financial crime, and scrutiny followed.
That sequence is not unusual in large firms. Clients arrive through mergers, lateral hires or long-standing relationships. They come with history, expectations and internal advocates. Risk ratings are applied, files are opened, and work begins. The assumption, often unstated, is that identifying the risk is itself a form of control.
The Dentons case suggests that assumption is fragile. Identifying a client as high risk does not mitigate exposure if the response to that risk is insufficient. In AML terms, the obligation is not simply to classify, but to act proportionately. That means enhanced due diligence, clear source-of-wealth and source-of-funds enquiries, and a willingness to refuse or limit instructions where the answers are not adequate.
The legal mechanism is not complex, but it is unforgiving. The Money Laundering Regulations impose duties that are triggered by risk. Once that risk is identified, the firm must be able to demonstrate that it took steps that matched it. A failure to do so may begin as a regulatory breach, but it does not remain there if the surrounding circumstances suggest that the firm’s systems were not effective in practice.
This is where the “seriousness” threshold becomes critical. It is not a shield; it is a filter. The question is no longer whether a breach occurred, but whether the breach, viewed in context, was serious enough to undermine professional standards. That assessment does not depend solely on intention. It turns on what the firm knew, what it did, and whether its response was capable of protecting the public and maintaining confidence in the profession.
For firms, the danger lies in how easily a file can move from one category to the other. A politically exposed client, a high-value transaction, repeated instructions over time, and incomplete enquiries can combine into a pattern that is difficult to defend as inadvertent. The longer the relationship continues without adequate scrutiny, the harder it becomes to argue that the failure was a one-off oversight rather than a systemic weakness.
There is also a governance dimension that cannot be ignored. Large firms operate through layers of decision-making, with compliance teams, partners and management structures all playing a role. When a risk is identified but not fully addressed, the question becomes who had the authority to act and whether that authority was exercised. Internal disagreement, particularly between fee earners and compliance professionals, can leave a trace that regulators are quick to examine.
The facts highlighted in the Dentons proceedings point directly to that issue. The firm initially identified the risk, but objections were raised internally before continuing to act. That dynamic is familiar across the profession. High-value clients are rarely neutral. They bring commercial pressure, relationship considerations and reputational sensitivities. The legal risk arises when those pressures influence how compliance decisions are made, or how rigorously they are enforced.
The Court of Appeal’s ruling does not resolve those tensions. It sharpens them. By confirming that seriousness is required, the court has ensured that disciplinary findings will depend on a close examination of the facts rather than a mechanical application of rules. That increases uncertainty for firms, because it makes outcomes less predictable and more dependent on how decisions are documented and justified.
The second-order risk is reputational. A finding of professional misconduct does not sit in isolation. It affects how a firm is perceived by clients, counterparties, insurers and regulators. It can influence panel appointments, transactional trust and internal culture. Even the process of defending such a case can expose weaknesses in governance that extend beyond the original file.
For firms expanding through mergers and acquisitions, the implications are immediate. Inherited clients are not neutral assets. They carry regulatory history and risk profiles that must be reassessed under the acquiring firm’s standards. The fact that another firm previously acted does not reduce the obligation. If anything, it increases the need for independent verification, because the receiving firm cannot rely on processes it did not design or oversee.
The same applies to lateral hires. When partners move with client relationships, they bring not only revenue but also assumptions about how those clients have been managed. Without a clear and independent review, those assumptions can persist unchecked. The Dentons case illustrates how quickly that can become problematic when the client is later scrutinised.
What emerges from the ruling is a more demanding view of compliance. Policies, risk ratings and procedures are necessary, but they are not sufficient. The real test is whether those systems influence behaviour at the point where risk becomes uncomfortable. If a file marked “high risk” proceeds without deeper enquiry, the existence of the label may do little to protect the firm.
That is why the distinction between inadvertence and misconduct matters less in practice than firms might hope. A failure described as inadvertent may still be serious if the surrounding context shows that the firm had enough information to act differently. The absence of intent does not eliminate the obligation to respond to risk in a way that is proportionate and defensible.
The case now returns to the Solicitors Disciplinary Tribunal, where the question will not be what happened, but how those facts should be characterised. The tribunal will consider whether the conduct meets the threshold of seriousness and, if so, what sanction is appropriate. That stage is where the abstract distinction between breach and misconduct becomes concrete, with consequences that extend beyond the parties involved.For the wider profession, the lesson is difficult to ignore. Compliance cannot be treated as a parallel function that records risk while commercial decisions proceed independently. Where risk is identified, it must shape the outcome. If it does not, the firm may find itself answering a question that is much harder than whether it followed procedure.
The Dentons case does not suggest that firms should avoid high-risk clients altogether. It suggests that they must be prepared to justify, in detail and with evidence, why acting for those clients was consistent with their obligations. That justification must withstand scrutiny not only from regulators, but from tribunals and courts willing to look beyond labels and examine the substance of what was done.
The uncomfortable conclusion is that “good faith” is not a safe harbour. It may explain how a breach occurred, but it does not determine whether that breach is serious. In a regulatory environment that increasingly focuses on outcomes rather than intentions, firms that rely on good faith without demonstrating effective control may find that the distinction offers less protection than they expect.