TL;DR:
- Effective law firm onboarding establishes documented compliance controls for client and staff intake, ensuring regulatory requirements are met from the start. It integrates identity verification, source of funds, sanctions screening, and cybersecurity measures into a sequenced workflow with clear sign-offs. Proper operationalization of these steps creates audit-ready records and reduces compliance risks, supported by structured systems like Onboardinggenie.
Most law firm administrators treat onboarding as a starting line. Get the paperwork signed, hand over the access credentials, and move on. But the role of compliance in law firm onboarding is far more consequential than that framing suggests. Onboarding is where your firm's first and most defensible compliance controls either get established or get skipped. For both clients and new staff, what you document, verify, and attest to during intake becomes the foundation your regulatory posture stands on. This article gives you a practical, practitioner-level look at what compliance requirements actually require at each stage.
Table of Contents
- Key Takeaways
- Client onboarding compliance requirements
- Staff onboarding compliance protocols
- Operationalizing compliance in onboarding workflows
- Complaints handling as an onboarding compliance obligation
- My take on where onboarding compliance actually breaks down
- How Onboardinggenie supports law firm compliance
- FAQ
Key Takeaways
| Point | Details |
|---|---|
| Onboarding is a compliance control point | Client and staff intake creates the documented evidence that regulators examine when things go wrong. |
| AML checks must be documented, not just done | Identity verification, source of funds, and sanctions screening all require formal records retained at intake. |
| Staff onboarding needs sanctions screening | Integrating sanctions checks with background checks on day one prevents a commonly overlooked risk gap. |
| Technology configuration affects regulatory compliance | Access permissions must be set so the right staff can perform ongoing client monitoring under Regulation 28(11). |
| Complaints transparency starts at onboarding | Clients must receive written information about your complaints process before or at the start of the engagement. |
Client onboarding compliance requirements
Client intake is where your anti-money laundering obligations become concrete. The SRA requires that solicitors confirm client identity with documents such as passports and utility bills before proceeding, even when the client is already known to the firm. Familiarity is not a substitute for documentation.
Beyond identity, source of funds verification is a mandatory step for most matters. Accepted documentation typically includes recent bank statements, a letter from an accountant confirming business income, or evidence of a property sale. The key is proportionality. A client funding a straightforward residential purchase with a bank transfer from their savings account carries a different risk profile than a client using a third-party payment from an overseas company. Your documentation should reflect that distinction.
Sanctions screening cannot be treated as a one-time checkbox at intake. The SRA mandates documented risk assessments with ongoing monitoring for the client relationship's duration. That means your onboarding process needs to establish the screening result and the monitoring cadence from day one.
When your firm relies on third-party digital identity verification tools, the compliance responsibility stays with you. The SRA is explicit that reliance on digital ID vendors requires documented due diligence on that provider, and your staff must understand what those tools verify and what they do not. Outsourcing the task does not outsource the obligation.
Here is what effective client onboarding compliance documentation should capture:
- Full identity verification records including document type, date checked, and who conducted the check
- Source of funds documentation with the specific evidence reviewed
- Initial sanctions screening result, the database queried, and the date of the check
- Client risk rating with the rationale recorded and a supervisor or compliance officer sign-off
- Confirmation that the client has been informed of your complaints procedure in writing
Pro Tip: Create a client intake checklist that requires a named compliance officer to sign off on the risk rating before any work begins. This single step converts onboarding compliance from a passive form-fill into a supervised control point.
Staff onboarding compliance protocols
The importance of compliance in onboarding applies equally to your new hires. Yet most small law firms run their HR onboarding and their compliance onboarding as separate tracks, and that gap creates real risk.
Sanctions screening during staff intake is one of the most commonly missed controls. The SRA guidance is clear that sanctions checks for new employees should be integrated with standard background and DBS checks rather than treated as an afterthought. Someone who clears a criminal record check can still appear on a sanctions list, and the two searches draw from entirely different databases.
Cybersecurity configuration is the other area where staff onboarding compliance often falls short. New employees should receive access credentials only after role-appropriate system permissions have been set. In jurisdictions like New York, professional conduct rules require reasonable cybersecurity controls including multi-factor authentication and AES-256 encryption as an ethical duty, not just a best practice. Failure to configure these controls during onboarding can expose the firm to malpractice claims and disciplinary action.
Consider what a compliant staff onboarding protocol covers:
- Sanctions screening run against current databases and dated records retained
- DBS or equivalent background check with results documented
- System access granted on a least-privilege basis, with role permissions documented
- MFA enabled on all client-data systems before the employee accesses live files
- Written acknowledgment of data protection and confidentiality policies
- Completion of compliance training on AML procedures, conflicts of interest protocols, and IT security
Pro Tip: Build a staff onboarding completion checklist that requires HR, IT, and the compliance officer to each sign off independently before the new hire accesses client files. Three separate sign-offs take minutes but close the gaps that single-track HR onboarding leaves open.
You can find a detailed walkthrough of the full employee onboarding process for small firms, including compliance protocols, in the OnboardingGenie resource library.
Operationalizing compliance in onboarding workflows
Knowing what compliance requires and actually building it into your onboarding workflow are two different problems. Most compliance failures at small firms do not happen because administrators are unaware of the rules. They happen because the process is fragmented: one team member emails a form, another chases an ID document on a spreadsheet, and nobody can confirm whether the sanctions check was actually run or just noted as pending.
The goal is an onboarding process where compliance steps are embedded in sequence, not bolted on afterward. That means standardized intake forms that require each compliance field to be completed before the workflow advances. It means automated conflict checks triggered at client intake, not after the engagement letter is signed. And it means documented risk assessments with named approvers, not just a box that says "risk level: low."
Technology configuration matters here in a way that has direct regulatory consequences. Under Regulation 28(11), onboarding systems must be set up so that appropriate staff can access due diligence records for ongoing monitoring. Restricting that access through poorly configured permissions is itself a compliance failure, not just an IT oversight.
Audit readiness should be designed in from the start. Audit-ready onboarding documentation means capturing who approved the client risk rating, when each check was performed, and what documentation was reviewed. When a regulator asks those questions, the answer should come from a structured file, not from memory or a chain of emails.
| Process element | Manual/spreadsheet approach | Integrated workflow approach |
|---|---|---|
| Identity verification tracking | Email chain with attached scans | Centralized intake portal with time-stamped uploads |
| Sanctions screening record | Separate spreadsheet, often incomplete | Embedded in intake flow, auto-dated and retained |
| Risk rating sign-off | Verbal or informal email | Named approver field, required before workflow advances |
| Ongoing monitoring visibility | Dependent on individual memory | Role-based access to live compliance record |
| Audit trail | Reconstructed from multiple sources | Single file, export-ready for regulatory review |
Independent file audits are a practical feedback mechanism here. Structured audits of your onboarding files reveal where documentation gaps actually occur versus where you think your process is solid. Many firms discover through their first file audit that risk ratings were recorded without documented rationale or that third-party ID verification results were retained without the required provider due diligence.
Pro Tip: Run a sample audit of five recent client intake files using your compliance checklist. The gaps you find are your onboarding process gaps, and they are far cheaper to fix before a regulatory review than after one.
For a deeper look at AML compliance in onboarding for small firms, including documentation templates, that resource is worth reviewing.
Complaints handling as an onboarding compliance obligation
Most administrators think of complaints handling as a post-engagement issue. The regulatory requirement is different. Clients must be informed in writing about your complaints process at the start of the engagement, not after a dispute arises.
This is a concrete compliance step, not just a client service nicety. Your onboarding documents need to include a plain-language explanation of how a client can raise a complaint, who handles it internally, and what external body they can escalate to. That last point matters. For SRA-regulated firms, clients have the right to escalate to the Legal Ombudsman, and they need to know that from day one.
Practically, this means your client onboarding packet should include:
- A written summary of your complaints procedure, in plain English
- The name or role of the person who handles complaints internally
- Reference to the Legal Ombudsman with contact details and eligibility timelines
- A confirmation that the client has received and acknowledged this information
Publishing your complaints procedure on your firm's website is also required, but website publication does not replace the obligation to provide it directly at onboarding. Both requirements apply. Compliance tracking for your onboarding workflow should include a confirmation step that the complaints information was delivered and acknowledged, not just that it exists somewhere on your website.
You can explore how a structured compliance tracking system handles these documentation obligations across the full client lifecycle.
My take on where onboarding compliance actually breaks down
I have seen the same pattern repeat itself across small firms. The compliance knowledge exists. The MLRO or compliance officer knows exactly what the SRA requires. The HR manager knows what the onboarding checklist says. But those two things live in different documents, different systems, and different people's heads. When a new client comes in or a new hire starts, each person completes their own part and assumes someone else handled the rest.
The result is not deliberate negligence. It is structural fragmentation. And it produces exactly the kind of documented compliance gaps that file audits and regulatory reviews expose.
What I have found actually works is treating onboarding as a single, sequenced workflow rather than a set of parallel tasks owned by different departments. When the compliance officer cannot proceed with a client risk sign-off until HR confirms sanctions screening was completed, and HR cannot issue access credentials until IT confirms MFA is configured, the interdependencies become visible and accountable.
The other mindset shift worth making: compliance in onboarding is not a burden your firm manages. It is evidence your firm generates. The records you create at intake are the proof you acted responsibly, regardless of what happens later in the engagement. Firms that understand this build onboarding processes they are genuinely proud to show a regulator. The ones that treat it as paperwork scramble to reconstruct records when it matters.
— Chris
How Onboardinggenie supports law firm compliance
If your current onboarding process relies on scattered email attachments, manually updated spreadsheets, and disconnected signature tools, Onboardinggenie was designed specifically to replace that setup for small professional service firms.
Onboardinggenie consolidates your client and staff onboarding into a single branded portal where compliance steps are built into the workflow sequence, not added as an afterthought. Intake forms require completion of AML documentation fields before advancing. Risk assessment sign-offs are captured with named approvers and timestamps. Staff onboarding packets can include sanctions screening attestations, cybersecurity policy acknowledgments, and compliance training completion records, all in one place.
The result is an onboarding file that is audit-ready by design, without the cost or complexity of enterprise tools. You can explore compliance management features or start a free trial to see how it fits your firm's workflow.
FAQ
What does compliance in law firm onboarding actually require?
At minimum, it requires identity verification, source of funds checks, sanctions screening, a documented risk assessment with approver sign-off, and written complaints procedure disclosure for clients. For staff, it requires sanctions screening alongside background checks, role-appropriate system access, and documented compliance training before accessing client files.
Can a law firm rely on digital ID verification tools for AML compliance?
Yes, but the firm retains full compliance responsibility. The SRA requires documented due diligence on any third-party identity verification provider, and staff must understand the limits of what those tools verify.
What is Regulation 28(11) and why does it affect onboarding technology?
Regulation 28(11) requires that appropriate staff can access client due diligence records for ongoing monitoring. Law firms must configure system permissions during onboarding so that compliance-relevant personnel are not locked out of the records they need to fulfill this obligation.
How does complaints handling fit into onboarding compliance?
Firms regulated by the SRA must provide clients with written information about the complaints process at the start of the engagement, including details on escalating to the Legal Ombudsman. This must be captured in your onboarding documentation, not just published on your website.
What is the biggest compliance risk in staff onboarding for law firms?
Running HR onboarding and compliance onboarding as separate processes creates the most consistent risk gap. Sanctions screening is frequently missed because it sits outside the standard DBS check workflow, and system access is often granted before cybersecurity controls like MFA are confirmed as active.