The Shape of Law-Firm Risk & Compliance in 2025: Structure and Resourcing 

Risk & Compliance – from back-office to boardroom
Once considered back-office support, risk and compliance (R&C) has moved to the centre of how UK firms operate. Our Law Firm Risk & Compliance Maturity Study 2025 examines where the function sits and how teams are resourced. Managing Director Chris Cayley offers some practical actions to consider. 
 
This study is the most comprehensive look to date at how UK law firms (including UK offices of US firms) structure, resource and value their R&C functions, and how professionals in those teams experience their careers. Across interviews and surveys, the picture is clear: the function has moved from “necessary obligation” to “vital strategic asset,” but maturity varies by firm.
 
Where R&C sits in 2025
The study makes a few things clear.
• Independence is increasingly the norm. 86% of firms now report a fully independent General Counsel or R&C function; only 10% still combine R&C with other operations and 3% cover only narrow areas with the rest pushed to fee-earners
• Leadership titles signal maturity: 48% of teams are led by a General Counsel, 45% by a Director/Head of Risk & Compliance, and 7% use the title Chief Risk & Compliance Officer.
• Regulatory responsibilities remain split: about 55% of MLROs are partners versus 34% of COLPs and 31% of DPOs.

Against that backdrop, a common operating model has emerged at the top end of the market: a General Counsel/Director with a tight span of control and specialist “Heads of” for business acceptance, financial crime, data/privacy, PI/insurance and sometimes litigation or commercial. Some firms split business acceptance from legal/risk; others group by risk area. There isn’t a single “right” blueprint, but the pattern that works best is consistent: modular sub-teams with crisp interfaces, lean escalation paths, and 2–5 direct reports at the top so the leader has time for strategy, policy and cross-border alignment.
 
Resourcing: capabilities growing, pipelines tight
Over the last 15 years, the Office of the General Counsel has broadened to cover conflicts, reporting, governance, data/privacy, procurement and internal investigations, mirroring corporate in-house teams. More qualified lawyers are choosing this path.
But demand outpaces supply. As demand and the scope of roles grow, candidates with the right mix of legal and regulatory experience are head-hunted more often. This is driving churn and putting upward pressure on salaries, leaving firms open to losing talent unless they seriously invest in retention and development.

Where firms are investing next
On resourcing choices, technology is the top near-term investment, selected by 75% of firms, followed by training (14%). Yet adoption is uneven: in the study, respondents described systems that exist but aren’t fully connected, which adds friction rather than removing it. Technology is part of the answer when it frees people up. Well-chosen tools shrink repetitive steps (screening, document collection, basic orchestration) and integrate cleanly with matter opening and billing. Poorly chosen tools add “second systems” and extra forms.

The study’s message here is pragmatic: treat automation and AI as enablers of judgement, not as a substitute for it.
 
Practical actions to consider
You don’t need a wholesale transformation, just a few targeted moves that reshape workflow and clarify decision-making.

Value compliance expertise on an equal footing with fee-earning roles
 
Closing Thought
The firms moving fastest align how R&C is structured, resourced and rewarded with the role they want it to play. Independence, clear leadership, modular teams, enabling tech and consistent pay send a single message: compliance is how the firm moves faster with confidence. 2025 may mark the tipping point where compliance stops chasing the business and starts shaping it. What happens next will depend on how firms turn structure into strategy.

Download the full Law Firm Risk & Compliance Maturity Study 2025
 

To discuss your risk and compliance resourcing needs and the current market, get in touch with Chris Cayley or Michelle Corneby.

Invest in the careers, not just the capacity, of your teams

Adopt a progressive recruitment strategy designed with the future in mind

Treat compliance as a strategic partner, not a reactive backstop

Use tech to enable people, not replace them