For decades, Indian lawyers could reasonably assume that anti-money laundering (AML) enforcement was a banking problem. That assumption no longer holds. The Enforcement Directorate (ED) has dramatically expanded its investigative reach under the Prevention of Money Laundering Act (PMLA), and law firms — particularly those handling real estate closings, corporate structuring, trust formation, and high-net-worth client work — are increasingly drawn into the scope of scrutiny.
The shift is structural, not incidental. Lawyers sit at chokepoints in the transactions that launder money most effectively: property transfers, shell company incorporation, trust and nominee arrangements, and cross-border fund movement. Regulators worldwide have concluded that professional gatekeepers — lawyers, accountants, company secretaries — are either the last line of defense against financial crime or, when compliance is weak, an unwitting (or willing) enabler of it. India's enforcement posture has followed this global trend.
The practical consequence is that a law firm's exposure no longer depends solely on whether a partner personally structured a fraudulent transaction. It depends on whether the firm had reasonable systems in place to recognise red flags, document client due diligence, and escalate concerns internally. The absence of a compliance framework is, in itself, increasingly treated as an aggravating factor when a matter is investigated.
This creates a straightforward business question for every Indian law firm: can you demonstrate, on paper, that your practice recognises money laundering risk and has a documented process for handling it? If the answer is uncertain, the firm carries risk that has nothing to do with any individual partner's intentions.
The stakes are not abstract. Maximum imprisonment under PMLA provisions runs into years, and NDPS-linked exposure extends further. Reputational damage — the loss of institutional clients who now conduct their own vendor due diligence on law firms — often arrives well before any formal proceeding does.
The practical response isn't complex: risk-awareness training, a documented client due diligence process, and clear internal escalation procedures. Firms that build this now are simply choosing to build it on their own terms, rather than reconstructing it under the pressure of a regulator's request for information.