Search and find what you need faster.

Archive for the ‘Uncategorized’ Category

Dominic Holden discusses proposed ransomware ban in Law 360

Posted on: May 23rd, 2025 by Natasha Cox

Director Dominic Holden discusses the UK government’s proposals for a ransomware ban in Law 360.

Dominic’s article was published in Law 360, 22 May 2025, and can be found here. 

Ransomware ban move could push hackers to private sector

The government’s bid to crack down on ransomware payments could heap pressure on companies in crisis without any guarantee that it will pull the plug on the billion-pound cybercrime industry, lawyers say.

Proposals by the Home Office to ban public entities from making ransom payments and to require other bodies to consult with the authorities before they consider sending money to their attackers are intended to undermine the ransomware business model by making the U.K. a less profitable target.

But lawyers warn that the proposals, set out in a wide-ranging government consultation, appear to underestimate the opponents.

“Deceptively simple and undoubtedly well-intentioned, the proposal borders on the naive,” Julian Hayes, a partner at BCL Solicitors LLP said. “Even if it worked, it would simply drive ransomware attackers to softer targets.”

Ransomware pulled in more than £1 billion ($1.3 billion) from victims worldwide in 2023, according to the Home Office. It has become a lucrative source of cash for cybercriminals and state-sponsored actors able to infiltrate businesses and government agencies and take control of their networks and data.

Law enforcement agencies and the government see it as the biggest cyber risk facing businesses in Britain. But it is also perceived as a direct threat to national security because of the ability of criminals to shut down hospitals, energy suppliers and grocery chains.

The National Cyber Security Centre helped to manage 317 ransomware incidents in the 12 months to August 2024. They included 13 separate attacks deemed to be “nationally significant” that “posed serious harm to essential services or the wider economy.”

They include Russian hackers who stole private medical data in June 2024 in a ransomware attack on a medical testing company, Synnovis Services LLP, that disrupted London hospitals. And hackers demanded £600,000 from the British Library to prevent publication of stolen files, a demand it refused to pay, in October 2023.

What to do about the problem divides opinion. Some experts say that paying the ransom puts money in the pockets of organized crime, terrorists and sanctioned individuals — with no guarantee that the stolen data will be returned or services resumed. Paying helps to create a business model, encouraging more attacks.

Many organizations targeted do not pay. Most victims interviewed by the National Crime Agency said they did not want to reward their attackers.

But principles come at a cost.

Marks & Spencer the grocery and clothing chain, continues to lose money following a recent ransomware attack that has disrupted service and will cost it an estimated £300 million. And the Legal Aid Agency, which revealed in May that data dating back to 2010 had been stolen, warned anyone who had applied for legal support in criminal cases that they face the risk of being scammed.

But some companies see no other option. LockBit hackers hit Allen & Overy with a ransomware attack in 2023, but later retracted its threat to release the stolen data. Cyber-experts have interpreted this as a sign that A&O paid out to avoid sensitive client information from being released, although the firm never publicly commented.

Against this backdrop, the Home Office said in March that it was consulting on a range of proposals. They include a limited ban on publicly owned bodies and operators of critical national infrastructure making payments, mandatory reporting of all ransomware attacks by companies that meet thresholds and even approval by the government before they make any payment.

But lawyers warn that the proposals are risky. Payments are already widely viewed as the last resort, a drastic step for companies to take only when backup files restoring their operations fail or there is a risk that the stolen data is not encrypted.

James Longster, a partner in the technology and commercial transactions practice at Travers Smith LLP, said that private sector clients, particularly financial services firms, are concerned that putting restrictions on public-sector targets will simply push criminals to intensify their attacks on them.

“There isn’t a magic answer,” Longster said. “People want to do something because it’s a problem. It’s hard to work out exactly what that is.”

There was also doubt among observers about how the proposals would work in practice. When would companies, trying to get to grips with resuming service, be required to notify the government of the attack? How would a ban, if it was extended to the private sector, affect global companies in countries where there was no bar to payment?

The government has already introduced compulsory reporting of cyberattacks in the Cyber Security and Resilience Bill, which is making its way through Parliament. Victims would be required to report an incident only once. But lawyers say a lack of detail means it is unclear how the proposals would sit alongside existing notification requirements, potentially delaying payment during talks with authorities — and prolonging the disruption.

Business leaders fear the proposals might also lead to expensive red tape when they are already under pressure. Companies already face a race against the clock to disclose cyberattacks to their regulator, the Information Commissioner’s Office — and, potentially, to individuals if personal data was stolen.

Longster predicted that the ban on public sector bodies making payments might not make it into legislation if there was resistance during the consultation. But he said that the reporting obligations to the central government “could meaningfully turn the dial” by equipping law enforcement agencies with the best information possible.

Another proposal would require businesses to gain government clearance to ensure that money would not go to sanctioned individuals or terrorists. Christopher Whitehouse of Reynolds Porter Chamberlain LLP said that limited legislation introducing a reporting requirement – but not going as far as an outright ban – would be a good compromise.

“Save for those extreme cases, if there’s something companies could do to survive, but aren’t allowed, it’s going to be a tough sell,” Whitehouse said.

Britain would become one of few Western governments to introduce the ban – perhaps the only one – if it did so. Many countries have pledged not to pay ransomware, but none have actually made it illegal, even if it involves paying a sanctioned entity.

Some U.S. states have passed legislation banning public authorities from paying ransoms, but experts have warned that the results have been mixed.

Hayes of BCL Solicitors also said that the potential ban on government agencies making payments overlooks the fact that hackers, particularly those backed by hostile governments, are often more interested in causing chaos than making money.

Outlawing ransomware payments “risks making hostages of us all,” Hayes said.

“Such sophisticated threat actors are highly unlikely to surrender without a struggle,” Hayes continued. “Far from being deterred, such groups are more likely to fight tenaciously to protect their lucrative business models, with ‘big game’ ransomware groups intentionally targeting the U.K. essential services on which we all rely, both to break the government’s will and serve as a warning to like-minded countries not to follow suit.”

Some lawyers advocate for a more aggressive policy to help ensure that does not happen.

Dominic Holden of Lawrence Stephens said that hackers would look abroad if it was illegal for public and private sector entities to pay out.

Support for small and midsized businesses in the form of tax breaks or subsidized insurance premiums would also mean that the incentives to target the U.K. would vanish, Holden said.

“If the government is going to do this, I don’t think they should do it in half measures,” Holden said. “If you’re going to eradicate the problem, and disincentivize the hackers so they go overseas in jurisdictions where they can be paid, then grasp the nettle and ban all payments.”

Mark Jones, a partner at Paynes Hicks Beach LLP, said there were also concerns that the mandatory reporting requirement could then trigger regulatory scrutiny. The government would have to assure companies that the information would remain confidential if it wants to win support for legislation, Jones said.

“I would also hope to see measures to support those who are victims of ransomware, rather than simply add to the stress of the situation,” Jones added.

For more information on our cryptoassets expertise, please click here.

How to navigate the first 72 hours of a ransomware attack and recover ransoms paid in crypto

Posted on: May 23rd, 2025 by Alanah Lenten

Dominic and Asim’s article was published in Fraud Intelligence, 21 May 2025, and can be found here.

Discovering that you have been the victim of a ransomware attack can be reputationally and financially devastating to an organisation. However, when responding to an attack, the first 72-hours are critical. Quick and decisive action can help preserve evidence, while protecting assets and systems.

Cyber attacks vary in their potency and impact. A ransomware attack which locks down a company’s entire IT system is, of course, different from a more limited attack on a single device – an organisation’s response will therefore vary. However, notifying your insurers and the police, getting internal and external IT support on task immediately, while also notifying company staff should all be considered.

Where data is at risk, notifying the Information Commissioner and other regulators within 72 hours – as well as your customers – can also be necessary.

Should you pay the ransom?

Current guidance from the National Crime Agency is that they do not “encourage endorse nor condone the payment of ransom demands”. This is because there is no guarantee that you will get access to your data or computer, your computer may still be infected, you will be paying a criminal group, and you increase the likelihood that you (and others) may be targeted in the future.

However, in many cases, commercial victims of a ransomware attack can find themselves unable to continue their business operations whilst key systems remain compromised. This is the hacker’s leverage, that, there may come a point where continued business losses are unsustainable and paying a ransom to unlock their systems becomes an expense in mitigation.

Such ransom payments are often demanded in cryptocurrency and their payment can be covered by insurance. It is important that businesses check their policies to see whether this forms part of their cover.

How to prepare?

Given the number of moving parts involved in managing the aftermath after a ransomware event, it can quickly become overwhelming, unless robust and specific plans are already in place. Such ‘incident response plans’ should already be agreed and understood by the company’s leadership and those staff who will need to take action. Running simulations of how a business will cope during a ransomware attack is advisable (e.g. turning to paper processes in the short term and ensuring that all know what their roles are during an attack).

Backing up your systems on a regular basis and training staff  to recognise unusual behaviour or unexpected activity on their devices is critical – for example, phishing emails, unprompted windows opening up for split seconds, or excessive system resources being used when your device does not appear to be doing much. This can suggest that scammers have taken remote control of your device under the pretence of assisting you through services, like AnyDesk.

How to react?

While you are reacting to the consequences of the breach, you may simultaneously have to identify and fix the vulnerability, comply with legal and regulatory requirements, notify your insurers and provide comfort to your staff, customers and suppliers that matters are in hand. During this period, chaos can ensue, and mistakes can be made that could severely hamper any subsequent investigation.

Below are some key points to bear in mind during this initial period:

Preserve the evidence

The preservation of evidence is a key initial task, and leadership should strive to work with professionals to ensure that all system logs are retained. It is advisable to hire in digital forensics or organisations that specialise in dealing with cyberattacks –if you have good cyber insurance, this is something your insurer may provide.

Avoid formatting or performing factory resets at this stage. Evidence preservation is vital, particularly as forensic digital examination of your devices could yield critical information, instrumental in tracing and recovering the stolen assets.

If possible, take a full forensic image of the affected devices and work from backups (provided these have not also been compromised by the attack). You may need to buy fresh devices so that those affected can be preserved as evidence.

Your internal communications team may want to take on PR consultants to assist with crisis comms as the news breaks, if it is an attack with significant reputational implications.

Secure Your Communications

It may be wise to set up new, secure email addresses immediately and avoid logging into any accounts you suspect may have been compromised. You should consider how best to continue internal communications with secure channels being set up to action any critical messaging

It may be necessary to notify your bank and or other service providers of any new email address, or communication preferences, to ensure that no instructions are to be taken from the old email addresses.

In attacks where the victims have been socially engineered, one or more company email addresses or social media accounts may have been compromised. You should access the log-in history which details the IP address and location of all log-in attempts.

If there are any suspicious logins, it is likely that email addresses have been compromised, and your communications may be monitored or used by the scammers to gain further access. This could also impact other accounts, bank accounts and social media profiles.

It is vital that passwords are immediately changed and strengthened across the organisation.

Communicating with the Hackers

When the hackers reach out to demand a ransom payment from you ensure that they are unaware of the steps you are taking internally.

Ransom payment negotiators are available to assist with these negotiations to drive the ransom demanded down. This can also buy an organisation time if the hacker is threatening to publish the compromised data on the internet.

Make sure to collate a detailed record of all communications with the hackers, including requests for payments, emails, phone calls, text messages, social media interactions. If the ransom is paid in crypto, take a note of the transaction details, wallet addresses and transaction hashes etc.

If you have been directed to a webpage during your interactions with the hackers, you should ensure to take screenshots of these pages in case they disappear. Any evidence of what jurisdiction they may be in is also vital.

Accurate records are crucial for any subsequent legal action and investigations.

Recovering the ransom payment

If the ransom is paid in crypto, this could give you and your legal team time to investigate and trace the assets, write to any centralised exchanges who may be in receipt of those assets, and put them on notice of the theft and request that they freeze those accounts pending further legal action. It may also allow time for the necessary court orders to freeze assets to be granted and implemented. These steps, if taken quickly, can result in an organisation (or their insurer) recovering the ransom after it has been paid.

Your legal team will quickly be able to identify suitable independent blockchain tracing specialists who will be tasked with conducting an initial tracing report to follow the movement of your crypto assets and their traceable proceeds. You will need to provide proof that you owned the assets, as well as relevant transaction hashes or addresses as these will form the basis of asserting your proprietary claim to those assets, which is essential in recovering them.

Hackers typically seek to convert stolen crypto assets into cash, often using centralised exchanges as their off-ramp. The first step in any successful crypto asset recovery matter is identifying the exchanges used. Exchanges are subject to a degree of regulatory oversight and compliance mechanisms to satisfy the requirements of typically highly regulated banking entities.

Your legal team can place exchanges on notice that they have received the proceeds of crime and request they freeze the relevant accounts while also requesting disclosure of any onward transfers and withdrawals from that account to trace the stolen assets.

Report to Law Enforcement

The attack should be reported to the police and Action Fraud. Make sure you keep a copy of your report, as well as any crime reference numbers provided.

It is important that you engage with your local police force as much as possible and obtain a direct liaison and contact details. Try not to be discouraged or frustrated if the police cannot offer much help.

Police resources, expertise, and capacity to deal with cyber crime can vary considerably, and officers may lack immediate familiarity with the complexities involved.

Even if the police can’t provide much assistance, a formal report is important, as it creates an official record that supports other legal and recovery actions you may take and can also assist law enforcement in identifying patterns in criminal gangs to help others avoid falling victim.

Engage with Experts

Engaging promptly with specialist IT and legal advisors experienced in breach response is crucial to mitigate the fallout from the attack and limit business interruption.

Cyber experts should be able to quickly identify the areas of your system that have been affected, the extent of the breach and the data under threat, as well as devise a plan for bringing your systems back into operation. It may be possible to decrypt some of the compromised data without paying the ransom, or to restore your systems from backups.

Your legal team should work closely with these experts to ensure that your regulators are notified of the attack and kept abreast of developments. Your legal team may also need to review your company’s commercial agreements, to see if any termination or notification events are triggered as well as deal with any claims that might arise from your suppliers or customers as a result of the attack.

Conclusion

Careful advanced planning and swift and methodical action when an attack occurs can reduce stress, while also significantly limiting the damage a ransomware attack can cause to an organisation in the first 72 hours.

Crypto recovery – navigating the first 72 hours

Posted on: May 23rd, 2025 by Natasha Cox

When a person goes missing, the first 72-hours are mission critical.

The same urgency applies if you have been hacked, scammed or are the victim of a theft- even more so if the loss are crypto assets. Quick and decisive action in the immediate hours will significantly mitigate the risk of those assets being obfuscated and dissipated and assist with recovery.

Crypto scammers are particularly ruthless, often deploying all manner of sophisticated tactics. From straightforward account compromises and theft with no direct interaction, to elaborate social engineering, often gaining trust through dating websites, fake investment platforms, or social media, their ultimate aim is to deprive a rightful owner of crypto assets.

Discovering that you have been the victim, regardless of the methodology used, can be emotionally draining as well as financially devastating. Clarity of thought and rational action can often give way to absentmindedness. This can lead to victims continuing to pay the bad actors, or fake recovery firms who are one and the same.

In the circumstances this is entirely understandable.

The appropriate next steps can vary depending on the specific circumstances, however our recommended action plan is detailed below and applies to most scenarios:

  1. Secure your communications

Often, particularly in cases where victims have been socially engineered, your email addresses and social media accounts will likely have been compromised as the result of the hack.

Most mainstream email providers will allow you to see a log-in history which details the IP address and location of all log-in attempts. Consider if any are unrecognisable.

If there are any suspicious log-ins, it is likely that your email address has been compromised and your communications may be monitored by the scammers. This could also impact other personal and financial accounts linked to your email, such as online shopping accounts, bank accounts and social media profiles. Credit ratings and access to future baking facilities may also be affected.

In this case, it is vital that you immediately change the password for your email, and then for all other accounts held online.

In addition, we recommend that you set up a new, secure email address immediately and avoid logging into any accounts you suspect may have compromised. You should divert any personal and critical emails to your new account, and ensure that you update your email address across your online shopping, social media and bank accounts.

It is important that you notify your bank and or cryptocurrency exchange of your new email address, which replaces the old one, and ensure to communicate that no instructions are to be taken from the old email address.

  1. Cease communications strategically

In cases where scammers have maintained prolonged contact, they may continue to reach out to you. Let them remain unaware you know this is a fraudulent scheme. If they know that you are aware, there is a heightened risk that they will take steps to obfuscate their trail and dissipate assets, which can make asset recovery more complicated.

If you can, you should look to cease communication strategically without encouraging further interaction. One approach might be to indicate you will be unavailable or away for a few weeks. This will hopefully give you and your legal team time to investigate and trace the assets, write to any centralised exchanges who may be in receipt of those assets, and put them on notice of the theft and request that they freeze those accounts pending further legal action.

In short, the longer the scammers believe that their scam is undetected, the better.

You should then immediately begin collating a detailed record of all previous communications, including requests for payments, emails, phone calls, text messages, social media interactions, transaction details, wallet addresses and transaction hashes etc. Accurate records are crucial for any subsequent legal action and investigations. If you have been directed to a webpage during your interactions with the scammers, you should ensure to take screenshots of these pages in case they disappear.

Evidence of what jurisdiction they may be in is also vital. For example, note of their telephone number and dialling code (e.g. +44 for UK) or mention of a registered office (even if untrue) will help dramatically.

  1. Report to law enforcement

As soon as possible, you should report the theft to the police and Action Fraud – or equivalent law enforcement agencies. Make sure you keep a copy of your report, as well as any crime reference numbers provided.

It is important that you engage with your local police force as much as possible, and obtain a direct liaison and contact details. Action Fraud is only a database, and your query will not progress unless the police investigate.

Try not be discouraged or frustrated if the police cannot offer much help. Police resources, expertise, and capacity to deal with crypto related crimes can vary considerably, and officers may lack immediate familiarity with blockchain technology, or the complexities involved

Even if the police are unable to offer much direct assistance, formally reporting the incident is a crucial step as it creates an official record that supports any subsequent legal and recovery actions you may take with the support of your legal team.

  1. Device management and evidence preservation

Given that so much of our lives are conducted online and contained within personal devices such as laptops and mobile phones, it is crucial to exercise heightened caution if these devices may have been compromised.

If you notice unusual behaviour or unexpected activity on your devices (for example, unprompted command prompt windows opening up for split seconds, or excessive system resources being used when your device does not appear to be doing much) then this may be an indication your device may be compromised.

This is more likely if the scammers have previously taken remote control of your device under the pretence of assisting you through services, like AnyDesk.

As tempting as it may be, avoid formatting or performing factory resets at this stage. Evidence preservation is vital, particularly as forensic digital examination of your devices could yield critical information, instrumental in tracing and recovering the stolen assets. Formatting or resetting the device risks destroying potentially valuable evidence which often indicates the attack vectors used by the scammers and can be a useful part of the puzzle in identifying who they may be.

If your budget permits, obtaining new, uncompromised devices for interim use is recommended.

  1. Secure remaining cryptoassets

It may be that the scammers have only targeted or been able to target specific parts of your crypto holdings. However, if your devices or email/social media accounts have been compromised, it is likely they know much more than you think – including what centralised exchange accounts and wallet addresses you have that they may wish to target next.

As such, you should immediately access and review all centralised exchange accounts you may hold online, and cold storage where applicable. Update your details held at these accounts, including email, contact information and passwords.

It is also crucial to strengthen your two-factor authentication and carefully review transactions to identify any activity you do not recognise which may be indicative of that account being compromised.

If you are holding any assets on these accounts, consider creating new, secure self custodial wallets on uncompromised devices and transferring remaining assets between multiple wallets.

If you have previously staked assets, check to see whether these remain staked or have been unstaked without your knowledge and are in any cooldown period. If unstaking has been initiated, try to take steps to ensure the unstaked assets can immediately be sent to your new, secure wallets as soon as possible.

  1. Engage with experts

Engaging promptly with specialist lawyers experienced in crypto asset disputes, particularly asset tracing on blockchains and recovery, can be vital ensuring the swift tracing and recovery of your assets.

Your legal team will quickly be able to identify suitable independent blockchain tracing specialists who will be tasked with conducting an initial tracing report to follow the movement of your crypto assets and their traceable proceeds. You will need to provide proof that you owned the assets (such as statements) as well as relevant transaction hashes or addresses as this will form the basis of asserting your proprietary claim to those assets. This is essential in recovering such assets.

Scammers typically seek to convert stolen crypto assets into cash, often using centralised exchanges as their off-ramp. The first step in any successful crypto asset recovery matter is identifying the exchanges used. These exchanges will have established payment rails which allow them to enable the transfer of fiat funds and are crucial to their business operations. 

As these payment rails exist within a regulated environment, banks must be comfortable with the funds handled by these exchanges. Consequently, exchanges are subject to a degree of regulatory oversight and compliance mechanisms to satisfy the requirements of typically highly regulated banking entities.

Once an investigator can identify exchanges which have received the stolen assets, your legal team should then enter into dialogue to place them on notice that they have received the proceeds of crime and request they take specific actions. These include freezing the relevant accounts to secure any assets held within, as well as requesting disclosure of any onward transfers and withdrawals from that account which can be used to further trace the stolen assets with a view to recovery.

This draws a line in the sand – the exchange is now aware of the issue and any funds held at or subsequently deposited at that account must now be frozen.

  1. Seek emotional support

Recognising that you have fallen victim to a scam can trigger intense emotional distress, anxiety, and feelings of isolation. It is important to recognise you are not alone and that these feelings, while overwhelming, are a common response to what can be a very personal breach of privacy, trust and security.

If you find yourself in such a position, consider reaching out to supportive friends and family. Whilst there are also online communities offering support to victims, you should treat these with caution, as these can present attractive hunting grounds for scammers seeking to exploit those at their most vulnerable.

If you find your emotional state severely impacted or you are feeling persistent low, anxious or overwhelmed, it is essential to seek professional medical or mental health support.

As outlined above, acting quickly and methodically within the immediate hours and days after discovering a scam or can significantly improve the prospects of recovery and limit the broader financial and emotional damage.

For more information on our services relating to technology disputes, please click here. For our cryptoassets services, please click here

Lawrence Stephens featured in PM Forum Magazine

Posted on: May 22nd, 2025 by Natasha Cox

Managing Director Steven Bernstein, Chief Operating Office Johnny Nichols and Head of Business Development and Marketing Daryl Atkinson feature in the latest edition of PM Forum Magazine talking about what makes the culture at Lawrence Stephens so special, and how this is powering our growth.

Founded in 1996, PM Forum is the world’s largest community of professional services marketers, with more than 3,000 members in over 40 countries. The Forum is dedicated to raising the standards of marketing across law, accountancy, property and other professional sectors.

House Shouts

There will be very few law firms where the CEO knows the names of all 190 staff, and even fewer where those people are, like school, assigned a ‘house’. Alongside phenomenal growth, this is why Lawrence Stephens has been repeatedly tagged as the firm to watch.

Matt Baldwin speaks to Managing Director Steven Bernstein, Chief Operating Officer Johnny Nichols, and Head of Business Development and Marketing Daryl Atkinson.

Lawrence Stephens like to do things differently. It is a relative newcomer to the London legal market, founded in 1997, and, like many other firms, named after its founding directors.

But unlike its peers, the firm is strictly first names only. The ‘Lawrence’ is Lawrence Kelly and the ‘Stephens’ are Steven Bernstein and Stephen Messias. All are still involved in the firm.

It is a hint towards its difference.

The firm is a limited company, with directors instead of partners, focused on entrepreneurial owner-managed businesses, SMEs and financial institutions, particularly challenger banks.

“We know what we are good at, and we concentrate on that,” explains Managing Director Steven Bernstein. The firm does, however, provide the full service of legal advice for those clients and will, as it grows “stay in its lanes, acting for bigger clients”.

It is an approach that is clearly working, seeing revenue increase by 30% a year over the last five years, and its headcount growing from 50 to 190 people. It was named by The Lawyer as a ‘firm to watch’ in its December 2024 podcast.

It is, however, its culture that truly marks the firm out as different.

Bernstein spends 30 minutes every day walking the floors and talking to his colleagues. Remarkably, he knows them all by name. “I see it as part of my job description to walk the office, chat with people and ask them how they are doing, if everything’s OK. “I have to work at it, particularly with 40 new members of staff this quarter alone, but it is the easiest 30 minutes of my day.”

The firm’s Farringdon office is open plan with no allocated desks. It means staff quickly get to know each other.

“It creates a real buzz,” says Johnny Nichols, the firm’s Chief Operating Officer, “with conversations and discussions naturally occurring all the time. It means those who have recently joined us get to meet others and build relationships quickly. “Importantly,” he adds, “it fosters the kind of environment where everyone is nice, enjoying each other’s company, happy to collaborate and celebrate each other’s wins.”

And then there are the firm’s ‘houses’, named after locations of previous offices – Baker (Baker Street), Portland (Great Portland Street), Wigmore (Wigmore Street) and Morley (Morley House on Holborn Viaduct).

“The idea came from our trainees,” explains Bernstein, “with first-year trainees appointed ‘head of house’. Everyone in the firm is a member of one of the four houses. There are competitions throughout the year for ‘house points’ that at the end of each year are turned into charitable donations.”

Every summer, there is the firm’s sports day and BBQ where house members, joined by partners and families, compete for house glory. Other events include the ‘Bake-Off’ challenge and the annual house quiz.

“It empowers younger people, breaking down the hierarchy in the firm,” says Bernstein. “It means that as we grow, staff get to know each other much easier. Importantly, it’s fun, and we want everyone to enjoy what they do and where they work.”

Lawrence Stephens 3.0

Entrepreneurial businesses are never static. Just as its clients grow and change, so too is Lawrence Stephens. “We are currently Lawrence Stephens 2.0,” says Bernstein, “and quickly heading towards Lawrence Stephens 3.0”.

Part of that journey has been the investment in a strong business services team, supporting and guiding the legal teams.

Nichols joined the firm as its Chief Operating Officer in September 2022 having held senior roles in Allen & Overy and Bird & Bird. Daryl Atkinson joined in June 2024 as its Head of Business Development and Marketing. He leads a team of five.

“There are two aspects to the role,” explains Atkinson. “There is the execution piece, making things happen efficiently and effectively and without reinventing the wheel, and the advisory piece, trying to encourage the right kind of behaviours and activity that deliver results. “I strongly believe that to make waves, a firm of this size needs to be really clear about its future. We can’t be in every market – it is just not possible. It’s about bringing focus to the firm. We know what we are good at and what we should concentrate on. We are also clear on what we not going to do.”

Atkinson and his team have made an immediate impact.

“We are a people business,” explains Bernstein, “and that means the relationships we have with our clients are important. They like what we do and keep coming back to the firm. Daryl and his team are helping us to better leverage those relationships and to understand where we should focus our energy.

“We are now better known in the areas we work than ever before. The reputation change has been enormous, and the foundations are now in place for the firm to grow into Lawrence Stephens 3.0.”

Lawrence Stephens 3.0 will look and feel very similar to the firm today. Its culture will be jealously guarded and nurtured.

“We don’t want to lose our humanity,” says Nichols. “Our HR team is helping us to articulate what our culture means to people individually so we can find ways to hold on to that and sustain it as we grow.”

That growth might see the addition of new teams – it recently took a banking and real estate finance team from the collapsed Memery Crystal – and the addition of new expertise, but only if it fits the firm’s tight client profile.

“We can imagine ourselves with an office a little further north… a kind of hub for clients in Birmingham, Manchester or Leeds,” adds Bernstein. “But there is no intention of having an office in every town or a large international footprint.”

There is an energy inside Lawrence Stephens, a sense of urgency and mission that is shared by its 190 people. It is a little less like a law firm and more like its entrepreneurial clients. And that should leave the more traditional mid-tier firms looking nervously over their shoulders.

Lawrence Stephens successfully acts for Respondent parent in reported case of M v F

Posted on: May 15th, 2025 by Alanah Lenten

Lawrence Stephens’ Family team, led by Co-Head of Family Eleanor Wood, recently acted for the Respondent parent in the reported Family Court case of M v F [2025] EWFC 114 (B).

A fact-finding hearing as part of child arrangement proceedings, the four-day hearing concerned allegations of long-standing abuse and controlling behaviour made my Lawrence Stephens’ client (Parent M) against their former partner. These included allegations of physical abuse (one of which lead to police involvement), emotional abuse, coercive and controlling behaviour and sexual abuse.

The Applicant (Parent F) contested these allegations, however the judge noted that their evidence was “remarkably inconsistent and lacking in credibility.” The Applicant’s argument that the allegations were financially motivated and intended to block their contact with their child was also rejected by the court.

Concluding her judgment, HHJ Owens upheld all allegations of abuse behaviour made by the Respondent parent, with the case proceeding to determine what arrangements are in the best interest of the child.

The full judgment can be read here.

Emma Cocker comments on the role of AI in legal services in City AM

Posted on: May 15th, 2025 by Natasha Cox

Senior Associate Emma Cocker comments in City AM on the future of AI within law firms, arguing that it can be a useful tool, however lawyers and employers must act cautiously as improper use can have serious legal implications. 

Emma’s comments were published in City AM, 15 May 2025, and can be found here.

“AI undoubtedly plays a huge role in the future of legal services. It will make them more accessible and affordable, which is a huge benefit, given that so many people and small businesses struggle to access legal services. It can also speed up output, with the automation of repetitive and time-consuming tasks helping lawyers to work more efficiently, which also translates to costs savings for clients.

“However AI must be used with caution. Remember that it should be used as a starting point and that the output is only ever as good as the input, which may be vulnerable to online misinformation. As such, AI content must always be reviewed for accuracy and subject to ultimate approval by a human being. We know that AI ‘hallucinates’ and we have already seen lawyers over relying on AI coming unstuck. As well as the professional embarrassment factor, AI could deskill junior lawyers who may not be practicing legal researching and drafting to the same degree as previous generations of lawyers. It may also contribute to a decline in the development of other key skills, such as critical and independent thinking.

“In authorising the first AI-driven law firm, the Solicitors Regulation Authority made it clear that lawyers relying on AI output will be ultimately responsible for the consequences and that professional standards must always be maintained to ensure public trust and confidence in the sector. Those who do use AI improperly may find themselves facing disciplinary proceedings by their employer and the regulator and in cases of ‘AI gone wrong’ there is scope for negligence claims by clients, as well as costs applications by opponents.”

For more information on our Employment services, please click here.

Matt Green interviewed by Commercial Dispute Resolution

Posted on: May 14th, 2025 by Natasha Cox

Head of Blockchain and Digital Assets and Technology Disputes, Matt Green, speaks with Commercial Dispute Resolution (CDR) about his career in the crypto asset space and how some of the notable cases he has worked on have influenced legal precedent around blockchain and digital assets. 

Matt’s interview was published online in Commercial Dispute Resolution (CDR), 12 May 2025 and can be found here.

Discussing the first crypto case he was involved with, the landmark AA v Persons Unknown, Matt explains “I was enormously opportunistic, and I just rode with it… I was in the right place at the right time.”

He notes how there was “a big gap in the market” at the time, with many in the blockchain and digital asset space not knowing that there were legal routes to trace and recover their stolen or hacked assets.

Speaking on lessons learned during his career, Matt comments:“It is attrition, staying in the game, not overreaching. Being very aware that you don’t know everything. I don’t think anybody could say they did have all the answers, on the basis that the judiciary and the industry are trying to figure it out.”

Discussing the evolution of both his practice and the digital asset space itself, Matt explains that “there will be huge intellectual property battles about a variety of different things that we probably can’t even imagine yet, it’s almost unknowable.”

With many of Matt’s cases showing the “grizzly places” of the crypto world – from pig butchering scams on Facebook groups for grieving widows to tracing stolen assets to an organ farm in Southeast Asia, and the high-profile disputes over the identity of Satoshi Nakamoto.

Yet despite this, Matt encourages people to see the wider utility of this technology, telling CDR that he would like to see the “wider adoption and understanding of the applications of blockchain tech and digital assets.”

For junior lawyers looking to get into the constantly evolving world of digital assets and blockchain, Matt explains that there are plenty of ways: “set up a blog, write articles, start a podcast, join groups. If you get involved with the industry that you choose, you’re going to be much more valuable to a law firm than if you don’t, and there is no date by which you should start doing this.”

For more on our Blockchain, Digital Assets and Technology Disputes services, click here

Lawrence Stephens strengthens Residential Real Estate practice with senior hire

Posted on: May 12th, 2025 by Natasha Cox

Lawrence Stephens is delighted to announce the appointment of Alexa Kordowicz as a Director in the firm’s growing Residential Real Estate team.

Alexa joins from Child & Child, where she developed a leading reputation for advising on high-value residential property transactions. Alexa has built a wide-ranging practice acting for individuals, companies and both UK and international private banks. She brings to the firm a wealth of experience in managing complex and high-net-worth property matters, with a particular focus on delivering a seamless client experience through strong relationships and a commercially minded approach.

Alexa looks forward to working closely with teams such as Private Wealth to coordinate multi-faceted transactions involving extensive property portfolios.

Speaking on her appointment, Alexa commented: “I’m thrilled to be joining the highly regarded team at Lawrence Stephens. The firm’s client-first ethos and collaborative culture are an excellent fit for my approach to legal practice. I look forward to continuing to support clients in the UK and internationally on their residential property matters, and to growing the practice together with the wider team.”

Goli-Michelle Banan, Head of Residential Real Estate, added: “Alexa is an exceptional addition to our team. Her experience in high-value residential transactions, coupled with her commitment to client service, aligns perfectly with our focus on delivering a tailored and positive experience. We’re excited to welcome her to Lawrence Stephens as we continue to expand the scope and strength of our Residential Real Estate offering.”

Details of our Residential Real Estate services can be found here

Lawrence Stephens advises Fidelius on its investment in Vobis

Posted on: May 9th, 2025 by Natasha Cox

Lawrence Stephens has advised Top 100 financial planning firm Fidelius on its acquisition of a non-controlling stake in Vobis, a London and Yorkshire-based IFA.

Founded in 2013, Vobis, which manages over £140m in client assets, specialises in financial planning for high-net-worth individuals and operates a joint venture with a top 60 accountancy practice in central London. The firm also has a regional office in Leeds.

The deal marks the first investment by Fidelius since Swedish wealth manager Söderberg & Partners took a minority stake in the business at the start of 2024.

The Lawrence Stephens’ team was led by Corporate and Commercial Director Jeff Rubenstein, supported by Associate Harshita Samani, Solicitors Lucy Cadley and Avni Patel, and Trainee Electra Kallidou.

Jeff Rubenstein commented: “While this was our first transaction for Fidelius, this assignment was the latest in a series of transactions we have advised on in the rapidly consolidating Financial Services industry. We very much enjoyed working with the Fidelius team, their energy and ambition very much reflects our own ethos and we look forward to working with them in the future”.

Richard Armstrong, Head of Governance, Risk and Compliance at Fidelius responded: “We are grateful for the advice and support provided by the team at Lawrence Stephens. The team were proactive and responsive, and their can-do approach helped move this important transaction along. Our ambition is to be a top 20 IFA and more acquisitions are likely.”

Find out more about our Corporate and Commercial services here

The Renters’ Rights Bill – What it could mean for lenders?

Posted on: May 8th, 2025 by Natasha Cox

The Renters’ Rights Bill (‘the Bill’) is currently making its way through the House of Lords. While there has been growing opposition to the Bill, with over 300 amendments being proposed, the Bill could still prove to be a welcome change for lenders.

Purpose of the Bill

The Bill has been introduced to:

  • give greater rights and protections to people renting their homes
  • provide tenants with the flexibility to leave substandard properties

In short, it is intended to:

  • Reform tenancies
  • Strengthen tenants’ rights
  • Create a landlord redress scheme
  • Create a private rented sector database
  • Create a legal standard for property conditions
  • Expand enforcement powers


The potential impact of the Bill on lenders

Currently, there are two options available to recover vacant possession of a property subject to an assured shorthold tenancy, namely:

  • Serving a notice under section 21 of the Housing Act 1988 (‘HA 1988’)
  • Serving a notice under section 8 of the HA 1988

Section 21 Notice

Also known as a ‘no-fault’ eviction, this is used where a tenancy is coming up to expiry or has already expired.

As a result of Trecarrell v Rouncefield [2020], if the landlord is unable to evidence compliance with the various prescribed requirements, then simply put, they will not be granted a possession order.

Section 8 Notice

A notice under this section can be used in two situations:

– where the tenant has breached the terms of the tenancy, or

– where a lender requires vacant possession of the property for the purpose of exercising their power of sale and is bound by a tenancy postdates the loan.

Notices under Section 8 of the HA 1988 are restrictive for lenders requiring vacant possession. Many grounds under this section can be remedied and it is otherwise limited to tenancies which postdate the loan. In addition, a landlord (borrower) should have also served a notice on the tenant confirming they can rely on this ground to obtain vacant possession (albeit the court has discretion to dispense with this requirement).

 

What the reform could mean for lender’s enforcement

The reform will essentially simplify a lender’s ability to take possession of a property subject to a tenancy.

The intention is to abolish assured shorthold tenancies (and as a consequence, ‘no-fault’ eviction notices) under Section 21 of the HA 1988, and to amend Ground 2 of Schedule 2 of the HA 1988 so that it reads as follows:

The dwelling-house is subject to a mortgage and –

(a) the mortgagee is entitled to exercise a power of sale conferred on him by the mortgage or by section 101 of the Law of Property Act 1925; and

(b) the mortgagee requires possession of the dwelling-house for the purpose of disposing of it with vacant possession in exercise of that power.

For the purposes of this ground “mortgage” includes a charge and “mortgagee” shall be construed accordingly.

This means that lenders will be able to rely on this section whether the tenancy predates or postdates the loan, provided the lender requires vacant possession for the purpose of exercising their power of sale. They need no longer be concerned about evicting a tenant when they are unable to comply with the requirements for prescribed information for tenant deposits and the Deregulation Act 2015, viz. the provision of the How to Rent Guide, EPC, Gas and Electrical Safety Certificates. The main contention under the reform is that tenants will be afforded a four-month notice period, which some lenders may accept as a small quid pro quo.

It is recommended that lenders continue to ask the right questions and continue to carry out their due diligence in respect of tenancies. In terms of lending in the short term/alternative lending space, which is often time critical, such potentially arduous and frustrating requirements need no longer be so. Lenders will now have the flexibility to take a view, knowing that it will not compromise their ability to secure vacant possession should they need to enforce the terms of their loan.

For more information on our Real Estate Disputes services, please click here.

Matt Green discusses crypto assets disputes and recovery with the Government of Gibraltar

Posted on: May 8th, 2025 by Natasha Cox

Director and Head of Blockchain Matt Green presented to the Ministry of Justice, Trade and Industry of the Government of Gibraltar, outlining the evolving legal status of digital assets alongside Scott Pounder, Founder and CEO of Prometheus Insights. 

Looking to the current legal landscape and potential future developments, Matt and Scott explained why recognising digital assets as property is essential, considering:

  • The definition of digital assets
  • The canon of common law, including Matt’s own cases, and how asset recovery cases created precedents globally
  • The role of legal definitions of property, now ratified in the Court of Appeal, from case law through to the Property (Digital Assets etc) Bill
  • Considering a draft statutory instrument designed to bring dealing with crypto assets into the remit of regulated activity under FSMA 2000.

The Government of Gibraltar’s official press release can be found here.

For more information on our digital assets expertise, please click here.

Angélique Richardson discusses the legal and reputation risks of doping in City AM

Posted on: May 7th, 2025 by Natasha Cox

Writing in City AM, Associate Angélique Richardson discusses the return of tennis star Jannik Sinner following his three-month suspension for failing two “in-competition” drug tests and analyses the legal and reputational risks arising from anti-doping violations.

Angélique’s article was published in City AM, 7 May 2025, and can be found here.

Jannik Sinner and anti-doping bans in tennis: how players can mitigate risks

Jannik Sinner’s re-appearance at the Italian Open guarantees attention, following his three-month suspension for failing two “in-competition” drug tests during and eight days after Indian Wells last year, for the banned anabolic steroid clostebol.

Ranked world No1, the three-time Grand Slam winner’s return to competitive tennis at his home tournament this week is a reminder of the legal and reputational risks arising from anti-doping violations.

Sinner was charged with an anti-doping rule violation by the International Tennis Integrity Agency, which enforces the World Anti-Doping Code 2015 through the Tennis Anti-Doping Programme (“TAPD”).

According to the TAPD, a first in-competition rule violation carries a four-year ban, reduced to two if proven unintentional. The ban could be eliminated if the player proves “no fault or negligence”, meaning that they couldn’t have reasonably known or suspected they had used a prohibited substance.

Sinner and his team never denied the substance was in his system. Thei argument was that his fitness coach purchased an antiseptic spray which contained clostebol.

While Sinner was at Indian Wells, his physio accidentally cut his hand and used the fitness coach’s antiseptic spray daily to treat the cut. The physio massaged Sinner without wearing gloves or washing his hands, and the substance entered Sinner’s system through the cut. They claimed Sinner bore no fault or negligence.

Initially, this version of events was accepted by the independent tribunal. The World Anti-Doping Agency (WADA) appealed the decision to the Court of Arbitration for Sport in Switzerland and reached a case resolution agreement with Sinner for a three-month ban, which elapsed on Sunday.

This case, while resolved, highlighted numerous issues faced by professional athletes.

Sinner’s reputation and integrity have been called into question, including by fellow player Novak Djokovic, and future potential sponsors and partners may be wary.

Many commercial deals with brands contain anti-doping clauses which enable them to terminate the agreements when an athlete is alleged to have committed an doping violation. Sinner may find some of these clauses triggered.

Stars like Jannik Sinner ‘must be proactive’

The ease of cross-contamination is clear. Sinner was contaminated by his physio, but the same could happen when sharing equipment with others who have used a prohibited substance, touching friends and family who have used a prohibited substance or using untested supplements.

A recent study commissioned by Sport Integrity Australia showed that, of the 200 supplements tested, 35 per cent contained WADA-prohibited substances. Athletes assume the ingredients listed in supplements are accurate, but this is not always true.

So, what can be done? Better education is needed about the risks associated with supplements, including via seminars, clubs, online resources and support teams.

Athletes can further mitigate risks by using Informed-Sport Certified supplements, staying up-to-date with substances on the prohibited list, and ensuring that nutritionists and staff members are fully trained. Instructing a sports lawyer with a specialism in doping is a no-brainer.

In the event of an anti-doping rule violation notice or charge, athletes should talk to a legal specialist. Sinner and WADA reaching an agreement on a three-month ban came thanks to the specialist anti-doping knowledge of his lawyers, who will also be working hard to ensure as few commercial deals are impacted as possible.

Athletes and their teams need to proactively reduce risks. An apology won’t get you out of trouble. Regardless, Sinner will hope that it is his tennis, rather than his lawyers, doing the talking at the Italian Open.

For more information on our expert services for athletes and sportspeople, please click hereanti-doping.