Law firms “not doing enough” to prevent money laundering, says SRA