The UK Money Laundering Regulations 2017 (as amended in 2019 and 2022) require regulated firms — accountants, solicitors, estate agents, trust and company service providers, and others — to identify the people they do business with, monitor what they do, and report suspicions to the National Crime Agency.

Compliance is a daily operational discipline, not a once-a-year task. Firms that treat AML as a tick-box exercise fail their supervisor visits. Firms that build it into client onboarding pass quietly.

Who the regulations apply to

The list of "relevant persons" in scope includes:

• Auditors, accountants, tax advisers, insolvency practitioners
• Solicitors and other legal professionals
• Trust and company service providers (TCSPs) — anyone setting up companies, providing registered office services, acting as nominee director or shareholder
• Estate agents and letting agents (over a certain rent threshold)
• High-value dealers (cash transactions over €10,000)
• Casinos and most regulated financial firms

If your firm appears on this list, you are in scope. Your supervisor (HMRC, ICAEW, SRA, or another professional body depending on activity) inspects your compliance periodically and can impose fines or remove your right to practise.

The four-step framework

Every in-scope firm must do four things, structured around them:

1. Firm-wide risk assessment

A written assessment of where money-laundering risk lives in your firm. You categorise risk across: client type, geography, services, and delivery channel. Each category is scored. Document the rationale — supervisors care more about the thinking than the score.

Review at least annually, and out-of-cycle when something material changes (regulatory update, sanctions list addition, supervisor visit feedback).

2. Client due diligence (CDD) on every client

Before starting a business relationship, you must identify the client and verify their identity using reliable, independent sources. For individuals: passport or driving licence plus proof of address. For corporate clients: incorporation evidence, beneficial ownership down to natural persons, and verification of those individuals.

The depth scales with the risk score. Low risk gets Simplified Due Diligence (SDD) — typically less verification. High risk gets Enhanced Due Diligence (EDD) — typically source-of-funds checks, senior approval, ongoing monitoring.

3. Ongoing monitoring

CDD is not a one-time event at onboarding. You must monitor the relationship for activity inconsistent with the client''s profile, and refresh identification when documents expire or things change materially. Most firms set refresh cycles by risk tier (e.g. annually for high risk, every three years for low risk).

4. Internal reporting and SARs

Every regulated firm must appoint a Money Laundering Reporting Officer (MLRO). Staff who become suspicious of money laundering must report internally to the MLRO. The MLRO decides whether the threshold for a Suspicious Activity Report (SAR) to the National Crime Agency is met.

A "tipping off" offence exists — once a report is filed, you cannot tell the client (or anyone who might tell the client) that the report has been made. This includes the seemingly innocent step of refusing to continue working without explanation. Document everything; take advice if unsure.

Record-keeping

Records must be kept for at least 5 years from the end of the business relationship — longer in some cases. This includes copies of identification documents, CDD assessments, EDD evidence, training records, internal reports to the MLRO, and SARs. Most firms now keep these digitally in a structured client folder.

What supervisor visits look for

A typical supervisor visit examines:

• Your firm-wide risk assessment (does it exist, when was it last reviewed, is it specific to your firm)
• A sample of client files (was CDD done, is the risk score documented, is EDD applied where it should be)
• Your MLRO appointment letter and training records
• Your internal reporting log and SAR records
• Evidence of ongoing monitoring
• Your written AML policies and procedures

Firms typically have 14 days to remediate findings. Persistent or serious failures lead to monetary penalties and supervisor enforcement.

Where firms commonly fail

• No written risk assessment, or one copied from a template without firm-specific tailoring.
• CDD records that don''t prove the verification step — a copy of the document but no record of who checked it, when, and against what.
• Risk scores that are uniform "medium" across the entire client base, suggesting the categories weren''t actually applied.
• No evidence of ongoing monitoring — the file was created at onboarding and never touched.
• Training records that don''t exist for staff who need them.

What to do next

• If you haven''t looked at your firm-wide risk assessment in the last 12 months, that''s the first thing to fix.
• If your client onboarding still relies on emailed copies of passports without any verification step, fix the verification gap before the next supervisor visit.
• If you don''t know who your MLRO is, you don''t have one — and that''s a regulatory breach in itself.