Anti-Money Laundering in the UK: The Complete Guide for Accountants (2026)

Anti-money laundering (AML) in the UK is the framework of criminal offences, regulations and supervision that stops the proceeds of crime being passed off as legitimate funds. It rests on the Proceeds of Crime Act 2002 and the Money Laundering Regulations 2017, and it places legal duties on accountancy practices and on every individual who works in them.

For accountants, this matters more than most. The government’s 2025 National Risk Assessment rates accountancy services as high risk for money laundering. If your firm provides accounts, bookkeeping, payroll, tax, audit or company services to other persons by way of business, it must be supervised for AML by its professional body or HMRC, check who its clients are and report anything suspicious.

Understanding Money Laundering

What Is Money Laundering?

Money laundering means dealing with money or other property that comes from crime. It covers hiding where the property came from, helping someone else keep or move it, and simply holding or using it while knowing or suspecting its source.

The Proceeds of Crime Act 2002 (POCA) sets this out in three offences:

• Section 327: Concealing, disguising, converting or transferring criminal property, or removing it from England and Wales, Scotland or Northern Ireland.
• Section 328: Entering into, or becoming concerned in, an arrangement you know or suspect helps another person acquire, keep, use or control criminal property.
• Section 329: Acquiring, using or possessing criminal property.

Attempting, conspiring in or inciting any of these, or aiding, abetting, counselling or procuring them, also counts as money laundering, as does conduct abroad that would be one of these offences if done in the UK (s.340(11)).

Everything turns on the meaning of criminal property. Under s.340(3), property is criminal property if it constitutes or represents a person’s benefit from criminal conduct, and the alleged offender knows or suspects that it does. Criminal conduct is any conduct that is an offence in any part of the UK, or would be if it happened here (s.340(2)).

Three features of that definition matter to accountants:

• No minimum value. POCA sets no de minimis threshold. A few hundred pounds of tax dishonestly evaded is criminal property in the same way as the proceeds of a large fraud.
• Tax evasion counts. Where a client evades tax, the tax saved is their benefit from criminal conduct and is criminal property (s.340(6)). A genuine error is not criminal conduct, though the strict liability offshore offences in TMA 1970 ss.106B to 106H need no dishonesty. Clients’ own tax affairs remain the most common exposure in practice.
• It does not matter who committed the crime. Under s.340(4), it is irrelevant who carried out the conduct or who benefited from it. Whether the crime was committed by your client, a relative or a stranger, and even if the person holding the property gained nothing from it, it remains criminal property. Anyone who handles it, or helps someone else keep or move it, while knowing or suspecting its source can commit an offence under ss.327 to 329.

The Three Stages of Money Laundering

Laundering is usually described as a three-stage cycle. Each stage creates a different point of contact with an accountancy practice.

1. Placement - Criminal funds first enter the financial system. A cash-intensive business banking takings that its trading activity cannot support is a typical example.
2. Layering - A series of transactions separates the funds from their source. Intercompany loans, movements through overseas entities and frequent changes of ownership all add distance between the money and the crime.
3. Integration - The funds re-emerge as apparently legitimate wealth, invested in property, businesses or other assets. Accounts and tax returns prepared on the funds can give them a paper trail they would not otherwise have.

The stages are a descriptive model, not a legal test. The POCA offences apply at any point in the cycle, and an accountant can commit one without handling the money at all. For worked examples of each stage, see money laundering meaning, stages and examples.

What Is Anti-Money Laundering in the UK?

Anti-money laundering means the legal duties and internal controls that regulated businesses and their staff must apply to prevent, detect and report money laundering, terrorist financing and proliferation financing. No UK statute defines AML as a single term. It describes the combined effect of POCA, the Terrorism Act 2000, MLR 2017 and UK sanctions law.

In practice, UK AML operates on two levels, and an accountancy practice has to meet both.

• Individual level (POCA Part 7 and Terrorism Act 2000 Part 3) - Every partner and employee must not conceal, arrange for, acquire, use or possess property they know or suspect to be criminal property (POCA ss.327 to 329), and must not commit the terrorist property offences in TA 2000 ss.15 to 18. Anyone working in the regulated sector must also report knowledge or suspicion, or reasonable grounds for either, of money laundering (POCA s.330).
• Firm level (MLR 2017 and sanctions regulations) - The practice must assess its money laundering, terrorist financing and proliferation financing risks, run policies and controls, carry out customer due diligence, keep records, train staff and be supervised. Separately, sanctions regulations made under the Sanctions and Anti-Money Laundering Act 2018 treat accountancy and tax firms as relevant firms. Where information received in the course of business gives them knowledge or reasonable cause to suspect that a person is a designated person, or that a sanctions offence has been committed, they must report to OFSI as soon as practicable. A SAR to the NCA does not meet this duty.

The two levels depend on each other. Firm-level controls give staff the information they need to spot and report suspicion. Where those controls are missing, the individuals carry the exposure.

The UK AML Legal Framework at a Glance

Seven pieces of legislation shape AML work in an accountancy practice. Two of them, POCA and MLR 2017, carry most of the weight.

Did you know? MLR 2017 transposed the EU’s Fourth Money Laundering Directive. The Fifth Directive reached UK law later, through the Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (SI 2019/1511), in force from 10/01/2020.

The most recent amendments, the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621), came into force on 30/06/2026. Their effect is reflected in the sections below. For a provision by provision walkthrough, see UK Money Laundering Regulation amendment: what is changing in 2026.

Alongside the law sits sector guidance. The Consultative Committee of Accountancy Bodies (CCAB) publishes the Anti-Money Laundering and Counter-Terrorist Financing Guidance for the Accountancy Sector; the current edition, published in August 2026, states the law as at 01/07/2026. It matters in court: under MLR 2017 reg 86(2), when deciding whether a person committed an offence under the regulations, the court must consider whether that person followed Treasury-approved guidance in force at the time.

Does Anti-Money Laundering Apply to Your Practice?

MLR 2017 applies to any firm or sole practitioner that, by way of business, provides accountancy, tax advice, audit, insolvency or trust and company services to other persons (regs 8, 11 and 12). Scope follows the activity, not professional membership or firm size.

The definitions in reg 11 are broad. An external accountant is a firm or sole practitioner who by way of business provides accountancy services to other persons. A tax adviser provides “material aid, or assistance or advice” in connection with the tax affairs of other persons, whether directly or through a third party.

A self-employed bookkeeper working from home is an external accountant under reg 11(c). The size of the practice changes how controls scale, not whether the regulations apply.

Property transactions bring further regulated parties into the chain, including estate agents and letting agents. For that sector, see AML checks when buying or selling a house.

Who Supervises Anti-Money Laundering in the UK for Accountants?

Every relevant person must have an AML supervisor. A professional body listed in Schedule 1 to MLR 2017 supervises its member firms. HMRC supervises accountancy service providers and TCSPs that no professional body supervises. The FCA can also supervise TCSPs.

The Office for Professional Body Anti-Money Laundering Supervision (OPBAS), part of the FCA, oversees these professional body supervisors. Acronyms across the regime are collected in AML acronyms and definitions.

Future Change: Supervision Moving to the FCA

HM Treasury confirmed in its October 2025 consultation response that the Financial Conduct Authority will become the single AML supervisor for accountancy service providers, legal service providers and trust or company service providers, replacing both the professional bodies and HMRC in that role. Its June 2026 response on supervisory powers says the primary legislation will go in a Financial Services Bill and that implementation will take several years. No start date has been set. Until it takes effect, your current supervisor remains your supervisor and your obligations are unchanged.

Registration timing differs by sector. HMRC guidance allows an accountancy service provider to trade while its application is processed. A TCSP must not trade until HMRC confirms registration. Trading while not registered is a criminal offence.

Approval of individuals is a separate duty. Under reg 26, the beneficial owners, officers and managers of an accountancy service provider or TCSP need their supervisor’s approval. A person convicted of a relevant offence listed in Schedule 3 cannot be approved. Acting as an officer or manager without approval is a criminal offence carrying up to two years’ imprisonment on indictment (reg 26(12) and (13)).

Did you know? HMRC has a duty, as a supervisor under MLR 2017, to publish details of businesses that do not comply with the regulations. Its published lists name individual accountancy service providers alongside the penalty imposed.

Firm-Wide Obligations: The Controls Your Practice Must Have

Supervisors examine the firm before they examine client files. A missing practice-wide risk assessment breaches reg 18 however good the client due diligence looks.

Practice-Wide Risk Assessment (regs 18 and 18A)

Every relevant person must identify and assess the money laundering and terrorist financing risks its business faces. The assessment must take account of customers, countries or geographic areas, products or services, transactions and delivery channels, and information the supervisor makes available.

The assessment must be in writing, kept up to date, and provided to the supervisor on request. Its depth must be proportionate to the size and nature of the business.

Reg 18A adds a separate written assessment of proliferation financing risk. For what that covers in an accountancy practice, see counter-proliferation financing for accountants.

Policies, Controls and Procedures (regs 19 and 19A)

The firm must establish written policies, controls and procedures that mitigate and manage the risks identified in its risk assessment. They must be proportionate, approved by senior management, regularly reviewed and updated, and communicated across the firm.

They must cover risk management, customer due diligence, reporting, record keeping, internal control and monitoring. They must also address the risk of new products, practices and technologies before adoption. For a drafting framework, see how to write an AML policy for your firm.

Compliance Officer, Nominated Officer and Independent Audit (reg 21)

Reg 21 sets the internal governance roles. Several apply only where appropriate to the size and nature of the business.

The reg 21(6) exemption covers only an individual who neither employs nor acts in association with any other person. Taking on one employee, or working in association with another practitioner, brings every row back into scope.

The nominated officer must consider each internal report in light of relevant information the firm holds, and decide whether it gives rise to knowledge or suspicion of money laundering or terrorist financing (reg 21(5)).

Training and Awareness (reg 24)

Relevant employees must be made aware of the law on money laundering, terrorist financing and proliferation financing, and of data protection requirements. They must be regularly trained to recognise and deal with transactions and situations that may involve laundering.

The firm must keep a written record of the measures taken and the training given. The regulations do not set a frequency. Your policy should, and your supervisor will test it.

Record Keeping (reg 40)

Records of customer due diligence and supporting transaction records must be kept for five years. The clock starts when the firm knows, or has reasonable grounds to believe, that the business relationship has ended or the occasional transaction is complete.

Transaction records within a business relationship cannot be kept for more than 10 years. At the end of the retention period, the firm must delete personal data obtained for AML purposes unless an enactment or court proceedings require retention, the data subject consents, or there are reasonable grounds to believe the records are needed for legal proceedings (reg 40(5)).

Customer Due Diligence: From Onboarding to Exit

If you cannot complete customer due diligence, reg 31 requires you not to establish the business relationship or carry out the transaction, to terminate any existing relationship, and to consider whether a disclosure is required under POCA or the Terrorism Act 2000. A narrow exception in reg 31(3) applies where an independent legal professional or other professional adviser is ascertaining a client’s legal position, or defending or representing the client in or concerning legal proceedings, including advice on starting or avoiding proceedings. Reg 31(4) limits “other professional adviser” to an auditor, external accountant or tax adviser who is a member of a qualifying professional body.

When Must You Apply Customer Due Diligence?

Reg 27 requires CDD when the firm:

• establishes a business relationship
• carries out an occasional transaction at or above the reg 27(2) threshold of £12,000, single or linked, or a transfer of funds exceeding £800
• suspects money laundering or terrorist financing
• doubts the veracity or adequacy of documents or information previously obtained for identification or verification

Warning: The reg 27(2) threshold has been £12,000 since 30/06/2026. Onboarding procedures that still quote the old €15,000 figure apply the wrong test.

CDD also applies to existing clients at appropriate times on a risk-based approach, and when the firm becomes aware of a change in a client’s relevant circumstances (reg 27(8)). Indicators include a change in identity of the client or beneficial owner, transactions inconsistent with what the firm knows, and a change in the purpose of the relationship (reg 27(9)).

What Customer Due Diligence Involves (reg 28)

CDD has four core components:

• Identify the client and verify their identity from documents or information obtained from a reliable source independent of the client (reg 28(2) and (18))
• Identify the beneficial owner and take reasonable measures to verify their identity. For a body corporate, that includes any individual who ultimately owns or controls more than 25% of the shares or voting rights (reg 5(1)(b))
• Understand the ownership and control structure of any legal person, trust or similar arrangement (reg 28(3A) and (4))
• Assess the purpose and intended nature of the business relationship or transaction (reg 28(2)(c))

Electronic identity verification qualifies where the process is secure from fraud and misuse and gives the necessary level of assurance (reg 28(19)). Where someone acts on the client’s behalf, verify their authority and identity (reg 28(10)).

Public registers do not finish the job. Reg 28(9) prevents reliance solely on information held on a register such as Companies House to meet the beneficial ownership requirements. Where the beneficial ownership information you collect differs from the register, reg 30A requires you to report any material discrepancy, as defined in Schedule 3AZA. Reports on companies, LLPs, eligible Scottish partnerships and overseas entities go to Companies House. Reports on trusts go to HMRC.

Verification must normally be completed before the relationship is established. Reg 30(3) allows completion during establishment only where that is necessary not to interrupt the normal conduct of business, there is little risk of laundering, and verification is completed as soon as practicable.

Due diligence is not one fixed set of checks, though. The steps above apply to every client, but MLR 2017 requires their depth to match the risk each client presents: lighter for a low-risk client, standard for most, and deeper for a client who presents a higher risk.

Simplified, Standard and Enhanced Due Diligence

The extent of CDD must reflect the firm’s own risk assessment and the level of risk in each case (reg 28(12)), and the firm must be able to show its supervisor that the measures it chose were proportionate (reg 28(16)). In practice, that risk-sensitive scale is described in three levels:

Mandatory EDD by country applies only where a party is established in a FATF call for action country (reg 33(1)(b)). Countries under FATF increased monitoring are no longer an automatic EDD trigger, but they remain a geographical risk factor under reg 33(6)(c).

A single risk factor does not by itself establish high risk (reg 33(7)). For the detailed EDD process, see what is enhanced due diligence.

One EDD trigger in the table comes with its own detailed rules: a client who holds, or recently held, a prominent public role. The regulations call these clients politically exposed persons, and set out exactly who counts and what extra checks apply.

Politically Exposed Persons (reg 35)

A politically exposed person (PEP) is an individual entrusted with prominent public functions, other than as a middle-ranking or more junior official. The PEP rules also cover family members, including spouses, civil partners, children and their spouses, and parents, and known close associates.

For a PEP, family member or known close associate, the firm must obtain senior management approval to establish or continue the relationship, take adequate measures to establish source of wealth and source of funds, and conduct enhanced ongoing monitoring (reg 35(5)).

Two rules change the risk weighting:

• Domestic PEPs - Since 10/01/2024, a PEP entrusted with prominent public functions by the UK starts from a lower level of risk than a non-domestic PEP, absent other enhanced risk factors (reg 35(3A)).
• Leaving office - The reg 35(5) measures continue for at least 12 months after the person stops holding the function, and longer if the firm’s risk assessment requires (reg 35(9)). For family members and close associates, the measures stop once the PEP leaves office (reg 35(11)).

The practical screening process is covered in how to perform enhanced due diligence on PEPs.

Ongoing Monitoring

Reg 28(11) requires ongoing monitoring of every business relationship. That means scrutinising transactions, including source of funds where necessary, to confirm they are consistent with what the firm knows of the client, its business and its risk profile, and keeping CDD documents and information up to date.

The regulations set no fixed review interval. Frequency follows risk: the firm’s policy should set review cycles by risk rating and name the events that trigger an earlier review under reg 27(8).

Reliance and Companies House Identity Verification

Reg 39 allows a firm to rely on another relevant person, or an equivalently regulated firm overseas, to apply CDD measures. The relying firm remains liable for any failure (reg 39(1)).

Reliance has conditions. The relying firm must immediately obtain the CDD information it needs, and must have written arrangements that let it obtain copies of identification and verification documents immediately on request (reg 39(2)). It cannot rely on a third party established in a FATF call for action country (reg 39(4)).

Companies House identity verification became a legal requirement from 18/11/2025, with a 12-month transition for existing directors and PSCs. A verified personal code shows that the individual verified with Companies House. It does not discharge your own reg 28 duties. Accountants filing on clients’ behalf usually do so as Authorised Corporate Service Providers, a status that requires AML supervision. See identity verification through an ACSP.

Suspicious Activity Reports, Consent and Tipping Off

A regulated sector employee who fails to disclose knowledge or suspicion of money laundering commits an offence carrying up to five years’ imprisonment (POCA ss.330 and 334(2)). The test includes reasonable grounds for knowing or suspecting. It is objective, so failing to notice what a competent practitioner would have noticed is no defence.

The reporting route runs in four steps:

• Internal report - The person who forms the suspicion reports to the nominated officer as soon as is practicable after the information comes to them (s.330(4)).
• Nominated officer review - The nominated officer considers the report against relevant information held by the firm (reg 21(5)) and decides whether to disclose to the NCA. Failing to disclose where required is an offence under s.331.
• Suspicious activity report - The nominated officer submits the SAR to the National Crime Agency through the SAR Portal.
• Defence Against Money Laundering (DAML) - If the firm needs to do something that would otherwise be a prohibited act under ss.327 to 329, it makes an authorised disclosure (s.338) and seeks appropriate consent (s.335) before acting.

Warning: A SAR on its own authorises nothing. Protection for an act that would otherwise fall within ss.327 to 329 comes from an authorised disclosure and appropriate consent. Proceeding before consent leaves the firm exposed.

Accountants have a narrow reporting exemption. A relevant professional adviser, meaning an accountant, auditor or tax adviser who is a member of a qualifying professional body, need not disclose information received in privileged circumstances: from a client in connection with the giving of legal advice, from a person seeking legal advice, or in connection with legal proceedings (s.330(6)(b), (10) and (14)). The exemption does not apply to information communicated with the intention of furthering a criminal purpose (s.330(11)).

Tipping off is a separate offence. Disclosing that a report has been made, or that an investigation is contemplated or under way, where that is likely to prejudice an investigation, carries up to two years’ imprisonment on indictment (s.333A). Permitted disclosures are set out in ss.333B to 333D. Reg 28(14) allows CDD to stop where continuing would tip the client off.

For reporting mechanics, see the suspicious activity report guide and tipping off in AML.

Anti-Money Laundering in Practice: Three UK Scenarios

The scenarios below are illustrative. Names and figures are invented to show how the rules apply.

Onboarding: An Undisclosed Overseas Shareholder

A trading company asks a practice to take on its accounts and tax. The Companies House register shows two founding directors as PSCs. Share allotment documents produced during CDD show a recent issue to an overseas holding company, leaving it with 30% of the shares.

At 30%, the holding company’s controllers are potential beneficial owners under reg 5(1)(b). The practice identifies the individuals behind it, takes reasonable measures to verify them and documents the ownership structure under reg 28(4).

The register does not show the individuals behind the overseas holding company that CDD uncovered. The practice checks whether this is a material discrepancy under Schedule 3AZA and, if it is, reports it to Companies House under reg 30A. It then rates geographic risk under reg 33(6)(c). If the holding company were established in a FATF call for action country, EDD would be mandatory under reg 33(1)(b).

Monitoring: A Café’s Takings Jump Fivefold

A bookkeeping client’s monthly takings rise from £8,000 to £45,000 over two quarters. Most of the increase arrives as cash deposits just below round amounts. Opening hours, staffing and supplier purchases have not changed.

That pattern meets the reg 33(1)(f) triggers for EDD: an unusual pattern of transactions with no apparent economic purpose. The bookkeeper makes an internal report to the nominated officer, who reviews the file and concludes there is suspicion. A SAR goes to the NCA.

The nominated officer then considers whether any further work, such as handling client money, would be a prohibited act needing a DAML. Nobody discusses the report with the client (s.333A).

Enhanced Due Diligence: A Former Minister

A prospective client left a UK ministerial post eight months ago and wants advice on a property portfolio. Eight months is inside the minimum 12-month period in reg 35(9), so the client is still treated as a PEP.

As a domestic PEP with no other enhanced risk factors, the client starts from a lower risk level than a foreign PEP (reg 35(3A)). The reg 35(5) measures still apply: a partner approves the engagement, the practice establishes source of wealth and source of funds for the portfolio, and the file moves to enhanced ongoing monitoring. When the 12 months end, the practice decides on its own risk assessment whether enhanced measures should continue (reg 35(9)(b)).

The client’s spouse is a PEP family member, but the reg 35(5) measures for the spouse stopped when the minister left office (reg 35(11)).

Penalties for AML Failures

AML failures carry criminal, civil and professional consequences, and the criminal offences attach to individuals as well as firms.

Reg 86(3) provides a defence where the person took all reasonable steps and exercised all due diligence to avoid committing the offence. A documented risk assessment, policy and training record is the evidence that supports it.

Civil penalties sit alongside the criminal regime. HMRC, as a designated supervisory authority, can impose a penalty of such amount as it considers appropriate under reg 76, or publish a statement of censure. Professional bodies fine, reprimand and exclude members under their own disciplinary rules. HMRC also publishes the names of businesses that breach the regulations.

For each POCA offence, its defences and how prosecutors apply them, see money laundering offences for accountants.

Common AML Misconceptions Among UK Accountants

Most supervisory findings trace back to a small number of persistent assumptions.

Conclusion

Anti-money laundering in the UK runs in one sequence for an accountancy practice: confirm scope, register with the right supervisor, assess firm-wide risk, apply risk-sensitive CDD, monitor, report and keep records.

A practice that documents each step meets an inspection with evidence and a reg 86(3) defence. A practice that does not faces civil penalties, published sanctions and personal criminal exposure for the individuals involved.

Review your practice-wide risk assessment and onboarding procedures against the 30/06/2026 amendments before your next supervisory visit.

Frequently Asked Questions