Which Businesses Need an AML Policy?

If your business is a relevant person under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, a written anti-money laundering (AML) policy is a legal requirement. Regulation 19 obliges you to establish and maintain policies, controls and procedures that manage the risks identified in your firm-wide risk assessment, and senior management must approve them.

The list of relevant persons is longer than many business owners expect. It covers accountants, bookkeepers and tax advisers, estate and letting agents, high value dealers, trust and company service providers, cryptoasset firms, independent legal professionals, art market participants, casinos and money service businesses.

The regime changed on 30 June 2026, when most of the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 came into force. Among other changes, the old euro thresholds became sterling figures, so the triggers for letting agents, high value dealers and art market participants now sit at £10,000.

This guide sets out who is in scope, which supervisor covers each sector, and what a compliant policy suite has to contain. It also covers penalties, because HMRC and the FCA both publish the names of businesses they fine.

AML Scope at a Glance

Who Counts as a Relevant Person?

Regulation 8 of the 2017 Regulations lists the categories of business in scope. The test is based on activity, not on how a business describes itself. A car dealership that accepts £10,000 in cash is a high value dealer even if it has never heard the term.

Accountants, bookkeepers and tax advisers

Anyone providing accountancy services, audit, insolvency, bookkeeping or tax advice by way of business is in scope. There is no turnover or size exemption, so a sole practitioner bookkeeper has the same core documentation duties as a national firm.

Firms regulated by a professional body are supervised by that body for AML purposes. Everyone else must register with HMRC before trading. Our page on policies for accountants and professional services firms lists the full document set supervisors expect to see.

Estate agents and letting agents

Estate agency businesses are in scope for all sales work and must register with HMRC. Letting agency businesses joined the regime in 2020, but only where they manage lets with a monthly rent of £10,000 or more, a threshold restated in sterling from 30 June 2026.

Estate agency is consistently one of the most heavily penalised sectors in HMRC's published lists, almost always for trading without registration rather than for sophisticated failings.

High value dealers and art market participants

A high value dealer is any business trading in goods that makes or accepts cash payments of £10,000 or more, whether in one transaction or in linked instalments. Car dealers, jewellers, plant and machinery sellers and auctioneers are regularly caught. Art market participants are in scope when they buy, sell or store works of art valued at £10,000 or more.

Trust and company service providers

Forming companies, providing a registered office or business address, and acting as or arranging a nominee director, secretary or trustee all bring a business into scope. The 2026 amendment puts the sale of off-the-shelf companies expressly within the definition, closing a long-argued gap.

Legal professionals

Independent legal professionals are relevant persons when they participate in financial or real property transactions, which captures most conveyancing, trust and company work. Supervision sits with the legal sector professional bodies rather than HMRC.

Cryptoasset firms, financial institutions and casinos

Cryptoasset exchange providers and custodian wallet providers must register with the FCA, which supervises them alongside banks and other financial institutions. From 1 February 2027 a new regulation 34A will add enhanced due diligence duties for cryptoasset firms in correspondent relationships. Casinos answer to the Gambling Commission, and money service businesses to HMRC unless the FCA already authorises them.

Who Supervises Anti-Money Laundering Compliance?

Three statutory supervisors divide the regulated sector between them: HMRC, the FCA and the Gambling Commission. HMRC is the default supervisor for estate and letting agents, high value dealers, art market participants, trust and company service providers, and any accountancy service provider without a professional body.

The legal and accountancy professions are supervised by 25 professional body supervisors, including the SRA, ICAEW, ACCA and AAT. Their performance is overseen by OPBAS, the Office for Professional Body Anti-Money Laundering Supervision, which sits inside the FCA. Our guide to what OPBAS is and how it works explains what those bodies are pushed to look for when they inspect member firms.

Reform is coming. In October 2025 the government confirmed its intention to make the FCA the single AML supervisor for legal, accountancy and trust and company service providers, but the transfer needs primary legislation and will take several years. Until then, your current supervisor's expectations apply in full.

What an AML Policy Suite Must Cover

Supervisors do not expect a single document. They expect a connected set of documents that starts with a risk assessment and flows through to procedures, training and records. The components are fixed by the regulations:

• Firm-wide risk assessment (regulation 18). A written assessment of your money laundering and terrorist financing risks across customers, countries, products, transactions and delivery channels, kept up to date.
• Policies, controls and procedures (regulations 19 to 21). Proportionate to your size and nature, approved by senior management, with internal controls including staff screening and, where appropriate, an independent audit function.
• Customer due diligence (regulations 27 and 28). Identity and beneficial ownership checks before you act, plus ongoing monitoring of the relationship.
• Enhanced due diligence (regulation 33). For higher-risk situations, including transactions that are unusually complex or unusually large given their nature, and any business connected to a FATF call for action country.
• Politically exposed persons (regulation 35). Procedures to identify PEPs, their family members and known close associates, with senior management approval before the relationship proceeds.
• Suspicious activity reporting. A nominated officer, usually called the MLRO, who receives internal reports and submits SARs to the National Crime Agency under the Proceeds of Crime Act 2002.
• Staff training (regulation 24). Relevant employees trained to recognise suspicious activity, with records kept to prove it.
• Record keeping (regulation 40). Due diligence and transaction records retained for five years.

Pooled client accounts have new rules of their own. Since 30 June 2026, firms that provide a customer with a pooled account must take reasonable measures to understand its purpose and to assess and manage the risk it carries. Accountants, solicitors and letting agents holding client money should reflect this in their procedures.

AML controls also sit alongside two neighbouring regimes. The corporate failure to prevent fraud offence has applied to large organisations since 1 September 2025, and our failure to prevent fraud employer guide explains how the two frameworks share controls. The Criminal Finances Act 2017 facilitation offences apply to businesses of every size, with reasonable prevention procedures as the only defence.

Common Failure Points

• Trading without registering. The most common breach in HMRC's penalty lists by a wide margin. Registration is due before you start relevant activity, not after your first inspection letter.
• Template policies that ignore the risk assessment. A generic document that does not reflect your actual clients, services and geography fails regulation 19, which requires procedures built on the regulation 18 assessment.
• Euro thresholds left in documents. Policies still quoting 10,000 euros have been out of date since 30 June 2026 and signal to a reviewer that nothing has been maintained.
• Due diligence treated as an identity check. Verifying a passport is not CDD. Beneficial ownership, source of funds where risk demands it, and ongoing monitoring are all required.
• No senior management approval or training records. Both are explicit requirements, and both are among the first things a supervisor asks to see.

Penalties and Enforcement

Breaching a relevant requirement of the regulations is a criminal offence under regulation 86, carrying up to two years' imprisonment and a fine on indictment. In practice supervisors usually impose civil penalties, but they publish the outcomes either way.

HMRC's latest published list, covering 1 April to 30 September 2025, names hundreds of businesses. The largest single penalty was £104,000 against a high value dealer, an accountancy service provider was fined £52,000, and the great majority of entries were for failing to register at the required time.

At the top end sits the FCA's prosecution of NatWest, fined £264.8 million in December 2021 after pleading guilty to three offences of failing to comply with money laundering regulations. It was the FCA's first criminal prosecution under the regulations, brought over roughly £264 million of cash deposited by a single jewellery customer.

Sentences under the Proceeds of Crime Act 2002 are heavier still. The principal money laundering offences carry up to 14 years' imprisonment, and failure to disclose suspicions in the regulated sector carries up to five years.

There is a levy to budget for as well. AML-regulated businesses with UK revenue above £10.2 million pay the annual economic crime levy, restructured from April 2026 into four bands: £10,200 in Band A, £36,000 in Band B, £500,000 in the new Band C and £1 million in Band D. Businesses below the threshold pay nothing but keep every documentation duty.

AML Policy and Procedure Writers

Policy Pros writes bespoke AML documentation for businesses in every supervised sector. Our anti-money laundering policy writing service delivers the firm-wide risk assessment, the main policy, customer due diligence and enhanced due diligence procedures, PEP and sanctions screening, a SAR procedure and a staff training programme, all matched to your supervisor's guidance.

Every document we write reflects the 2026 amendments, including the sterling thresholds and the pooled client account duties. Many clients pair the AML suite with our anti-tax evasion policies so that money laundering, tax evasion facilitation and fraud prevention operate as one financial crime framework rather than three overlapping papers.

Tell us your sector and your supervisor, and we will scope exactly what you need at a fixed price. Contact Policy Pros for a quote.