The UK's money laundering regulations are the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, SI 2017/692. They apply to banks and financial firms, and also to accountants, auditors, tax advisers, insolvency practitioners, lawyers, estate and letting agents, trust and company service providers, and others. Every business in scope must assess its risks, check its customers, train its staff and keep records for five years. The most recent changes took effect on 30 June 2026. They converted the euro thresholds into sterling, so the standard occasional transaction threshold is now £12,000.
Who the regulations apply to
Regulation 8 lists the "relevant persons" when they act in the course of business carried on in the UK:
- Financial sector. Credit institutions and financial institutions;
- Professional services. Auditors, insolvency practitioners, external accountants and tax advisers, and independent legal professionals;
- Trust or company service providers. Since the 2026 amendments, this explicitly includes selling off-the-shelf companies;
- Property. Estate agents and letting agents;
- Dealers and others. High value dealers, casinos, art market participants, cryptoasset exchange providers and custodian wallet providers.
Every relevant person must be supervised. Accountants who belong to a professional body such as the ICAEW are supervised by that body. Accountancy service providers with no professional body supervisor must register with HMRC. HMRC's guidance is blunt about the consequences: trading while not registered is a criminal offence.
The core obligations
Most of the regulations follow one sequence, and the regulation numbers are worth knowing because supervisors cite them:
- Risk assessment (regulation 18). A written, firm-wide assessment of the money laundering and terrorist financing risks the business faces, covering its customers, countries, services, transactions and delivery channels. Regulation 18A adds a separate assessment for proliferation financing;
- Policies, controls and procedures (regulation 19). These must be proportionate to the size and nature of the business and approved by senior management;
- Internal controls (regulation 21). Where appropriate to the size and nature of the business, this includes a board or senior management officer responsible for compliance, screening of relevant employees and an independent audit function. A nominated officer must also be appointed to receive internal suspicious activity reports. The only exception is a sole practitioner who neither employs nor acts in association with anyone else;
- Training (regulation 24). Relevant employees must be made aware of the law and regularly trained to recognise and deal with suspicious transactions. The firm must keep a written record of the training;
- Customer due diligence (regulations 27 and 28). Identify and verify the customer and any beneficial owner, and understand the purpose of the relationship;
- Enhanced due diligence (regulations 33 to 35). Required for high-risk situations, politically exposed persons and certain high-risk countries;
- Record-keeping (regulation 40). Keep CDD records for five years from the end of the business relationship or the completion of an occasional transaction.
When customer due diligence is required
Under regulation 27, as amended, a relevant person must apply CDD when it:
- Establishes a business relationship. For an accountancy practice, almost every engagement is one;
- Carries out an occasional transaction of £12,000 or more, whether in one operation or several linked ones. This trigger does not apply to letting agents, high value dealers, art market participants, casinos and some cryptoasset businesses, which have their own thresholds;
- Carries out an occasional transfer of funds of more than £800;
- Suspects money laundering or terrorist financing;
- Doubts the documents or information it obtained earlier.
High value dealers must apply CDD to cash transactions of £10,000 or more. CDD is not a one-off exercise either. Regulation 27(8) applies it to existing customers at other appropriate times on a risk-based approach, including when their circumstances change.
The 2023 and 2026 amendments
People searching for the "UK AML regulations 2023" usually mean the Money Laundering and Terrorist Financing (Amendment) Regulations 2023, SI 2023/1371. They came into force on 10 January 2024. They inserted regulation 35(3A), so that for a domestic PEP, or a family member or close associate of one, the starting point is a lower level of risk than for a non-domestic PEP. Enhanced due diligence still applies, but it should be less extensive where no other high-risk factors are present.
The larger package is the Money Laundering and Terrorist Financing (Amendment) Regulations 2026, SI 2026/621. It was made on 9 June 2026 and most of it took effect 21 days later, on 30 June 2026. Its explanatory note summarises the changes:
- Euro to sterling. Euro references are converted to sterling, generally on a 1:1 basis so that 10,000 euros becomes £10,000. The exception is where 1:1 would breach FATF standards, which is why the occasional transaction threshold moved from 15,000 euros to £12,000 and the transfer-of-funds threshold to £800;
- Off-the-shelf companies. Selling them is now a trust or company service and is treated as a business relationship;
- Pooled client accounts. New due diligence requirements apply;
- Trust registration. Expanded for trusts that acquired UK land before 6 October 2020;
- Cryptoassets. New enhanced due diligence for correspondent relationships, from 1 February 2027.
One inconsistency to be aware of: HMRC's page on who needs to register still states its sector thresholds in euros. The amended regulation 27 is in sterling, and the legislation is what applies.
Reporting suspicions and penalties
The regulations sit alongside the Proceeds of Crime Act 2002. Under section 330, a person in the regulated sector commits an offence if they know or suspect money laundering, or have reasonable grounds to suspect it, and do not report it as soon as practicable to their nominated officer or the National Crime Agency. Reasonable grounds is an objective test, so a deliberate decision not to look offers no protection. Our guide to suspicious activity reports covers what to include and the tipping-off rules.
Breaching a requirement of the regulations is itself a criminal offence under regulation 86. It carries up to two years' imprisonment, a fine, or both on indictment. There is a defence for someone who took all reasonable steps and exercised all due diligence. Under regulation 76, the FCA and HMRC can also impose civil penalties or publish a statement censuring the business.
Supervision is changing, but not yet
In October 2025 the government announced that the FCA will take over AML supervision of accountancy, legal, and trust and company service providers from the professional bodies and HMRC. The reform depends on new legislation, which is still going through Parliament. The FCA says it does not expect to begin supervising them until autumn 2028, with the transition likely to finish around 2030. It also says firms do not need to take any action now. Until then, professional body and HMRC supervision continues as before.
For most firms, the gaps that supervisors find are a firm-wide risk assessment that has not been updated, client risk assessments missing from files, and training records that cannot be produced. The 30 June 2026 changes are a good reason to update all three. Our AML audit service independently tests policies, files and controls against the amended regulations. For a broader view of financial crime controls, see our guide for MLROs.