Anti-money laundering (AML) compliance

UK businesses in regulated sectors must comply with the Money Laundering Regulations 2017 (MLR 2017) and the Proceeds of Crime Act 2002 (POCA 2002). This guide covers registration, customer due diligence, suspicious activity reporting, and ongoing compliance requirements.

Who needs to comply?

You must register for AML supervision if your business is an 'obliged entity' under the regulations. This includes:

• Banks and financial services firms (FCA supervised)
• Money service businesses (currency exchange, money transfer)
• Trust or company service providers
• Estate agents
• High-value dealers (accepting cash over £10,000)
• Accountants and tax advisors
• Legal professionals
• Casinos and gambling providers
• Cryptoasset businesses

Registering for AML supervision

Before commencing business in a regulated sector, you must register with the appropriate AML supervisor. Registration with HMRC is free. FCA-supervised firms pay application and annual fees.

Appointing a Money Laundering Reporting Officer (MLRO)

Every obliged entity must appoint an MLRO who is responsible for receiving internal suspicious activity reports and deciding whether to submit SARs to the National Crime Agency. The MLRO must have sufficient authority and resources to fulfil the role.

Customer due diligence (CDD)

Customer due diligence is the process of identifying and verifying your customers before establishing a business relationship. CDD must be completed before providing services, unless there is low risk and it would interrupt normal business conduct.

Standard CDD

Standard CDD applies to most customer relationships and occasional transactions above the relevant threshold.

Enhanced due diligence (EDD)

Enhanced due diligence is required for higher-risk customers including politically exposed persons (PEPs), customers from high-risk countries, and correspondent banking relationships. EDD requires additional verification, senior management approval, and enhanced ongoing monitoring.

Suspicious activity reports (SARs)

If you know, suspect, or have reasonable grounds to suspect money laundering or terrorist financing, you must submit a Suspicious Activity Report (SAR) to the National Crime Agency. Failure to report is a criminal offence punishable by up to 5 years imprisonment.

Key points about SARs

• No minimum threshold - report any suspicious activity regardless of amount
• Do not tip off - informing the customer you have filed a SAR is a criminal offence
• Consent SARs - if you need to proceed with a suspicious transaction, submit a consent SAR and wait for NCA response
• Protected disclosure - filing a SAR provides a legal defence against money laundering charges

Risk assessment

You must conduct and document a business-wide risk assessment identifying the money laundering and terrorist financing risks to your business. This assessment must be reviewed at least annually and forms the foundation for your policies and procedures.

Policies, procedures, and training

You must establish written AML policies and procedures approved by senior management, and provide regular training to all relevant staff.

Record keeping

All AML records must be retained for at least 5 years and made available to your supervisor upon request. This includes customer identification documents, transaction records, and SAR decisions.

Penalties for non-compliance

Non-compliance with AML regulations can result in severe criminal and regulatory penalties including imprisonment and unlimited fines.

Online services and resources

Use these official services to register your business, submit suspicious activity reports, and verify customer identities.