The UK AML regime is tightening — what’s changing, and how to prepare

The UK isn’t replacing its AML rulebook — it’s tightening the rules, reshaping professional-services supervision, and widening corporate accountability for economic crime.

Post-Brexit, the UK runs its own regime rather than the EU’s new Single Rulebook. The day-to-day framework still sits principally in the Money Laundering Regulations 2017, with money-laundering offences and the suspicious-activity-report regime under the Proceeds of Crime Act 2002. What is moving is the detail of those rules, the supervision of legal, accountancy and trust-or-company service providers, and corporate accountability for offending.

Where UK AML stands today

Most regulated businesses operate under three things: the Money Laundering Regulations 2017 (risk assessment, customer due diligence, record-keeping, controls); the Proceeds of Crime Act 2002 (the money-laundering offences and the suspicious-activity-report regime to the National Crime Agency); and the oversight of a supervisor — and which one depends on your sector:

HMRC — the default for many DNFBPs: estate agents, high-value dealers, art-market participants, and accountancy or trust-or-company service providers that do not belong to a professional body.
The FCA — financial-sector firms (today).
Professional-body supervisors (PBSs) — the SRA for solicitors in England & Wales; ICAEW, ACCA, AAT, CIOT and others for accountancy — all overseen by OPBAS, which sits within the FCA, for consistency.

For HMRC-supervised businesses — estate agents, high-value dealers, art-market participants, accountancy and trust-or-company service providers and others — HMRC’s own guidance is the operational reference for what compliance looks like in practice (linked in the references below).

What’s changing

The changes fall into two groups: reforms still being shaped, and measures already enacted and landing now.

Reform in the pipeline

A single professional-services AML supervisor — the FCA Confirmed direction · HM Treasury consultation response, 18 June 2026 · subject to legislation and transition

The government has confirmed that AML supervision for the legal, accountancy and trust-or-company service provider sectors will move to the Financial Conduct Authority. This brings together supervision currently split between professional-body supervisors and, for some accountancy and TCSP businesses, HMRC. The confirmed direction includes:

a single FCA register, with registration as a condition of carrying out relevant AML-regulated professional-services activity;
strengthened ‘fit and proper’ assessments (Regulation 58) across the legal and accountancy sectors;
extended FCA inspection, information-gathering and direction powers (Regulations 17 and 46) over newly supervised firms;
approval of legal-sector AML guidance moving from HM Treasury to the FCA — the professions continue to draft sector guidance, with HM Treasury retaining a role;
OPBAS winding down once the FCA assumes full responsibility for these professional-services sectors;
FCA supervision funded on a full cost-recovery basis, with detailed fees to be consulted on separately.

The FCA said in September 2026 that it currently expects a phased transition to start in late 2028 and complete around 2030, subject to legislation and implementation. This transfer does not currently extend FCA AML supervision to estate agents, high-value dealers or art-market participants; those sectors remain under their existing supervisory arrangements unless the government changes the model.

A first package of MLR reforms is already live Money Laundering and Terrorist Financing (Amendment) Regulations 2026 · most changes in force from 30 June 2026

A first package of changes to the Money Laundering Regulations took effect on 30 June 2026. The amendments cover, among other points, aspects of customer due diligence and enhanced due diligence, unusually complex or unusually large transactions, high-risk jurisdictions, trust-or-company service provider scope and trust-registration rules. HMRC’s consolidated AML guidance, published in July 2026, reflects the changes. Further reform may still follow, so check the current MLRs and your supervisor’s guidance for what applies now.

Enacted and landing now

Companies House reform and identity verification (ECCTA 2023)

The Economic Crime and Corporate Transparency Act 2023 is phasing in identity verification for directors and people with significant control (PSCs), alongside verification requirements operating through the authorised filing and ACSP regime and stronger Companies House powers over the register. For KYB, Companies House and PSC information are increasingly useful sources — but the MLRs do not allow beneficial-owner verification to be satisfied by relying on Companies House information alone.

Corporate criminal liability, widened

ECCTA 2023 introduced the failure to prevent fraud offence for large organisations and an expanded senior-manager attribution route for specified economic crimes. The Crime and Policing Act 2026, section 250, in force from 29 June 2026, replaced those ECCTA senior-manager attribution provisions with a broader rule: a body corporate or partnership can itself commit an offence where a senior manager commits that offence while acting within the actual or apparent scope of their authority. This is separate from the failure-to-prevent-fraud offence and its reasonable-procedures defence.

Overseas entities and property

Overseas entities that own UK property must identify their beneficial owners on the Register of Overseas Entities — relevant to real-estate and high-value transactions.

The accountability shift — and why the record matters

UK law is placing greater emphasis on corporate accountability, but through different legal routes. Under section 250 of the Crime and Policing Act 2026, an organisation can itself commit an offence where a senior manager commits that offence while acting within the actual or apparent scope of their authority. Separately, the failure-to-prevent-fraud offence applicable to large organisations provides a statutory defence based on reasonable fraud-prevention procedures.

Alongside those corporate-liability rules, the Money Laundering Regulations require regulated firms to maintain and implement risk-based policies, controls and procedures and to retain the required customer-due-diligence records. That makes a complete, contemporaneous record valuable: what was found, what the firm’s policy required, who decided, what was escalated and why. A record like that helps evidence how the firm’s controls operated in practice and avoids having to reconstruct the decision later from emails and memory.

What this means in practice

For supervision and governance, firms are better placed when they can show how decisions were reached as the work happened — attributed, reasoned and versioned. The record does not itself provide a defence to section 250 or remove the firm’s legal responsibility. It is evidence of how the firm’s controls operated in practice.

A checklist to prepare

Group by group, the steps a UK supervised business is expected to have in place. You will work on several at once. Tick items as you go — your progress is saved on this device only.

0 of 0 steps marked done

1. Know your supervisor and stay registered

Who supervises you decides what good looks like.

Confirm who supervises you — and keep your registration current.HMRC for many professional and high-value sectors, the FCA for financial firms, or a professional-body supervisor. Register and renew as required. Follow your supervisor’s guidance.For HMRC-supervised firms, HMRC’s anti-money-laundering guidance is the operational reference for what compliance looks like in practice (linked below).

2. Keep your risk assessment and policies live

The regulations expect these to be current, not filed once.

Maintain a firm-wide risk assessment and MLR-compliant policies, controls and procedures.Cover your services, customers, geographies and delivery channels, and review them as your business changes. Watch for the MLR reforms and update when they land.Some requirements are being reshaped; don’t assume today’s detail is permanent.

3. Do customer due diligence proportionate to risk

The core of day-to-day compliance.

Identify and verify customers and beneficial owners; apply enhanced due diligence where risk requires.Risk-based, not one-size-fits-all; simplified where genuinely low-risk, enhanced for high-risk. Screen for sanctions and PEPs, and monitor on an ongoing basis.Not a one-time gate at onboarding — keep it current and refresh when lists change.

4. Use verified company data

Use Companies House and PSC information as an important KYB source — and corroborate beneficial ownership where required.Identity verification for directors and PSCs is being phased in, but the MLRs do not allow beneficial-owner verification to be satisfied by relying on the register alone. Use the Register of Overseas Entities where an overseas entity owns UK property.Relevant to real-estate and high-value transactions.

5. Report suspicions correctly

The POCA regime hasn’t gone away.

Appoint a nominated officer (MLRO) where required and report suspicious activity to the National Crime Agency.Know how and when to submit a SAR. Limited exceptions apply, including certain sole practitioners with no employees who do not act in association with others. Avoid tipping off.Handle disclosures carefully so you don’t prejudice an investigation.

6. Prepare for widening corporate liability

Accountability is moving from the individual to the firm.

Make senior-management oversight real — and evidenced.Section 250 can attribute a senior manager’s offence to the organisation where its statutory conditions are met. Separately, evidence of real oversight helps demonstrate how the firm’s AML controls operated in practice; oversight that exists only on paper may not do so. Where the failure-to-prevent-fraud offence applies, put reasonable procedures in place and document them.It applies to large organisations; reasonable procedures are the defence.

7. Keep records — and be able to show how decisions were made

The single most useful thing to have ready.

Retain what the MLRs require, and keep a contemporaneous, attributed trail.So you can answer “how was this decided?” without reconstructing it from emails and memory when HMRC, a bank or an investigation asks.

8. Train your people — and evidence it

Expected, and easy to overlook.

Train relevant staff on AML obligations and the firm’s procedures; keep evidence of training.Who was trained, on what, and when.

9. Watch the reforms

The regime is moving.

Track the MLR effectiveness reforms and the supervision overhaul via HMRC and gov.uk.Check the current rules and guidance for what applies now, rather than assuming.

References & official sources

The primary guidance and legislation behind this page. Links open on official sites.

Guidance & reform

HMRC — AML guidance for supervised businesses (current operational guidance)
HM Treasury — AML/CTF supervision reform consultation outcome (18 June 2026)
FCA — AML supervisory reform (transition planning and current timetable)
Companies House — identity verification guidance

Legislation

Operating in the EU too? See the sibling guide: JUSTE AML EU.

Before you rely on this

The UK AML regime is under active reform. Some measures are already in force; others, including the professional-services supervision transfer, still require legislation and implementation. Dates and detail can change.
Use the current MLRs and the guidance of the supervisor that applies to your sector. HMRC’s guidance is the operational reference for HMRC-supervised businesses.
A contemporaneous governance record can evidence how controls operated in practice, but it does not itself provide a defence to section 250 or remove any legal responsibility.
This is a plain-language overview to help you prepare, not legal advice. For your firm’s specific obligations, speak to a qualified AML professional.

Where a governed AML platform helps

JUSTE is an AI-assisted, human-supervised AML platform built for UK and EU regulated SMEs — sanctions and PEP screening, policy-governed due diligence, beneficial-ownership checks, team controls and training, and an inspection record that shows how each decision was reached as the work happened. The record supports supervision and internal governance by showing how the firm’s controls operated in practice; it does not replace the firm’s legal responsibility. AI recommends. Policy governs. Humans sign off. Evidence survives. Talk to us at hello@juste.ai.