Every UK accountancy practice that provides accounting, tax or related services to clients must be supervised for anti-money laundering (AML) under the Money Laundering Regulations. Supervision is provided either by your professional body (ICAEW, ACCA, AAT, ICB and others) or by HMRC. Operating without supervision is a criminal offence. AML compliance includes registration, a written firm risk assessment, client due diligence, ongoing monitoring, staff training, and reporting suspicious activity.
Who has to register?
You must be supervised for AML if you, your firm, or your business provide any of the following to clients in the course of business:
- Audit, accountancy, bookkeeping, tax services or payroll-related advisory
- Trust or company service provider activities (forming companies, acting as registered office, providing nominee directors)
- Insolvency services
- Estate agency, letting agency, high-value dealer activity (less common but in scope)
Even sole-practitioner part-time bookkeepers fall in scope as soon as they accept paid clients.
Who supervises you?
If you are a member of a recognised professional body and licensed to practise, that body usually supervises you for AML:
| Body | Supervises |
|---|---|
| ICAEW | Members in practice (Practising Certificate holders) |
| ACCA | Members holding ACCA Practising Certificate |
| AAT | AAT Licensed Members and Licensed Bookkeepers |
| CIOT / ATT | Members in practice |
| ICB / IAB | Members in practice |
| HMRC | Anyone not supervised by a professional body who falls in scope |
If you are not a member of a supervised body, you must apply to register with HMRC.
How to register with HMRC
If HMRC is your supervisor:
- Apply through GOV.UK using the Anti-Money Laundering Supervision online service
- Provide details of the business, beneficial owners, and any senior managers
- Pass HMRC's "fit and proper" test for relevant individuals
- Pay the annual premises fee plus the fit-and-proper fee for relevant people
- Wait for HMRC's confirmation; do not provide regulated services until you are registered
Operating before registration is a criminal offence carrying unlimited fines and possible imprisonment.
What AML compliance requires
Once registered (whichever supervisor), the core AML compliance components are:
- Firm risk assessment: a written assessment of how money laundering and terrorist financing risks affect your practice (clients, services, geography, delivery channels)
- Policies, controls and procedures: documented AML policies covering client acceptance, monitoring, training, record-keeping
- Client due diligence (CDD): identify and verify the identity of every client; identify beneficial owners of corporate clients; understand the purpose of the relationship
- Enhanced due diligence (EDD): required for higher-risk clients (e.g. PEPs, complex structures, high-risk jurisdictions)
- Ongoing monitoring: review client relationships regularly; refresh CDD periodically
- Staff training: annual AML training for all staff in scope; document attendance and content
- Suspicious Activity Reports (SARs): submit SARs to the National Crime Agency where you have grounds to suspect money laundering
- Record-keeping: retain CDD, transaction and training records for at least five years from the end of the client relationship
What AML inspections look like
Your supervisor will inspect your firm periodically (frequency varies by risk and supervisor). A typical AML inspection covers:
- Review of your written firm risk assessment and AML policies
- Sample testing of client files: CDD documents, EDD where applicable, evidence of ongoing monitoring
- Confirmation of staff training records and CPD
- Review of SAR registers and any reports made
- Discussion of any high-risk client relationships
Common inspection findings include: out-of-date firm risk assessments, missing CDD on long-standing clients, inadequate beneficial owner identification on corporate clients, and weak ongoing monitoring.
Sanctions can include fines (often substantial), public censure, suspension or removal of practising certificate, and in serious cases criminal prosecution. AML compliance is not optional, and "small practice" or "low-risk clients" are not defences.
How much does AML supervision cost?
HMRC supervision involves an annual premises fee plus a fit-and-proper fee for each relevant person, plus the cost of running compliant systems (training, software, time). Total cost commonly £400 to £1,500 per year for a sole practitioner.
Professional body supervision is typically bundled with your practice licence and annual subscription.
Key Takeaways
- Every UK accountancy practice (including sole-practitioner bookkeepers) must be supervised for AML
- Supervision is by your professional body if licensed; otherwise by HMRC
- Operating without AML supervision is a criminal offence
- Compliance includes a firm risk assessment, CDD, EDD, ongoing monitoring, SAR reporting and staff training
- Records must be kept for at least five years; inspections are routine
Frequently asked questions
Do I need AML registration if I only have one client?
Yes, if you provide accountancy, bookkeeping, tax or related services to a client in the course of business. There is no minimum-client exemption.
How long does HMRC AML registration take?
Typically several weeks once HMRC has all the information it needs, including fit-and-proper checks. Apply well in advance of taking your first client.
What is a Suspicious Activity Report?
A SAR is a report submitted to the National Crime Agency where you have grounds to suspect a transaction relates to money laundering or terrorist financing. SARs can be made online via the SAR Online portal.
Do clients have to be told about CDD checks?
You can ask clients for ID and beneficial-owner information openly; in fact you should explain that this is a regulatory requirement. You must not, however, "tip off" clients about a SAR or any suspicious activity investigation.
How often do you need to refresh CDD?
There is no fixed period in regulation, but most firms refresh on a risk basis: low-risk clients every 3 to 5 years, higher-risk clients annually or when circumstances change.