Key takeaways

  • Every UK accountancy practice must keep an up-to-date written firm-wide risk assessment under regulation 18 of the Money Laundering Regulations 2017.
  • The assessment must cover risk from customers, countries, services, transactions and delivery channels, scaled to the size and nature of the firm.
  • You must give the risk assessment to your AML supervisor on request, together with the information it is based on.
  • The UK's 2025 National Risk Assessment rated accountancy services high risk for money laundering and low risk for terrorist financing.
  • HMRC says the 2025 NRA highlights payroll, bookkeeping, insolvency and tax advice as services attractive for money laundering.
  • The CCAB published updated accountancy sector AML guidance on 5 August 2026, reflecting the Money Laundering Regulations amendments in force from 30 June 2026.
  • ACCA warns that a risk assessment copied from a template's generic wording is unlikely to satisfy regulators; tailor it to your own clients and services.

An AML risk assessment for an accountancy practice is a written record of the money laundering and terrorist financing risks your firm faces, and how you control them. Regulation 18 of the Money Laundering Regulations 2017 requires every firm to keep one up to date and show it to its supervisor on request. The template below follows the five risk areas in the regulation and the 2026 CCAB guidance.

What does the law require?

Regulation 18 of the Money Laundering Regulations 2017 requires you to take appropriate steps to identify and assess your firm’s money laundering and terrorist financing risks. It sets four rules.

  • Cover the risk factors: customers, countries or geographic areas, products or services, transactions and delivery channels.
  • Use your supervisor’s information: including the risk information it publishes.
  • Scale it: the steps must suit the size and nature of your business.
  • Keep a written record: up to date, and give it to your supervisor on request with the information behind it.

The firm-wide risk assessment comes first. Your policies, controls and client risk assessments should follow from it.

Which sources should you use?

Base the assessment on published risk information as well as your own client data. Sources to cite in your document:

  • HM Treasury’s National Risk Assessment 2025, which rates accountancy services high risk for money laundering and low risk for terrorist financing
  • the CCAB accountancy sector AML guidance, published 5 August 2026
  • your supervisor’s risk outlook, such as the Accountancy AML Supervisors’ Group (AASG) Risk Outlook
  • HMRC’s AMLG3700 sector risk guidance, updated 13 October 2026
  • the UK Sanctions List and the FATF high-risk country lists

The template

Copy each section into your own document and replace the prompts with your firm’s facts.

Part 1: firm profile

  • Firm name, AML supervisor and registration number
  • Money laundering reporting officer (MLRO) and the partner or director responsible
  • Number of principals and staff
  • Number of clients, split by type (individuals, sole traders, partnerships, companies, trusts)
  • Services offered and the share of fee income from each
  • Date of this assessment and date of the next review

Part 2: risk ratings

Rate each area low, medium or high, and record why. Use a simple scale.

RatingMeaningTypical response
LowUnlikely, small impactStandard due diligence
MediumPossible, moderate impactExtra checks for affected clients
HighLikely or serious impactEnhanced due diligence, partner sign-off

Part 3: risk areas

For each area, list your exposure, the rating and the controls. HMRC’s sector guidance gives these examples.

Customer risk

  • cash-intensive or low-margin, labour-intensive businesses
  • businesses in financial difficulty
  • frequent changes of owners, directors or shareholders
  • dormant entities needing services without a clear reason
  • clients whose lifestyle does not match their known income

Service risk

  • payroll, bookkeeping, insolvency and tax advice, which the 2025 NRA highlights
  • accounts prepared from incomplete or unverified records
  • forming companies that look like shell companies
  • requests with no clear business purpose

Geographic risk

  • clients or transactions linked to FATF “call for action” countries (Iran, North Korea and Myanmar)
  • links to countries with weak AML controls, sanctions, secrecy laws or high corruption

Transaction risk

  • overpayments followed by refund requests
  • unexplained changes in transaction patterns or counterparties
  • round-sum salaries or unusually low National Insurance in payroll records

Delivery channel risk

  • clients you never meet face to face
  • cash payments from unknown sources
  • pooled client accounts
  • introductions through unsupervised intermediaries

ACCA’s template also asks firms to assess proliferation financing risk as a separate area.

Part 4: controls and actions

For each high or medium risk, record the control, who owns it and the deadline. Examples are identity checks at client onboarding, enhanced due diligence for high-risk clients, staff training and periodic file reviews. Many firms use AML software for accountants to record checks.

Part 5: approval and review

Record who approved the assessment and when. ACCA says the management team should review and approve it periodically.

When should you review it?

Review the assessment regularly and whenever something changes. Regulation 18 requires the record to be kept up to date, and ACCA says it is “not a one-off exercise” and should be updated when clients, services, geographic exposure, regulation or threats change.

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 came into force on 30 June 2026. ICAS reports that they narrow mandatory enhanced due diligence for high-risk third countries to FATF call-for-action countries; grey-list countries remain a geographical risk factor. If your assessment predates July 2026, update it against the new CCAB guidance.

Common mistakes

  1. Copying template wording. ACCA says generic wording “is unlikely to satisfy regulatory expectations”.
  2. No link to clients. The assessment should reflect your actual client base and fee split.
  3. No evidence of review. Date every version and keep the old ones.
  4. Missing controls. Each high risk needs a named control and owner.

What to do now

  1. Check the date of your current assessment.
  2. Re-rate geographic risk under the 2026 rules.
  3. Confirm your supervisor’s details, as AML supervision of accountants is moving to the FCA. See AML supervision moving to the FCA and AML registration for accountants.

Frequently asked questions

Yes. Regulation 18 of the Money Laundering Regulations 2017 requires every relevant firm to assess its risks and keep an up-to-date written record, unless its supervisor says in writing that no record is needed.

Do sole practitioners need a written AML risk assessment?

Yes. Regulation 18 applies to sole practitioners, but the steps should match the size and nature of the business, so a smaller practice can keep a shorter document.

How often should an AML risk assessment be reviewed?

Regularly, and whenever your clients, services, regulations or risks change. Many firms set a fixed annual review date so the record never falls out of date. ACCA describes it as “not a one-off exercise”.

What risk rating does the National Risk Assessment give accountants?

The 2025 National Risk Assessment rates accountancy services high risk for money laundering and low risk for terrorist financing, according to HMRC’s AMLG3700 guidance.

Can I use a free AML risk assessment template?

Yes. ACCA publishes a free template, last updated in May 2026, but you must tailor it to your own clients and services.

Sources

Rates, thresholds and rules in this guide were checked against HMRC and GOV.UK guidance on 6 November 2026. Tax rules change, so check the current position on GOV.UK or with a qualified adviser before acting. This guide is general information, not personal advice.