Anti-Money Laundering for Businesses

Anti-money laundering (AML) regulations require UK businesses in certain sectors to take active steps to prevent criminals from using legitimate businesses to disguise the origins of illegally obtained money. Failing to comply can result in criminal prosecution, unlimited fines and significant reputational damage.

Even if your business is not in a traditionally regulated sector, understanding AML basics protects you from inadvertently facilitating financial crime.

Who is covered by AML regulations?

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017) apply to businesses in the “regulated sector”, which includes:

• Accountants and tax advisers
• Estate agents and letting agents
• Legal professionals (solicitors, barristers)
• Financial institutions (banks, building societies, insurance companies)
• Trust and company service providers
• High-value dealers (businesses accepting cash payments of €10,000 or more)
• Art market participants (dealers handling transactions of €10,000 or more)
• Cryptoasset exchange providers and custodian wallet providers

If your business falls within any of these categories, you must comply with the full AML regime. If it does not, you still have a general obligation under the Proceeds of Crime Act 2002 (POCA) not to deal with the proceeds of crime.

Core AML obligations

Risk assessment

Every regulated business must carry out a firm-wide risk assessment that identifies and assesses the money laundering and terrorist financing risks it faces. This assessment must consider:

The risk assessment must be documented, kept up to date and made available to your supervisory authority on request.

Customer due diligence (CDD)

Before establishing a business relationship or carrying out an occasional transaction above certain thresholds, you must carry out customer due diligence:

• Identify the customer – obtain their name, date of birth and residential address
• Verify identity – check identity documents (passport, driving licence) or use electronic verification
• Identify beneficial owners – determine who ultimately owns or controls the customer (anyone holding more than 25% of shares or voting rights)
• Assess the purpose and nature of the business relationship

Enhanced due diligence (EDD)

Enhanced checks are required in higher-risk situations:

• Politically Exposed Persons (PEPs) – individuals holding prominent public positions, their family members and known close associates
• Customers from high-risk third countries – countries identified by the Financial Action Task Force (FATF) or the UK government
• Complex or unusually large transactions with no apparent legitimate purpose
• New technologies or delivery mechanisms that may increase anonymity

EDD measures might include obtaining additional identity documentation, verifying the source of funds, obtaining senior management approval and conducting ongoing enhanced monitoring.

Simplified due diligence (SDD)

For lower-risk customers (such as UK-listed companies, UK public authorities), you may apply simplified due diligence – reduced checks based on the lower risk profile. However, you must still be able to demonstrate that the lower risk assessment is justified.

Suspicious Activity Reports (SARs)

If you know or suspect that a person is engaged in money laundering or terrorist financing, you must file a Suspicious Activity Report (SAR) with the National Crime Agency (NCA).

Key rules:

• Reports must be filed as soon as practicable after the suspicion arises
• You must not tip off the customer that a report has been made
• If you want to proceed with a transaction that you have reported, you must obtain consent from the NCA (known as a Defence Against Money Laundering, or DAML)
• Failure to report is a criminal offence carrying up to 5 years’ imprisonment

What triggers a SAR?

There is no definitive list, but common indicators include:

• Customer reluctant to provide identification
• Transactions that do not match the customer’s known profile
• Unusually large cash transactions
• Complex transaction structures with no apparent legitimate purpose
• Connections to countries with weak AML controls
• Customer acting on behalf of undisclosed third parties

Record-keeping

AML records must be kept for 5 years after the end of the business relationship or the date of the occasional transaction. Records include:

• Copies of identification documents
• Details of all transactions carried out
• Results of due diligence and ongoing monitoring
• Internal suspicion reports and SARs filed

This aligns with broader accounting records retention requirements, though the AML-specific retention period runs from the end of the relationship, not the end of the accounting period.

Policies, controls and procedures

Regulated businesses must have written AML policies covering:

• Customer due diligence procedures
• Reporting procedures (internal and external)
• Record-keeping procedures
• Risk assessment methodology
• Screening of employees
• Training – all relevant staff must receive AML training at the start of their employment and at regular intervals

You must appoint a nominated officer (also called the Money Laundering Reporting Officer, or MLRO) responsible for receiving internal suspicious activity reports and filing SARs with the NCA.

Supervisory authorities

Your AML supervisory authority depends on your sector:

If you are unsure which supervisory body applies to your business, HMRC is the default supervisor for businesses in the regulated sector that are not supervised by a professional body.

Penalties

AML failures carry severe consequences:

Beyond criminal penalties, regulated firms face enforcement action from their supervisory authority, which can include fines, public censure and removal of authorisation to operate.

Practical steps for small businesses

Even small businesses in the regulated sector must have proportionate AML measures. Practically, this means:

1. Complete your firm-wide risk assessment and review it annually
2. Document your CDD procedures and apply them consistently
3. Train your staff – even a sole practitioner needs to evidence their own training
4. Keep records of all identification checks and transactions
5. Appoint a nominated officer (this can be the owner in a small firm)
6. Screen against sanctions lists – the UK sanctions list is available from the Office of Financial Sanctions Implementation (OFSI)
7. Report suspicions – when in doubt, file a SAR; you are protected from liability for reporting in good faith

AML compliance is not just a regulatory box-ticking exercise. It protects your business from criminal exploitation and the devastating consequences of being associated with financial crime.