Regulation 18 of the Money Laundering Regulations 2017 requires every UK accountancy practice to assess the risk of money laundering and terrorist financing to its own business — not just to each client. That assessment has to consider five specific risk factors, be written down, stay current, and be produced to your supervisor on request. It is a genuinely separate document from the risk assessment you carry out on each individual client, and confusing the two is the single most common gap a supervisor's review will find.
What regulation 18 actually requires
The duty itself is stated plainly: a relevant person must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject. What counts as "appropriate" isn't fixed — regulation 18(3) specifically requires you to take into account the size and nature of your business when deciding what steps are proportionate. A two-partner practice and a 200-person firm are both subject to the same duty, but what discharging it properly looks like will differ.
The Institute of Financial Accountants frames the practical mechanics as a three-step process: identify the risks, assess their likelihood and impact, and then put mitigating controls in place. And this obligation isn't specific to any one supervisor's interpretation — all accountancy service providers must carry out this risk assessment in line with the Regulations, whoever supervises them.
The risk factors the regulation actually lists
Regulation 18(2)(b) sets out five specific categories of risk factor your assessment has to cover: your customers; the countries or geographic areas you operate in; your products or services; your transactions; and your delivery channels. The Chartered Institute of Taxation summarises the same five categories in more practical language — the type of client, the country or geographic areas involved, the product or service being provided, the transactions themselves, and the delivery channel being used — and provides worked examples of what makes each one higher or lower risk in practice.
Taking your supervisor's own risk assessment into account
Regulation 18(2)(a) requires you to take into account information made available to you by your supervisory authority — specifically the information provided under regulations 17(9) and 47. For accountancy service providers supervised by HMRC, that means HMRC's own risk assessment of the accountancy sector, which HMRC prepares and makes available under those same provisions; you're required to factor that assessment into your own.
HMRC's guidance also tells supervised businesses to read the National Risk Assessment 2025, the national risk assessment of proliferation financing and the guidance on the Financial Action Task Force's website, and the Institute of Financial Accountants gives its members a similar list. Regulation 18 does not name those documents itself — they come from supervisors' guidance — but a supervisor will expect your assessment to reflect them.
The National Risk Assessment 2025 itself assessed accountancy service provider services as high risk for money laundering and low risk for terrorist financing — a starting point every practice-wide assessment in this sector should be built around.
Writing it down, and the narrow exception most guidance skips
Regulation 18(4) requires you to keep an up-to-date written record of every step you've taken under the identification and assessment duty — unless your supervisory authority notifies you, in writing, that a record isn't required. That exception is narrower than it sounds. Regulation 18(5) restricts when a supervisor can even issue that notification: only if the supervisor considers that the money laundering and terrorist financing risks applicable to the whole sector the firm operates in are clear and understood — not that your individual firm's risks are simple, but that the entire sector's risk profile is settled enough to need no written record from anyone in it. Given the National Risk Assessment's own high-risk rating for accountancy services, that's not a bar this sector is likely to clear — treat the written record as mandatory.
As an AML supervisor, professional bodies like the IFA may ask to see your documented firm-wide risk assessment as part of membership renewals and AML monitoring visits — it needs to actually exist and be current when that request comes, not be reconstructed retrospectively.
On how often to revisit it, the legislation itself is genuinely silent — the Chartered Institute of Taxation is explicit that the Regulations don't indicate how often a review should occur, though it recommends reviewing and considering updates at least annually as good practice. Other guidance frames the same expectation more firmly as a supervisory standard: the assessment should be recorded in writing, kept up to date, reviewed at least annually or more often if new services, clients or risks emerge, carry version control, and be signed by its author and approved by management. Treat "annually" as the expected professional standard your supervisor will look for, not a fixed legal minimum you can point to in the Act itself.
Providing it to your supervisor on request
Regulation 18(6) requires you to provide the risk assessment itself, the information it was based on, and any written record kept under regulation 18(4), to your supervisory authority whenever it asks. More broadly, all businesses are expected to have their documented policies, controls and procedures — including copies of compliance reviews — available for inspection by their supervisory authority on request. That means the firm-wide risk assessment can't just live in someone's head or an old email; it has to be retrievable as a document, on demand.
How this differs from the risk assessment on each client
This is the distinction worth being completely clear on, because the two documents look similar but do different jobs. HMRC's own risk-based approach guidance splits the work into two separate steps: carry out a detailed risk assessment of your business as a whole, focusing on things like customer behaviour and delivery channels in general terms, and separately carry out a risk assessment of your customers individually. AAT's structure mirrors this — it places the firm-wide risk assessment under general risk management, and treats the client-level assessment as one of the customer due diligence measures: an assessment of the level of risk arising from a specific business relationship. The Chartered Institute of Taxation lists them as two entirely distinct formal documentation requirements: a written firm-wide risk assessment and a documented risk assessment for every client, alongside a written AML policies and procedures document and an AML training log. One assessment looks at your practice as a whole; the other looks at the specific person or entity sitting in front of you. You need both, and neither substitutes for the other.
What HMRC's guidance actually flags as risk indicators
HMRC's published guidance for the accountancy sector gets specific about what raises risk in practice, which is worth folding directly into your written assessment rather than leaving it generic. A request with no clear business reason — especially one that's complex or cross-border, particularly if the customer seems secretive about it — is flagged as a signal of higher risk. Where services are delivered through a supply chain — created whenever a service reaches an end-user through an intermediary rather than directly — HMRC expects you to properly assess the services, customers, intermediaries and locations involved, the chain's length or complexity, and specifically how the risk of delivering the service through that chain differs from delivering it directly.
Geography matters directly too: providing services to, or transacting with, a person or business established in a high-risk third country — a jurisdiction FATF considers to have strategic deficiencies in its anti-money-laundering, counter-terrorist-financing or counter-proliferation-financing regimes — carries a high risk in HMRC's own guidance, and enhanced due diligence measures must be applied before you even form the business relationship, not after.
On services specifically, HMRC highlights payroll, bookkeeping, insolvency and tax advice as work that's attractive for money laundering purposes, and separately flags that where an accountancy service provider also offers trust or company services, those are considered high risk for money laundering in their own right.
Which services carry the highest risk
The National Risk Assessment 2025 rates the money laundering risk for accountancy service providers as high. It names the services criminals can use: payroll, bookkeeping, insolvency services and tax advice, plus trust and company services where a practice offers them. It singles out clients with cash-intensive businesses as particularly high risk, because cash can disguise where money came from and makes it easy to mix legitimate and criminal earnings. It also warns about fragmentation — a criminal using one firm for payroll, another for tax and a third for the books, so no single firm sees the whole picture — and about services delivered through a supply chain, where the intermediary puts distance between you and the end client. Weight your own assessment around the services you actually provide, the clients you take on, and how you reach them.
The scale behind all of this is worth keeping in view while you're weighing how seriously to take the exercise: the UK economy is estimated to lose over £100 billion annually to money laundering, and the National Crime Agency has said there's a realistic possibility the true figure runs into the hundreds of billions of pounds a year. Accountancy services sit inside that picture as a sector the National Risk Assessment itself rates high risk for money laundering.
Frequently Asked Questions
Is the annual review of our firm-wide risk assessment a legal requirement? No. The Regulations themselves don't specify a review frequency. Annual review, at minimum, is the standard supervisors expect as good practice, and it's a reasonable one to hold yourself to.
Does the firm-wide risk assessment replace the risk assessment on each client? No — they're two separate, both mandatory documents. One assesses risk to your business as a whole; the other assesses the risk arising from each specific client relationship.
Can our firm skip keeping a written record? Only if your supervisor notifies you in writing that one isn't required, and it can only do that if it judges the money laundering and terrorist financing risks across your entire sector — not just your firm — are clear and understood. Given the accountancy sector's high-risk rating in the National Risk Assessment, treat the written record as effectively mandatory.
Does regulation 18 apply the same way to a small practice as a large firm? The duty applies regardless of size, but regulation 18(3) requires you to take the size and nature of your business into account when deciding what steps are proportionate — so what a small practice needs to produce can reasonably be less extensive than what a large multi-office firm needs, without the underlying obligation changing.
Which of our services carry the highest money laundering risk? The National Risk Assessment 2025 names payroll, bookkeeping, insolvency services and tax advice, plus trust and company services. Clients with cash-intensive businesses are singled out as particularly high risk.
Deplexify writes the practice-wide risk assessment (regulation 18) and the policies, controls and procedures (regulation 19) for your firm, from your answers — the documents pack is £295 at launch pricing.
Sources
- Anti-money laundering | AAT — aat.org.uk, read 2026-09-24
- Risk assess your business for money laundering supervision - GOV.UK — gov.uk, read 2026-09-24
- AML risk and the risk-based approach — ifa.org.uk, read 2026-09-24
- AML Risk Based Approach | Chartered Institute of Taxation — tax.org.uk, read 2026-09-24
- AML Firm-Wide Risk Assessments: Often Overlooked but Integral to a Firm’s Compliance — cpdstore.co.uk, read 2026-09-24
- Risks common to accountancy service providers - GOV.UK — gov.uk, read 2026-09-24
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 — legislation.gov.uk, read 2026-09-24
- AMLG3700 - Sector Risk Assessments: Risk Assessment of Accountancy Service Providers - HMRC internal manual - GOV.UK — gov.uk, read 2026-09-24
- National Risk Assessment of Money Laundering and Terrorist Financing 2025 (HM Treasury / Home Office) — assets.publishing.service.gov.uk, read 2026-09-25