AML supervision for UK firms: HMRC or a professional body, and what your supervisor actually expects

If you've been told your business needs "AML supervision" and you're not sure what that actually means beyond registering somewhere and paying a fee, you're not alone. The Money Laundering Regulations 2017 (MLR 2017) capture a specific list of business activities, hand supervision to different bodies depending on who you are, and expect a written risk assessment, written policies, a named officer, customer checks and years of records — before anyone visits you. This is a plain-English walkthrough of who's caught, who supervises you, and what your supervisor is actually going to ask for.

Who needs supervision at all

MLR 2017 applies to specific regulated sectors, defined by activity rather than by job title. The ones outside financial services that catch most people out are:

Accountancy service providers — accountants, bookkeepers and tax advisers providing accountancy, audit, insolvency or tax services by way of business.
Trust or company service providers (TCSPs) — forming companies, acting as a client's director/secretary/partner, providing a registered office, or acting as trustee.
Estate agency businesses — estate agency work as defined by the Estate Agents Act 1979, including commercial sales and lettings above threshold.
Letting agency businesses — a tenancy of a month or more at a monthly rent of £10,000 or more. That threshold used to be €10,000; S.I. 2026/621 substituted the sterling figure from 30 June 2026, so check pounds, not euros — some third-party guidance still hasn't caught up.
High value dealers — cash of €10,000 or more for goods, single or linked payments.
Art market participants — works of art valued at €10,000 or more.
Plus money service businesses, casinos and other financial-sector firms, not covered here.

It's the activity that captures you, not the label on your door — a "practice" that only does management consultancy, with no accountancy, audit, insolvency or tax work, is a harder case for capture than the name suggests, while a business that never calls itself a TCSP but forms companies for clients as part of its work is captured regardless. And being unregistered doesn't mean you're out of scope: HMRC has said plainly, in the estate agency context, that a firm carrying out captured activity without ever having enrolled is an unregistered reporting business, not one outside the Act.

HMRC or a professional body — it's not really a free choice

This is the question in the title, and the honest answer disappoints people hoping for a preference to exercise. For accountancy service providers, supervision follows professional membership, not election. Members of a chartered or certified body with a practising certificate — ICAEW, ACCA, ICAS, CIMA — are normally supervised by that body as a condition of membership; you don't opt for HMRC because it looks cheaper. If you're not affiliated with any of them — unqualified accountants, many bookkeepers, some tax advisers — HMRC is the default, describing itself as "supervisor of last resort." Solicitors and other legal professionals sit with their own regulator (the SRA, CILEx Regulation), never HMRC or an accountancy body. TCSPs, estate agencies, letting agencies above threshold, high value dealers and art market participants have no professional-body route at all — HMRC or nothing. So "choice" mostly runs one step removed: an accountancy practice picks which body to join, and that fixes its supervisor as a side effect.

Cost and process do differ. HMRC's fees are flat and published — £300 application, £400 per premises, plus a per-person check (below). Professional bodies set AML fees per firm, by size and assessed risk, with no single published number — ICAEW says as much on its own fee pages — and firms also carry the OPBAS levy (£60 per UK practising certificate holder for ICAEW), funding the Office for Professional Body AML Supervision's oversight of the 22 professional body supervisors. HMRC and the FCA aren't overseen by OPBAS; they answer to Parliament and the Treasury directly. HMRC runs standalone AML compliance checks through regional teams; a professional body more often folds AML into a wider practice-monitoring visit — ICAEW's cycle runs annual to every eight years by risk, desk-based or on-site.

One live change worth flagging: in November 2025, Treasury announced it intends to make the FCA the single supervisor for professional services AML, replacing the split between the 22 professional bodies and HMRC's supervision of unaffiliated accountants and TCSPs. No fixed date yet — it needs legislation and a "phased, risk-managed" transition still being designed. Compliant firms shouldn't need to change their control framework purely because the supervisor's name does. Don't restructure around it yet; watch your own supervisor's updates instead.

Registering with HMRC — what actually happens

Registration runs through your Government Gateway account, and HMRC is blunt about sequencing: have your risk assessment and controls in place, know your beneficial owners, officers and managers (BOOMs), and know every premises where the supervised activity happens — before you apply. In HMRC's own words: "We may reject or refuse your application if you do not have these in place."

The fees, current as of HMRC's most recent schedule:

£300 one-off application fee (non-refundable; waived under the small business fee reduction — turnover under £5,000).
£400 per premises, paid annually.
£40 approval-check fee per BOOM (accountancy service providers, estate agency businesses, high value dealers, letting agencies, art market participants), or £500 for the fuller fit-and-proper test per BOOM (money service businesses and TCSPs — see below).
Since 1 December 2025, a £2,000 sanction administration charge on top of every civil sanction HMRC issues (capped at the penalty value where that's under £2,000).

New applications normally take up to 45 days, longer if HMRC comes back for more information. If it does, regulation 57(3) gives you 21 days from the date the request is issued — not from application — to respond, and regulation 59(1)(a) lets HMRC refuse registration if you don't. Registration then runs annually: HMRC notifies you around 30 days before your declaration is due, and you confirm and pay, or it's cancelled.

Fit-and-proper versus approval check. MSBs and TCSPs face the full three-part fit-and-proper test — a Schedule 3 criminal-record check (an unspent listed conviction is an automatic fail), a pattern-of-non-compliance check, and a broader look at honesty, competence and financial soundness. Everyone else's BOOMs go through the lighter approval check: under regulation 26, HMRC "must grant" approval unless the person has a relevant Schedule 3 conviction. A later conviction simply ends the approval.

What every supervised firm must have, whoever supervises you

The substantive obligations are the same regardless of whether HMRC or a professional body signs off on your registration — they come straight from MLR 2017, not from your supervisor's own rulebook.

A written, firm-wide risk assessment (regulation 18). Five named factors — customers, countries you operate in, products and services, transactions, delivery channels — kept current and producible on request. Regulation 18A adds a separate proliferation financing assessment, which generic templates routinely miss.
Written policies, controls and procedures (regulation 19). These must mitigate the risks your own risk assessment identified — regulation 19(1)(a) ties the two documents together by law, which is why an off-the-shelf template structurally can't satisfy it: it wasn't built against any risk assessment, let alone yours. Senior management approval is required (regulation 19(2)(b)).
A nominated officer (regulation 21), an individual within your own firm (21(3)) who receives internal suspicion reports and decides whether to escalate to the NCA. Your compliance officer must separately sit in senior management (21(1)(a)). Neither role can be outsourced.
Customer due diligence, or CDD (regulation 27), triggered by a business relationship, suspicion of laundering or terrorist financing, doubt about ID already held, and occasional transactions above sector thresholds — £12,000 generally, £10,000 cash for high value dealers, £2,000 for casinos, £10,000 monthly rent for letting agents, £800 for cryptoasset transfers.
Enhanced due diligence, or EDD (regulation 33), layered on top wherever risk is genuinely higher: FATF call-for-action countries, correspondent banking, PEPs and their close associates, a customer who's previously supplied false ID but you're continuing anyway, and transactions unusually large, complex, or without apparent economic purpose.
Ongoing monitoring, not just a check at the start.
Record keeping (regulation 40) — CDD documents and enough transaction detail to reconstruct what happened, kept five years from the end of the relationship, extendable to ten if your supervisor asks, then deleted under data protection law.
Training (regulation 24) for every relevant employee and agent — the law, related data protection, recognising suspicious activity — given regularly, with a written record of what was given and to whom.

What a supervisor actually checks

HMRC runs these as compliance checks, usually arranged by phone, though it reserves the right to turn up unannounced. A visit covers your risk assessment, policies and controls, CDD files, staff training records, and record-keeping — checking that what's written matches what actually happens on your files, not just that the documents exist. HMRC is explicit a visit doesn't imply suspicion; it's also a chance to ask about anything you're unsure of.

Professional bodies more often build the AML check into a wider practice-monitoring visit. ICAEW reports 2,000+ reviews completed across supervised firms in 2025, with frequency (annual to every eight years) and format (desk-based or on-site) both set by risk. Either way, the check is increasingly whether your risk assessment and procedures actually agree with each other, not whether you can produce a folder.

Common failures and the enforcement pattern

HMRC has a statutory duty to publish businesses that haven't complied with MLR 2017, in six-monthly rounds on gov.uk. The round covering 1 April to 30 September 2025 lists 334 penalty notices, of which 159 were against estate agency businesses, totalling £825,405 for that sector alone. Of those 159, 148 — over 90% — were issued under regulation 56, for failing to apply for registration at the required time, not for a missing risk assessment or a documentation gap. The same pattern holds across the other supervised sectors on the same list. HMRC updates it on a rolling basis and breakdowns shift each release, so check the current version on gov.uk rather than relying on any single point-in-time figure, including this one.

Put plainly: the highest-value thing a newly captured firm can do is register on time, before doing any captured work — not agonise over a perfect risk assessment while trading unregistered.

SARs — when, how, and the tipping-off trap

If you know or suspect — or have reasonable grounds to — that a client is engaged in money laundering, section 330 of the Proceeds of Crime Act 2002 (POCA) makes it a criminal offence for anyone in the regulated sector to fail to report that to the NCA or their nominated officer. That's what a suspicious activity report (SAR) is for, filed through the NCA's SAR portal.

Two traps sit either side of that duty. Tipping off — POCA section 333A — makes it an offence to disclose to the client, or anyone else, that a SAR has been made or an investigation is under way, where that might prejudice it; you cannot warn a client, even obliquely. If you need to keep acting for a client without committing an offence yourself, request a defence against money laundering (DAML), formerly a consent SAR — filed electronically, triggering a seven-working-day notice period the NCA can object within, extendable into a moratorium if it does. Live DAML queries go through a dedicated NCA inbox, not the general SAR channel.

A practical readiness checklist

Confirm, by activity rather than job title, whether MLR 2017 actually captures what you do.
Establish who your supervisor is — professional body membership if you have it, HMRC by default if not — and don't assume you get to pick.
If HMRC-supervised: gather your BOOM and premises lists, and have your risk assessment and controls written before you apply, not promised for later.
Hold both a firm-wide risk assessment (the five factors, plus the separate proliferation financing assessment) and policies actually written against it.
Name a nominated officer and a compliance officer from your own senior management — not an outsourced arrangement.
Build CDD and EDD triggers into onboarding itself, not just the written policy.
Keep CDD and transaction records for five years minimum, and know what extends that to ten.
Run and log training regularly for every relevant employee and agent.
Register — and renew — on time. It's the single most common way firms end up on HMRC's published list.

Glossary

MLR 2017 — the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, the core UK AML statute for non-financial businesses.
BOOM — beneficial owner, officer or manager; the individuals HMRC checks when a firm registers.
OPBAS — the Office for Professional Body Anti-Money Laundering Supervision, overseeing the 22 professional body supervisors (not HMRC or the FCA).
CDD / EDD — customer due diligence and enhanced due diligence: who a customer actually is, and, for EDD, why the relationship needs closer scrutiny.
Nominated officer / MLRO — the individual inside a firm who receives internal suspicion reports and decides whether to file a SAR with the NCA.
DAML — defence against money laundering, a request for NCA consent to proceed with an otherwise-suspect transaction.

FAQ

I'm a qualified accountant. Can I just register with HMRC instead of my professional body to save money? Not normally. If your practising certificate comes from a body that supervises AML for its own members — ICAEW, ACCA, ICAS, CIMA — that supervision is generally a condition of membership, not an alternative you opt out of.

We're a small firm — does the fit-and-proper test apply to us? Only if you're a money service business or a TCSP. Everyone else's BOOMs go through the lighter approval check, which under regulation 26 comes down to whether you have an unspent conviction for a relevant offence.

What's the actual difference between CDD and EDD? CDD is the baseline check required whenever you establish a business relationship or cross a transaction threshold. EDD is additional scrutiny layered on top wherever specific higher-risk circumstances apply — a PEP, a high-risk jurisdiction, an unusually large or opaque transaction — and it adds to CDD rather than replacing it.

If I suspect something but I'm not sure, do I still have to report it? Yes. Section 330 of POCA sets the bar at "know or suspect, or have reasonable grounds to know or suspect" — certainty isn't the threshold, and neither is being right in the end.

This article explains the legal framework — it isn't legal advice, and Deplexify is not an AML supervisor. If you're an HMRC-supervised estate or letting agent, Deplexify's UK AML service builds your regulation 18 risk assessment and regulation 19 policies from your own answers, with the working shown, so what you hand over on request actually matches what your business does.