Understanding Your Anti-Money Laundering Responsibilities

Money laundering isn’t just something that happens in the world of international finance or crime dramas — it’s a real risk for many UK small businesses, and the legal responsibilities are both serious and complex. Whether you’re an accountant, estate agent, jeweller, or run a business in a regulated sector, failing to meet your anti-money laundering (AML) duties can land you with hefty fines, business closure, or even criminal charges. This guide breaks down exactly what AML means for UK small business owners, what laws apply, who needs to comply, and how to set up robust procedures that keep your business safe and legal.

Money laundering is the process of disguising the origins of money obtained through criminal activity, making it appear legitimate. This isn’t just an abstract risk — in the UK, the National Crime Agency estimates that hundreds of billions of pounds are laundered through the UK every year. Criminals use legitimate businesses to funnel dirty money back into the economy, undermining the integrity of the financial system and putting honest businesses at risk.

To combat this, the UK enforces strict anti-money laundering (AML) regulations. The core legislation is the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, commonly known as the Money Laundering Regulations. Businesses that fall under these rules must take active steps to detect and prevent money laundering. These obligations are not optional or just ‘best practice’ — they’re legal requirements, enforced by HMRC and other supervisors.

AML laws are designed not only to catch criminals, but to prevent businesses being used — knowingly or unknowingly — as conduits for illegal funds. That’s why the rules place such a strong emphasis on knowing your customers, monitoring transactions, and reporting anything suspicious. Even small businesses can be targeted by criminals looking for weak spots in the system.

Not every business in the UK falls within the scope of AML regulations, but the list is broader than many owners realise. The main sectors covered include accountancy service providers, estate and letting agents, high-value dealers, trust or company service providers, law firms, and some financial institutions. If your business handles large transactions, provides financial advice, or deals in high-value goods (like jewellery or vehicles), you may well be within scope.

The regulations apply regardless of business size. A one-person accountancy practice is just as responsible for AML compliance as a large firm. HMRC supervises many of these sectors, but some — such as solicitors and chartered accountants — are overseen by professional bodies like the Law Society or ICAEW. You must register with your relevant supervisor before carrying out any regulated activities.

There is often confusion about the definition of 'high-value dealer'. Under UK rules, this means any business accepting cash payments of €10,000 or more (or the equivalent in other currencies) for goods, whether in a single transaction or several linked transactions. This threshold applies even if the transaction is split over several days.

• Check the latest guidance on GOV.UK for your sector’s threshold and requirements.
• If in doubt, consult your professional body or HMRC directly.
• Remember: registration must be completed before you start any regulated activity.
• Annual renewal of registration is required and comes with a fee.

Your AML obligations go far beyond simply registering with a supervisor. UK law requires you to take a risk-based approach to preventing money laundering. That means assessing where your business is vulnerable and putting proportionate controls in place. The main pillars of AML compliance are customer due diligence (CDD), ongoing monitoring, record keeping, reporting suspicious activity, and staff training.

Customer due diligence is fundamental — you must verify the identity of your clients, understand the nature of their business, and assess the risk they pose. For high-risk situations, you need to carry out enhanced due diligence, which involves gathering additional information and possibly verifying sources of funds. Ongoing monitoring means keeping an eye on transactions and relationships, not just at the start but throughout the business relationship.

Record keeping is another critical requirement. You must maintain detailed records of customer identification, transactions, and your own AML checks for at least five years. If you spot something suspicious, you’re legally obliged to report it to the National Crime Agency (NCA) via a Suspicious Activity Report (SAR). Staff training is also mandatory — even if you’re a sole trader, you need to keep your own knowledge up to date.

1. 1Complete a formal AML risk assessment covering your business, customers, products, and delivery channels.
2. 2Carry out customer due diligence (CDD) before establishing a business relationship or carrying out an occasional transaction.
3. 3Apply enhanced due diligence (EDD) in higher-risk cases, such as politically exposed persons (PEPs) or high-risk countries.
4. 4Monitor customer transactions for unusual or suspicious activity on an ongoing basis.
5. 5Maintain up-to-date records of all CDD checks, transactions, and internal AML decisions.
6. 6Report suspicious activity to the NCA and cooperate with law enforcement if required.
7. 7Ensure all relevant staff receive regular AML training.

Registering with your designated AML supervisor is a legal requirement before carrying out any regulated activity. For many small businesses, this will be HMRC, but it could also be a professional body. The registration process involves submitting detailed information about your business, its owners, structure, and the types of services you provide. You will need to pay an initial registration fee and an annual renewal fee. As of 2026, HMRC charges £300 per premises plus a £40 fit and proper test fee for each relevant person.

After registration, you must keep your supervisor updated on any changes to your business activities, addresses, or responsible persons. Supervisors have the power to inspect your business, request documents, and impose penalties for non-compliance. Regular audits are common — these may be announced or unannounced, and you’ll be expected to demonstrate your AML procedures in detail.

Non-compliance can result in severe penalties, including fines, suspension, or being barred from practice. In 2022–23, HMRC issued over £5.6 million in penalties for AML failings. The best way to protect your business is to treat AML compliance as a continual, proactive process, not a one-off tick-box exercise.

• Set calendar reminders for annual renewals — late fees and deregistration are common mistakes.
• Update your supervisor within 14 days of any major business change.
• Keep copies of all correspondence with HMRC or your supervisor.
• If you cease regulated activity, formally deregister to avoid ongoing fees.

Customer due diligence (CDD) is the backbone of any AML programme. The law requires you to verify the identity of your customers and, where relevant, the beneficial owners (the real people who ultimately own or control the customer). For individuals, this typically means checking official ID (passport, driving licence) and proof of address (utility bill, bank statement). For companies, you must verify the business’s legal existence, ownership, and control structure using Companies House or equivalent documents.

The timing of CDD is crucial. You must complete checks before entering into a business relationship or carrying out an occasional transaction worth €15,000 or more. If you cannot complete CDD, you must not proceed with the transaction. In some cases — such as remote onboarding or dealing with high-risk countries — you should apply enhanced due diligence. This might include verifying sources of funds, requiring senior management approval, or conducting additional checks against sanctions lists.

Don’t fall into the trap of treating CDD as a one-time event. Ongoing monitoring is legally required, so you must keep customer information up to date and revisit checks if something changes (new directors, unusual transactions, etc.). If you spot anything suspicious during CDD or ongoing monitoring, you must file a Suspicious Activity Report (SAR) without tipping off the customer.

• Always use reliable, independent source documents for verification.
• For face-to-face clients, check the photo ID matches the person.
• For remote clients, use trusted electronic verification providers.
• Update CDD if the client’s circumstances change or red flags arise.
• Don’t proceed with a transaction if you cannot complete CDD satisfactorily.

Spotting suspicious activity is a legal duty, not a suggestion. Signs can include reluctance to provide information, complex or illogical transactions, deals that don’t make commercial sense, or clients who are evasive about the source of funds. These aren’t always obvious, and criminals often try to exploit trusted relationships or pressure staff into ignoring red flags.

If you have reasonable grounds to suspect money laundering or terrorist financing, you must submit a Suspicious Activity Report (SAR) to the National Crime Agency (NCA). This is done online via the NCA SARs portal. You should provide as much detail as possible, including customer information, reasons for suspicion, and any supporting documents. Make the report as soon as suspicion arises — it’s a criminal offence to continue with a transaction once you suspect money laundering, unless you receive consent from the NCA.

It is illegal to tip off the customer that you have made a SAR. Doing so can itself be a criminal offence under the Proceeds of Crime Act 2002. The NCA may give you consent to proceed, or may instruct you to halt the transaction. All SARs should be documented and kept confidential within your business.

• Unusual payment methods (large cash deposits, third-party cheques, cryptocurrencies).
• Reluctance to provide ID or explain the source of funds.
• Transactions that are inconsistent with the customer’s profile.
• Complex company structures with no clear business rationale.
• Frequent changes in ownership or directorship without explanation.

Regulations require all relevant employees to receive regular AML training. This isn’t just a box-ticking exercise — untrained staff are a key weak point criminals exploit. Training must cover how to spot suspicious activity, your business’s specific AML procedures, and the consequences of non-compliance. For sole traders, you must keep your own knowledge up to date and document your training efforts.

A strong culture of compliance is about more than just policies. Senior management must set the tone, making it clear that AML is a non-negotiable priority. Staff should feel able to raise concerns without fear of reprisal. Many businesses appoint a Money Laundering Reporting Officer (MLRO), even if not strictly required, to centralise responsibility and ensure consistent standards.

Common mistakes include treating training as a one-off or using generic online courses that don’t address your actual risks. Tailor your training to the realities of your business: the types of clients you serve, the transactions you process, and the red flags most relevant to your sector. Revisit training at least annually, and after any regulatory changes or major business events.

• Develop sector-specific training using real-world case studies.
• Maintain written records of all training sessions and assessments.
• Provide refreshers after regulatory updates or major incidents.
• Encourage staff to report concerns without fear of reprisal.
• Appoint an MLRO to oversee AML procedures where possible.

The most frequent AML failings among UK small businesses are inadequate CDD, poor record keeping, insufficient training, and failure to register or renew with the supervisor. Many businesses are caught out by believing that only large transactions or high-profile clients carry risk. In reality, criminals often target small firms seen as less likely to have robust procedures.

Penalties for breaches can be severe. HMRC and other supervisors have powers to issue unlimited fines, revoke registrations, and — for serious cases — pursue criminal prosecution. Ignorance is not a defence: you are expected to know and follow the rules. Penalties are typically larger where there is evidence of repeated failings, deliberate non-compliance, or failure to act on known risks.

The best way to avoid problems is to embed AML compliance into your everyday business processes. Use checklists, keep all documentation up to date, and review your risk assessment regularly. Seek professional advice if you’re unsure about your obligations — the cost of non-compliance will always outweigh the cost of getting it right.

• Never delay CDD even for longstanding or referred clients.
• Don’t ignore small or unusual transactions — these are often used to test your controls.
• Renew your AML registration on time every year.
• Regularly review and update your AML risk assessment.
• Seek external advice if you don’t fully understand your sector’s requirements.

Navigating AML requirements can feel daunting, but there is help available. Start with the official guidance for your sector on GOV.UK and the website of your AML supervisor. HMRC provides detailed guidance notes and runs periodic webinars for small businesses. Your professional body (e.g., ICAEW, ACCA, Law Society) will also have sector-specific resources, templates, and training materials.

The National Crime Agency’s website has comprehensive information about filing SARs, including an FAQ and sample reports. For high-value dealers, estate agents, and other businesses without a professional body, the Federation of Small Businesses (FSB) is an excellent source of practical advice and template policies. If your business is particularly complex, consider engaging an AML consultant or legal adviser — the upfront cost is small compared to the potential penalties for getting it wrong.

If you ever receive a visit or notice from HMRC or your supervisor, respond promptly and transparently. Inspections are routine and do not necessarily imply wrongdoing, but failing to cooperate will escalate matters rapidly. If you have any doubt about your AML status, seek advice immediately — time is of the essence when it comes to compliance.

• HMRC AML Guidance: https://www.gov.uk/guidance/money-laundering-regulations-introduction
• NCA SARs portal and guidance: https://www.nationalcrimeagency.gov.uk
• FSB AML resources: https://www.fsb.org.uk
• Sector-specific support from professional bodies (ICAEW, ACCA, Law Society, etc.)
• Free webinars and training via HMRC and the British Business Bank