Pendlebury Bookkeeping & Payroll Limited

1Gap Analysis

Every pack opens with this document, written about your business: what is in place, what is missing, and what to do first. This is the fictional firm’s, exactly as the engine generated it.

Pendlebury Bookkeeping & Payroll Limited (trading as Pendlebury Books)

What is in place, what is missing, and what to do first.

1.1Where you stand

This analysis found 7 items to deal with first, 13 to deal with soon, and 3 things already in order.

The order matters more than the count. Items in the first list either have a deadline attached or are the things HMRC penalises; items in the second are real requirements without a clock on them. Nothing here is padded to make the list look worth what you paid — where something is already right, it says so.

1.2Do these first

1. Proliferation financing is not covered. Regulation 18A is a separate duty from regulation 18, in the same terms — appropriate steps to identify and assess the risks of proliferation financing, against the same five factors, with its own written record. HMRC's own penalties framework groups regulations 18 and 18A together as fundamental requirements. This is the single most common omission in downloaded template packs, because most were written before regulation 18A was inserted and never updated. Document 01 covers it.

1. Engagements are being completed before the client checks are finished and recorded. Regulation 27(1)(a) requires customer due diligence when a business relationship is established, and CCAB's guidance for this sector — which HM Treasury has approved, and which the courts must take account of — states the rule in terms a practice can audit itself against: “No client engagement (including transfers of client money or assets) should be completed until CDD has been completed in accordance with the business's own procedures.” The fix is a hard stop in the onboarding process at the point the engagement letter is signed, not a reminder.

1. What is held on who owns and controls a client is not being refreshed at the annual cycle. For most of an accountancy book this is not a matter of good practice but a statutory trigger: regulation 27(8)(za) requires customer due diligence measures to be applied where the business has any legal duty in the course of the calendar year to contact an existing customer for the purpose of reviewing information that is relevant to its risk assessment for that customer and relates to the beneficial ownership of the customer, including information enabling it to understand the ownership or control structure. The accounts and confirmation-statement contact is that duty for a company client. It is in the compliance calendar as a dated recurring item.

1. The anti-money laundering supervision of the firms this business takes work from, or sends work to, is not being checked. HMRC's expectation for this sector is written as a prohibition: “Before entering into a business relationship with a business, customer or intermediary who is carrying out relevant activity, you should take appropriate measures to check they are anti-money laundering supervised for that activity. If not, you should not enter into the business relationship.” Where the firm should be supervised by HMRC, check HMRC's supervised business register — noting HMRC's own qualification that the register “will not include businesses supervised by another authority”, so a professional-body member is checked with that body. And read the entry, not just its presence: “If the business does not appear on the HMRC register or its entry does not reflect all types of relevant activity they carry out, you should not enter into a business relationship.” Section 2.9 of document 02 is that procedure. Ask each counterparty for its supervisor and registration number, check it, and record the check and its date.

1. The beneficial ownership register is not being collected or inspected before a relationship starts. Regulation 30A requires the business, before establishing a business relationship with a company, unregistered company, limited liability partnership, eligible Scottish partnership, registrable trust or overseas entity, to collect an excerpt of the register containing the required information or establish from inspection that no such information is held. Most of an accountancy book is companies, so this duty runs on most files rather than on the occasional one — and this business is often the agent that filed the information it would be checking.

1. Beneficial ownership is being taken from the Companies House register alone. Regulation 28(9) provides that relevant persons “do not satisfy their requirements under paragraph (4) by relying solely on information delivered to the registrar” about registrable persons, registrable relevant legal entities or registrable beneficial owners. In this sector that has a second edge: the business is frequently the agent that filed the register entry, so relying on the register alone is relying on its own paperwork. The register stays in use — it is simply not sufficient on its own. Add at least one independent source and record which sources were used on each file.

1. 1 engagement on your books has been completed without the identity checks being completed and recorded, and with no extension recorded. The detail is in the table below. CCAB's guidance for this sector, which HM Treasury has approved, is that no client engagement — including a transfer of client money or assets — should be completed until customer due diligence has been completed, so this is an existing gap rather than a future one, and it is the item on this pack most worth acting on this week.

1.3Do these next

1. Your risk assessment was last reviewed 11 June 2024, 28 months ago. Regulation 18(4) requires the record to be kept up to date. There is no statutory review interval, but an assessment older than a year is hard to describe as up to date, and this one predates changes to the Regulations that took effect on 30 June 2026.

1. Staff have not been taken through the policies, or there is no record that they were. Regulation 19(1)(c)(iii) requires a written record of the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person's business. Holding the document is not enough; the record of telling people is itself a requirement, and it is routinely missed.

1. Staff training was last given 18 September 2024, 25 months ago. Regulation 24 requires training to be given regularly. The Regulations do not set an interval, but HMRC's Anti-money laundering guidance for supervised businesses states that HMRC expects, as a minimum, that training is delivered annually, with higher-risk businesses training more often. So annual is HMRC's stated expectation of you, not a period written into the Regulations.

1. Personal data is not deleted once the retention period expires. Regulation 40(5) requires deletion of personal data obtained for the purposes of the Regulations once the period in regulation 40(3) — or the ten-year cap in 40(4) — has run, subject to the stated exceptions. Template packs almost always tell businesses to keep everything indefinitely, which is itself a breach. Keeping too much is not the safe option.

1. Needed from you: How a decision to start work before the checks are finished is authorised and recorded has not been described. CCAB's guidance allows verification to be completed during the establishment of a business relationship where it is necessary not to interrupt the normal course of business and there is little risk, and requires the checks to be completed as soon as practicable. But the latitude is conditional: extensions must be “specific, well-defined and time-limited”, and there is “no granting of general extensions (such as for particular client types)”. Without a record naming the reason and the end date, an engagement that started early cannot be distinguished from one that simply skipped the checks — which is exactly the distinction this pack needs in order not to overstate a gap.

1. The risk assessment does not engage with HMRC's own risk assessment for this sector. Regulation 18(2)(a) requires the business to take into account information made available to it by its supervisory authority, and HMRC's risk assessment of accountancy service providers says so on its own face: “You must take this HMRC risk assessment into account when carrying out your business's own risk assessment.” Document 01 in this pack cites it, and the National Risk Assessment 2025 ratings, by name.

1. The beneficial ownership register is checked at the start but not again. Regulation 30A attaches to ongoing monitoring as well as to onboarding. In this sector the annual contact required for the accounts is when a change would actually surface, and regulation 27(8)(za) makes that contact a due diligence trigger in its own right — so the two duties are done together or not at all.

1. New clients are not being given the regulation 41(6) data protection statement. Regulation 41(6) requires a relevant person, before establishing a business relationship or entering into an occasional transaction with a new customer, to provide the information in Article 13(1)(a) and (b) of the UK GDPR and a statement that personal data will be processed only for the purposes of preventing money laundering, terrorist financing and proliferation financing. In an accountancy practice it belongs in the engagement letter, which is exactly where the relationship is established, so it costs a paragraph and cannot then be missed.

1. Needed from you: How the business would know whether a client, or someone who owns one, is a politically exposed person has not been described. Regulation 35(1) requires systems and procedures to determine whether a customer or a beneficial owner is a politically exposed person, or a family member or known close associate of one — a duty to have a method, not merely to react when a name is recognised. Where the answer is yes, regulation 35(5) requires senior management approval, measures to establish the source of wealth and the source of funds, and enhanced ongoing monitoring, and regulation 35(9) keeps enhanced measures running for at least 12 months after the person leaves the public function.

1. How long the business would have to wait after asking the National Crime Agency for a defence, and what happens if it is refused, is not understood. The periods are statutory: a seven working day notice period under section 335(5) of the Proceeds of Crime Act 2002, starting with the first working day after the disclosure, during which it is an offence to let the transaction proceed without consent; and a 31-day moratorium under section 335(6) if the defence is refused, starting with the day notice of refusal is received. Section 4 of document 02 sets it out. In this sector there is a further point CCAB makes: where a defence would be required and a privilege reporting exemption prevents a report, “the only option would be for the business to resign from the client engagement”.

1. The business holds money or assets for clients, so the client-account controls in section 2.10 of document 02 apply and are worth reading first. HMRC's risk assessment of this sector makes unrestricted deposits and withdrawals in designated or pooled client accounts a named risk factor, and singles out three patterns: funds paid in from unknown or cash sources; an overpayment followed by a request for a refund; and money paid out to a different account from the one it came in from. A pooled account is described as “an attractive method of mixing illicit funds with legitimate funds”. This is not a criticism of holding client money — it is where the monitoring effort goes.

1. The business uses sub-contract bookkeepers or other non-employees to do client work, so the training duty reaches them. Regulation 24 requires relevant employees and agents to be made aware of the law and given regular training, and requires a written record of the training given to employees and agents alike. CCAB's guidance for this sector restates it in the same terms, and treats a non-employee engaged to carry out work on the business's behalf under its supervision as an agent. A sub-contractor who has never been taken through these policies is a gap in the record, not just in the training.

1. Where a decision is taken not to report something because of how the information was learned, there is no record of where the information came from. CCAB's guidance for this sector is explicit that it is “strongly recommended that careful records are kept about the provenance of the information”, because a business usually provides a client with several services and not all of them create the circumstances the exemption requires. Section 4 of document 02 sets out the position; the record is what makes a decision defensible afterwards.

1.4Already in order

• You are registered with HMRC for anti-money laundering supervision, and have been since 15 February 2021. Registration is annual: regulation 57(4) requires material changes to the information HMRC holds to be notified within 30 days, and the annual declaration and fee keep the registration current.
• Customer records are kept for 6 years, which covers the five-year minimum in regulation 40(3). Keeping them longer is not itself a breach, but regulation 40(5) requires personal data obtained for the Regulations to be deleted once that period — or the ten-year cap in regulation 40(4) — has run, unless the business is required to keep it by or under an enactment or for court proceedings, or the person has consented. The retention period and the deletion step are two different duties.
• The business holds an agent services account with HMRC. HMRC's conditions for registering as a tax adviser require evidence that the business is supervised for anti-money laundering — for example a digital copy of the supervision certificate or a confirmation email — so the HMRC registration this pack supports feeds it. That is an adjacent regime and not a Money Laundering Regulations duty, so nothing in this pack is drafted to it; it appears in the compliance calendar so the evidence is not left to go stale, and its “relevant individuals” list is defined separately from the beneficial owners, officers and managers named in this document.

1.5What is on your books right now

There is no timing table to apply here, and no buyer-and-seller split. Almost every accountancy engagement is a business relationship, so regulation 27(1)(a) fires when the relationship is established, and CCAB's guidance turns that into something the business can test itself against: “No client engagement (including transfers of client money or assets) should be completed until CDD has been completed in accordance with the business's own procedures.”

That rule has a second half, and this section applies it. CCAB permits verification to be completed during the establishment of a business relationship where it is necessary not to interrupt the normal course of business and there is little risk, provided the checks are completed as soon as practicable and the extension is specific, well-defined and time-limited. So an engagement running under a recorded extension of that kind is not listed as overdue below, and an engagement that has started but has not been completed is listed as something to answer rather than as a breach. Only a completed engagement with no recorded checks and no recorded extension is called overdue — and where it is, we are not going to soften it.

The 1 engagement marked started, not yet completed is not called a breach here, and that is deliberate. The rule CCAB states bites on completing the engagement, so work in progress with the checks still running is only a gap if there is no specific, time-limited extension recorded for it. It is therefore the first thing to look at: either finish and record the checks before the engagement is completed, or write the extension down now — the reason, and the date it ends. An extension nobody recorded is not an extension, and general extensions for a class of client are not permitted at all.

2 further engagements have the checks completed and recorded, and are not listed above.

1.6What we still need from you

Each of these was left open in your answers. We have not guessed any of them.

• how customers reach you — Needed from you: Identity is checked electronically, at least in part, but the provider was not named.

1.7What this pack does not cover

• Suspicious activity reports. Reporting to the National Crime Agency is the nominated officer's, under Part 7 of the Proceeds of Crime Act 2002 and Part 3 of the Terrorism Act 2000. We do not make reports and cannot make them for you.
• Holding either officer role. Regulation 21(3) requires an individual in your firm.
• Submitting your HMRC registration. The application, the declaration and the fees are yours. We can tell you what to expect at each step.
• Group-level policies under regulation 20. If you own subsidiaries or have branches outside the UK, that is a wider piece of work than this pack — tell us and we will scope it.
• Legal advice. This is a compliance drafting service, not a law firm.

Status of this document

This document was prepared by Deplexify from information supplied by the business named on it.

Nothing in it has been independently verified. It is not legal advice, and it is not an audit,

review or other assurance engagement.

It is a draft for the business to read, correct and adopt as its own. Regulation 19(2)(b) of the

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations

2017 requires the policies, controls and procedures to be approved by the business's senior

management — that approval is the business's act, and so is everything that follows from it.

The officer responsible for compliance under regulation 21(1)(a) and the nominated officer under

regulation 21(3) are the business's own people. Regulation 21(3) requires an individual in the

firm. Deplexify does not hold either role, does not make suspicious activity reports to the

National Crime Agency, and does not submit or sign anything to HMRC on the business's behalf.

Sources

Every requirement stated in this document comes from one of the following, read directly rather

than from a summary:

• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer)

Regulations 2017 (S.I. 2017/692) as amended, including by the Money Laundering and Terrorist

Financing (Amendment) Regulations 2026 (S.I. 2026/621), in force 30 June 2026 —

<https://www.legislation.gov.uk/uksi/2017/692>

• The Proceeds of Crime Act 2002, Part 7, including sections 335 and 336 (the notice and

moratorium periods) — <https://www.legislation.gov.uk/ukpga/2002/29>

• HMRC, Risk Assessment of Accountancy Service Providers (AMLG3700, HMRC internal manual

Anti-money laundering guidance for supervised businesses, manual updated 16 July 2026),

made available under regulations 17 and 47 —

<https://www.gov.uk/hmrc-internal-manuals/anti-money-laundering-guidance-for-supervised-businesses/amlg3700>

• Consultative Committee of Accountancy Bodies, *Anti-Money Laundering, Counter-Terrorist and

Counter-Proliferation Financing Guidance for the Accountancy Sector* (AMLGAS, July 2026;

based on the law and regulations as at 1 July 2026). Approved by HM Treasury — by its

own §1.3.1 the UK courts must take account of its contents when deciding whether a

business has contravened a relevant requirement under the 2017 Regulations or committed an

offence under sections 330 to 331 of the Proceeds of Crime Act 2002 — ccab.org.uk, and

linked from HMRC's Accountancy sector guidance for money laundering supervision page

• HMRC, *Check if you need to register for money laundering supervision if you're an

accountancy service provider* (page updated 16 March 2023) — gov.uk

• HMRC, Fees you'll pay for money laundering supervision (page updated 22 December 2025) —

gov.uk

• HMRC, Check if you meet HMRC's conditions to register as a tax adviser (page updated

18 May 2026) — gov.uk. An adjacent regime, not a Money Laundering Regulations duty

• HM Treasury and Home Office, *National Risk Assessment of Money Laundering and Terrorist

Financing 2025* (17 July 2025) — gov.uk

2Practice-Wide Risk Assessment

Pendlebury Bookkeeping & Payroll Limited (trading as Pendlebury Books)

Regulation 18 and regulation 18A, Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

2.1Why this document exists

Regulation 18(1) requires the business to take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject. Regulation 18(2)(b) sets out the risk factors that must be taken into account — its customers, the countries or geographic areas in which it operates, its products or services, its transactions, and its delivery channels. Regulation 18(2)(a) requires information made available by HMRC to be taken into account as well. Regulation 18(4) requires an up-to-date record of it all in writing, and regulation 18(6) requires the assessment, the information behind it and that record to be given to HMRC on request.

Regulation 18(3) then says something easy to miss: in deciding what steps are appropriate, the business must take into account its size and nature. That is why this document is the length it is. A four-person business is not required to produce what a national chain produces, and a longer document is not a better one.

This assessment is built from the answers Pendlebury Bookkeeping & Payroll Limited gave. Every rating below shows the findings that produced it and names the answer each came from, so you can check the reasoning and change it where we have read something wrong. A rating you cannot check is worth nothing.

2.2What the business does, and why it is regulated

Who supervises this business, before anything else. Regulation 7(1)(b) makes each of the professional bodies listed in Schedule 1 the supervisory authority for relevant persons who are members of it, or regulated or supervised by it. Regulation 7(1)(c)(iv) then makes HMRC the supervisory authority for “auditors, external accountants and tax advisers who are not supervised by one of the professional bodies listed in Schedule 1”. HMRC is therefore the residual supervisor for this sector, not the primary one, and this pack is written for a firm on HMRC's side of that line. Where a Schedule 1 body supervises the firm — because the firm, or a principal, is a member of it or is regulated or supervised by it — that body's guidance and monitoring apply instead, and this pack is the wrong document. Regulation 7(2) to (4) contemplate a firm having more than one supervisory authority: where that happens the authorities may agree which of them acts, and must co-operate where they have not, so dual supervision is an ordinary position and not a defect.

The scope test is regulation 8(2)(c) read with regulation 11. Regulation 8(1) applies the Regulations to persons acting in the course of business carried on by them in the United Kingdom who are listed in regulation 8(2) and who do not come within the exclusions in regulation 15; regulation 8(2)(c) lists “auditors, insolvency practitioners, external accountants and tax advisers”; and regulation 8(4) sends you to regulation 11 for what those four words mean. “Accountancy service provider” is HMRC's administrative label for that group and appears nowhere in the Regulations — it is used here as a name, never as a definition.

Every limb is activity-bound, and none of them has a value threshold. Regulation 11(c) defines an external accountant as “a firm or sole practitioner who by way of business provides accountancy services to other persons, when providing such services”, and regulation 11(d) defines a tax adviser as one who by way of business provides “material aid, or assistance or advice, in connection with the tax affairs of other persons, whether provided directly or through a third party”, again “when providing such services”. Regulation 11(a) catches a statutory auditor only when carrying out statutory audit work. So the question is what the business does, service by service — not how big it is. A one-person bookkeeping practice is as much an external accountant under regulation 11(c) as a fifty-partner firm, and no turnover figure, fee level or transaction value changes that.

And regulation 15(2) is not a way out for this business. The “occasional or very limited basis” exclusion requires every one of seven conditions, and condition (f) is that the person's main activity is not one falling within regulation 8(2)(a) to (f) — which is where accountancy sits. An accountancy practice's main activity is the regulated activity, so it fails condition (f) on the face of it. Regulation 15(2) is for a business in another trade doing a sliver of regulated financial activity on the side.

• Bookkeeping. The business maintains clients' primary records. HMRC's guidance lists professional bookkeeping services among the accountancy services that require registration, and regulation 11(c) catches it as accountancy services provided to other persons.
• Accounts preparation. The business prepares or signs off accounts for clients — named in HMRC's guidance as “accounts preparation and signing”, and within regulation 11(c).
• Tax returns and duty claims. The business completes or submits returns or claims for clients — “help with completing and submitting tax returns or duty claims” in HMRC's list, and material aid or assistance in connection with the tax affairs of other persons under regulation 11(d).
• Tax advice. The business gives clients specific advice about their tax — whether something is liable to a tax or duty, and how much is due. Regulation 11(d) reaches “material aid, or assistance or advice”, which is wider than advice in the ordinary sense. HMRC draws the line at generic information: giving customers, or linking to, basic tax information that would be the same for everyone is not tax advice for this purpose.
• Payroll. HMRC's guidance treats payroll agents as accountancy service providers where they provide accountancy services or tax advice. It does not treat as caught a provider that only supplies payroll software or hardware support without analysing or preparing financial information, only pays invoiced service fees, operates as an umbrella or managed service company running payroll for its own assignees, or carries out payroll as a small part of a recruitment or HR business.

Registration comes with the activity, not with a threshold. Regulation 56(5) provides that a business of a registrable description must not carry on that business unless it is on the register, or has applied and the application has not been determined. Regulation 56(5)(c) exempts art market participants and letting agents from that prohibition; it does not name accountancy service providers, so the general rule applies and the business may not trade before it has applied.

Two things this business may do that are NOT accountancy service provider work, and each carries its own registration. Forming companies, selling off-the-shelf firms, providing a registered office or correspondence address, and acting or arranging for another person to act as a director, company secretary, partner, trustee or nominee shareholder are all trust or company service provider services under regulation 12(2). HMRC's risk assessment for this sector requires a firm doing both to identify and assess the risks of the combination, and the National Risk Assessment 2025 puts it as a registration duty: where firms perform both broader accountancy and trust or company functions they “must ensure they are correctly registered for both”. Where any of that is recorded above, the trust or company side needs its own registration, its own £500-a-head fit and proper test in place of the £40 approval check, and HMRC's trust or company service provider guidance rather than this pack.

Insolvency work is outside this pack entirely. Regulation 8(2)(c) and regulation 11(b) put insolvency practitioners in scope of the Regulations, but regulation 7(1)(c)(iv) lists only “auditors, external accountants and tax advisers”, so HMRC is never the supervisor for insolvency work — the authorising body is. HMRC states it directly: the reasons it lists for not needing to register include being “an insolvency practitioner (you’ll be supervised by your authorising body)”.

Size and nature, for the purposes of regulation 18(3). 4 people, around 45 new client engagements a year, 1 premises, operating mainly in Stockport and east Manchester. This is the yardstick against which everything below is judged proportionate.

2.3What HMRC and the National Risk Assessment say about this sector

Regulation 18(2)(a) requires the assessment to take into account information HMRC makes available, so this section records what that information says before the business's own factors are rated. It is the national picture, not a rating of this business — the findings below are what move the ratings — but a risk assessment that never engages with it has not discharged regulation 18(2)(a).

• Money laundering. HMRC's risk assessment of this sector, prepared and made available under regulations 17 and 47 and of which HMRC says “You must take this HMRC risk assessment into account when carrying out your business’s own risk assessment”, records that “The National Risk Assessment 2025 assessed ASP services as high risk for money laundering.” It adds that the assessment “highlights that criminals will try to misuse ASP services with weak or inadequate risk assessments, policies controls and procedures”, and that it “highlights payroll, bookkeeping, insolvency and tax advice as services attractive for money laundering purposes.” The National Risk Assessment 2025 itself records that the money laundering risk for accountancy service providers remains high, that the risk is particularly high for clients with cash intensive businesses, and that poor customer due diligence at onboarding and on an ongoing basis is among the most common compliance issues identified — of particular concern in smaller firms and sole practices, which collectively make up the majority of accountancy firms.
• Terrorist financing. HMRC records that “The National Risk Assessment 2025 assessed ASPs as facing a low risk for terrorist financing purposes. However, ASPs must remain vigilant as to the risk.” A low national rating is not an absence of duty: the reporting obligations under Part 3 of the Terrorism Act 2000 apply in full whatever the sector rating.
• Proliferation financing. This is not an afterthought in this sector. HMRC records that the National Risk Assessment of Proliferation Financing “considered specific proliferation risks associated with how easy it is to set up companies in the UK and access the UK financial system”, and that criminals seeking to establish a UK company or access the UK financial system for those purposes “may engage an ASP for their services. For example, engaging an accountant to draw up company accounts or to notarise documents needed to open a business bank account.” It also highlights “the risk of accepting records of transactions at face value” without considering whether the transactions are linked to illegal activity, including proliferation financing or high-risk third countries. The separate regulation 18A assessment below addresses it.
• System Prioritisation. HMRC asks businesses to read the NRA typologies alongside the economic crime priorities published by the NECC and the FCA, and to pay particular attention to anything falling into a priority category when deciding whether to make a report.

What follows from a high national rating. It is a floor for attention, not a ceiling and not a rating this business may adopt in place of its own. Regulation 18(1) still requires an assessment of the risks to which its business is subject, which is what the five factors below do from the answers given. What the high rating does mean is that an accountancy service provider cannot reason its way to a low inherent position by pointing at its own good record. It cuts the other way too, and this pack does that as well: HM Treasury records that most UK accountants have limited international exposure, so where the countries factor genuinely is low for this business it is rated low, on the evidence, rather than inflated to match the headline.

2.4The assessment

Practice-wide residual rating: High.

The practice-wide residual rating is taken as the highest of the five factor ratings, not an average of them. Averaging would let a genuinely high-risk factor hide behind four quiet ones. The highest here is customers.

2.5Customers

regulation 18(2)(b)(i)

What raises this factor

• The business acts for customers running cash-intensive trades. The National Risk Assessment 2025 is specific about this for accountancy: the money laundering risk for accountancy service providers is assessed high, and “The risk is particularly high for clients with cash intensive businesses”. HMRC's risk assessment of the sector names being paid in cash, or acting for a customer who operates a cash intensive business, as a risk factor in its own right.

_{From your answer at customers.cash_intensive. Weight 2.}

• A small share of clients (4%) are based outside the UK. HM Treasury records that most UK accountancy practices have limited international exposure, so a figure at this level is ordinary for the sector and is rated as what it is rather than inflated.

_{From your answer at customers.overseas_buyers_pct. Weight 1.}

• Around 62% of clients are companies or other registrable entities, so regulation 30A runs on most of the book rather than on the occasional file: before the relationship starts the business must collect an excerpt of the beneficial ownership register or establish from inspection that nothing is held, and must report a material discrepancy. In this sector the same firm is very often the agent that filed the information it is checking, which makes a discrepancy its own filing error as well as a reportable one.

_{From your answer at customers.company_clients_pct. Weight 2.}

• Clients employ low-paid manual labour — construction, cleaning, agriculture, care, hand car washes. HMRC's risk assessment of this sector treats a customer whose business involves a risk of employee exploitation through modern slavery or human trafficking as a named risk factor, and expects the people doing the work to know how to spot the signs and how to report them.

_{From your answer at customers.low_paid_labour. Weight 3.}

• The business acts for umbrella companies, or for contractors paid through them. HMRC's risk assessment records the risk that customers running umbrella fraud schemes may use accountancy services to legitimise transactions and channel illicit funds through corporate structures, and that the customers themselves may be agency workers caught up in it.

_{From your answer at customers.umbrella_or_contractors. Weight 3.}

• Some clients file as dormant, or the business has been asked to act for a dormant company. HMRC's risk assessment names accountancy services requested for an entity which appears to be dormant as a risk factor — the question the file has to answer is what the entity is being kept alive for.

_{From your answer at customers.dormant_entities. Weight 2.}

• At least one client's directors or shareholders keep changing. HMRC's risk assessment names frequent changes to beneficial ownership, or to those acting in roles such as directors and shareholders, as a risk factor, and it sits directly on top of the regulation 30A duty: the register the business checks is the register that keeps moving.

_{From your answer at customers.frequent_ownership_changes. Weight 3.}

• Some clients are in financial difficulty. HMRC's risk assessment names services provided to a business in financial difficulty as a risk factor — a business under pressure is a business more open to an offer of funds it would otherwise refuse.

_{From your answer at customers.financial_difficulty. Weight 2.}

What holds it down

• No politically exposed person has been encountered in the last 12 months.
• No transactions involving trusts in the last 12 months.

Inherent rating: High. Derived from 8 findings totalling 18 on the scale described in the note on method below.

Controls relied on to reduce it

The answers say Yes; the business's own engagements say otherwise. A control is evidenced by the file it acted on, not by the answer that says it exists, so the controls marked above earn no credit until the file shows them working:

• Merrivale Haulage Limited — bookkeeping and quarterly VAT — the engagement completed already passed with no customer checks completed and recorded, and no timing exception written down.
• Rowan Court Care Ltd — payroll and tax returns — the relationship entered into already passed with no customer checks completed and recorded, and no timing exception written down.

Residual rating: High — unchanged from inherent, because the controls for this factor are largely absent or undescribed.

2.6Countries and geographic areas

regulation 18(2)(b)(ii)

What raises this factor

• Customers come from or are linked to: Republic of Ireland. Each of these must be checked against the current FATF list of High-Risk Jurisdictions subject to a Call for Action at the date this pack is issued; where any is listed, enhanced due diligence is mandatory under regulation 33(1)(b), read with the definition in regulation 33(3)(a) as substituted by S.I. 2026/621 from 30 June 2026. A country on the FATF's list of Jurisdictions under Increased Monitoring does not trigger that mandatory duty by itself under the current wording; it is weighed as a higher-risk factor under regulation 33(1)(g).

_{From your answer at customers.countries. Weight 3.}

Inherent rating: Medium-Low. Derived from 1 finding totalling 3 on the scale described in the note on method below.

Controls relied on to reduce it

Residual rating: Low — reduced by 1 step from the inherent rating, on the strength of the 1 of 1 controls in the table above that are in place.

2.7Products and services

regulation 18(2)(b)(iii)

What raises this factor

• The business does bookkeeping — maintaining clients' primary records. That is the provision of accountancy services to other persons under regulation 11(c), and HMRC's risk assessment of the sector gives it its own risk factor: preparing primary records from incomplete sources, where the records the business produces may then be accepted by third parties without further checks. The National Risk Assessment 2025 names bookkeeping among the accountancy services that can be used for money laundering.

_{From your answer at scope.bookkeeping. Weight 2.}

• The business prepares or signs off accounts. Regulation 11(c) catches it as accountancy services provided to other persons, and HMRC's risk assessment treats preparing accounts or completing returns from incomplete records as a risk factor: “Pressure from customers for you to rely on unverified information or records they provide indicates a risk that the accountancy service is being sought to legitimise illicit business activity and funds.” The National Risk Assessment 2025 makes the same point about accountant's certificates of confirmation being used to support falsified accounts and invoices.

_{From your answer at scope.accounts_prep. Weight 2.}

• The business completes or submits tax returns or duty claims for clients. HMRC's registration guidance lists help with completing and submitting tax returns or duty claims as an accountancy service, and regulation 11(d) catches it as material aid, or assistance or advice, in connection with the tax affairs of other persons.

_{From your answer at scope.tax_returns. Weight 2.}

• The business gives specific tax advice. Regulation 11(d) defines a tax adviser as a firm or sole practitioner who by way of business provides “material aid, or assistance or advice, in connection with the tax affairs of other persons, whether provided directly or through a third party” — wording substituted with effect from 10 January 2020 and wider than “tax advice” in ordinary speech. HMRC's risk assessment of the sector carries a matching factor: customer pressure or willingness to take risks to reduce tax bills.

_{From your answer at scope.tax_advice. Weight 2.}

• The business runs payroll for clients. HMRC's registration guidance treats payroll agents as accountancy service providers where they provide accountancy services or tax advice, and HMRC's risk assessment of the sector gives payroll five risk factors of its own — falsified payroll instructions, unusual service requests, a customer who limits, prevents or changes interactions with HMRC, a risk of employee exploitation through modern slavery or human trafficking, and umbrella company fraud. The National Risk Assessment 2025 names payroll first among the accountancy services used for money laundering.

_{From your answer at scope.payroll. Weight 3.}

Inherent rating: Medium-High. Derived from 5 findings totalling 11 on the scale described in the note on method below.

Controls relied on to reduce it

Residual rating: Medium — reduced by 1 step from the inherent rating, on the strength of the 1 of 2 controls in the table above that are in place; the 1 marked No earned no credit.

2.8Transactions

regulation 18(2)(b)(iv)

What raises this factor

• The business accepts cash — Two of the smaller clients still pay their monthly fee in cash, usually £150 to £300 at a time. HMRC's risk assessment of this sector treats services paid for in cash as a risk factor, alongside acting for a customer who runs a cash-intensive business, and the National Risk Assessment 2025 records that the money laundering risk is particularly high for clients with cash intensive businesses.

_{From your answer at customers.cash_accepted. Weight 4.}

• Unusual transaction behaviour has actually been seen in the last 12 months: A construction client asked us to run payroll for eleven new operatives in one week and could only give National Insurance numbers for six of them. This is not a theoretical risk for this business — regulation 33(1)(f) makes enhanced due diligence mandatory where a transaction is unusually complex or unusually large, follows an unusual pattern, or has no apparent economic or legal purpose.

_{From your answer at customers.unusual_seen. Weight 3.}

• The business regularly has to prepare accounts or returns from incomplete records, or has been pushed to work from what the client supplied without backup. HMRC's risk assessment is direct about it: “Pressure from customers for you to rely on unverified information or records they provide indicates a risk that the accountancy service is being sought to legitimise illicit business activity and funds. There is a risk that the records you will produce will be accepted by third parties without further checks.” A lack of original documentation, or reluctance to provide it, is part of the same indicator.

_{From your answer at customers.incomplete_records. Weight 3.}

• A client has pushed the business to reduce a tax bill in a way it was not comfortable with. HMRC's risk assessment names customer pressure, or willingness to take risks, to reduce tax bills as a risk factor for tax advice work.

_{From your answer at customers.tax_pressure. Weight 3.}

• The business holds money or assets for clients. HMRC's risk assessment of this sector makes unrestricted deposits and withdrawals by clients in designated or pooled client accounts a named risk factor: criminal funds can be paid in and out to disguise them as legitimate business transactions, overpayments and accidental payments with a request for a refund indicate an attempt to legitimise illicit funds, and funds paid in from unknown or cash sources and paid out to a different account may indicate an attempt to hide their origin or true ownership.

_{From your answer at customers.hold_client_funds. Weight 4.}

• Client money is held in a pooled account. HMRC's risk assessment singles this out: a pooled client account is “an attractive method of mixing illicit funds with legitimate funds”, and monitoring transactions through the account is what shows whether it is being used for the purposes expected, and by the customers who were given permission to use it.

_{From your answer at client_money.pooled_account. Weight 3.}

• Overpayments and payments in error are received and refunded. That is a named indicator in HMRC's risk assessment of this sector, not an administrative nuisance: “Overpayments of fees or accidental payments, with requests to an ASP service provider to make a refund, indicate a risk the account is being used to legitimise illicit funds.”

_{From your answer at client_money.refunds. Weight 2.}

Inherent rating: High. Derived from 7 findings totalling 22 on the scale described in the note on method below.

Controls relied on to reduce it

Residual rating: Medium-High — reduced by 1 step from the inherent rating, on the strength of the 3 of 4 controls in the table above that are in place; the 1 marked No earned no credit.

2.9Delivery channels

regulation 18(2)(b)(v)

What raises this factor

• Around 35% of customers are met face to face, so a substantial part of the book is verified remotely, where fraudulent documents are harder to spot.

_{From your answer at channels.face_to_face_pct. Weight 2.}

• Work arrives through intermediaries or referral partners, so a supply chain exists. HMRC expects an accountancy service provider to assess the services, customers, intermediaries and locations in the chain, its length and complexity, and how the risk differs from providing the same service directly — and to be able to say why it and the others form part of the chain at all.

_{From your answer at channels.introducers. Weight 2.}

• The business does not check that the firms it takes work from, or sends work to, are anti-money laundering supervised. HMRC's expectation for this sector reads as a prohibition rather than a preference: “Before entering into a business relationship with a business, customer or intermediary who is carrying out relevant activity, you should take appropriate measures to check they are anti-money laundering supervised for that activity. If not, you should not enter into the business relationship.”

_{From your answer at channels.counterparty_supervision_checked. Weight 4.}

• Client work is passed out to other people. That puts this business inside a supply chain from the other end, and CCAB's guidance treats a non-employee engaged to carry out work on the business's behalf under its supervision as an agent — which brings the regulation 24 training duty with it, because regulation 24 reaches agents and not only employees.

_{From your answer at channels.subcontract_out. Weight 2.}

Inherent rating: Medium-High. Derived from 4 findings totalling 10 on the scale described in the note on method below.

Controls relied on to reduce it

The answers say Yes; the business's own engagements say otherwise. A control is evidenced by the file it acted on, not by the answer that says it exists, so the controls marked above earn no credit until the file shows them working:

• The written method — ‘Photo ID and a proof of address for the person signing the engagement letter, and the Companies House record printed off for a company client’ — names no electronic verification and no certified copies, yet around 65% of customers are not met in person. A method that stops at documents seen in the office does not reach the remote book, and regulation 28(19) sets the standard a remote check has to meet.

Residual rating: Medium-High — unchanged from inherent, because the controls for this factor are largely absent or undescribed.

2.10Proliferation financing

Regulation 18A

Regulation 18A is a separate duty from regulation 18, in materially the same terms: appropriate steps to identify and assess the risks of proliferation financing to which the business is subject, taking into account the report referred to in regulation 16A and the same five risk factors, with its own written record under regulation 18A(4) and its own production duty under 18A(5). HMRC's penalties framework groups regulations 18 and 18A together as fundamental requirements.

Proliferation financing means the movement of funds connected with the spread of weapons of mass destruction, and it reaches this sector through the two things an accountancy practice actually produces: company accounts and documents that open doors. HMRC's proliferation-financing analysis for this sector is company formation and access to the UK financial system — “engaging an accountant to draw up company accounts or to notarise documents needed to open a business bank account” — together with the risk of accepting records of transactions at face value.

The exposure for this business comes through:

• customers linked to Republic of Ireland
• the preparation and signing of company accounts, which HMRC names as the service a proliferation-linked customer would engage an accountant for
• money moving through a client account, where the transaction records are the thing being taken at face value
• bookkeeping from records supplied by the customer, where accepting the transactions at face value is the named risk
• 4% of clients based outside the UK

Proliferation financing rating: Medium. The controls that address it are the same ones that address the countries factor above — screening customers and beneficial owners against the UK sanctions list before proceeding, and stopping rather than proceeding on a match. That screening must happen on the beneficial owner behind a corporate buyer, not only on the named customer. That screening is only as good as the beneficial-ownership checks it runs on, and document 01 records those as not yet in place — beneficial ownership is checked against something other than the companies house register; the beneficial ownership register is collected or inspected before the relationship starts; there is a described method for determining whether a client or a beneficial owner is a politically exposed person. Until they are, this control does not reach the person it is meant to reach, and the proliferation financing rating above is carried by the exposure, not by the control.

2.11Note on method

Each factor accumulates a weight for every finding drawn from the business's answers. The totals map to bands as follows: 0–2 Low, 3–5 Medium-Low, 6–9 Medium, 10–14 Medium-High, 15 or more High. Controls then move the inherent rating down — by two steps where every control relied on for that factor is in place and there is more than one of them, by one where at least half are, and by none otherwise.

Three rules constrain that, and they are what keep the result honest:

• No written policies means no control credit at all. Regulation 19(1)(c) requires the policies to be recorded in writing; a control nobody has written down is one HMRC cannot inspect and staff cannot follow.
• A factor with an inherent rating of Medium-High or High can only come down one step, however complete the controls. Controls manage exposure, they do not remove it. A firm where most customers are never met in person does not have low delivery-channel risk because it bought an identity product.
• An unanswered question, or a risk the business has already met, floors the residual at Medium-Low. Silence is not evidence of safety, and something that has actually happened cannot be rated away.

The weights are ours, not HMRC's. The Regulations do not prescribe a scoring method — regulation 18(1) requires appropriate steps, and regulation 18(3) makes what is appropriate depend on the size and nature of the business. What the method gives you is consistency and an audit trail: the same answers always produce the same rating, and every rating can be traced back to the answer that caused it. If you disagree with a rating, change the answer or tell us the finding is wrong, and the document changes with it.

Information made available by HMRC, as required by regulation 18(2)(a), has been taken into account throughout — specifically HMRC's Risk assessment of accountancy service providers (AMLG3700, in the HMRC internal manual Anti-money laundering guidance for supervised businesses, manual updated 16 July 2026), which states on its face that it is “prepared and made available to you under regulations 17 and 47” and that “You must take this HMRC risk assessment into account when carrying out your business’s own risk assessment”, and from which the thirty sector risk factors and the national ratings in this document are drawn; together with the Consultative Committee of Accountancy Bodies' Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector (AMLGAS, July 2026), which is the guidance HMRC routes this sector to and which HM Treasury has approved

2.12Review

Regulation 18(4) requires this record to be kept up to date. The Regulations set no review interval, but HMRC's Anti-money laundering guidance for supervised businesses states: “In any event, HMRC expects your risk assessment to be reviewed at least annually. You should record the review date and note any updates. If no changes are made, you should still record the review and the reasons for maintaining the current assessment.” The annual review in document 03 is set to that expectation. What also forces a review, whenever it happens: a new service line, a new delivery channel or new technology; a materially different type of customer; a change in the Regulations; or anything HMRC publishes that changes the picture for the sector.

2.13Adoption

This assessment takes effect when the business adopts it. Regulation 19(2)(b) requires the policies that follow from it to be approved by senior management, and in practice the assessment is approved at the same time.

Status of this document

This document was prepared by Deplexify from information supplied by the business named on it.

Nothing in it has been independently verified. It is not legal advice, and it is not an audit,

review or other assurance engagement.

It is a draft for the business to read, correct and adopt as its own. Regulation 19(2)(b) of the

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations

2017 requires the policies, controls and procedures to be approved by the business's senior

management — that approval is the business's act, and so is everything that follows from it.

The officer responsible for compliance under regulation 21(1)(a) and the nominated officer under

regulation 21(3) are the business's own people. Regulation 21(3) requires an individual in the

firm. Deplexify does not hold either role, does not make suspicious activity reports to the

National Crime Agency, and does not submit or sign anything to HMRC on the business's behalf.

Sources

Every requirement stated in this document comes from one of the following, read directly rather

than from a summary:

• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer)

Regulations 2017 (S.I. 2017/692) as amended, including by the Money Laundering and Terrorist

Financing (Amendment) Regulations 2026 (S.I. 2026/621), in force 30 June 2026 —

<https://www.legislation.gov.uk/uksi/2017/692>

• The Proceeds of Crime Act 2002, Part 7, including sections 335 and 336 (the notice and

moratorium periods) — <https://www.legislation.gov.uk/ukpga/2002/29>

• HMRC, Risk Assessment of Accountancy Service Providers (AMLG3700, HMRC internal manual

Anti-money laundering guidance for supervised businesses, manual updated 16 July 2026),

made available under regulations 17 and 47 —

<https://www.gov.uk/hmrc-internal-manuals/anti-money-laundering-guidance-for-supervised-businesses/amlg3700>

• Consultative Committee of Accountancy Bodies, *Anti-Money Laundering, Counter-Terrorist and

Counter-Proliferation Financing Guidance for the Accountancy Sector* (AMLGAS, July 2026;

based on the law and regulations as at 1 July 2026). Approved by HM Treasury — by its

own §1.3.1 the UK courts must take account of its contents when deciding whether a

business has contravened a relevant requirement under the 2017 Regulations or committed an

offence under sections 330 to 331 of the Proceeds of Crime Act 2002 — ccab.org.uk, and

linked from HMRC's Accountancy sector guidance for money laundering supervision page

• HMRC, *Check if you need to register for money laundering supervision if you're an

accountancy service provider* (page updated 16 March 2023) — gov.uk

• HMRC, Fees you'll pay for money laundering supervision (page updated 22 December 2025) —

gov.uk

• HMRC, Check if you meet HMRC's conditions to register as a tax adviser (page updated

18 May 2026) — gov.uk. An adjacent regime, not a Money Laundering Regulations duty

• HM Treasury and Home Office, *National Risk Assessment of Money Laundering and Terrorist

Financing 2025* (17 July 2025) — gov.uk

3Policies, Controls and Procedures

Pendlebury Bookkeeping & Payroll Limited (trading as Pendlebury Books)

Regulation 19 and regulation 19A, Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

3.1How to read this document

Regulation 19(1)(a) requires policies, controls and procedures that mitigate and manage effectively the risks of money laundering and terrorist financing identified in the risk assessment undertaken under regulation 18(1) — this business's own assessment, not a general one. That is why each section below opens by naming the risk it answers and the rating that risk carries in document 01. If you change an answer and a rating moves, the policy that answers it moves with it.

It is also why a downloaded template cannot satisfy regulation 19(1)(a) however well written it is: it was not drafted against any risk assessment, let alone this one.

The practice-wide residual rating in document 01 is High. The procedures below are calibrated to that, and to the size of the business, as regulation 19(2)(a) requires — they must be proportionate with regard to the size and nature of the business.

3.21. Scope, ownership and approval

This document applies to everyone working in Pendlebury Bookkeeping & Payroll Limited, a limited company of Unit 4, The Old Mill, Water Street, Stockport SK1 3BQ, including employees, directors, self-employed associates and any agent acting for the business.

The same person holds both roles. In a business of this size that is normal and compliant — the Regulations do not require them to be separate people.

HMRC must be told who these people are within 14 days of appointment, and of any later appointment. That is regulation 21(4), and it is a duty on the business, not on the individual.

1.1 Who is allowed to run this business — regulation 26 approval

Regulation 26(1) prohibits anyone from being a beneficial owner, officer or manager of an accountancy service provider — HMRC calls them BOOMs — unless HMRC has approved them. Regulation 26(2)(a) names “auditors, insolvency practitioners, external accountants and tax advisors” expressly, so this business is in the approval regime and not in the regulation 58 fit and proper test that applies to money service businesses and to trust or company service providers. HMRC's own fee schedule confirms the split and the cost: an “approval process fee (for accountancy service providers, estate agency businesses, or high value dealers) for each person tested”, at a non-refundable charge of £40 for each person tested, where the fit and proper test fee is £500. Acting in breach of that prohibition is a criminal offence under regulation 26(12), and it is one of the few duties in the Regulations that falls on individuals as well as on the business.

The approval check is a check for an unspent conviction for a relevant offence — an offence listed in Schedule 3 to the Regulations — in any jurisdiction, not only the UK. HMRC checks its own records and police records, and every BOOM must disclose any such conviction in the application.

The business's own duties, which is what this section exists to record:

• Reasonable care on appointment. Regulation 26(4) requires the business to take reasonable care that no-one is appointed, or continues to act, as an officer or manager unless they have been approved or have applied for approval. In practice: before anyone is appointed to such a role, the business asks them whether they hold an unspent conviction for a Schedule 3 offence, records the answer and the date, and does not appoint where the answer is yes.
• Telling HMRC about a new BOOM — 30 days. When a new beneficial owner, officer or manager joins after the business is registered, HMRC must be informed within 30 days and the approval fee paid, by amending the registration. The new BOOM cannot act in the role until HMRC has been informed and the fee paid. Where the new BOOM is the nominated officer or the compliance officer, the shorter 14-day period in regulation 21(4) applies instead.
• On first registration the approval checks run as part of the application, and no separate step is needed. The business may trade, and the BOOMs named on the application may act in the roles specified, while the checks are being carried out.
• If someone fails the check they must stop working in that role immediately, and must not take any other role in or control of the business that requires approval. Where a beneficial owner fails and remains a beneficial owner, HMRC will cancel the registration.
• Convictions after approval — 30 days. Regulation 26(10) requires an approved person convicted of a relevant offence to tell HMRC within 30 days, and requires the business to tell HMRC within 30 days of becoming aware of it. Approval ceases to be valid on conviction; it does not lapse quietly.
• New branches — 30 days. Where the business opens a new branch it must notify HMRC within 30 days of opening — a material change to its registration information under regulation 57(4) — with the branch details and any officer or manager there who is subject to the approvals test. Branch officers are not outside this section.

The current BOOMs, as given to us. These are the people regulation 26 catches in this business. Each must hold HMRC approval, or have applied for it, before acting in the role.

The two empty columns are filled in by the business and kept up to date. That table is the first thing to produce if HMRC asks who runs the business.

Approval. Regulation 19(2)(b) requires these policies to be approved by senior management. The approval block at the end of this document is that approval. Until it is signed and dated, this is a draft and the business is not compliant with regulation 19 however good the drafting is.

Communication and the record of it. Regulation 19(1)(c)(iii) requires a written record of the steps taken to communicate these policies, and any changes to them, within the business. Holding the document is not enough. Every person listed in the scope above is to be taken through this document, and the date each was taken through it is to be recorded in the training and communication log. This is the requirement most often missed, and it is one of the easiest for HMRC to test — they ask a member of staff.

What is recorded today, in the business's own words: The policy was emailed round when it was written and has not been revisited since. That is the starting point for the log at the end of this document; regulation 19(1)(c)(iii) is satisfied by the written record, not by the briefing.

3.32. Customer due diligence

*Answers the customers factor, rated High residual in document 01. Required content under regulation 19(3)(c); the measures themselves are regulations 27 to 38.*

2.1 Who the customer is

The customer is the person or entity the business is engaged by — the individual, sole trader, partnership, company, LLP or trust whose accounts, returns, payroll or advice the business is instructed on. Almost every accountancy engagement is a business relationship within regulation 27(1)(a), because it is expected to have an element of duration, so the customer is identified at the point the engagement is established rather than transaction by transaction.

Where the customer is a company or other legal entity, the entity is the customer and the beneficial owners behind it are identified as part of the checks in 2.3 — the directors who sign the engagement letter are not the customer. Where work arrives through another firm, who the customer is has to be decided and recorded, because it decides who is checked: an introducer who instructs the business on its own account is the customer, and an end client the business deals with directly is a customer of this business too, whoever pays the invoice.

2.2 When the checks are done

Regulation 27(1) requires customer due diligence when a business relationship is established, when there is a suspicion of money laundering or terrorist financing, or when there is doubt about identification evidence previously obtained. For an accountancy practice that first limb does nearly all the work, and the trigger table is short for a reason:

Almost everything is a business relationship, so the trigger is the engagement. An accountancy engagement is expected to have an element of duration, so regulation 27(1)(a) fires when the relationship is established. There is no buyer and no seller, no “before an offer is accepted”, and no per-transaction value to watch. CCAB's guidance for this sector turns that into a rule the business can test itself against: “No client engagement (including transfers of client money or assets) should be completed until CDD has been completed in accordance with the business's own procedures.”

Verification may run on into the engagement, but only on both limbs and only on a record. CCAB's guidance permits verification to be completed during the establishment of a business relationship where it is necessary not to interrupt the normal course of business and there is little risk, provided customer due diligence is completed as soon as practicable — naming some insolvency appointments, work ascertaining a client's legal position or defending them in legal proceedings, and response to an urgent cyber incident as the situations where work may have to begin first. Any extension is “specific, well-defined and time-limited”, and there is “no granting of general extensions (such as for particular client types)”. Where the business uses that latitude, the extension, its reason and its end date are recorded on the file at the time. An unrecorded extension is not an extension.

Regulation 27(2) is the fallback for a genuine one-off, and applies to an occasional transaction amounting to £12,000 or more, whether in a single operation or in several which appear to be linked. The sum was substituted by S.I. 2026/621 with effect from 30 June 2026. It rarely governs an accountancy engagement, because the engagement is a business relationship and regulation 27(1)(a) has already fired; it is here so that a genuine single piece of work for someone who is not a client is not missed.

Regulation 27(8)(za) makes the annual cycle a statutory trigger. Where the business has any legal duty in the course of the calendar year to contact an existing customer for the purpose of reviewing information that is relevant to its risk assessment for that customer and relates to the beneficial ownership of the customer, including information enabling it to understand the ownership or control structure of a legal person, trust, foundation or similar arrangement, customer due diligence must be applied. An accountancy practice contacts every company client every year for the accounts and the confirmation statement information, so for much of this book the annual cycle is a due diligence trigger rather than a good habit — which is why it is a dated line in the compliance calendar. Regulation 27(8)(zb) does the same where the business has to contact a customer to fulfil a duty under the International Tax Compliance Regulations 2015.

No engagement is completed, and no client money or assets moved, ahead of the checks. Where a check cannot be completed, regulation 31 requires the business not to proceed with the transaction and to consider whether the circumstances give rise to a suspicion that must be reported.

2.3 What the checks consist of

Identity is established and verified using: A mix — Passport or driving licence in the office where the client comes in; photographs by email where they do not, checked against the Companies House record.

• Individuals — full name, date of birth and residential address, verified from a reliable source independent of the customer.
• Companies and other legal persons — the full name, the company or other registration number, the registered office address and the principal place of business, the law the body corporate is subject to, its constitution, the full names of the board of directors or equivalent and of the senior persons responsible for its operations, and the beneficial owners. Regulation 28(4) requires the beneficial owner to be identified, reasonable measures taken to verify their identity, and — where the beneficial owner is itself a legal person, trust, company, foundation or similar arrangement — reasonable measures taken to understand the ownership and control structure. Most of an accountancy book is companies, so this is the ordinary case here rather than the exception.
• The PSC register is never the whole answer. Regulation 28(9) provides that relevant persons “do not satisfy their requirements under paragraph (4) by relying solely on information delivered to the registrar” about registrable persons, registrable relevant legal entities or registrable beneficial owners. That bites unusually hard in this sector, because the business is very often the agent that filed the information it is now checking — so relying on the register alone would be relying on its own paperwork. The file records which other sources were used: enquiries of the company itself, its own records and website, and public records.
• Where the beneficial owner cannot be identified, regulation 28(6) allows the senior person responsible for managing the body corporate to be treated as its beneficial owner — but only where regulation 28(7) applies, which is once all possible means have been exhausted — and regulation 28(8) then requires reasonable measures to verify that senior person and a written record of all the actions taken to identify the beneficial owner, of the measures taken to verify the senior person, and of any difficulties encountered. The record is the part most often missing, and it is the part regulation 28(8) actually requires.
• Trusts — where the customer is a trustee acting on behalf of a trust, the trustees are identified and their identity verified, and the purpose and intended nature of the business relationship assessed. The settlor and the other beneficial owners are identified and verified on a risk-sensitive basis: the settlor, the trustees, the beneficiaries or the class of persons in whose interest the trust is set up, and any individual who has control over it. A material discrepancy on a registrable trust is reported to HMRC, not to the registrar of companies.
• Source of funds — where the money is coming from, evidenced rather than asserted, proportionate to the risk rating of the file. In this sector that reaches two things in particular: the funds behind any client money the business holds or moves, and the funds behind a fee paid by someone other than the client, where the relationship between payer and client is recorded.
• The purpose and intended nature of the relationship — regulation 28(2)(c) requires this to be assessed, and information obtained on it where appropriate. One line on the file saying what the customer is trying to do and why is enough; nothing on the file is not. It is also what makes a later transaction recognisable as out of pattern.

Where someone acts for the customer. Regulation 28(10) applies whenever a person (the Regulations call them A) purports to act on behalf of the customer — a bookkeeper at the client, an office manager, a company secretary, another accountant, a solicitor. The business must verify that A is authorised to act, identify A, and verify A's identity from a reliable source independent of both A and the customer. In an accountancy practice this is the ordinary case rather than the exception — most day-to-day contact is with someone other than the beneficial owner — so the authority is evidenced once, on the file, at the start of the relationship, and revisited when the person changes. Customer due diligence on the customer is still done as well: identifying the agent does not replace it.

The standard a verification has to meet. HMRC sets this out, and a check that does not meet it is not verification however genuine it looks.

• Original documents first. Originals are produced wherever possible. A certified copy is for where the original is not produced or cannot be validated with the issuing source.
• Certified copies. HMRC's manual sets the standard: the certifier writes “Certified to be a true copy of the original seen by me” on the document, signs and dates it and prints their name, and adds their occupation, address and telephone number. They must be an appropriate professional person, such as a solicitor. The business must satisfy itself that the certifier exists and is an appropriate person to certify — a certification nobody checked is not evidence. Certifying a copy does not by itself amount to enhanced due diligence and is never counted as such.
• Electronic and digital verification. A records check on a name and address is not verification. The check must show the customer was identified, that the identity was verified, and that the person using the service is that same person. Where a digital verification service is used, HMRC's current position is decisive: only providers certified against the UK digital verification services trust framework and listed on the DVS register are a reliable and independent source for this purpose, and a provider not on the DVS register cannot reliably be deemed suitable for identity verification in compliance with the Regulations. The business checks the register before appointing a provider and records the check.
• Where an electronic records check is relied on, the business uses a package that addresses the risks in document 01 and understands how it does so; uses multiple positive information sources; uses negative sources such as identity-fraud and deceased-person databases; uses data from multiple sources collected over a period of time; includes checks assessing the strength of the information supplied; sets the system to fail or refer at a level appropriate to the risk; and retains, or keeps access to, records sufficient for regulation 40 even if the provider goes out of business. Electronic verification bought in from a provider is outsourcing, not reliance under regulation 39: the business remains responsible for it. HMRC's guidance is that where services are provided virtually or through an automated service, the business still has to perform customer due diligence on its customer.
• Remote onboarding. Viewing a photograph of a document over the internet, or a selfie of a person holding a document, is not adequate on its own unless there are reliable measures to detect counterfeits and forgeries. Facial recognition does not solve this: it will match a face to the same face on a false document.

Every check is recorded at the time. An unrecorded check does not satisfy regulation 40(2)(a), and in an HMRC visit it did not happen.

2.4 Enhanced due diligence

Regulation 33(1) makes enhanced due diligence and enhanced ongoing monitoring mandatory in each of the following, and they are not a matter of judgement:

• any case identified as high risk by this business's own risk assessment under regulation 18(1), or by information HMRC makes available — which means the ratings in document 01 drive this list, not the other way round;
• any business relationship or relevant transaction where a party is established in a country subject to a FATF call for action (regulation 33(1)(b));
• where the customer, or a family member or known close associate, is a politically exposed person (regulation 33(1)(d)) — see 2.5 below for how that is determined and what follows from it;
• where a customer has provided false or stolen identification and the business proposes to continue dealing with them (regulation 33(1)(e));
• where a transaction is unusually complex or unusually large given its nature, there is an unusual pattern of transactions, or the transaction has no apparent economic or legal purpose (regulation 33(1)(f));
• any other case which by its nature can present a higher risk (regulation 33(1)(g)).

In this business, enhanced due diligence is expected on the following, on the ratings in document 01: customers linked to Republic of Ireland; customers running cash-intensive businesses.

Enhanced due diligence means more evidence and a second pair of eyes, not more forms: additional independent verification of identity, evidence of source of funds and source of wealth, and approval from Claire Pendlebury recorded on the file before the business proceeds.

Two of the triggers above carry a prescribed list of measures, and on those the Regulations leave no discretion about what enhanced due diligence consists of.

• Where a party is established in a FATF call-for-action country (regulation 33(1)(b)), regulation 33(3A) says the measures must include all six of: additional information on the customer and on the customer's beneficial owner; additional information on the intended nature of the business relationship; information on the source of funds and source of wealth of the customer and of the beneficial owner; information on the reasons for the transactions; the approval of senior management — here, Claire Pendlebury — for establishing or continuing the relationship; and enhanced monitoring by increasing the number and timing of controls and selecting patterns of transactions that need further examination. Being established in a country means, for a company, incorporation or principal place of business there, and for an individual, residence there — not merely having been born there (regulation 33(3)(c)).
• Where the transaction is unusually complex or unusually large, follows an unusual pattern, or has no apparent economic or legal purpose (regulation 33(1)(f)), regulation 33(4) says the measures must include examining, as far as reasonably possible, the background and purpose of the transaction, and increasing the degree and nature of monitoring of the relationship to determine whether it appears suspicious.

2.5 Politically exposed persons

Regulation 35(1) requires the business to have appropriate risk-management systems and procedures to determine whether a customer, or a customer's beneficial owner, is a politically exposed person (PEP) or a family member or known close associate of one. That is a positive duty to look, not a duty to react if something happens to surface. This section is that procedure.

• Who is a PEP. An individual entrusted with prominent public functions, in the UK or abroad, other than a middle-ranking or more junior official — heads of state and government, ministers, members of parliaments and equivalent legislatures, members of the governing bodies of political parties, members of supreme and constitutional courts, members of courts of auditors and central bank boards, ambassadors and armed forces officers at Permanent or Deputy Permanent Secretary level or equivalent rank, members of the administrative, management or supervisory bodies of state-owned enterprises, and directors and board members of international organisations. UK public servants below Permanent or Deputy Permanent Secretary are not normally treated as holding a prominent public function, and UK local government is not included.
• Family members — spouse or civil partner, children and the children of a spouse or civil partner, and parents; HMRC's guidance says siblings should also be considered.
• Known close associates — joint legal ownership with a PEP of a legal entity or arrangement, any other close business relationship with a PEP, and sole beneficial ownership of an entity or arrangement set up for a PEP's benefit.
• How the check is done. Ask the customer, and search open sources: the internet, news agencies, government and parliament websites, the Electoral Commission, the Companies House PSC register, Transparency International and Global Witness. A commercial screening tool is permitted but not required; where one is used the business must understand how the database is populated and how often it is updated, and must still satisfy itself that anyone flagged actually falls within the definition. The search and its result are recorded on the file whichever way it goes — a negative check that was never written down cannot be produced to HMRC.

Where the customer, a family member or a known close associate is a PEP, regulation 35(5) requires three things in addition to the enhanced due diligence above, and all three before the business proceeds: approval from senior management — here, Claire Pendlebury — for establishing or continuing the relationship; adequate measures to establish both the source of wealth and the source of funds involved; and enhanced ongoing monitoring of the relationship for as long as it lasts.

How much enhancement. Regulation 35(3) requires the level of risk and the extent of the measures to be assessed case by case, and regulation 35(3A) sets the starting point: a domestic PEP, or their family member or close associate, is taken to present a lower level of risk than a non-domestic one, and where no enhanced risk factors are present the measures applied are correspondingly lighter. HMRC puts the same rule the other way round: a PEP holding a prominent public function in the UK should be treated as lower risk unless other factors in the risk assessment indicate otherwise. This is a starting point for assessment, not a licence to skip the reg 35(5) measures, and it is not a rule that every overseas PEP is automatically high risk — that too is assessed, on the accountability and corruption profile of the country concerned.

When it stops. Regulation 35(9) requires the reg 35(5) measures to continue for at least 12 months after the person ceases to be entrusted with the prominent public function, and longer where the business considers it appropriate to address the risk. Regulation 35(11) then removes the requirement for their family members and close associates. The date the function ceased, and the date enhanced measures were stood down, are recorded.

2.6 Simplified due diligence

Regulation 37 permits simplified measures where the business has determined the relationship or transaction presents a low degree of risk, having taken into account the risk assessment. Simplified does not mean none: identity is still established, and monitoring still applies. The determination and the reason for it are recorded on the file.

2.7 Company, LLP, trust and overseas-entity customers: the register check

Regulation 30A applies whenever the customer is a company subject to Part 21A of the Companies Act 2006, an unregistered company, a limited liability partnership, an eligible Scottish partnership, a trust registrable under Part 5 of the Regulations, or an overseas entity registrable under Part 1 of the Economic Crime (Transparency and Enforcement) Act 2022. It is a separate duty from identifying the beneficial owners, and it is one HMRC can test in minutes.

• Before the business relationship is established, the business must either collect an excerpt of the register showing the beneficial ownership information held on it, or establish from its own inspection of the register that no such information is held at that time. The excerpt, or a dated note of the inspection and what it showed, goes on the file.
• The same check is repeated as part of ongoing monitoring and of any enhanced due diligence after the relationship has started (regulation 30A(2A)). This is the limb most often missed: the check is not a one-off at onboarding.
• Any material discrepancy must be reported as soon as possible between what the register shows and what the business has learned in doing its own due diligence. A discrepancy is material where it may reasonably be considered to be linked to money laundering or terrorist financing, or to conceal details of the customer's business. HMRC gives the forms it takes: a difference in name; an incorrect entry for nature of control, date of birth, nationality or correspondence address; a missing entry for a person of significant control or registrable beneficial owner; or an incorrect date on which the individual became a registrable person.
• Where the report goes — to Companies House for a company, unregistered company, LLP, eligible Scottish partnership or overseas entity; to HMRC for a trust.
• Reporting a discrepancy is not a suspicious activity report and does not replace one. If the discrepancy also gives rise to knowledge or suspicion, section 4 of this document applies as well, and the customer is not told about the SAR.

2.8 Arrangements that favour anonymity

Regulation 19(4)(b) is a required part of these policies in its own right: they must specify the taking of additional measures, where appropriate, to prevent the use for money laundering or terrorist financing of products and transactions which might favour anonymity. HMRC's manual gives customers who are not seen face to face, and anonymous funding sources, as its examples. The measures are these.

• Distance between the client and this business. Where an introducer, an intermediary or another firm stands between the business and the person actually benefiting from the work, the beneficial owner is identified and verified in the ordinary way, the reason for the intermediary is recorded, and who the customer is for that engagement is decided and written down. HMRC's supply-chain risk factor for this sector names intermediaries who promote secrecy or hidden ownership, requests that could help disguise income, assets and ownership, the number of intermediaries in the chain, an apparently excessive frequency of requests, and “no clear reason why an end user has not approached you directly for the service”.
• Not seen face to face. A customer verified remotely gets the standard in 2.3 applied in full, and the file records which method was used and why.
• Anonymous funding. Cash provides anonymity and disguises the audit trail, so where any part of the consideration or of this business's own fee is offered in cash the source of funds is evidenced rather than asserted, and the offer itself is treated as a risk indicator under section 3 whatever the amount.
• Addresses that identify nobody. A virtual office or accommodation address with no connection to the customer or the beneficial owners is queried and the answer recorded before the business proceeds.
• Opaque ownership. Where a company, trust or overseas entity is used and the ownership cannot be established to the standard in 2.3, the business does not proceed on the strength of the structure alone; regulation 31 applies.

2.9 Checking that the other firm is supervised, before taking or sending work

This is the procedure most specific to this sector, and HMRC states it as a prohibition rather than as good practice. From its risk assessment of accountancy service providers: “Before entering into a business relationship with a business, customer or intermediary who is carrying out relevant activity, you should take appropriate measures to check they are anti-money laundering supervised for that activity. If not, you should not enter into the business relationship.”

The steps, which are carried out before the relationship starts and recorded on the file:

• Ask who supervises them, and for the registration number. A firm that cannot answer that question about itself has answered it.
• Check it. Where the firm should be supervised by HMRC, check HMRC's supervised business register. HMRC's own qualification matters here: that register “will not include businesses supervised by another authority”, so a firm supervised by a professional body is checked with that body instead of being written off because it is absent from HMRC's list.
• Read the entry, not just the presence of one. HMRC: “If the business does not appear on the HMRC register or its entry does not reflect all types of relevant activity they carry out, you should not enter into a business relationship.” A firm registered for accountancy work but not for the trust or company work it is actually doing is not covered for that work.
• If not satisfied, do not proceed. HMRC: “In all cases, if you are not satisfied that the business is appropriately supervised for anti-money laundering, you should not enter into a business relationship.” This is a refusal rule, and the reason for a refusal is recorded.
• Tell HMRC about an unsupervised firm. HMRC: “If you believe a business is conducting relevant activity without appropriate supervision, you should report them to HMRC”. That report goes to HMRC and is not a suspicious activity report to the National Crime Agency; where the facts also give rise to knowledge or suspicion, the reporting route in section 4 runs separately and the tipping-off rules apply to it.
• Record the check and its date, and repeat it when the arrangement is reviewed. This check is also the precondition of any reliance under regulation 39 in section 6.1, because reliance is only ever available in respect of a person who is themselves supervised.

2.10 Client money and the client account

HMRC's risk assessment of this sector makes unrestricted deposits and withdrawals by clients in designated or pooled client accounts a named risk factor: criminal funds can be paid into and out of the account to disguise them as legitimate business transactions; “Overpayments of fees or accidental payments, with requests to an ASP service provider to make a refund, indicate a risk the account is being used to legitimise illicit funds”; and “Funds paid in from unknown or cash sources, and funds paid out to a different account than that used to initially pay in, may indicate an attempt to hide the origin or true ownership of the funds.” A pooled account is singled out as “an attractive method of mixing illicit funds with legitimate funds”.

So where this business holds or moves client money:

• No client money or assets are transferred before the customer due diligence for that engagement is complete — CCAB's rule in 2.2 covers transfers of client money and assets expressly.
• Money is paid out only to the account it came in from, unless a different account is specifically explained, the explanation is recorded, and the file is escalated to the nominated officer first.
• Overpayments are not refunded on request as a matter of routine. The reason for the overpayment is established and recorded before any refund is made.
• The account is monitored rather than merely reconciled: HMRC's point is that monitoring transactions through a client account is what shows whether it is being used for the purposes the business expects, and by the customers it gave permission to use it. Any deposit from a party who is not the client, and any movement that does not match the work in hand, is queried and the answer recorded.
• Where a client-money movement involves a party in a FATF call for action country — the term regulation 33(3)(a), as substituted by S.I. 2026/621, now uses for a high-risk third country — enhanced due diligence under regulation 33(1)(b) is mandatory. CCAB's guidance notes that the high-risk-third-country occasional transaction limb “would predominantly apply to services other than accountancy apart from where the business is handling client money or client assets” — this is the one place in an accountancy practice where it ordinarily bites.

2.11 The annual cycle, and refreshing what is held

Regulation 27(8)(za) is set out in 2.2 and is a statutory trigger, not a recommendation. In practice it works like this. When the business contacts a company client for the accounts, the confirmation statement information or the persons-with-significant-control position, it refreshes what it holds on who owns and controls that client at the same time, compares it against the beneficial ownership register, and records the date and the result. Where anything has changed, the risk rating for that client is reconsidered before the work is done rather than after it. Where the register does not match what the client says, the discrepancy is reported under regulation 30A — to the registrar of companies for a company, LLP, eligible Scottish partnership or overseas entity, and to HMRC for a registrable trust.

3.43. Ongoing monitoring and unusual transactions

*Answers the transactions factor, rated Medium-High residual. Required content under regulation 19(4).*

Regulation 19(4) requires policies providing for the identification and scrutiny of any case where a transaction is unusually complex or unusually large given its nature, where there is an unusual pattern of transactions, or where a transaction has no apparent economic or legal purpose — and of any other activity the business regards as particularly likely by its nature to be related to money laundering.

The following are treated as requiring scrutiny and a written note on the file:

• any offer of cash for fees, in any amount, at any stage — HMRC treats accountancy services paid for in cash as a risk indicator in its own right
• a request or business activity that does not have a clear business reason or make economic sense — including an existing client asking for a new service with no obvious need for it
• pressure to work from incomplete records, or reluctance to provide bank statements, invoices or other original documentation — HMRC's point being that the records this business then produces may be accepted by third parties without further checks
• pressure to reduce a tax bill in a way the business is not comfortable with, or a willingness to take risks to do so
• a client who stops the business dealing with HMRC on their behalf, or who cannot show that the required reports were made; a refusal to confirm National Insurance numbers, tax codes or related payroll information, which can indicate fabricated employees or abused identities
• significant or unexplained changes to a client's business activity, records, ownership, directors or shareholders — particularly shortly after the business was engaged
• an entity with no premises, no staff and no obvious trade, or one that appears dormant while services are requested for it
• client-account behaviour: a payment in from an unknown or cash source; an overpayment followed by a request for a refund; a request to pay out to a different account from the one the money came in from; deposits or withdrawals that do not match the work in hand
• secrecy about the business or its finances, restricted access to premises, or premises that do not match the trade described
• an introduction from, or a request to work alongside, a firm that is not anti-money laundering supervised for what it is doing — or a supply chain with no clear reason why the end user did not come direct
• a change in the activity or the proposed ownership of a client that is in, or approaching, financial difficulty — a new third-party investor, a buyer, or money arriving from a source the accounts do not explain. HMRC's risk assessment: businesses in financial difficulty “are vulnerable to exploitation by criminals due to the financial pressures their owners or management may be facing”, and “monitoring changes to activity or proposed ownership of your customer's business can help you to consider whether they may be in or approaching financial difficulty”
• payroll or workforce figures that do not fit the business — headcount out of step with turnover, wages paid in cash or to third parties, workers who cannot be identified, or accommodation deducted from pay — in a client that employs low-paid manual labour (construction, cleaning, agriculture, care, hand car washes). HMRC's risk assessment names “any other type of business model or trade considered likely to be exploited for the purposes of modern slavery or human trafficking” among the customer risks, and the payroll this business runs is where the pattern shows first

Where any of these is present, the file is escalated to Claire Pendlebury before the business proceeds, and the outcome — including a decision that there is nothing in it — is recorded. A decision recorded is a defence; a decision remembered is not.

Current practice, as described by the business: We see most clients' records every month, so anything odd tends to surface in the bookkeeping.

3.54. Reporting a suspicion

Required content under regulation 19(4); the duties themselves are in Part 7 of the Proceeds of Crime Act 2002 and Part 3 of the Terrorism Act 2000.

• Anyone in the business who knows or suspects, or has reasonable grounds to know or suspect, that a person is engaged in money laundering or terrorist financing reports it internally to Claire Pendlebury immediately. There is no threshold amount and no discretion to sit on it.
• The report is made in writing, kept confidential, and stored separately from the customer file.
• Under regulation 21(5) the nominated officer must consider each internal disclosure in the light of the relevant information available and determine whether it gives rise to knowledge or suspicion. That determination is recorded whichever way it goes.
• Where it does, the nominated officer reports to the National Crime Agency, and where the business wants to go on with the transaction, follows the defence procedure below before it goes any further.
• Nobody says anything to the customer. Tipping off is a criminal offence under Part 7 of the Proceeds of Crime Act 2002. Staff do not raise it with the customer, the other side, or anyone acting for them.
• Nobody in the business is penalised for making an internal report in good faith that turns out to be nothing.

Asking for a defence (a DAML) — and how long to wait.

Where the business wants to carry on with a transaction it has reported, it must ask the NCA for a defence against money laundering by ticking the consent requested box on the report. Only the NCA's grant gives the defence. The timings are statutory and the nominated officer works to them, not to the pressure of the deal.

• Ask before, never after. A defence can only be sought where the NCA has prior notice of the transaction or activity. The NCA cannot give consent once the act has happened — a report arriving afterwards is treated as an ordinary SAR, and the defence is gone.
• One act, not a general permission. A defence is only given to the extent it is asked for, and only for a particular transaction. There is no such thing as a DAML to trade with a person generally. The request therefore sets out the transaction, the parties, what the criminal property is thought to be, its value or an estimate, and where it is.
• The notice period is seven working days, starting with the first working day after the disclosure is made (Proceeds of Crime Act 2002, section 335(5); section 336(7) for the nominated officer). It is an offence for the nominated officer to let the transaction proceed within that period without a granted notice.
• If nothing comes back within the notice period, the business may form its own view that it has a defence and proceed. Silence is not approval of the transaction, and neither is a grant — the NCA is not endorsing the deal or requiring the business to do it.
• If the defence is refused, the moratorium period is 31 days, starting with the day notice of refusal is received (section 335(6); section 336(8)). It is an offence to let the transaction proceed during it. A court may extend the moratorium where more is needed.
• Terrorist property is different. Under section 21ZA of the Terrorism Act 2000 the notice period is the same seven working days, starting with the first working day after the disclosure (section 21ZA(3)), and consent is treated as given if no notice of refusal arrives before it ends (section 21ZA(2)). But there is no moratorium period: where consent is refused the refusal stands, and the transaction cannot proceed unless an authorised officer later consents.
• A defence changes nothing else. It is a defence to the principal money laundering offences only. It does not displace any duty under the Regulations — customer due diligence, record keeping and the rest continue — and it does not permit tipping off.

The date the report was made, the date the notice period ends, the NCA reference, the response and the date it arrived are recorded before anything moves on the file.

The business has never made a report to the National Crime Agency. That is not a criticism and it is not unusual — most businesses of this size never do. It does mean this procedure has never been run, so the first internal report is the one to get right: the nominated officer works through the steps above in order rather than from memory.

Privilege, and the one exemption that exists — stated so it cannot be misread.

Everyone in an accountancy practice is in the regulated sector, so section 330 of the Proceeds of Crime Act 2002 applies: it is an offence to fail to disclose where a person knows or suspects, or has reasonable grounds for knowing or suspecting, that another person is engaged in money laundering, and the information came to them in the course of a business in the regulated sector. The “reasonable grounds” limb is objective, so not noticing is not an answer.

There is one exemption, and it is narrower than the word “privilege” suggests. Section 330(6)(b) provides that a professional legal adviser or relevant professional adviser does not commit the offence where the information came to them in privileged circumstances — which section 330(10) defines as information communicated by a client in connection with the giving of legal advice, by a person seeking legal advice, or by a person in connection with legal proceedings or contemplated legal proceedings; and section 330(11) removes the protection where the information was communicated with the intention of furthering a criminal purpose. Section 330(14) defines a relevant professional adviser as “an accountant, auditor or tax adviser who is a member of a professional body which is established for accountants, auditors or tax advisers” and which tests the competence of those seeking admission and imposes and maintains professional and ethical standards with sanctions for non-compliance. Section 330(7B) extends it to a person employed by, or in partnership with, such an adviser to provide assistance or support.

This exemption is not available to this business, and the pack says so plainly rather than leaving it to be assumed. The exemption in section 330(6)(b) belongs to a relevant professional adviser, which section 330(14) defines by membership of a qualifying professional body. The answers given record that neither the business nor its principals hold such a membership — which is the ordinary position for a firm HMRC supervises, because HMRC's supervision under regulation 7(1)(c)(iv) is precisely the supervision of accountants who are not members of a Schedule 1 body. So the section 330 duty applies to this business in full, with no privilege exemption of any kind. Client confidentiality is not legal professional privilege, and legal professional privilege is not what section 330(6)(b) confers. If a member of staff knows, suspects, or has reasonable grounds to suspect, the internal report in section 4 is made, whatever the work was and however the information arrived.

And in this sector the exemption would not reach the day job in any event. CCAB's guidance is unambiguous about the work an accountancy practice actually does: “Audit work, bookkeeping, preparation of accounts or tax compliance assignments are unlikely to take place in privileged circumstances.” What can attract it is legal advice and litigation work — advising on a client's tax position in law, on directors' duties, on employment law, taking witness statements, representing a client at a tribunal. So even for a firm that qualifies, the exemption is an exception at the edge of the practice, never a general answer to a reporting duty.

Nothing in this section is a decision about a particular piece of work, and nothing in it may be used as one. Whether a specific communication came to a specific adviser in privileged circumstances is a legal question on the facts. CCAB's guidance for this sector says the same: it is “a difficult question with a fundamentally legal answer”, and businesses are “strongly recommended to seek the advice of a professional legal adviser experienced in these matters”. Deplexify does not advise on privilege and this pack does not decide it.

One further place where privilege appears, and it is a different test again. Regulation 30A(4) relieves the business of the duty to report a beneficial-ownership discrepancy where it would be entitled to refuse to provide the information on grounds of legal professional privilege in the High Court. That is the ordinary High Court test, not the section 330 “relevant professional adviser” concept above, and the two are not interchangeable: an accountant may be a relevant professional adviser for section 330 purposes and still have no regulation 30A(4) protection on the same facts.

Deplexify has no role in this process. Reporting is the nominated officer's duty and cannot be delegated outside the business.

3.65. Countries, sanctions and proliferation financing

*Answers the countries factor, rated Low residual, and regulation 19A.*

• Before proceeding, the customer and — where the customer is a company — its beneficial owners are screened against the UK sanctions list, and their country is checked against the current FATF list of High-Risk Jurisdictions subject to a Call for Action at the date this pack is issued.
• Where a party is established in a country subject to a FATF call for action, enhanced due diligence is mandatory under regulation 33(1)(b) (regulation 33(3)(a) as substituted by S.I. 2026/621). A country on the FATF increased-monitoring list is weighed as a higher-risk factor under regulation 33(1)(g) — it does not trigger the mandatory duty by itself.
• A sanctions match stops the transaction. It is not a matter of enhanced checks and proceeding carefully; the business does not proceed, and takes advice.
• Regulation 19A requires policies to mitigate the proliferation financing risks identified under regulation 18A. In this business those risks run through sanctions exposure, so the screening above is the control that answers regulation 19A, and it is applied to beneficial owners and not only to the named customer.

3.76. Delivery channels and new technology

*Answers the delivery channels factor, rated Medium-High residual. Required content under regulation 19(4).*

Around 35% of customers are met in person, so most identity verification happens remotely. HMRC's guidance is direct: where services are provided without meeting the customer, there is a risk the customer is not who they say they are, and fraudulent documents are harder to detect when supplied online. Remote verification therefore requires either an electronic verification result retained on file, or certified copies from an independent professional — a photograph of a document sent by message is not verification.

Where business arrives through an introducer, the file records why the customer did not approach the business directly. HMRC names the absence of a clear rationale as an indicator.

The introducers and referral partners the business works with are: Kirkby & Vance, an IFA in Stockport, and a Manchester recruitment agency that refers its contractors to us for their returns. Each is named on the file of any customer it introduced, and each is reviewed at the annual review of this document — an introducer relationship that has changed, or that now brings a different kind of customer, is a reason to revisit the risk assessment under regulation 19(4).

6.1 Relying on someone else's due diligence

Regulation 39 lets the business rely on customer due diligence carried out by another supervised person instead of doing it again. It is narrow, it is conditional, and the liability never moves. In this sector it comes up constantly, because work reaches accountancy practices through other practices — introducers, sub-contract bookkeepers, tax specialists, other firms' overflow. Two things are worth separating before the conditions below are read. Reliance under regulation 39 is only ever available in respect of a person who is themselves supervised, so the check in section 2.9 comes first and reliance comes after it. And HMRC's registration concession for a firm whose clients are all themselves supervised is not reliance and transfers no customer due diligence duty.

• Who may be relied on — regulation 39(3): another relevant person subject to the Regulations under regulation 8; a person carrying on business in a third country who is subject to customer due diligence and record-keeping requirements equivalent to the fourth money laundering directive and supervised for compliance with them; or an organisation whose members are such persons. The separate limb for a business in another EEA state has been revoked — an EEA business qualifies, if at all, as a third-country person under regulation 39(3)(c). The business may not rely on a person established in a FATF call for action country (regulation 39(4)); the one exception is a branch or majority-owned subsidiary of a UK-supervised or equivalently supervised entity that complies fully with group-wide policies under regulation 20 or their equivalent (regulation 39(5)).
• The third party must agree to be relied on, and the arrangement must provide that they give details of the due diligence they hold so the business can see it meets its own risk requirements; provide copies of the underlying information immediately on request; and retain those copies for five years from the transaction or the end of the relationship. Any reliance arrangement is put in writing before it is used.
• Liability does not transfer. The business remains responsible for any failure to apply due diligence measures properly, and that matters most when relying on someone outside the UK. Reliance is itself a risk and is assessed as one.
• Reliance is not outsourcing, and not certification. Accepting a certified copy of a document, or using an electronic verification provider, is not reliance — it is outsourcing a service, and the business remains fully responsible for the check. Reliance means adopting another supervised business's completed due diligence as satisfying this business's own obligation.
• Never on simplified due diligence. The business must not rely on simplified due diligence carried out by a third party, or on any exceptional form of verification such as source of funds used as evidence of identity.
• Relying does not end the file. The business still carries out its own risk assessment of the customer and the transaction, and still conducts ongoing monitoring of the relationship.
• Introducers and introducing agents. Where another firm introduces work, the customer due diligence obligation is not transferred by the introduction: an introducing agent who has formed a business relationship with the client owes its own duties on that client, and this business owes its own on whoever it decides is its customer for that engagement. HMRC's separate registration concession — that a firm need not register where “all your customers are themselves supervised by HMRC or a professional body” — is conditional on the business not doing business directly with that firm's own customers, and on being included in that firm's anti-money laundering controls and procedures, suspicious activity reporting and training programmes. It is a registration concession and nothing more; it does not make this business's checks somebody else's job.
• If reliance is refused. Where the business asks to rely on another party and is turned down, it records what it did instead to satisfy the due diligence requirement, leaving a clear audit trail of the steps taken.

Regulation 19(4) requires that when new products, new business practices including new delivery mechanisms, or new technology are adopted, appropriate measures are taken in preparation for and during the adoption to assess and mitigate the risks. In practice: before the business adopts a new portal, a new identity tool or a new way of taking instructions, the risk assessment in document 01 is revisited first, not afterwards.

3.87. Record keeping

Required content under regulation 19(3)(d); the duty is regulation 40.

• Copies of the documents and information obtained to satisfy the customer due diligence requirements are kept, together with supporting records sufficient to reconstruct each transaction (regulation 40(2)).
• Records are kept for five years beginning when the business knows or has reasonable grounds to believe the transaction is complete, or that the business relationship has ended (regulation 40(3)).
• Transaction records within a business relationship need not be kept for more than ten years (regulation 40(4)).
• Once the period expires, personal data obtained for the purposes of the Regulations is deleted, subject to the exceptions in regulation 40(5). Keeping everything indefinitely is not the cautious option — it is a breach of regulation 40(5), and it is what most template packs tell businesses to do.
• Regulation 21(8) requires systems enabling a rapid response to enquiries about business relationships from the previous five years. Files are held so that any customer from the last five years can be retrieved the same day.

7.1 What every new customer is told, before the relationship starts

Regulation 41(6) is a duty owed to the customer, and it has to be discharged before a business relationship is established or an occasional transaction entered into — not at completion, and not on request. The business must give every new customer a statement that any personal data it receives from them will be processed only for the purposes of preventing money laundering, terrorist financing or proliferation financing, or as otherwise permitted by regulation 41(3), together with the information required by Article 13 of the UK GDPR.

That is a short notice, given once, and it is easiest to carry in the terms of business or the client-care letter so it cannot be forgotten. HMRC's guidance sets out what the Article 13 information must include:

• the identity and contact details of the controller, and of the controller's representative if there is one;
• the contact details of the data protection officer, if the business has one;
• the reason the personal data is being processed, including the legal basis;
• who will receive the personal data;
• whether the business intends to transfer the data outside the UK and, if so, whether there is a UK adequacy agreement or appropriate safeguards;
• how long the data will be stored — which, for data held under the Regulations, is the five-year period in section 7 above;
• the right to request access to and deletion of personal data, including data portability;
• the right to complain to the Information Commissioner's Office;
• whether providing the personal data is a statutory or contractual obligation, and the consequence of not providing it — here, that the business cannot proceed;
• the existence of any automated decision making, including profiling — which covers an electronic verification tool that passes or refers a customer automatically.

Regulation 41(1) then limits what the business may do with that data: personal data obtained for the purposes of the Regulations may only be processed for preventing money laundering, terrorist financing or proliferation financing. It is not marketing data. Using it for anything else requires either another enactment permitting it or the customer's consent (regulation 41(3)).

3.98. Training, screening and internal controls

Regulations 21 and 24; required content under regulation 19(3)(b).

• Training. Regulation 24 requires relevant employees to be made aware of the law and regularly given training in how to recognise and deal with money laundering and terrorist financing. Training covers this document, the risk indicators in section 3, how to make an internal report, and the tipping-off offence. A written record of the training given is required by regulation 24 and is kept in the training log — training that cannot be evidenced counts for nothing. The Regulations say regularly without setting an interval; HMRC's guidance for supervised businesses expects training annually as a minimum, and more often for higher-risk businesses.
• Agents. Regulation 24 extends to agents used for the purposes of the business, not only employees.
• Screening. Regulation 21(1)(b) requires screening of relevant employees before appointment and during it. Regulation 21(2)(a) defines screening as an assessment of the individual's skills, knowledge and expertise to carry out their functions effectively, and of their conduct and integrity. A dated note of what was checked at hire answers only half of it: regulation 21(1)(b) requires screening both before the appointment is made and during the course of the appointment. For a business of this size that is met by revisiting each relevant employee at the annual review of this document — a short dated note that their conduct, integrity and competence for the role have been considered again — rather than by a separate screening exercise. What the business checks today, in its own words: References taken up before anyone starts.
• Who counts as a relevant employee — regulation 21(2)(b) — is anyone whose work is relevant to compliance, or otherwise capable of contributing to identifying or mitigating money laundering, terrorist financing or proliferation financing. In an accountancy practice that is the bookkeepers, the payroll staff and the people who take the onboarding call as much as the partners — and, because regulation 24 reaches agents as well as employees, the sub-contract bookkeeper brought in at year end.

Independent audit function. Regulation 21(1)(c) requires one where appropriate with regard to the size and nature of its business — to examine and evaluate the adequacy and effectiveness of these policies, make recommendations, and monitor compliance with them. With 4 people, a standing independent audit function is not proportionate for this business, and that judgement is recorded here rather than left as a silent omission — which is the difference between a proportionate decision and a gap. Instead, the officer responsible for compliance reviews these policies annually against what actually happened on files, and records the review.

3.109. Review of this document

Regulation 19(1)(b) requires these policies to be regularly reviewed and updated, and regulation 19(1)(c)(ii) requires a written record of any changes made as a result. The Regulations set no interval, but HMRC's guidance for supervised businesses states that your policies, controls and procedures should be reviewed at least annually, even if no changes seem necessary, with the review date recorded, and that they should be communicated to all staff and agents at least annually where there are no changes. This document is reviewed on that footing. A review is required, whenever it falls, on any of: a change to the Regulations; new HMRC guidance for the sector; a new service, delivery channel or technology; a change of nominated officer or compliance officer; or anything found on a file that these procedures did not catch.

The policies this document replaces were last reviewed on 11 June 2024, 28 months ago. That is more than twelve months ago, so a review is due now and is the first entry in the compliance calendar.

3.1110. Approval

Regulation 19(2)(b) requires approval by senior management. This document takes effect on the date below.

Record of communication — regulation 19(1)(c)(iii). Add a row for each person taken through this document.

Status of this document

This document was prepared by Deplexify from information supplied by the business named on it.

Nothing in it has been independently verified. It is not legal advice, and it is not an audit,

review or other assurance engagement.

It is a draft for the business to read, correct and adopt as its own. Regulation 19(2)(b) of the

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations

2017 requires the policies, controls and procedures to be approved by the business's senior

management — that approval is the business's act, and so is everything that follows from it.

The officer responsible for compliance under regulation 21(1)(a) and the nominated officer under

regulation 21(3) are the business's own people. Regulation 21(3) requires an individual in the

firm. Deplexify does not hold either role, does not make suspicious activity reports to the

National Crime Agency, and does not submit or sign anything to HMRC on the business's behalf.

Sources

Every requirement stated in this document comes from one of the following, read directly rather

than from a summary:

• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer)

Regulations 2017 (S.I. 2017/692) as amended, including by the Money Laundering and Terrorist

Financing (Amendment) Regulations 2026 (S.I. 2026/621), in force 30 June 2026 —

<https://www.legislation.gov.uk/uksi/2017/692>

• The Proceeds of Crime Act 2002, Part 7, including sections 335 and 336 (the notice and

moratorium periods) — <https://www.legislation.gov.uk/ukpga/2002/29>

• HMRC, Risk Assessment of Accountancy Service Providers (AMLG3700, HMRC internal manual

Anti-money laundering guidance for supervised businesses, manual updated 16 July 2026),

made available under regulations 17 and 47 —

<https://www.gov.uk/hmrc-internal-manuals/anti-money-laundering-guidance-for-supervised-businesses/amlg3700>

• Consultative Committee of Accountancy Bodies, *Anti-Money Laundering, Counter-Terrorist and

Counter-Proliferation Financing Guidance for the Accountancy Sector* (AMLGAS, July 2026;

based on the law and regulations as at 1 July 2026). Approved by HM Treasury — by its

own §1.3.1 the UK courts must take account of its contents when deciding whether a

business has contravened a relevant requirement under the 2017 Regulations or committed an

offence under sections 330 to 331 of the Proceeds of Crime Act 2002 — ccab.org.uk, and

linked from HMRC's Accountancy sector guidance for money laundering supervision page

• HMRC, *Check if you need to register for money laundering supervision if you're an

accountancy service provider* (page updated 16 March 2023) — gov.uk

• HMRC, Fees you'll pay for money laundering supervision (page updated 22 December 2025) —

gov.uk

• HMRC, Check if you meet HMRC's conditions to register as a tax adviser (page updated

18 May 2026) — gov.uk. An adjacent regime, not a Money Laundering Regulations duty

• HM Treasury and Home Office, *National Risk Assessment of Money Laundering and Terrorist

Financing 2025* (17 July 2025) — gov.uk

4Compliance Calendar

Pendlebury Bookkeeping & Payroll Limited (trading as Pendlebury Books)

The dates that carry a deadline, and the events that force a review.

4.1Dated obligations

4.2The 21-day one, which has no fixed date

This is the deadline worth understanding before it arrives, because it does not appear on a calendar until it is already running.

Under regulation 57(2)(f), the information HMRC may specify on a registration application includes a risk assessment which satisfies the requirements in regulation 18, and under 57(2)(g), information as to how the business meets the Regulations. Under regulation 57(3), at any time after receiving an application and before determining it, HMRC may require the applicant to provide within 21 days beginning with the date on which the requirement is issued such further information as it reasonably considers necessary. Under regulation 59(1)(a), HMRC may refuse to register an applicant if any requirement imposed under regulation 57 has not been complied with.

HMRC does not leave this to chance either. Its own registration guidance tells every applicant, under Before you apply, to complete an anti-money laundering, terrorist financing, and proliferation financing risk assessment and to put in place policies, controls and procedures to manage and mitigate the risks you have identified, and then says: “We may reject or refuse your application if you do not have these in place.” So both documents are expected of every applicant before the application goes in, and regulation 57(2)(f) is the power HMRC uses to ask to see one.

So the 21 days runs from the date HMRC issues the requirement, not from the date you applied — and it is a period in which to produce documents, not to write them. Having documents 01 and 02 already adopted is what turns that letter into an email with two attachments.

4.3Events that force a review, whenever they happen

• A new service line — taking on payroll, audit, customs work, or company formation and registered-office work. Regulation 19(4) requires the assessment to be revisited in preparation for the change, not after it. Each of those brings a different group of HMRC's thirty sector risk factors into play, and company formation or officer services bring a second registration with them.
• A new delivery channel or new technology — a new identity provider, a new portal, a new way of taking instructions.
• A change of nominated officer or compliance officer — and remember regulation 21(4): HMRC must be told within 14 days of the new appointment.
• A materially different client — the first trust, the first overseas client, the first client with layered ownership, the first umbrella company, the first client connected to a politically exposed person, or the first time the business starts holding client money.
• A change to the Regulations. The most recent was S.I. 2026/621, in force 30 June 2026, which among other things replaced the euro sums in regulation 27 with sterling — the occasional transaction threshold in regulation 27(2) is now £12,000 — and substituted an entry in Schedule 1, the list of professional bodies that decides who HMRC supervises.
• New guidance for this sector — which regulation 18(2)(a) requires the assessment to take into account. For accountancy that means two documents, not one: HMRC's risk assessment of accountancy service providers (AMLG3700, updated 16 July 2026), and the CCAB Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector (July 2026), which HM Treasury has approved and which the courts must take account of.
• Anything a file threw up that these procedures did not catch. That is the most valuable trigger on this list and the one least often used.

4.4Standing housekeeping

• Record every identity check at the time it is done. Reconstructing it later is not the same thing and does not satisfy regulation 40(2)(a).
• Keep records five years from the end of the relationship or the completion of the transaction; not more than ten for transaction records; then delete personal data (regulation 40(3)–(5)).
• Log every person taken through the policies and when — regulation 19(1)(c)(iii).
• Notify HMRC of material changes to your registration information within 30 days (regulation 57(4)).
• Tell HMRC within 30 days when a new beneficial owner, officer or manager joins, and pay the approval fee — they cannot act in the role until you have. Within 14 days instead if they are the nominated officer or compliance officer (regulation 21(4)). Same 30 days for a new branch (regulation 57(4)), and for a conviction for a relevant offence (regulation 26(10)).
• Give every new customer the regulation 41(6) data protection statement before the relationship starts — easiest carried in your terms of business so it cannot be missed.
• For a company, LLP, trust or overseas-entity customer, collect or inspect the beneficial ownership register before the relationship starts and again as part of ongoing monitoring, and report any material discrepancy as soon as possible (regulation 30A).
• Before taking work from, or sending work to, another firm, check it is anti-money laundering supervised for the activity it carries out — and do not enter the relationship if it is not, or if its register entry does not reflect all the relevant activity it does.
• Where work comes through an introducer, record who is treated as the customer for that engagement, and why, before the engagement is completed.
• Where an engagement has to begin before verification is finished, record the extension, its reason and its end date at the time. Extensions are specific, well-defined and time-limited, and there are no general extensions for a class of client.
• Where the business holds client money, check every payment out against the account the money came in from, and establish the reason for any overpayment before refunding it.

Status of this document

This document was prepared by Deplexify from information supplied by the business named on it.

Nothing in it has been independently verified. It is not legal advice, and it is not an audit,

review or other assurance engagement.

It is a draft for the business to read, correct and adopt as its own. Regulation 19(2)(b) of the

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations

2017 requires the policies, controls and procedures to be approved by the business's senior

management — that approval is the business's act, and so is everything that follows from it.

The officer responsible for compliance under regulation 21(1)(a) and the nominated officer under

regulation 21(3) are the business's own people. Regulation 21(3) requires an individual in the

firm. Deplexify does not hold either role, does not make suspicious activity reports to the

National Crime Agency, and does not submit or sign anything to HMRC on the business's behalf.

Sources

Every requirement stated in this document comes from one of the following, read directly rather

than from a summary:

• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer)

Regulations 2017 (S.I. 2017/692) as amended, including by the Money Laundering and Terrorist

Financing (Amendment) Regulations 2026 (S.I. 2026/621), in force 30 June 2026 —

<https://www.legislation.gov.uk/uksi/2017/692>

• The Proceeds of Crime Act 2002, Part 7, including sections 335 and 336 (the notice and

moratorium periods) — <https://www.legislation.gov.uk/ukpga/2002/29>

• HMRC, Risk Assessment of Accountancy Service Providers (AMLG3700, HMRC internal manual

Anti-money laundering guidance for supervised businesses, manual updated 16 July 2026),

made available under regulations 17 and 47 —

<https://www.gov.uk/hmrc-internal-manuals/anti-money-laundering-guidance-for-supervised-businesses/amlg3700>

• Consultative Committee of Accountancy Bodies, *Anti-Money Laundering, Counter-Terrorist and

Counter-Proliferation Financing Guidance for the Accountancy Sector* (AMLGAS, July 2026;

based on the law and regulations as at 1 July 2026). Approved by HM Treasury — by its

own §1.3.1 the UK courts must take account of its contents when deciding whether a

business has contravened a relevant requirement under the 2017 Regulations or committed an

offence under sections 330 to 331 of the Proceeds of Crime Act 2002 — ccab.org.uk, and

linked from HMRC's Accountancy sector guidance for money laundering supervision page

• HMRC, *Check if you need to register for money laundering supervision if you're an

accountancy service provider* (page updated 16 March 2023) — gov.uk

• HMRC, Fees you'll pay for money laundering supervision (page updated 22 December 2025) —

gov.uk

• HMRC, Check if you meet HMRC's conditions to register as a tax adviser (page updated

18 May 2026) — gov.uk. An adjacent regime, not a Money Laundering Regulations duty

• HM Treasury and Home Office, *National Risk Assessment of Money Laundering and Terrorist

Financing 2025* (17 July 2025) — gov.uk