A conveyancing solicitor receives a client deposit from a bank account held by a third party. The payment is not automatically proof of money laundering, but it is a clear point at which the firm must pause, understand the relationship between the parties, verify the source and decide whether the matter can proceed. Anti money laundering controls provide the documented, risk-based process for making that decision, escalating concerns and demonstrating why the firm acted as it did. The UK government describes the Money Laundering Regulations as a vital part of the country's anti-money laundering and counter-terrorist-financing regime, with regulated firms expected to identify, assess and manage relevant risks (UK government guidance on risk assessments).
For a finance director, solicitor, insurer or business owner, the practical question is rarely whether a policy exists. It is whether the policy changes behaviour, produces reliable evidence and stands up when a supervisor, investigator, insurer, court or counterparty asks what happened. The sections below translate the regulatory duty into an operating framework for smaller and mid-market firms.
Table of Contents
- What Anti Money Laundering Controls Actually Mean in the UK
- The UK Regulatory Architecture Behind the Controls
- Core Control Types Every Regulated Firm Needs
- Designing and Implementing a Risk-Based Control Framework
- Testing, Monitoring and Independent Audit of Controls
- Where AML Controls Commonly Fail in Smaller Firms
- Practical Checklist for SMEs and Mid-Market Firms
- Common Reader Questions and Next Steps
What Anti Money Laundering Controls Actually Mean in the UK
Anti money laundering controls are not a single customer checklist. They are a connected system of risk assessment, customer due diligence, enhanced review, monitoring, escalation, reporting, training and record keeping. The system must be proportionate to the firm's business model and must change when the firm's clients, services, jurisdictions or delivery channels change.
The immediate purpose is practical:
- Prevent misuse: stop the firm, its accounts, services or professional standing being used to move or conceal criminal property.
- Detect concern: identify activity that warrants internal escalation and, where appropriate, a Suspicious Activity Report to the National Crime Agency.
- Demonstrate control: retain a defensible record showing what was checked, who made the decision and why the response was proportionate.
A firm-wide risk assessment sits at the centre. It should explain exposure arising from customers, beneficial ownership, geography, products and services, transactions and methods of delivery. Customer due diligence then applies that assessment to a particular relationship. Ongoing monitoring tests whether the original understanding remains credible.
AML controls are not every financial crime control
The anti money laundering framework overlaps with sanctions compliance, fraud prevention, bribery and corruption controls, tax-risk procedures and general financial governance. It doesn't replace them. A sanctions screening process may identify a designated person, while an AML review may identify unexplained wealth, a concealed beneficial owner or an implausible payment route. Fraud controls may focus on deception and loss, whereas AML controls focus on criminal property and the risk that a firm facilitates its movement or use.
That distinction matters because a firm can have a strong fraud policy and still have weak AML controls. A commercial onboarding process can establish whether a client appears creditworthy, but it won't necessarily establish who ultimately owns a company or why a third party is funding a transaction.
Practical rule: A policy is only useful if a member of staff can apply it to an unfamiliar fact pattern and produce a record that another person can follow.
The control system therefore sits on top of ordinary commercial practice. It should inform acceptance, pricing, matter management and payment decisions without turning every unusual transaction into an allegation. Good design creates clear triggers, sensible escalation routes and a documented basis for accepting residual risk.
The UK Regulatory Architecture Behind the Controls
The UK framework combines the Money Laundering Regulations with supervision by the FCA, HMRC, the Gambling Commission and professional body supervisors. The government plans to transfer AML supervision of legal, accountancy and trust or company service providers to the FCA. In its 22 September 2026 update on supervisory reform, the FCA said firms should continue their existing AML processes and deal with their current supervisor. The planned transition depends on legislation; the FCA does not expect to begin taking on these firms until autumn 2028.
The division is operationally important. A solicitor may deal primarily with the Solicitors Regulation Authority, an accountant with a professional body, an estate agency with HMRC and a financial services business with the FCA. The underlying principles are similar, but the supervisor's registration requirements, inspection style, thematic priorities and evidence expectations can differ.
UK AML supervisors and the firms they oversee
| Supervisor | Firms regulated | Key register or body |
|---|---|---|
| Financial Conduct Authority | Relevant financial services businesses | FCA supervision and firm permissions |
| HM Revenue and Customs | Estate agencies, certain accountancy and trust or company service providers, high value dealers and certain art market participants | HMRC AML supervision |
| Gambling Commission | Relevant gambling businesses | Gambling Commission oversight |
| Professional body supervisors | Regulated legal, accountancy and related professional practices | The relevant professional body and its AML supervision |
The National Crime Agency receives Suspicious Activity Reports and performs the UK Financial Intelligence Unit function. The Office of Financial Sanctions Implementation deals with financial sanctions. Those functions should be connected in a firm's escalation map, but they aren't interchangeable. A suspicious activity concern and a sanctions hit can require different analysis, restrictions and reporting decisions.
The Proceeds of Crime Act 2002 provides the criminal backstop. It is the reason an MLRO and senior managers must treat escalation, reporting and confidentiality as personal governance issues rather than administrative tasks. A firm that cannot explain why a suspicion was escalated, reported or closed may struggle to defend the decision later.
Data governance is part of that evidence chain. Firms handling ownership records, identity evidence, payment information and investigation notes may find a practical overview of digna's finance data governance framework useful when designing ownership, access and retention controls. The Economic Crime and Corporate Transparency Act also forms part of the wider transparency context, as outlined in this UK economic crime legislation briefing.
Core Control Types Every Regulated Firm Needs
A reliable framework links each control to the next. The firm-wide risk assessment determines the level of due diligence. Due diligence informs monitoring. Monitoring produces escalation decisions. The MLRO uses those decisions to determine whether a SAR is required, while records preserve the reasoning.
The firm-wide risk assessment
Under regulation 18 of the Money Laundering Regulations 2017, a regulated firm needs a written assessment of the risks relevant to its business. A small accountancy practice serving sole traders, property investors and companies might identify higher exposure in complex ownership, cash-intensive businesses, overseas payments and clients introduced through intermediaries. That assessment should then drive onboarding questions, approval levels, training and review frequency.
A generic template copied from another firm won't explain the practice's actual exposure. A useful assessment records the risk, the evidence supporting the rating, the existing control and the residual risk after that control operates.
Due diligence and beneficial ownership
Customer due diligence normally requires identification and verification of the customer, understanding the purpose and intended nature of the relationship, and identifying relevant beneficial owners. Evidence should be current, internally consistent and sufficient to explain the ownership and control structure. A search result without a reasoned review is not the same as a completed ownership assessment.
For UK identity checks, use the standards and guidance relevant to the firm's own sector. HMRC's customer due diligence guidance explains identification, beneficial ownership, the purpose of a relationship and ongoing monitoring. Our customer due diligence resource provides further practical context.
Enhanced due diligence and monitoring
Enhanced due diligence should be triggered by documented risk factors, such as a politically exposed person, a complex or opaque ownership structure, a high-risk jurisdiction, unusual third-party funding or an unexplained change in transaction behaviour. The trigger should lead to specific actions, not merely a higher-risk label. Those actions can include source-of-wealth evidence, source-of-funds corroboration, senior approval and more frequent review.
Ongoing monitoring tests whether activity remains consistent with the firm's understanding. It can include reviewing payments, changes in ownership, new instructions and unusual transaction patterns. Monitoring that generates alerts without clear disposition standards effectively transfers the problem to the MLRO.
SARs and records
Staff should know when a concern must be escalated internally, how the MLRO is contacted and what information the escalation must contain. The firm must protect against tipping off, so staff shouldn't tell a customer that a SAR has been made or disclose information that could prejudice an investigation.
Records should preserve the evidence and reasoning behind due diligence, risk decisions, monitoring and reporting. Regulation 40 generally requires relevant CDD records, including enhanced due diligence, and transaction evidence to be kept for five years after the business relationship ends or an occasional transaction completes. It does not create a separate six-year EDD rule. The regulation contains qualifications, including a ten-year limit for certain transaction records. At the end of the applicable period, personal data must be deleted unless a specified exception permits retention. Document the applicable basis and any legal hold. An anti-money laundering audit can test whether records are retrievable and coherent.
Designing and Implementing a Risk-Based Control Framework
Risk-based design begins with the business, not the policy manual. A firm should identify what it does, who it serves, where clients and funds originate, which services create leverage and how instructions are delivered. That scoping exercise prevents a common failure, where a polished document describes risks the firm doesn't face while ignoring the risks it does.
Four building blocks make the framework workable:
- Business model scoping: document clients, services, jurisdictions, transaction types, introducers and delivery channels.
- Inherent risk mapping: assess exposure before controls are applied, using evidence rather than instinct.
- Control mapping: connect each material risk to an owner, procedure, approval point and evidence requirement.
- Residual risk acceptance: record what remains after controls operate, who accepts it and when the decision will be revisited.
Residual risk is often the point of greatest scrutiny. A risk rating of “medium” says little unless the file shows why the rating was selected, what controls reduce the exposure and why the remaining risk is acceptable.
Risk-Based Control Design From Inherent Risk to Residual Risk
| Risk Stage | What Is Recorded | Worked Example, Overseas Developer |
|---|---|---|
| Business scope | Services, client type, jurisdictions and payment routes | Conveyancing work for a developer with overseas ownership and funding |
| Inherent risk | Factors present before additional safeguards | Complex ownership, overseas funding and third-party payment risk |
| Control response | Checks, approvals and monitoring requirements | Source of wealth verification, payment-trace rules and matter-level EDD sign-off |
| Residual risk | Remaining exposure, decision-maker and review date | Proceeding only with senior approval, documented limitations and a defined review point |
The MLRO and escalation route
The MLRO should have sufficient authority, access to information and time to make reporting decisions. Delegation can support day-to-day triage, but it shouldn't remove the MLRO's accountability for the reporting framework or allow fee pressure to determine an escalation outcome.
A practical route usually runs from fee earner or first-line staff, to the matter or client supervisor, to the MLRO, with material themes reported to the board or partners. The route should specify what happens when a concern is unresolved, when a transaction must pause and how legal, confidentiality and tipping-off issues are handled.
Hypothetical worked example: A 40-person conveyancing firm accepts a high-risk overseas developer client. The initial risk assessment is re-rated because ownership is layered, funding comes from several sources and a third party proposes to make a payment. The firm introduces source-of-wealth verification, payment-trace rules and matter-level EDD sign-off. The residual risk is recorded with a senior decision, restrictions on payment acceptance and a review trigger linked to any ownership or funding change.
Proportionality doesn't mean informal controls. A smaller practice may use fewer systems, but it still needs a written risk assessment, clear ownership, adequate training and evidence that controls operate. The SRA's expectations for smaller practices illustrate the point. Limited headcount changes the method, not the need for a defensible framework.
Testing, Monitoring and Independent Audit of Controls
A control that hasn't been tested is an assumption. First-line staff operate customer checks, review transactions and record alerts. Second-line oversight examines whether those activities follow the firm's risk appetite. Independent audit then assesses the framework without relying solely on the people who designed or operated it.
Good testing evidence is specific. It identifies the sample, selection method, testing date, documents reviewed, exception, conclusion, responsible owner and closure date. A report that repeats the policy wording but doesn't name the failed control gives management little basis for action and gives a regulator little evidence of oversight.
Monitoring that leads to decisions
Smaller firms don't need an elaborate dashboard to obtain useful management information. They do need indicators with owners and action thresholds, such as:
- Alert activity: unusual changes in volume, concentration or unresolved reviews.
- CDD ageing: files awaiting refresh or missing current ownership evidence.
- SAR outcomes: internal escalations, reports made, rejected concerns and reasons.
- Training coverage: role-specific completion and overdue learning.
A static dashboard fails when nobody knows what happens after an indicator changes. A useful report shows the threshold, the action, the owner and the date for follow-up.
Sample testing and independent review
Testing should be risk-led rather than conveniently random. A firm might select files across risk grades, review higher-risk matters separately, examine transaction-monitoring dispositions and assess whether SAR narratives contain the facts the MLRO relied upon. Samples should also include closed or declined relationships, because an acceptance-only review can miss weaknesses in exit decisions.
Independent review is proportionate where the firm lacks internal challenge, where the MLRO has operational conflicts or where previous findings remain open. The reviewer should receive the firm-wide risk assessment, policies, training records, sample files, escalation logs, SAR governance records and prior action plans. The output should distinguish design gaps from operating failures.
Where AML Controls Commonly Fail in Smaller Firms
A compliant manual doesn't establish a controlled firm. Among the firms it reviewed, the SRA's 2024–25 AML annual report found that firm-wide risk assessment compliance fell from 60% to 47%, while AML policy compliance fell from 51% to 37%. It also reported that 10 firms had no policies and procedures in place at all (SRA AML annual report 2024–25).
Those findings point to an operational problem rather than a drafting problem. The recurring failures are usually visible in files, emails and approval records.
Four recurring failure themes
Static risk assessments describe an idealised business and remain unchanged after the firm adds new services, clients or jurisdictions. Under review, the document cannot explain why a particular client was rated as it was.
Weak EDD triggers treat complexity as a matter of judgement without defining when additional evidence becomes mandatory. Third-party payments, opaque ownership and high-risk corridors then appear as isolated anomalies rather than connected indicators.
Poor SAR quality arises when the MLRO lacks time, authority or access to the underlying file. A report may be filed, but the narrative doesn't clearly explain the suspicion, relevant transactions, parties, chronology or supporting evidence.
Role-blind training gives every employee the same annual presentation. A fee earner, cashier, accounts clerk and partner encounter different risks, so generic training can leave the most exposed decisions unsupported.
To turn a finding into an operational improvement, record the failed control, its owner, the evidence needed to close the gap and a review date. Test a later sample to check whether the change works in practice. Use the requirements of the firm's UK supervisor when setting the acceptance criteria.
These weaknesses surface under investigation because investigators reconstruct decisions from contemporaneous records. They surface in litigation because a policy may be disclosed alongside the file and tested against what staff did. They surface during a supervisory visit when the risk assessment, CDD file and monitoring record tell different stories.
Practical Checklist for SMEs and Mid-Market Firms
A smaller firm can improve control quality without buying a major system. The immediate requirement is disciplined ownership, sensible prioritisation and evidence that actions were completed.
| Priority action | Owner | Evidence to retain |
|---|---|---|
| Confirm the correct supervisor and registration position | MLRO or compliance lead | Registration record, supervisor correspondence and scope assessment |
| Refresh the firm-wide risk assessment | MLRO with board or partner approval | Dated assessment, source evidence, risk appetite and approval minutes |
| Review CDD and EDD triggers | Operations and matter owners | Updated procedure, trigger matrix and sample file results |
| Formalise SAR escalation | MLRO and senior management | Escalation flow, decision log and confidentiality guidance |
| Establish a simple KRI dashboard | Compliance or finance operations | Monthly report, thresholds, actions and closure evidence |
| Schedule independent testing | Board, partners or audit committee | Scope, sample plan, report and tracked remediation |
The firm should also check whether its sector requires registration with HMRC or another supervisor. HMRC identifies estate agencies, certain accountancy service providers, trust or company service providers, high value dealers and certain art market participants among the businesses it supervises (GOV.UK guidance on who must register). For example, the high-value-dealer registration threshold concerns cash payments for goods totalling 10,000 euros or more, including linked transactions. Other sectors and CDD triggers have different rules. Do not treat a monetary threshold as permission to ignore suspicious activity.
Governance actions that make the checklist stick
The MLRO's terms of reference should define authority, access to records, escalation rights, reporting to senior management and arrangements for absence. A training matrix should map roles to risks, with targeted learning for those who onboard customers, handle payments, supervise matters or make acceptance decisions.
A quarterly cycle can include one risk assessment review, one focused file sample, one management information report and one tracked action log. The objective isn't to create paperwork for its own sake. It is to ensure that the person accountable for AML controls can show what changed, what remains open and why the firm considers its response proportionate.
Separate POCA thresholds also need careful treatment. The Proceeds of Crime (Money Laundering) (Threshold Amount) (Amendment) Order 2025 increased the section 339A(2) and (6A) amounts from £1,000 to £3,000 from 31 July 2025. These provisions concern specified account-operation and relationship-termination exemptions from the principal money-laundering offences. They are not a general cash limit or an exemption from all reporting duties. Check the statutory conditions before relying on them.
Common Reader Questions and Next Steps
How can a small firm keep the MLRO independent?
The MLRO doesn't need to be outside the firm, but the role needs authority to challenge fee earners, pause activity and escalate concerns without commercial interference. Where the MLRO also manages matters or client relationships, the firm should document conflict arrangements and provide access to an independent senior decision-maker.
Which records matter most during a review?
The critical record is the chain of reasoning. It includes the risk assessment, CDD and beneficial ownership evidence, EDD decisions, monitoring results, internal escalations, SAR decisions, training completion, testing workpapers and remediation evidence. Records should be dated, attributable and retrievable, with access restricted to those who need it.
What drives the cost of remediation?
Cost usually depends on the quality of the existing records, the number and complexity of relationships, the maturity of monitoring, the availability of internal staff and whether independent testing is required. A focused review of risk assessment, onboarding and escalation may be more proportionate than a wholesale replacement of every procedure.
What should be prepared before external support is instructed?
The firm should assemble its current risk assessment, policies, organisation chart, MLRO terms, recent training records, sample CDD files, monitoring reports, SAR governance records and open audit actions. A short scoping discussion can then focus on actual gaps rather than begin with a generic template.
Lighthouse Consultants can assess AML risk assessments, onboarding, escalation, transaction review, record keeping and governance, with forensic analysis where source-of-funds evidence or financial tracing needs independent examination. Firms can discuss their current risk assessment, SAR themes and testing findings through Lighthouse Consultants before deciding whether a targeted review or broader engagement is proportionate.
For a free consultation about anti money laundering controls, call +44 20 7871 0485 or email info@lighthc.london. The discussion can identify the highest-risk control gap, the records available and the evidence needed for a focused review.
