On 13 February 2026 the Hong Kong Companies Registry publicly reprimanded Guoke (Hong Kong) Accounting Services Limited (TC006180), a licensed TCSP. It also fined the firm HK$30,000. One of the four breaches was a failure to take measures "to identify and verify the identities of the beneficial owner of its customer" (the Registry's disciplinary actions). That check matters at a TCSP because TCSPs set up and administer many of the structures that hide ownership.
What is the legal definition of a TCSP, and what is it not?
The FATF Glossary defines trust and company service providers as persons or businesses "not covered elsewhere under these Recommendations" that, "as a business", provide any of five services to third parties (FATF Recommendations, Glossary, updated June 2026). So a bank already under the financial institution rules is not a TCSP, while a formation agent registering companies for clients is. TCSPs are among the six DNFBP groups.
EU and UK law say "trust or company service provider" (Directive (EU) 2015/849, Article 3(7)). The Isle of Man licenses trust and corporate service providers, and Singapore's law says corporate service provider. A TCSP is also not a trust service provider in the EU's eIDAS sense: that term covers electronic services such as signatures, seals, time stamps and website certificates (Regulation (EU) No 910/2014, Article 3(16) and (19)).
Which services offered by TCSPs bring them under AML rules?
Recommendation 22(e) names five trust and company services, and any one of them is enough:
- Formation agent. Forms companies, so it meets the owner first.
- Director, secretary or partner. Takes the role or supplies someone, so the registered name may not be the one who decides.
- Registered office or address. Gives a company its registered, business or mailing address.
- Trustee. Acts as trustee of an express trust, or arranges one.
- Nominee shareholder. Holds shares for a person who stays off the register.
The UK added a sixth in 2026, selling a ready made firm (regulation 12 of the Money Laundering Regulations 2017). HMRC's TCSP guidance says these services "can be provided by anyone" and names formation agents, professional trustees, mail forwarding operations, accountants and solicitors.
Why are TCSPs high risk for money laundering?
Each service can put a name between a company and its owner. A shell with no trade adds a layer, and a trust splits legal title from the benefit. HMRC says "Nominee services are used to keep the true ownership or control of a company confidential". The FATF Glossary says "A Nominee Director is never the beneficial owner of a legal person", and the same goes for a nominee shareholder.
So when a company's director, shareholder and registered office all come from one TCSP, the register shows who serves the company, and the owner may appear nowhere on it. Ask the TCSP for the person it acts for. Interpretive Note 24 lets countries make nominees disclose their nominator, license nominees or ban them, alone or in combination.
What are the AML compliance requirements for TCSPs?
Table 1. The FATF Recommendations that set a TCSP's AML duties (June 2026).
| Recommendation | What it asks | Trigger | Note |
|---|---|---|---|
| R.22(e) | Customer due diligence (CDD) and record keeping, as in R.10, 11, 12, 15 and 17 | Preparing for or carrying out a transaction for a client in one of the five services | Triggered by the service, whatever the firm calls itself |
| R.23(c) | Suspicious transaction reporting, internal controls, higher risk countries, no tipping off (R.18 to 21) | A transaction for a client in those services | R.21 is tipping off and confidentiality |
| R.24 | Countries keep company ownership data accurate and stop nominee misuse | Nominee director and shareholder services | A country duty, revised March 2022 |
| R.25 | Countries keep settlor, trustee and beneficiary data on express trusts | Trustee services | A country duty, revised February 2023 |
| R.28(b) | Monitoring by a supervisor or self regulatory body, risk sensitive | Every TCSP | Criminals kept out of ownership and management |
Within CDD, enhanced due diligence applies where risk is higher. From 10 July 2027 the EU adds measures when a higher risk relationship handles EUR 5,000,000 or more through personalized services for a client whose total assets reach EUR 50,000,000 (Regulation (EU) 2024/1624, Article 34(5)).
A TCSP that suspects criminal proceeds files a suspicious transaction report (STR), the FATF name for a suspicious activity report, and keeps each client under ongoing monitoring.
For a TCSP and its bank alike, CDD includes finding out who owns the client. complead, formerly Sanction Scanner, does that step with KYB and UBO verification: owners are followed up the chain until natural persons are reached, and directorships and nominee patterns show beside the percentages.
Who licenses TCSPs under the global regulatory framework?
Table 2. TCSP licensing and registration by jurisdiction, as of October 2026.
| Jurisdiction | Law | What a TCSP needs | Supervisor | Key date |
|---|---|---|---|---|
| EU | Directive (EU) 2015/849, then Directive (EU) 2024/1640 | A license or registration, as each member state sets | National supervisors | New rules from 10 July 2027 |
| UK | Money Laundering Regulations 2017, regulations 54 to 58 | HMRC registration unless a professional body supervises; a fit and proper test that covers owners | HMRC or a professional body; the FCA later | Ready made firm sales covered from 30 June 2026 |
| Hong Kong | Cap. 615, Part 5A (licensing guideline, May 2025) | A license from the Registrar of Companies; trading without one carries HK$100,000 and 6 months | Companies Registry | 1 March 2018 |
| Singapore | Corporate Service Providers Act 2024 | Registration with ACRA, renewed every two years; fines up to S$100,000 for skipped CDD or nominee director checks | ACRA | 9 June 2025 |
| Isle of Man | Financial Services Act 2008 | A Class 4 (corporate) or Class 5 (trust) license | Isle of Man FSA | No start date on the FSA page |
| Australia | AML/CTF Act 2006, section 6, table 6 | AML/CTF program, CDD, reporting and record keeping for the company and trust services listed | AUSTRAC | 1 July 2026 (amending Act of 2024, Schedule 3, item 11) |
| US | Corporate Transparency Act (FinCEN BOI rule) | BOI reports come only from certain foreign companies registered to do business in the US | FinCEN | Rule effective 14 August 2026 |
Hong Kong and the Isle of Man license, Singapore and the UK register, each EU member state chooses, and the US BOI rule applies to the companies themselves. In the UK and Hong Kong, trading before approval is itself a breach.
What changed for TCSPs in 2025 and 2026?
- 9 June 2025, Singapore. Singapore's Corporate Service Providers Act 2024 took effect, with ACRA as registrar.
- 21 October 2025, UK. HM Treasury decided that the FCA will supervise TCSPs, lawyers and accountants; its 18 June 2026 response lists legislative changes among the next steps.
- 18 November 2025, UK. Identity verification became a legal requirement for directors and people with significant control, and Authorised Corporate Service Providers may verify them.
- 30 June 2026, UK. Selling a ready made firm became a TCSP service.
- 1 July 2026, Australia. Australia's second tranche of AML/CTF reforms began to apply to TCSP services.
- 14 August 2026, US. FinCEN's rule making the BOI exemption for US companies permanent took effect.
What does a bank check when a TCSP stands between it and the owner?
When a TCSP formed a corporate client or still runs it, the bank's KYC file on that client needs four things:
- Nominees and their nominator. Which director or shareholder acts for someone else, and for whom.
- The TCSP's own license. Its entry with its supervisor, such as the Companies Registry, HMRC or ACRA.
- Owner data and evidence. The beneficial owner's identity and documents, or the record to keep when the beneficial owner cannot be identified.
- The written decision. Whether the bank relies on the TCSP's checks or collects the owner data itself, and why.
Can a bank rely on a TCSP's customer due diligence?
Yes, where national law allows it, under FATF Recommendation 17. The bank must "immediately obtain the necessary information" on the customer, the beneficial owner and the purpose and nature of the relationship, be satisfied that copies will come "upon request without delay", and confirm the TCSP is "regulated, supervised or monitored" for CDD. The "ultimate responsibility" stays with the bank.
One decision is left for the onboarding team: rely on the TCSP under Recommendation 17 or collect the owner data directly, and record why. Guoke was reprimanded for missing that very owner check, so read the TCSP's own file before relying on it.
Related terms
- DNFBP. Businesses outside finance under FATF's AML rules, TCSPs included.
- Enhanced due diligence. Extra checks when a client's risk is higher than standard.
- Suspicious activity report. A report of suspected crime to the financial intelligence unit.
- Ultimate beneficial owner. The individual at the top of an ownership chain who owns or controls the customer.
- Customer due diligence. Who a customer is, who owns it and why.
- Front company. A real, trading business used to mix criminal money with its own revenue.
How this entry was checked
This entry is by Sinan Tekin, Regional Sales Manager, with review by Ufuk Gürdaş, Compliance Specialist. Last reviewed: 28 October 2026. On 28 October 2026 each legal point was reopened in its primary source: the FATF Recommendations of June 2026 (the Glossary and Recommendations 17 and 22 to 28), the EU's 2015 directive, its 2024 regulation and directive and the eIDAS Regulation, the UK Money Laundering Regulations 2017 as amended on 30 June 2026, HMRC's TCSP guidance, HM Treasury and Companies House, FinCEN's beneficial ownership rule of August 2026, ACRA on Singapore's Corporate Service Providers Act 2024, the Companies Registry on Hong Kong's Cap. 615, the Isle of Man FSA, and Australia's AML/CTF Act 2006 with its 2024 amending Act. The definition follows the FATF Glossary.
