What is the United Kingdom's approach to AML, and what are the main and most recent AML laws?
Part 7 of the Proceeds of Crime Act 2002 made dealing in criminal property a crime for anyone. On 26 June 2017 the Money Laundering Regulations 2017 took over from the 2007 Regulations and set the preventive duties. On 30 June 2026 most of S.I. 2026/621 took effect and put the Regulations' thresholds in sterling.
The UK approach to anti money laundering (AML) splits the work in two. POCA, with the Terrorism Act 2000 for terrorist property, sets the offences and the duty to report suspicion. The Money Laundering Regulations 2017 (S.I. 2017/692) tell a regulated firm what to do before and during a relationship: assess risk, check customers, monitor, keep records and train staff.
In UK law, money laundering means concealing, disguising, converting, transferring, removing, arranging, acquiring, using or possessing criminal property (POCA ss. 327 to 329). Picture an illustrative Birmingham jeweller paid £14,000 in cash for a watch. The Regulations require due diligence on cash of £10,000 or more, and if the jeweller suspects the cash is criminal property, POCA requires a report to the NCA.
The primary acts that deal with money laundering are POCA 2002, the Terrorism Act 2000 and the Sanctions and Anti-Money Laundering Act 2018. The most recent AML legislation is S.I. 2026/621, the Money Laundering and Terrorist Financing (Amendment) Regulations 2026, made on 9 June 2026.
Which authorities regulate AML in the UK?
HM Treasury sets AML policy and writes the Regulations. Three statutory supervisors check compliance: the Financial Conduct Authority (FCA) for banks, building societies, investment, payment and electronic money firms and cryptoasset businesses; HMRC for money service businesses, estate and letting agents, high value dealers, art market participants and some accountants and trust or company service providers (TCSPs); and the Gambling Commission for casinos. HM Treasury counted 22 professional body supervisors for the legal and accountancy sectors in 2023, and OPBAS, an office inside the FCA, oversees how they supervise.
FCA firms also follow the financial crime rules in SYSC 6.3 of the FCA Handbook. The National Crime Agency supervises nobody. Its UK Financial Intelligence Unit receives suspicious activity reports (SARs) and answers Defence Against Money Laundering (DAML) requests, and the NCA investigates money laundering as part of serious and organised crime. OFSI, part of HM Treasury, enforces financial sanctions, while the FCDO publishes designations on the UK Sanctions List.
An illustrative London electronic money institution answers to the FCA for its controls, while its nominated officer sends SARs to the NCA.
HM Treasury has also decided to move the AML supervision of legal, accountancy and TCSP firms to the FCA, and its June 2026 consultation response sets out the final policy for the move.
Who must comply, and how do AML obligations differ by sector?
Regulation 8 of the MLRs names the relevant persons. What sets each sector apart:
- Credit and financial institutions. Banks, building societies, lenders, payment and electronic money institutions, investment firms and long term insurers. Money service businesses outside FCA supervision register with HMRC before trading.
- Cryptoasset exchange and custodian wallet providers. FCA registration now; full FCA authorisation from 25 October 2027.
- Auditors, insolvency practitioners, external accountants and tax advisers. Professional body or HMRC supervision.
- Independent legal professionals. Only for property or business sales, client assets or accounts, and company or trust work (reg 12).
- Trust or company service providers. Since 30 June 2026 "selling an off-the-shelf firm" counts as this activity.
- Estate and letting agents. Letting agents only at a monthly rent of £10,000 or more.
- High value dealers. Only when making or receiving £10,000 or more in cash (reg 14).
- Casinos. Gambling Commission supervision; due diligence from £2,000.
- Art market participants. Art sales or storage worth £10,000 or more.
A UK branch or subsidiary of a foreign group is a relevant person for its UK business, with its own nominated officer. Since 1 September 2025 large organisations have also faced a fraud offence that is not an AML duty: failure to prevent fraud, created by section 199 of the Economic Crime and Corporate Transparency Act 2023.
What are the AML requirements for businesses in the UK?
The table sets out twelve duties with their legal basis as amended to 30 June 2026. The fourth column says how complead, formerly Sanction Scanner, keeps the record a supervisor will ask to see.
| Obligation | Legal basis | What a programme must do | How complead does it |
|---|---|---|---|
| Risk assessment, policies and controls | MLRs regs 18 to 21 | A written firm wide risk assessment of customers, countries, products, transactions and delivery channels, kept as "an up-to-date record"; policies and controls the firm must "regularly review and update"; a compliance officer from the board or senior management, employee screening and an independent audit where size and nature call for it. | Each rule in the rules engine is versioned, and every change keeps the name of the person who made it, the time and the reason. |
| Customer due diligence | MLRs regs 27 and 28 | Identify and verify the customer and understand the purpose and intended nature of the relationship, on every business relationship, on occasional transactions of £12,000 or more, on transfers of funds above £800, on suspicion and on doubts about identity data obtained earlier. | Onboarding, screening and monitoring share one engine, which gives each customer a single risk score. |
| Beneficial owners | MLRs regs 5, 28 and 30A | Identify individuals owning or controlling more than 25 percent, or controlling by other means; before a relationship with a UK company, check the register of people with significant control and report discrepancies. | KYB and UBO verification traces owners and parents upward to natural persons and marks any layer it cannot resolve as unresolved. |
| Politically exposed persons | MLRs reg 35; FCA guidance FG17/6 | Systems to find PEPs, their family members and known close associates; for those relationships, senior management approval, the source of funds and of wealth, and closer ongoing monitoring, in proportion to risk. | PEP lists are part of the screening coverage, and the PEP list type carries its own fuzzy matching threshold. |
| Enhanced due diligence | MLRs reg 33, as amended 30 June 2026 | EDD on high risk, on business with a FATF call for action country and on transactions that are unusually complex or unusually large given the nature of the transaction, follow an unusual pattern or have no apparent economic or legal purpose. | Jurisdiction scoped rules lift the score of a customer tied to a listed country, and the analyst chooses the EDD measure. |
| Ongoing monitoring | MLRs reg 28(11) | Scrutinise transactions against what the firm knows of the customer and keep documents and information up to date. | Names stay under ongoing monitoring until an API trigger stops it, so a closed customer drops out of rescreening. |
| Suspicious activity reports | POCA ss. 330 to 332, 335 and 336A; Terrorism Act 2000 s. 21A | Staff report to the nominated officer, who reports knowledge or suspicion to the NCA as soon as practicable; a DAML before any prohibited act, which the NCA has 7 working days to refuse, a refusal starting a 31 day moratorium that courts can extend by up to 186 more days in total; no tipping off (s. 333A). | Agents assemble the case file (evidence, narrative, work log), case management carries the reporting support, and the nominated officer makes the call. |
| Sanctions screening | Sanctions and Anti-Money Laundering Act 2018 and its regulations | Screen customers and payments against the UK Sanctions List; freeze the assets of designated persons and report to OFSI. | The UK Sanctions List is screened with its own fuzzy threshold, and each search is logged, a search with no match included. |
| Transfers of funds and the crypto travel rule | Funds transfer regulation; MLRs Part 7A, regs 64C and 64G | Payments carry payer and payee information; cryptoasset transfers of £800 or more that involve a business outside the UK carry the full set, while inside the UK the payee's business may request it and gets it within three working days; gaps are treated as a risk signal. | While a payment is processed, the API screens both its sender and its receiver. |
| Pooled client accounts | MLRs reg 29(10) to (18), from 30 June 2026 | Understand the purpose and use of a new pooled account, assess its risk and consider controls; the customer gives the identity of those whose money it holds on request. | A rule scoped to the pooled account product flags activity for an analyst to review. |
| Record keeping | MLRs reg 40 | Keep CDD records and supporting transaction records for five years once the relationship has ended or the occasional transaction is complete; relationship transaction records for no more than ten years. | The search audit trail keeps each search: the user, the name searched, the time and the result, a nil result included. |
| Training | MLRs reg 24 | Make staff aware of the law, regularly train them to recognise and deal with suspicious activity, and keep a written record. | Training is the firm's own task; complead adds alerts that show their rule and the signals it matched. |
Rows two to five hold most AML checks a UK business runs: who the customer is, who owns it, whether it is a PEP, and whether the risk calls for enhanced due diligence. Regulation 28 sets the fields, and the free UK MLR customer due diligence form lays them out. KYC requirements in the UK are these rows under another name. The Regulations say customer due diligence.
Onboarding is where the FCA found Monzo weakest. It fined the bank £21,091,300 on 8 July 2025, saying Monzo had onboarded customers on "limited, and in some cases, obviously implausible information", such as London landmarks given as addresses. Monzo also signed up over 34,000 high risk customers while an FCA requirement barred it from doing so.
Which sterling thresholds apply since 30 June 2026?
Business relationships need due diligence at any amount. S.I. 2026/621 put the occasional transaction figures in sterling.
- £12,000. Occasional transactions (MLRs reg 27(2); was 15,000 euros).
- £800. Transfers of funds above £800 (reg 27(1)(b)); cryptoasset transfers of £800 or more, with full travel rule data across borders (regs 27(7E), 64C, 64G; was 1,000 euros).
- £10,000. High value dealers' cash, art market deals, letting agents' monthly rent (regs 14, 27(3), 27(7A) to (7C)).
- £3,000. Below it, a bank or payment firm may process a transaction on an account without a DAML (POCA s. 339A, from 31 July 2025).
How does the UK apply a risk based approach to AML?
Barclays Bank UK PLC opened a client money account for WealthTek without checking the FCA's Financial Services Register, which would have shown that WealthTek had no permission to hold client money. Clients then paid £34 million in. Together with a second case, the FCA fined Barclays £42 million on 16 July 2025.
The Regulations leave checks like that one to the firm. Each firm finds its own risks and sizes its controls to them: regulation 18 requires a written risk assessment, and regulation 19 policies that answer it. Low risk can justify simplified due diligence (reg 37); high risk requires EDD (reg 33). If you are building an AML risk assessment in the UK, HM Treasury's national risk assessment (NRA) of 17 July 2025, the fourth, is the public starting point.
Which red flags trigger enhanced checks?
Regulation 33(1)(f) names the transaction red flags that require enhanced due diligence: a transaction that is "unusually complex or unusually large in each case given the nature of the transaction", an unusual pattern of transactions, or one with "no apparent economic or legal purpose". Regulation 33 lists other EDD cases too, among them a FATF call for action country, a PEP and correspondent relationships. In the Nationwide case, one personal current account customer received 24 fraudulent Covid furlough payments totalling £27.3 million over 13 months.
What are the penalties for AML non-compliance in the UK?
| Offence or breach | Basis | Maximum (in force, November 2026) |
|---|---|---|
| Concealing, arranging, acquiring or using criminal property | POCA ss. 327 to 329, s. 334 | 14 years in prison, a fine or both |
| Failure to disclose in the regulated sector | POCA ss. 330 to 332, s. 334 | 5 years in prison, a fine or both |
| Tipping off | POCA s. 333A(4) | 2 years in prison, a fine or both |
| Breach of the Money Laundering Regulations (criminal) | MLRs reg 86 | 2 years in prison, a fine or both |
| Breach of the Money Laundering Regulations (civil) | MLRs reg 76 | A penalty the supervisor considers appropriate, with no statutory cap; public censure |
| Failure to prevent fraud (large organisations) | ECCTA 2023 s. 199 | Unlimited fine |
Civil penalties have no cap. Under regulation 76 a supervisor may impose "a penalty of such amount as it considers appropriate" and publish a statement censuring the firm. The FCA uses that power most: since 2021 it has fined banks 13 times for AML systems and controls failings, £300,767,526 in total, by its own count on 12 December 2025. Criminal cases are rarer. NatWest's fine on 13 December 2021 was the first time the FCA pursued criminal charges for money laundering failings.
Major money laundering cases in the United Kingdom
| Firm | Date | Penalty | What the FCA found |
|---|---|---|---|
| Standard Chartered Bank | 9 Apr 2019 | £102,163,200 | Weak customer due diligence and ongoing monitoring in UK correspondent banking and the UAE branches |
| NatWest | 13 Dec 2021 | £264,772,619.95 (criminal fine) | Failed to monitor Fowler Oldfield, a Bradford jewellery business that deposited about £365m, about £264m of it in cash |
| HSBC Bank plc | 17 Dec 2021 | £63,946,800 | Transaction monitoring scenarios, parameters and data not tested or checked, 2010 to 2018 |
| Santander UK | 9 Dec 2022 | £107,793,300 | AML gaps over more than 560,000 business banking customers, 2012 to 2017 |
| Monzo Bank | 8 Jul 2025 | £21,091,300 | Weak onboarding, risk assessment and monitoring; over 34,000 high risk customers signed up against an FCA requirement |
| Barclays | 16 Jul 2025 | £42m (two firms) | WealthTek client money account opened without a register check; Stunt & Co received £46.8m from Fowler Oldfield |
| Nationwide Building Society | 12 Dec 2025 | £44,078,500 | Due diligence, risk assessments and transaction monitoring on personal current accounts not kept up to date, October 2016 to July 2021 |
Amounts as published in each FCA release, after the settlement or guilty plea discount where one applied. The same FCA notices can be filtered by sector, beside FinCEN, OFAC and FINTRAC penalties, in the free AML Fines Tracker.
Which screening and monitoring steps follow from UK AML compliance rules?
An FCA or HMRC supervisory review of a file asks for the screening list behind each name, the rule behind each alert and the person behind each decision, with dates. GOV.UK tells firms that use a specialist screener to ask the supplier how the move to the UK Sanctions List affects their data, so that is the first question to put to any AML or KYC software vendor.
On complead, client screening and ongoing monitoring loads 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. The UK Sanctions List is one. A team can hold a sanctions list to a stricter fuzzy match than a watchlist, because the threshold is set per list type and per individual list.
Transaction monitoring is built on the rules engine. You write a rule such as the £800 cryptoasset transfer line without code and test it against a 30, 60 or 90 day window of past transactions before it goes live; every change keeps who made it, when and why. Every alert lists its rule and the signals behind it. Agents close the routine cases with their evidence, narrative and work log attached, while the analyst or nominated officer decides and the record shows who.
What are the trends in AML compliance in the UK? What changed in 2025 and 2026
Dated changes since July 2025:
- 31 July 2025. POCA's threshold amount for banks and payment firms operating accounts rose to £3,000 (S.I. 2025/877).
- 18 November 2025. Companies House identity verification became law for company directors and people with significant control; the date opened a 12 month transition rather than setting a deadline.
- 28 January 2026. From 9am the UK Sanctions List became the single source of UK designations and the OFSI Consolidated List closed; historic OFSI Group IDs stay valid for designations made before that date.
- 4 February 2026. S.I. 2026/102, the FCA authorisation regime for cryptoassets, was made.
- 30 June 2026. Most of S.I. 2026/621 took effect: sterling thresholds, narrower EDD triggers, pooled client accounts, the reinsurance carve out, shelf company sales as TCSP work and 30 day FCA reporting of changes to regulation 23 notices.
What comes next:
- 1 February 2027. Regulation 34A: enhanced due diligence for cryptoasset correspondent relationships.
- June 2027. Possible on site visit for the FATF's fifth round evaluation of the UK, with plenary discussion in February 2028 (FATF assessment calendar).
- 1 September 2027. Registration deadline for trusts that acquired UK land before 6 October 2020 and still hold it.
- 25 October 2027. The FCA cryptoasset regime applies in full.
Three lines for screening teams this week
- Check that screening loads the UK Sanctions List and keys new designations on its Unique ID.
- Run a name designated after 28 January 2026 through the current system and the free sanctions check against the UK Sanctions List; if only one finds it, the old list is loaded.
- Confirm onboarding rules use £12,000 and £800, not 15,000 and 1,000 euros.
Get the 2026 PDF: checklist and templates
The 16 page PDF, 2026 edition, adds three working documents for the compliance file: a 14 point programme checklist ordered the way a supervisor reviews a file, a template of UK customer risk factors, and a SAR and DAML record with the day 7 and day 31 dates marked.
