Status

This guidance is to help you understand your obligations and how to comply with them. We may have regard to it when exercising our regulatory functions.

Who is this guidance for?

All firms and individuals we regulate who are subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs).

Purpose of this guidance

This guidance explains our expectations for firms subject to the MLRs in relation to anti-money laundering (AML) policies, controls and procedures (PCPs) under regulation 19. It is intended to support firms in meeting their legal obligations in a way that is effective and proportionate to their size, nature and risk profile.

Introduction

Under regulation 19 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, firms must establish, maintain, document and regularly review AML policies, controls and procedures. These must be designed to mitigate the risks identified in the firm-wide AML risk assessment.

Policies, Controls and Procedures

• Policies are high level statements that set out an organisations approach to AML. They provide direction and set expectations across your firm. For example, a policy will set out that customer due diligence (CDD) is carried out on all of the firm's clients.
• Controls are specific measures put in place to mitigate risks. These can include things like e-verification checks, payment monitoring systems, sanctions or politically exposed persons screening, file reviews or approval processes. Controls are designed to make sure risks are being managed in practice.
• Procedures are specific step by step instructions that explain how fee earners should apply policies in their day-to-day work. For example, setting out what types of documents can be gathered as part of CDD, how to risk assess clients/matters, or who fee earners should approach if they have suspicion of money laundering on a matter. 

A policy alone is not enough. Effective AML risk management depends on policies being supported by appropriate controls and procedures that are embedded in day-to-day practice. Well-designed PCPs help staff understand what they must do to help manage and reduce financial crime risks.

Robust and compliant AML PCPs will help detect and prevent financial crime. Fee earners are a firms' most effective defence against becoming inadvertently involved in money laundering. Moreover, under the Proceeds of Crime Act 2002 (POCA) and Terrorism Act 2000, staff could face criminal penalties if they are involved in money laundering or terrorist financing. Documented AML PCPs will help support staff with their AML responsibilities, as these set the steps staff must take to meet the requirements of the MLRs.

The legal requirements

Under regulation 19 of the MLR, firms undertaking work within scope of the MLR must:

• Establish and maintain AML PCPs. These must mitigate the risks identified within your firm wide AML risk assessment, carried out under regulation 18 MLR.
• Ensure all AML PCPs are documented. These must be proportionate to the size and nature of your firm and approved by senior management.
• Maintain a written record of any changes made to AML PCPs following any changes or reviews, and the steps taken to communicate these within your firm.
• Have AML PCPs which cover the following mandatory areas:
  • Risk management practices;
  • Internal controls (regulations 21 to 24);
  • Customer due diligence (regulations 27 to 38);
  • Reliance and record keeping (regulations 39 to 40);
  • The monitoring and management of compliance with, and the internal communication of, such policies, controls and procedures (regulation 19(3)(e)).
  • Identification and scrutiny of transactions which are complex or unusually large, or where there are an unusual pattern of transactions (regulation 19(4)(a)).
  • Identification and scrutiny of transactions which have no apparent economic or legal purpose (regulation 19(4)(a)).
  • Taking additional measures to prevent products and transactions which might favour anonymity being used to launder money (regulation 19(4)(b)).
  • Ensuring any new products/technologies which are adopted by the firm are assessed for money laundering risks (regulation (19(4)(c)).
• Regularly review and update AML PCPs, keeping a record of any changes and steps taken to communicate these across your firm (regulation 19(1)(c)).

Regulation 19A MLR also requires you have documented AML PCPs which outline the steps fee earners must take to prevent proliferation financing within your business. This can either be considered separately or within your AML policy. Further guidance on proliferation financing can be found in the Legal Sector Affinity Group guidance.

Monitoring compliance with PCPs will help identify whether the policies and procedures the firm have implemented are effective in identifying and mitigating risks. It will also help identify whether staff are aware and understand the AML procedures the firm have put in place.

What we have done

AML PCPs have always been assessed as part of our onsite AML inspections and desk-based reviews programmes. Over the last few years, our annual reports have highlighted that many policies were partially or non-compliant, highlighting recurring weaknesses in firms' policies and procedures. Over the last three years, we have reviewed 2,241 firms' AML PCPs.

Given the trends we have observed and highlighted in this area over the last two reporting periods, we began assessing how firms monitor compliance with their AML PCPs. This allowed us to make a comparison against the firms AML policies, to check whether the correct procedure has been followed. It also helped us to identify how well firms were adapting their controls and procedures, and whether the PCPs were being applied at file level.

This thematic will share examples of good and poor practices we have seen from our engagement with the industry.

What we have developed

AML PCPs are a key control to help protect firms against money laundering. We expect firms to put in place comprehensive AML PCPs which are suitable to their firm.

Regulation 19 MLR provides a mandatory list of areas which must be covered within firms' AML PCPs. This is further addressed within the Legal Sector Affinity Group (LSAG) AML guidance. While this guidance exists to support firms, we continue to see shortfalls.

To address these shortfalls, we have developed this guidance which sets out our expectations in relation to AML PCPs.

We have also published an AML policy checklist that firms may wish to use to review PCPs. This outlines the various areas which must be covered within AML PCPs as required under regulation 19.

This checklist is not exhaustive. If you choose to use the checklist you should adapt it to ensure your AML PCPs are relevant to your firm. This may include covering potential risk areas you have identified in your firm wide AML risk assessment.

Finally, we have created a file review form for firms to use. This will help firms to monitor AML compliance, as required under regulation 19(3)(e).

What we have seen

Firms and sole practitioners undertaking work within scope of the MLR must put in place AML PCPs under regulation 19 MLR. We ask firms to provide copies of their AML PCPs to assess their effectiveness as part of an onsite AML inspections or desk-based review.

We have observed the following:

• Firms with weaker or non-compliant PCPs were more likely to show broader AML weaknesses at file level
• Firms that regularly reviewed and updated their AML policies tended to demonstrate better compliance outcomes
• In our 2024-2025 reporting year:
  • 135 firms were referred for lack of client and matter risk assessments (CMRA) on files. Of these, 111 firms had a documented CMRA processes within their AML PCPs, but these processes were not being followed.
  • Where firms had documented processes for client and matter risk assessments, some files still showed that those processes were not being followed consistently in practice.
  • These firms had not picked up on this issue, suggesting they were unaware procedures were not being applied by their fee earners.

Over the last three years, we have observed the following levels of compliance:

AML PCPs 2025 – 2026:

We reviewed 934 AML Policies. We found around 46% of polices were either partially compliant or not compliant. Three firms did not have an AML policy in place, despite this being a legal requirement since 2007.

	Compliant	Partially-compliant	Non-compliant
Desk based review	262	219	94
Inspections	243	94	22
Total	505	313	116

AML PCPs 2024 – 2025:

We reviewed 823 AML Policies. We found 62% of policies were partially compliant or not compliant.

	Compliant	Partially-compliant	Non-compliant
Desk-based reviews	163	255	95
Inspections	148	127	35
Total	311	382	130

AML PCPs 2023 – 2024:

We reviewed 481 AML policies. We found 56% of policies were only partially compliant or not complaint.

	Compliant	Partially compliant	Non-compliant
Desk-based reviews	88	111	49
Inspections	121	90	22
Total	209	201	71

Overall, in the last reporting year, we have seen some improvement in compliance in this area. However further improvement is still required. We continue to see certain steps outlined in policies which are not being applied in practice, or documents which have not been updated following changes to legislation.

Levels of compliance

We assess AML policies to determine whether they are compliant, partially compliant or not compliant with the MLR.

• Compliant – this is where the policy covers all mandatory areas as set out under both regulation 19 MLR and the Legal Sector Affinity Group (LSAG) Guidance.
• Partially compliant – policies are deemed partially compliant where some mandatory areas (as outlined below) are missing. Policies may also be deemed to be partially compliant where they do not cover areas in enough detail.
• Not compliant – policies which are missing the majority of mandatory areas are deemed to be not compliant. We may also deem a policy to be not compliant if it is out of date, for example, referring to outdated guidance or legislation. Information taken directly from organisations and not tailored to a firm's practice would also not constitute a compliant policy. 

The table below sets out the most common mandatory areas that were missing from firms AML Policies over the last three years.

Most common mandatory areas missing from AML policies

Requirement	% missing or incomplete	Interpretation
Mitigation of Money Laundering (ML)/Terrorist Financing (TF) risk involving new products, practices or technologies - Regulation 19(4)(c) MLR	40%	Where new products, practices or technologies are adopted, you must ensure the money laundering risks are assessed. This should be made clear within your AML PCPs.
Reporting discrepancies to Companies House - Regulation 30A MLR	36%	Firms must inform Companies House of any discrepancies in their information about beneficial ownership. We would suggest including a link to the reporting page within your AML PCPs.
Reliance - Regulation 39 MLR	28%	Reliance has a specific meaning within the regulations. It relates to the process under regulation 39 where, in certain circumstances, firms may rely on another person to conduct CDD for you, subject to their agreement. A firm's stance on reliance must be documented within their policies and procedures, so fee earners know whether it is permitted by the firm.
Simplified due diligence (SDD) - Regulation 37 MLR	27%	SDD can be carried out where a firm determines that the business relationship or transaction presents a low risk of money laundering or terrorist financing. SDD is the lowest permissible form of due diligence and can only be used in specific circumstances. a firm's approach to SDD must be set out in its policies and procedures. This is so fee earners know whether they can apply it or not. If firms do permit SDD, they will need to set out the circumstances and the checks they would expect to see, as CDD will still need to be applied, albeit to a lesser extent.
The taking of additional measures, where appropriate, to prevent the use for money laundering or terrorist financing of products and transactions which might favour anonymity – Regulation 19(4)(b) MLR	24%	The regulations are clear that firms must set out their position on these types of services. If this is a service firms offer, they must make sure their AML policy contains a section which sets out mitigating actions for their fee earners.
High risk third countries / high-risk jurisdictions - Regulation 33 MLR	23%	While it may be unusual for some practices to come across overseas clients, firms must make sure their fee earners are aware of any high-risk jurisdictions so they can exercise caution and apply enhanced due diligence (EDD). High risk third countries under regulation 33(b) and 3A will only be those subject to a Call to Action by the Financial Action Task Force – currently Iran, North Korea and Myanmar. Further information.
Provision to identify and scrutinise transactions that have no apparent economic or legal purpose – Regulation 19(4)(a)(i)(bb) MLR	22%	We found that many firms mentioned these factors within their AML policy. However,very little explanation was given as to what a large or unusually complex transaction looks like for that firm. Each individual firm will have their own measure as to what constitutes unusually large or complex transactions. Firms' AML policies should outline a list of potential red flags that fee earners must be aware of. These red flags should be tailored to the firm. We accept that it is impossible to list every possible red flag, given that criminals are constantly adapting their methods to launder money. However, the inclusion of a non-exhaustive list will help fee earners identify transactions that may be out of the ordinary.
Provision to identify and scrutinise complex transactions – Regulation 19(4)(a)(i)(aa) MLR	21%
Provision to identify and scrutinise unusually large or unusual patterns of transactions – Regulation 19(4)(a)(i)(aa) MLR	22%
Checking the sanctions register/complying with sanctions regime - Regulation 33 MLR	20%	Firms may be at risk of being used to evade sanctions. It is important fee earners are aware of all parties involved within a transaction, including any beneficial owners, to ensure they are complying with the sanctions regime. It is good practice to include guidance around this within AML policies, or under a separate sanctions policy.

Good practice

We observed the following examples of good practice from firms:

• policies that were clear, concise and free from unnecessary jargon, focusing on the practical steps fee earners must take
• firms regularly reviewed and updated their AML policy, following senior management meetings. Previous versions were maintained to evidence these changes.
• pertinent parts of the firm's AML policy were implemented into the firm's new starter AML training, for example, guidance on how to risk assess clients and matters.
• AML policies and procedures being easily accessible on firms' intranet.
• policies were tailored to the firm's processes, for example:
  • Specific details of the case management systems and e verification systems used were set out.
  • Clearly defining the firm's approach to CDD and ongoing monitoring as opposed to an explanation of what CDD is.
  • Detailed procedures on where due diligence is kept on the case management system, including how it is accessed and reviewed.
• some firms' case management systems had separate folders for core AML documents, making them easier to review as part of ongoing monitoring.

Poor practice

We observed the following examples of poor practice:

• Heavily templated AML policy documents which had not been tailored to the firm. Often, these documents had been purchased 'off the shelf' and the steps outlined within the document were not being applied in practice.
  • If you use a template, you must ensure that it is tailored to your practice.
  • You cannot pass the regulatory risk of non-compliance on to a third party.
  • If a consultancy gives you the wrong advice, the responsibility remains with you.
• a disconnect between a firm's AML Policy and the controls and procedures in place 
• policies that focused heavily on the legislation but did not explain how the firm's procedures should be applied in practice
• occasionally, we came across some AML policies which were too vague or incorrect. For example, one firm explained simplified due diligence (SDD) could be applied to all low-risk matters, without defining what SDD is. SDD can only be applied in certain situations, as outlined under regulation 37 MLR
• policies that did not cover the mandatory requirements as set out under regulation 19 MLR
• some policies we reviewed contained references to outdated legislation, guidance links or organisations that no longer apply. For example, the OFSI consolidated sanctions list (which has since been replaced by The UK Sanctions List and old references to high risk third countries
• a small number of firms did not put a documented AML policy in place until after our request to view this and these firms were referred to our AML Investigations Team
• similarly, some firms have provided a copy of the LSAG AML Guidance or our guidance in response to our request for their AML policy. Both our guidance and the LSAG AML Guidance should be used to inform and shape a firm's AML policy, rather than being relied upon as a substitute for one
• we also observed detailed policies however the procedures were not followed on the ground. For example, the firm requires fee earners to review and update CDD for existing clients, however files contained historic CDD.

Monitoring compliance with AML policies, controls and procedures

Monitoring compliance will help identify whether the policies and procedures the firm have implemented are effective in identifying and mitigating risks. It will also help identify whether staff are aware and understand the AML procedures the firm have put in place.

The requirement to monitor compliance with policies is set out under regulation 19(3)(e) MLR.

As part of our onsite AML inspections, we ask firms to demonstrate how they monitor compliance with AML PCPs as required under regulation 19(3)(e) MLR. We found firms are taking varying approaches to this.

File reviews

This is the most common way firms monitor compliance with AML PCPs. Many firms utilise monthly, quarterly, or risk-based file reviews, monitoring AML compliance alongside supervision of the fee earner.

Often these reviews are carried out by supervisors, but occasionally carried out by heads of department, compliance teams or even peer reviews. Typically, firms would review 1- 3 files per fee earner, per month/quarter. Junior staff, new joiners or high-risk matters would be reviewed more frequently.

Checklists

Some firms use file checklists that are completed before opening or closing a file to ensure the controls are being complied with.

Case management systems

Some firms relied on their case management systems or automated controls to monitor compliance with AML PCPs. Common uses include:

• preventing files from opening unless the client due diligence (CDD) or client and matter risk assessment (CMRA) has been completed
• locking matters if required documents are missing
• automated alerts for:
  • missing ID
  • incomplete CMRAs
  • high-risk matters
  • PEP/sanctions changes
• automated compliance reports which highlight matters where CDD and CMRAs have not been completed
• alerts where unexpected payments are received, or where payments do not originate from an expected source.

Onboarding controls

Some firms focus on client/matter inception as the main control point:

• no file opened until CDD / CMRAs are complete. Often, central onboarding or compliance teams will review this. Some firms prevent the following until AML steps are completed:
  • billing
  • receiving funds
  • sending funds
  • time recording
• we also observed good practice on source of funds flags, whereby the accounts departments at firms' flag when the source of funds appears inconsistent with what they expected to receive, showcasing systems and controls that talk to each other.

This approach often works well alongside other controls, for example, controls built into your case management system.

Good practice

• Many firms kept written copies of file reviews to help demonstrate compliance with regulation 19(3)(e) MLR. We have developed a file review template to help firms with this.
• Where issues were identified, some firms set deadlines for corrective actions. Where these were completed, these were logged on files.
• Some firms maintained spreadsheets, registers or reports to help identify trends. These reports were often escalated to senior management or risk committees and influenced training across the firm.
• Higher risk matters were often subject to more frequent reviews, for example, extra checks being carried out before completion/the movement of funds.

Poor practice

• We occasionally found that reviews were done informally and not recorded, making it hard to demonstrate compliance with regulation 19(3)(e). Often, this was because the firm had no formalised procedure or access to a file review form.
• Some firms acknowledged they had processes in place, but these had not been followed, for example, the person responsible for carrying out the reviews having left the firm.
• We also found that some firms were over reliant on fee earners competence, relying on informal oversight. These firms often explained how they are a 'small team so we know what is going on' or how they 'all know each other's files', therefore they felt formalised checks were not required.  
• Some firms had file review processes in place, however, the review did not focus on any AML procedures, instead focusing on the quality of legal advice, conflicts of interest and whether bills were paid on time. 
• We also found differing approaches between partners of firms compared to junior staff, with less scrutiny applied to partners.

The two-tiered approach

An AML policy implemented in isolation, without controls and procedures will not protect your firm from money laundering risk. This is because a policy sets out expectations but does not create an environment or culture for those expectations to be embedded.

Without effective controls and procedures, fee earners can be left to interpret policies for themselves. This may lead to inconsistencies and a gap in controls.

Further, without effective controls, there is limited assurance available to the firm that the policy is being followed and/or if steps are being followed correctly.

A two-tiered approach will assist firms in complying with regulation 19. This can be a helpful way of approaching managing AML risks. A two-tiered approach will help different teams within an organisation share responsibility for identifying, controlling, and monitoring risk. The approach helps define clear roles across firms, ensuring that frontline staff, compliance functions, and internal reviews work together effectively and protect the firm. By doing so, it supports the implementation of appropriate controls and promotes a consistent and coordinated approach to managing AML risks.

1. First tier – front line staff

Employees directly involved in providing services to clients. They interact with clients and are responsible for the day-to-day business operations. They protect the firm by complying with policies, controls and procedures. Employees should be familiar with the controls you have embedded. This includes step by step processes they apply in their day-to-day role.

2. Second tier – money laundering compliance officer (MLCO) / Risk and compliance

The second tier is the money laundering compliance officer, and/or risk and compliance function. Risk and compliance will put in place policies and procedures, provide guidance, and monitor whether the first line is doing things correctly, for example, through regular internal file reviews. They will also review AML controls and, where necessary, provide training.

Our expectations

The requirement to put in place AML PCPs is set out under regulation 19 of the money laundering regulations. Firms have been required to have documented AML PCPs in place since December 2007. Effective AML arrangements support firms in managing risk efficiently and can reduce the need for remedial action or regulatory engagement.

Having completed a firm wide AML risk assessment, you must establish and maintain policies, controls and procedures to mitigate and manage the money laundering risks you have identified.

These must be proportionate to the size and nature of your business and be approved by an officer or employee who has enough knowledge of the firm's ML/TF risk exposure and who is of sufficient authority.

Mandatory areas

We expect to see each of these mandatory requirements covered within AML PCPs. We have developed an AML policy checklist to assist with this. Our table above covers the areas most frequently missed within AML policies.

• risk-management practices
• internal controls
• customer due diligence (CDD)
• reliance and record keeping
• monitoring and management of compliance with, and internal communication of, the policies.

Regular reviews/updates

We expect to see that AML PCPs are regularly reviewed and updated. This is a legal requirement. You should consider updating your AML PCPs where:

• new risks have been identified in your firm wide AML risk assessment
• after a period of time (for example, annually or every two years)
• there have been changes to legislation
• you have changed your controls, for example, implementing a new e-verification system.

Updates to legislation

We expect policies to be updated where there have been changes to legislation. Occasionally, we find that while firm's have reviewed their policies, key changes to legislation have not been picked up or reflected meaning the policy is out of date.

This was particularly prevalent following the introduction of the Fifth Money Laundering Directive (5MLD), which was introduced in January 2020. 5MLD introduced the requirement to report discrepancies to Companies House. On 1 April 2023 this requirement was updated to reporting material discrepancies only and not all discrepancies. We often found AML policies had not been updated to reflect this change.

Monitoring compliance

Implementing an AML Policy is not enough. Firms must integrate and embed appropriate controls and procedures, to ensure the policies are complied with. You must also monitor how staff are complying with your AML PCPs, in line with regulation 19(3)(e) MLR.

Measures to assist with this include:

• internal file reviews
• system led controls eg alerts on case management systems when CDD is outstanding
• file checklists
• independent audits.

Maintain a written record of any changes

You will need to regularly review and update policies and keep a record of your policies, any changes made, and what steps have been taken to communicate those policies to staff.

This can be demonstrated through various ways, including:

• maintaining a version control/previous documents following any updates
• keeping copies of emails/bulletin updates which are sent to staff following any changes.

Tailoring

To be effective, AML PCPs should be tailored to the firm's own business model, systems and risk profile. A policy should provide meaningful guidance to staff about what they need to do in practice, rather than simply restating the legislation.

The examples below are illustrative only. They are intended to show how firms might adapt generic wording to reflect their own arrangements. Firms should ensure that any wording used is accurate, operationally realistic and consistent with their actual practice.

Illustrative examples of tailored PCPs

Your AML policies and procedures should help your fee earners better understand your controls. Below are some examples on how tailoring can assist. You should note the examples below are fictitious and are provided to assist you in tailoring our policy.

Example one – client and matter risk assessments

We are required to undertake a risk assessment for each client and matter at the outset of an instruction and keeps this under review as appropriate. This helps to satisfy R28(13) MLR which requires that in assessing the level of risk arising in a particular case the following must be taken into account;

• the purpose of the matter or business relationship,
• the size of the matters undertaken by the customer; and
• the duration of the business relationship including accounting for any significant gaps.

Tailored wording:

We are required to undertake a risk assessment for each client and matter at the outset of an instruction and keeps this under review as appropriate. A copy of our client and matter risk assessment template can be found on our intranet. Once completed, this must be saved in the compliance folder for the matter on our case management system.

Where higher risk factors are identified, enhanced due diligence measures must be applied and you must have sign off from our compliance manager, Mrs Jones.

Example two – ongoing monitoring

R28(11) MLR requires that fee earners conduct ongoing monitoring of the business relationship including but not limited to the following:

1. scrutiny of transactions undertaken throughout the course of the relationship (including, where necessary, the source of funds) to ensure that the transactions are consistent with the relevant person's knowledge of the customer, the customer's business and risk profile
2. undertaking reviews of existing records and keeping the documents or information obtained for the purpose of applying customer due diligence measures up-to-date.

Further information on ongoing monitoring can be found in the LSAG Guidance 2025.

Tailored wording:

You must undertake ongoing monitoring of client relationships and matters to ensure that transactions and activities are consistent with your knowledge of the client and the nature of the work undertaken. Matters must be reviewed regularly and any changes noted on the client and matter risk assessment. Where there is a change in risk profile, you must updated client due diligence information as necessary. Where any unusual or suspicious activity is identified, this is must be escalated to our MLRO.

For repeat clients, documents must be reviewed to ensure all information is still correct. Any updated documents must be saved in the compliance folder for the matter on our case management system.

We have also developed:

• a checklist which outlines the mandatory areas we would expect to see covered within AML PCPs.
• a file review template to help monitor compliance with AML PCPs.
• a guidance form to accompany our file review template.
• examples on how wording in a policy can be tailored to support your fee earners.

Further guidance and support

Anti-Money Laundering (AML) Policies, controls and procedures checklist (PDF 2 pages, 99KB)

AML file review form (DOC 3 pages, 58KB)

AML File Review – Reviewer guidance PDF  3 pages, 153KB)

Legal Sector Affinity Group (LSAG) AML Guidance (PDF 228, 2.24MB)

Money laundering resources