Is my small firm covered by the money laundering regulations?

Who do the Money Laundering Regulations apply to?

They apply to particular types of business rather than to every company. HMRC's guidance on who needs to register says the regulations cover a number of business sectors, including accountants, financial service businesses, estate agents and solicitors, and that every business covered must be monitored by a supervisory authority.

For small firms, the sectors in the list most likely to be relevant include accountancy and bookkeeping, estate agency, letting agency and trust or company service providers.

Some sectors, such as letting agency work, high value dealing and the art market, are only covered at or above value thresholds set in the regulations. Where a threshold matters to your firm, check the current text of the regulations or ask your supervisor, because guidance pages are not always updated at the same time as the law.

The test is what the business actually does. The guidance says you need to register with HMRC if you carry out activities typically associated with these types of organisation by way of business and you are not already registered.

Who supervises a small firm?

Every business in scope must be supervised, but not every firm has the same supervisor. The guidance explains that your business may already be supervised because you are authorised by the Financial Conduct Authority or belong to a professional body like the Law Society. Several accountancy and legal bodies act as supervisors for their members.

If a business is not supervised by one of those, and it falls into one of 9 business sectors, it needs to register with HMRC. The sectors include accountancy service providers not supervised by a professional body, estate agency businesses, letting agency businesses and trust or company service providers not supervised by the FCA or a professional body.

Working out which supervisor applies to your own firm can take some care, especially if you belong to a professional body for one part of the work and not another. HMRC's guidance is the place to start, and the professional body or HMRC can confirm the position.

What happens if a firm in scope is not registered?

The guidance is direct about this. A business must not trade without registering with HMRC under the regulations, and trading while not registered is a criminal offence that may result in a penalty or prosecution.

Most businesses can keep trading while their application is processed. The exceptions are money service businesses and trust or company service providers, which must not trade until their registration has been confirmed as successful.

What should a small firm have in place?

HMRC's guidance on your responsibilities sets out what a covered business must do. The core is customer due diligence, a risk assessment of the business, and internal controls and monitoring that fit the size and complexity of the firm.

What to have	What the guidance or regulations say
A firm wide risk assessment, in writing	You must identify and assess the money laundering and terrorist financing risks your business faces, and keep an up to date written record of the steps taken
A policy statement	A document setting out your anti money laundering policy, controls and procedures, naming relevant people and their responsibilities
Customer due diligence	Identify customers and check they are who they say they are, including the beneficial owner in certain situations
A nominated officer	Someone employees know to report suspicious activity to
Training	Relevant employees trained on their anti money laundering responsibilities
Records	Kept for 5 years from the end of the business relationship or the completion of the transaction

The guidance makes the point that a policy statement is worth having even if the business is small. It describes it as a useful tool for focusing your mind and those of your employees.

What is a firm wide risk assessment?

It is the document that most of the rest hangs on. The regulation on risk assessment by relevant persons says a business must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which it is subject.

In doing so it must consider risk factors relating to its customers, the countries or geographic areas it operates in, its products or services, its transactions and its delivery channels. The steps should reflect the size and nature of the business, so a sole practitioner bookkeeper and a large estate agency will produce very different documents.

The regulation also says the firm must keep an up to date written record of those steps, unless its supervisor tells it in writing that a record is not required, and must provide the risk assessment to its supervisor on request. In practice, that means a written record, paper or electronic, that is specific to the firm and kept up to date as the business changes.

Why do small firms get this wrong?

One misunderstanding is that the regulations are only for banks and large firms. The sectors in the guidance are defined by activity, not by size, and the regulation on risk assessment says the steps should take into account the size and nature of the business. Size shapes how much is expected.

Another is treating customer checks as a one off task at onboarding. The guidance says due diligence must also be applied when you have doubts about a customer's information and when it is necessary for existing customers, for example if their circumstances change.

A third is keeping a generic template as the risk assessment. A document that could belong to any firm does little to show that the risks of this firm have been identified and assessed.

Gaps like these show when a supervisor asks to see the firm's records. The regulation says the risk assessment and the information behind it must be provided to the supervisor on request.

When is this not the answer?

Whether your firm is in scope, who supervises it and whether your arrangements meet the regulations are questions for your supervisor. Your supervisor's own guidance and, where needed, a solicitor are the right sources for that.

If you suspect that a client or transaction involves money laundering, follow your firm's reporting procedure through your nominated officer. That is a legal process with its own rules, and it should not wait for a general review of your paperwork.

If your firm already has a current risk assessment, policy and records that your supervisor has already reviewed, the most useful step may simply be to keep them up to date.

Where can you get help putting the paperwork in order?

For a small firm, the hardest part is often finding the time to write things down properly alongside client work. A clear risk assessment, a short policy and a tidy record of checks are a sound place to start.

If you would like a confidential conversation about your firm's paperwork, you can book a confidential consultation. We can help you organise the documents, set up a practical routine for customer checks and prepare questions for your supervisor. Your firm remains responsible for its own obligations. You can read more about our KYC and AML support.