Regulation 18 of the Money Laundering Regulations 2017 requires every accountancy and tax practice within their scope to take appropriate steps to identify and assess the money laundering and terrorist financing risks its business faces, and to keep an up to date written record of those steps. The assessment must cover customers, countries, services, transactions and delivery channels, and draw on information from the firm’s supervisor. The regulation sets no fixed review date, but ICAEW treats an annual review by senior management, plus a review whenever risks change, as good practice.

Who has to prepare a firm wide risk assessment?

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) apply to “relevant persons”, which under regulation 8 include auditors, insolvency practitioners, external accountants and tax advisers acting in the course of business in the UK. Regulation 18 applies to all of them, whatever their size. A sole practitioner with no staff still needs one; ICAEW’s thematic review of the firm wide risk assessment found that most firms without one were sole practitioners who assessed risk only at client level, and ICAEW’s response was that the assessment is a regulatory requirement regardless of size.

Regulation 18(4) does allow a supervisor to tell a firm in writing that a written record is not needed, but regulation 18(5) only permits that where the supervisor considers the risks for the whole sector are clear and understood. In practice accountancy supervisors expect a document. For who supervises whom, see AML supervision for accountants.

What exactly does regulation 18 require?

  1. Identify and assess risk. Take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which the business is subject (regulation 18(1)).
  2. Use supervisor information. Take into account information made available by the supervisory authority under regulations 17(9) and 47 (regulation 18(2)(a)). For accountants that includes the National Risk Assessment and the Accountancy AML Supervisors’ Group (AASG) Risk Outlook, which ICAEW recommends reading together.
  3. Cover five risk factor groups. Customers, countries or geographic areas of operation, products or services, transactions, and delivery channels (regulation 18(2)(b)).
  4. Scale it. Take into account the size and nature of the business when deciding what steps are appropriate (regulation 18(3)).
  5. Write it down and keep it current. Keep an up to date written record of all the steps taken (regulation 18(4)).
  6. Hand it over on request. Provide the assessment, the information it was based on and the record to the supervisor when asked (regulation 18(6)).

Regulation 18A, inserted from 1 September 2022, adds a parallel duty to assess the risk of proliferation financing, using the same five factor groups. ICAEW found many firms had not considered it, and says it can be covered within the firm wide assessment or separately, often simply by recording that the risk has been considered.

What should each risk factor cover?

Risk factor Questions ICAEW suggests asking
Clients What types of client do we serve, by industry, size and legal form? Are any types known to be used by money launderers? Which already need senior approval at take on?
Services Which services could criminals use to launder or layer money, such as company formation, registered office services, payroll, trust work or incomplete records engagements?
Geography Where are clients based, where do they get funding, sell and buy, and what links do they have to countries with corruption, criminal activity or sanctions?
Transactions What passes through the client money account or any client’s own accounts we operate, and which asset transactions could we facilitate?
Delivery channels Do we meet clients face to face, deal only online, or work through introducers whose due diligence we rely on?

ICAEW’s methodology stresses that size and nature change the answer: a firm with 20 offices and audit, tax and insolvency lines faces very different risks from a sole practitioner doing bookkeeping for local businesses.

How should the risks be scored?

ICAEW describes three steps. First identify the risks in each part of the business. Then assess each one for likelihood and impact. Finally review the controls in place, or planned, to bring the net risk to an acceptable level. Its suggested likelihood scale runs from almost certain, probable and possible to unlikely and rare; its impact scale runs from critical (significant sums laundered and possible prosecution of principals) through major and significant to minor. Firms may use their own ranges.

In the thematic review 24% of firms used some form of scoring, mostly low, medium and high or a red, amber and green rating, and reviewers singled out a 1 to 5 matrix for both likelihood and impact as giving a robust indication of risk. Scoring is not compulsory, but the assessment must show the reasoning, not just a list of ticks.

How does it connect to policies and client due diligence?

The firm wide assessment is the starting point for almost every other duty in the MLRs:

  • Regulation 19(1)(a) requires policies, controls and procedures to mitigate and manage the risks identified under regulation 18(1), and regulation 19(2)(b) requires them to be approved by senior management.
  • Regulation 28(12) requires the extent of customer due diligence to reflect both the firm wide assessment and the risk in the particular case.
  • Regulation 33(1)(a) requires enhanced due diligence wherever the firm’s own assessment identifies a high risk, and regulation 37(1) lets simplified due diligence be applied only after taking that assessment into account.

Individual client ratings sit underneath it; see assessing client risk for AML. ICAEW notes that a direct link between the factors in the firm wide assessment and the firm’s CDD procedures is often what makes CDD effective.

How often should it be updated?

Regulation 18(4) requires the record to be up to date, but no interval is set. ICAEW’s methodology says the assessment must be reviewed regularly and that for most firms this might mean an annual programme of review by senior management. Its thematic review says the regulations do not require an annual review but it considers one good practice, and that the assessment should also be revisited when risks change, for example:

  • adding a new service line, or adopting new technology or delivery methods, which regulation 19(4)(c) separately requires to be risk assessed before and during adoption;
  • receiving a supervisor risk bulletin that affects the firm, or an update to the National Risk Assessment;
  • making a suspicious activity report that points to a risk not previously recognised;
  • changes to the law. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 came into force on 30 June 2026, and the accountancy sector guidance was reissued to reflect them, including limiting the mandatory high risk country trigger to the FATF “call for action” list.

What does a good one look like for a small practice?

ICAEW publishes an example for a sole practitioner with 10 staff and fee income of £500,000, providing accounts, tax returns and payroll to local individuals and small companies, with two high net worth clients and a client money account used mainly for tax refunds. It rates clients and services as normal risk, geography and delivery channels as low, and transactions as normal. For each, it records specific mitigation: verifying source of wealth for the two wealthy clients, payroll procedures to confirm employees exist, phoning payroll clients to confirm changes of bank details, not offering company formation as a standalone service, and training staff on red flags. It ends with dated actions, an owner, a signature and the next review date.

What mistakes do supervisors find?

  • Submitting an AML compliance review or a policy manual instead. ICAEW found 6% of firms in its sample did this. The compliance review is a separate requirement under regulation 21(1)(c).
  • Using boilerplate templates with minimal changes, or a yes and no checklist with no explanation.
  • Risks in the firm’s annual return to its supervisor not matching those in the assessment, such as client money, trust and company services or politically exposed persons.
  • Listing risks without controls that respond to them.
  • Keeping the document away from staff. In the review, 46% of firms made it accessible to staff and 38% used it in training.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.