An accountancy firm that breaches the Money Laundering Regulations 2017 can face a civil penalty of any amount its supervisor considers appropriate, public censure, conditions, suspension or removal from supervision, and in serious cases prosecution with up to two years in prison. Separate offences under the Proceeds of Crime Act 2002 carry up to five years for failing to report suspicion. Most fines follow routine failings found on a monitoring visit: weak client due diligence, an out of date firm wide risk assessment and poor records.

Who can fine an accountancy firm for AML breaches?

That depends on the firm’s supervisor. Practices that belong to a professional body supervisor, such as ICAEW, ACCA or ICAS, are disciplined under that body’s own rules. Practices with no professional body supervisor register with HMRC as accountancy service providers, and HMRC uses the civil penalty powers in the regulations themselves. The background to supervision is covered in AML supervision for accountants.

The government has decided that the Financial Conduct Authority will take over AML supervision of accountancy firms from the professional bodies and HMRC. The FCA says nothing changes immediately, it does not expect to begin taking on supervision until autumn 2028, and the transition is likely to complete around 2030. See AML supervision reform.

What civil penalties can HMRC impose?

Regulation 76 lets HMRC (and the FCA) impose a penalty “of such amount as it considers appropriate”, publish a statement censuring the firm, or both, where it is satisfied a relevant requirement has been breached. Regulation 76(3) allows a separate penalty on an officer who was knowingly concerned in the breach. HMRC’s published guidance on civil measures lists its other tools: warning letters, information notices, refusing, suspending or cancelling registration, withdrawing an individual’s approval, and prohibiting someone from holding a management role.

HMRC’s guidance says it can issue a penalty or start a criminal investigation for any breach, even a first one. It will skip a warning letter and go straight to a penalty where breaches are serious or run throughout the business, where the firm knowingly breached the rules, where it traded while unregistered, or where it ignored an information notice.

How is an HMRC penalty worked out?

HMRC’s Economic Crime Supervision Handbook sets out a framework in place since 1 April 2020. For accountancy service providers it uses a “scale charge” at ECSH82790:

  1. Breaches are grouped, for example “fundamental requirements” (risk assessment, policies, nominated officer, record keeping) and “fundamental customer due diligence measures”.
  2. Each group attracts a fixed starting penalty of £5,000 plus a scale charge based on the number of clients affected: £5,000 for 1 to 25 clients, £10,000 for 26 to 249, £20,000 for 250 to 499, rising to £80,000 for 5,000 to 5,999.
  3. The starting penalty is capped at 25% of the business’s gross profit.
  4. Reductions are then available: up to 50% for an unprompted disclosure, 25% for full cooperation, and 25% where the breach was careless rather than deliberate.

The decision maker then carries out an “appropriateness review” and can move the figure up or down. Paying within 30 days of the penalty notice earns a further 25% reduction. A sanctions administration charge, capped at £2,000, is added and is not reduced for early payment.

What does a penalty look like in practice?

Illustration only. An HMRC supervised practice with 180 clients is visited. The officer finds client due diligence missing or incomplete across the client base, but no deliberate wrongdoing, and the practice cooperates fully. Gross profit is £120,000.

  • Starting penalty for one group of breaches: £5,000 plus a £10,000 scale charge (26 to 249 clients), so £15,000.
  • Cap: 25% of £120,000 is £30,000, so the lower figure of £15,000 stands.
  • Reductions: 25% for cooperation and 25% for carelessness, so £7,500.
  • If paid within 30 days: a further 25% off, so £5,625, plus the administration charge.

A second group of breaches, such as having no written firm wide risk assessment, would attract its own starting penalty.

What happens before and after an HMRC penalty?

HMRC may send a pre penalty notice setting out the breaches and the calculation. If the firm does not respond within 30 days, a penalty notice follows. Penalties, censures and management prohibitions are published, normally naming the business, and stay online for five years, although HMRC can publish anonymously where naming would be disproportionate. A firm has 30 days to appeal; it can ask for an independent HMRC review, usually decided within 45 days, and then has 30 days to appeal to the First tier Tribunal.

Failing to notify changes is penalised separately. HMRC expects to be told within 14 days of a change of nominated officer or compliance officer, and within 30 days of other material changes. Its guidance gives the example of a business that appointed two directors and lost three without telling HMRC: that counts as five breaches.

How do professional body supervisors sanction firms?

ICAEW’s AML supervision report says sanctions include exclusion, unlimited fines, public reprimands and conditions such as follow up reviews and training. ICAEW’s fixed penalty process, effective 1 January 2026, applies only to inadvertent or minor breaches with a full admission. “Failure to ensure appropriate money laundering supervision in place” attracts a reprimand and a category E financial penalty, with a 30% discount for early admission.

ICAS introduced tariff based regulatory penalties in April 2025. It reports 21 penalties issued since then, ranging from £100 to £3,000, with the largest given to firms whose enhanced due diligence for higher risk clients was not robust enough. ICAS says it only raises these penalties where a monitoring visit finds repeated or systemic issues. How visits work is explained in AML supervisory reviews.

When does an AML failure become a criminal offence?

Several offences sit alongside the civil regime:

Offence Where Maximum on indictment
Breaching a relevant requirement of the regulations Regulation 86 2 years, a fine or both
Acting as a beneficial owner, officer or manager without supervisor approval Regulation 26(12) 2 years, a fine or both
Prejudicing a supervisor’s investigation, including destroying documents Regulation 87 2 years, a fine or both
Giving false or misleading information Regulation 88 2 years, a fine or both
Failing to disclose suspicion in the regulated sector POCA section 330, penalty in section 334 5 years, a fine or both
Tipping off POCA section 333A 2 years, a fine or both

Regulation 86(4) stops a person who has been convicted under that regulation from also receiving a civil penalty for the same breach. In practice HMRC says it deals with most breaches as civil cases. The reporting offence is explained further in suspicious activity reports for accountants.

Is there a defence if the firm tried to comply?

Yes. Regulation 76(4) prevents a civil penalty where the firm “took all reasonable steps and exercised all due diligence” to comply, and regulation 86(3) gives the same defence to the criminal offence. In both cases the supervisor or court must consider whether the firm followed relevant guidance approved by the Treasury, which for accountants means the CCAB AML guidance for the accountancy sector. HMRC’s guidance adds that it may decide not to penalise where a breach resulted from unforeseeable circumstances, the firm is normally compliant, or it voluntarily disclosed weaknesses and is fixing them.

The defence only works if the firm can show what it did. A written risk assessment, documented client risk ratings and a record of training are the evidence a reviewer will look for.

Which failings lead to fines most often?

ICAEW completed 1,185 monitoring reviews in 2024/25. It found:

  • 12.6% of firms had ineffective risk assessment documentation, meaning ICAEW identified client risks the firm had not recorded;
  • 11.9% had ineffective client identification, such as missing beneficial owners or not understanding the client’s business;
  • 11.6% were not updating client due diligence during the relationship;
  • 10.2% had ineffective verification, often doing more ID checks when the actual risk was elsewhere.

ICAEW names the root causes as a lack of understanding of the regulations, insufficient risk assessment and over reliance on long standing client relationships, and says firms with income over £2m were over represented among those referred for follow up action. ICAS lists similar failings: unidentified beneficial owners, missing client risk assessments, no record of ongoing monitoring, no firm wide risk assessment and inadequate training.

The fixes are covered in firm wide risk assessments, client risk assessments and ongoing monitoring.

What mistakes make the outcome worse?

  • Treating a warning as the end of it. HMRC may treat a second breach of the same regulation as deliberate, which removes the carelessness reduction.
  • Not telling the supervisor about changes. Each missed notification is a separate breach.
  • Ignoring information requests. HMRC can issue a fixed penalty, suspend registration or treat non compliance as criminal.
  • Trading before supervision is in place. HMRC says the penalty for unregistered trading reflects how long the business traded, and it can treat any period of unregistered trading as a criminal matter.
  • Waiting to be found. Under HMRC’s framework an unprompted disclosure is worth up to 50% off; once a visit is booked, that reduction is largely gone.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.