Regulation 19 of the Money Laundering Regulations 2017 requires every practice in scope to have written policies, controls and procedures that address the risks found in its firm wide risk assessment, approved by senior management and reviewed regularly. They must be proportionate to the size and nature of the practice, which means a sole practitioner’s document can be short, but it cannot be a generic template unconnected to how the firm works.
Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.
What does regulation 19 require?
Regulation 19(1) requires a relevant person to:
- establish and maintain policies, controls and procedures to mitigate and manage effectively the money laundering and terrorist financing risks identified in its risk assessment under regulation 18(1);
- regularly review and update them;
- keep a written record of the policies, controls and procedures, of any changes made on review, and of the steps taken to communicate them, or changes to them, within the business.
Regulation 19(2) adds two conditions: they must be proportionate with regard to the size and nature of the business, and approved by senior management. A parallel duty in regulation 19A applies to proliferation financing risks identified under regulation 18A, with the same requirements for review, written records, proportionality and senior management approval. Many firms deal with both in one document.
The starting point is the risk assessment, so read this alongside our guide to the firm wide AML risk assessment.
What must the written policies cover?
Regulation 19(3) lists the minimum content:
| Area | Where the detail is |
|---|---|
| Risk management practices | Regulation 18 risk assessment |
| Internal controls | Regulations 21 to 24 |
| Customer due diligence | Regulations 27 to 38 |
| Reliance and record keeping | Regulations 39 and 40 |
| Monitoring and managing compliance, and internal communication | Regulation 19(3)(e) |
Regulation 19(4) then requires specific procedures for:
- identifying and scrutinising transactions that are unusually complex or unusually large given their nature, unusual patterns of transactions, and transactions with no apparent economic or legal purpose (wording updated by the Money Laundering and Terrorist Financing (Amendment) Regulations 2026);
- any other activity the firm regards as particularly likely to be linked to money laundering or terrorist financing;
- additional measures where products or transactions might favour anonymity;
- assessing and mitigating risk before and during the adoption of new products, new business practices or new technology;
- making sure anyone in the firm with knowledge or suspicion complies with Part 7 of the Proceeds of Crime Act 2002 or Part 3 of the Terrorism Act 2000, in practice by reporting internally. See suspicious activity reports.
Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.
Which internal controls sit alongside the policies?
Regulation 21 requires, where appropriate to the size and nature of the business:
- a member of the board or senior management appointed as the officer responsible for compliance;
- screening of relevant employees before and during appointment, covering their skills, knowledge and expertise, and their conduct and integrity;
- an independent audit function to examine the adequacy and effectiveness of the policies, make recommendations and monitor follow through.
A nominated officer to receive internal reports must be appointed regardless of size (regulation 21(3)), and the supervisor must be told within 14 days who was first appointed as compliance officer and nominated officer, and of any later change (regulation 21(4)). A sole trader who neither employs nor acts in association with anyone else is exempt from appointing either (regulation 21(6)). Regulation 21(8) also requires systems to answer enquiries from law enforcement about whether the firm has had a business relationship with a person in the previous five years.
Regulation 24 requires relevant employees to be made aware of the law and given regular training in recognising and dealing with suspicious activity, with a written record of the training given.
How do you keep them proportionate?
Proportionality is built into the Regulations. Regulation 19(5) allows a firm to take into account guidance issued by its supervisor or an appropriate body and approved by the Treasury in deciding what is proportionate. For accountants, ICAEW points members to the CCAB guidance. Practical pointers from ICAEW’s helpsheet for smaller practices:
- A sole practitioner with no relevant employees or agents need not appoint a nominated officer or compliance officer, and need not set up regular independent reviews unless asked by ICAEW.
- A relevant employee is one whose work is relevant to compliance or capable of contributing to identifying, mitigating, preventing or detecting money laundering. Client facing staff are usually relevant; a receptionist may not be, depending on the role.
- In a small practice the same person can be nominated officer and compliance officer, usually called the MLRO.
- Independent review does not have to mean external review. Existing quality monitoring can be extended to cover AML, proportionate to the business.
- Training records should at least show a summary of content, the date, who attended and any assessment results.
HMRC’s guidance for businesses it supervises suggests a policy statement that names the people responsible, sets out customer due diligence and monitoring procedures, commits to staff training, summarises monitoring controls and emphasises prompt reporting to the nominated officer. Its exact contents will depend on the business.
What does a proportionate document look like for a small practice?
Illustration only. A three partner practice with eight staff, mostly small company and self assessment work, might structure its manual as follows:
- Purpose, scope and senior management approval, signed and dated by the managing partner.
- Named MLRO and deputy, and how the supervisor was notified.
- Summary of the firm wide risk assessment, with the services and client types rated higher risk.
- Client acceptance: due diligence steps by client type, when enhanced due diligence applies, and when the firm will and will not rely on others.
- Ongoing monitoring cycle and trigger events.
- Red flags specific to the practice, such as unexplained cash, rapid changes of ownership, or refusals to explain the source of funds.
- Internal reporting form and the MLRO’s decision log.
- Staff screening on joining and annually, and the training plan.
- Record keeping periods and deletion of personal data afterwards.
- Annual review: who carries it out, how findings are recorded and how changes are communicated.
That is likely to run to a few pages, with checklists as appendices. Length is not the test; whether staff can follow it and whether it reflects the risk assessment is.
How often should they be reviewed?
Regulation 19(1)(b) says “regularly” without setting a frequency. Many firms choose an annual review, but certain events should prompt an earlier update:
- a change in the firm wide risk assessment;
- a new service, client type or delivery channel, such as onboarding clients entirely online, which regulation 19(4)(c) specifically requires to be assessed before and during adoption;
- findings from an internal review or a supervisor’s monitoring visit;
- changes to the law, such as the 2026 amending regulations.
Each change, and how it was communicated, must be recorded under regulation 19(1)(c).
What happens if the policies are missing or ignored?
The requirements in regulation 19 are relevant requirements, and under regulation 86 contravening a relevant requirement is a criminal offence, punishable on indictment by up to two years’ imprisonment, a fine or both. The court must consider whether the firm followed Treasury approved guidance, and it is a defence to show all reasonable steps and all due diligence were taken. Written, approved, communicated policies are the first evidence a firm has of those reasonable steps. Supervisors also act on failures through their own monitoring, covered in AML supervision for accountants.
What mistakes do practices make?
- Buying a template and never tailoring it to the firm’s services and risk assessment.
- No evidence of senior management approval.
- No record of how policies or updates were communicated to staff.
- Policies that describe procedures staff do not actually follow, such as a monitoring cycle nobody runs.
- Saying nothing about reliance on third parties, even though regulation 19(3)(d) requires it.
- Missing training records, or failing to notify the supervisor of a new MLRO within 14 days.
Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.
Related Accountapedia entries
- The AML independent audit function
- AML for sole practitioners
- AML training requirements for practice staff
- Screening relevant employees for AML
- The MLRO role in an accountancy practice
Related cover: Professional indemnity insurance for accountants and What professional indemnity insurance covers. For the whole practice, see insurance for accountants and fee protection schemes for your clients.
Sources
- legislation.gov.uk: SI 2017/692, regulation 19
- legislation.gov.uk: SI 2026/621, regulation 11
- legislation.gov.uk: SI 2017/692, regulation 19A
- legislation.gov.uk: SI 2017/692, regulation 18
- legislation.gov.uk: SI 2017/692, regulation 21
- legislation.gov.uk: SI 2017/692, regulation 24
- legislation.gov.uk: SI 2017/692, regulation 86
- legislation.gov.uk: SI 2017/692, schedule 6
- GOV.UK: Money laundering regulations your responsibilities
- ICAEW: Anti money laundering for smaller practices
Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.