Every accountancy practice covered by the Money Laundering Regulations 2017 has a supervisor, either its professional body or HMRC, and that supervisor must monitor it on a risk based approach. A review tests whether the firm wide risk assessment, written policies, training and client due diligence actually work in practice, usually by sampling client files and questioning the people responsible. The findings that come up most often are weak client identification, risk assessment and verification, so those are where preparation pays off.

Who reviews an accountancy practice, and why?

Regulation 46 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017) requires each supervisory authority to monitor the businesses it supervises effectively and take the measures needed to secure their compliance. It must adopt a risk based approach and base the frequency and intensity of its on site and off site supervision on the risk profiles it has prepared. Regulation 46(4) specifically requires it to review firms’ risk assessments under regulation 18 and the adequacy and implementation of their policies, controls and procedures under regulations 19 to 21 and 24.

For accountants the supervisor is usually a professional body such as ICAEW, ACCA, ICAS or AAT, or HMRC for firms with no professional body supervisor. See AML supervision for accountants. The professional bodies are themselves supervised by the Office for Professional Body Anti Money Laundering Supervision (OPBAS), which is part of the FCA.

This structure is due to change. In October 2025 the government announced that the FCA will take over AML supervision of accountancy, legal and trust and company service providers. The FCA says nothing changes immediately, firms should keep following their current supervisor, and it expects to begin taking on supervision from late 2028 with the transition completing around 2030.

What form does a review take?

HMRC’s guidance says it may check compliance through visits or office based checks such as telephone or desk based reviews, and that an office based check will often be enough. It generally phones to arrange a visit, then writes to confirm the date, who the officer wants to speak to, and the records they want, although they may ask for more on the day. HMRC can also visit without an appointment. Unless the business is large or complex a visit usually takes less than a day.

ICAEW’s leaflet on on site Practice Assurance reviews describes a pre review call, usually 7 to 14 days before the review, followed by a review that typically covers a sample of client files. Findings are recorded in a closing record discussed at a closing meeting, and the firm is asked to respond in writing within 15 days explaining what action it will take and by when. ICAEW also uses each firm’s annual return to monitor it between reviews, and risks shown there can bring a review forward.

What powers does the supervisor have?

Under regulation 66 a supervisor can, by written notice, require a firm to provide information, produce documents, or attend and answer questions, and regulation 66(1A) confirms this includes a copy of any suspicious activity disclosure made to the National Crime Agency. Regulation 69 gives duly authorised FCA and HMRC officers power to enter and inspect business premises without a warrant where they have reasonable grounds to believe the requirements may have been breached. HMRC’s guidance says its officers look at suspicious activity reports only for AML purposes and not for tax purposes.

What will the reviewer look at?

HMRC says its officers will always check the register details are correct, check that the right people have supervisor approval, look at the risk assessment of customers, products and services, look at the policies, controls, procedures and training, and ask the firm to explain how they work. Records an officer might ask for include:

  • internal audits of compliance with the firm’s own AML procedures;
  • evidence of customer identity;
  • training records;
  • a job description for the senior manager responsible for AML compliance;
  • records of suspicious transactions, the action taken, and copies of any reports to the National Crime Agency.

ICAEW’s list of documents for a review includes the firm’s most recent review of compliance with MLR 2017. On client files, ICAEW says its reviewers re perform the client risk assessment using the firm’s know your client information, open source checks and red flag sources such as the Accountancy AML Supervisors’ Group Risk Outlook, then compare what they find with what the firm recorded.

The approval check comes from regulation 26, which prohibits anyone acting as a beneficial owner, officer or manager of an accountancy firm, or as a sole practitioner, without approval from the supervisor. See AML for sole practitioners.

What do reviewers commonly find?

ICAEW’s 2024/25 AML supervision report records 1,185 monitoring reviews in that year and says the most common issues were customer due diligence, risk documentation covering policies, procedures and controls, and training. Its published figures include:

Finding Share of firms reviewed
Ineffective risk assessment documentation 12.6%
Ineffective client identification procedures 11.9%
Not updating due diligence during the relationship 11.6%
Ineffective verification procedures 10.2%

ICAEW explains that identification failures include missing beneficial owners and not understanding the client’s business or the jurisdictions it operates in. A verification failure it describes is doing more identity checks on a beneficial owner when the actual risk lay in transactions with a high risk third country. The root causes it identifies are a lack of understanding of the regulations, insufficient risk assessment, and over reliance on long standing client relationships. See customer due diligence and ongoing monitoring.

How should a practice prepare?

  • Close out the last review. ICAEW says it reports firms to its Practice Assurance Committee each year where they have not acted on issues from their previous review, often resulting in follow up action or a financial penalty.
  • Bring the firm wide risk assessment up to date. Regulation 18(4) requires an up to date written record unless the supervisor has said otherwise, and regulation 18(6) requires it to be provided on request. See firm wide AML risk assessment.
  • Check the policies are approved and current. Regulation 19(2) requires them to be proportionate and approved by senior management, and regulation 19(1)(b) requires regular review.
  • Test a few client files yourself. Pick higher risk clients and check identification, beneficial ownership, the written risk assessment, verification matched to the risk, and evidence of updates.
  • Find the training records. Regulation 24(1)(b) requires a written record of training given to relevant employees. See AML training.
  • Brief the right people. HMRC says the owner must be available at the start, and the person responsible for compliance should be present throughout. An adviser may attend but cannot answer for the business.

What happens after the review?

HMRC says it will write setting out any action needed, warn the firm if it may be liable to a penalty or other sanction, and in some serious cases issue a penalty notice immediately, with a reasonable time allowed to put things right. Its civil penalty power is in regulation 76, which applies to HMRC and the FCA. Regulation 76(4) prevents a penalty where the firm took all reasonable steps and exercised all due diligence, and regulation 76(6) requires the supervisor to consider whether the firm followed relevant approved guidance. Regulation 78 also allows HMRC and the FCA to prohibit an officer knowingly concerned in a breach from holding a management role.

Professional bodies act under their own disciplinary rules, which regulation 49 requires to make breaches liable to effective, proportionate and dissuasive measures. ICAEW lists sanctions including exclusion, unlimited fines, public reprimands, and conditions such as follow up reviews and training.

What does a review look like for a small firm?

Illustration only. A three partner practice receives notice of an on site review. In the pre review call the reviewer asks for the firm wide risk assessment, the policies and the last annual compliance review. The partners notice their risk assessment was last updated two years ago and refresh it before the visit. On the day the reviewer samples eight client files, re performs the risk assessment on a property client with an overseas shareholder and finds the firm had not identified that shareholder as a beneficial owner. The closing record lists that point and a gap in training records. The firm responds within 15 days with dated actions, and at the next review the reviewer checks those actions were completed.

What mistakes do firms make?

  • Treating the risk assessment as a one time document rather than something updated as the client base changes.
  • Collecting identity documents without recording why the client is low, medium or high risk.
  • Relying on long standing knowledge of a client instead of documented due diligence updates.
  • Promising actions in the closing response and not completing them before the next review.
  • Failing to notify the supervisor of changes in principals or ownership, which can leave someone acting without approval.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.