Since 1 September 2022, regulation 18A of the Money Laundering Regulations 2017 has required every supervised practice to identify and assess the risk that it could be used for proliferation financing, meaning finance for chemical, biological, radiological or nuclear weapons in breach of UN based financial sanctions. For most accountancy practices the risk is low, but it still has to be considered, recorded and backed by proportionate policies under regulation 19A.

What is proliferation financing?

Regulation 16A(9) defines proliferation financing as providing funds or financial services for use, in whole or in part, in the manufacture, acquisition, development, export, trans shipment, brokering, transport, transfer or stockpiling of chemical, biological, radiological or nuclear weapons, or otherwise in connection with their possession or use. That includes their means of delivery and other CBRN related goods and technology, including dual use goods used for non legitimate purposes. The final element is the most important: the activity must be in contravention of a “relevant financial sanctions obligation”, which the regulation ties to sanctions regulations made under the Sanctions and Anti Money Laundering Act 2018 so far as they relate to UN Security Council obligations.

That makes the definition narrower than it first appears. HMRC’s Economic Crime Supervision Handbook, at ECSH33206, states that the PF sanctions regimes relate only to the Democratic People’s Republic of Korea (North Korea) and Iran. Proliferation financing is therefore a sanctions evasion risk, not a proceeds of crime risk, and it can arise even where the money involved is entirely clean.

What does regulation 18A require?

Regulation 18A was inserted by the Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 with effect from 1 September 2022. It requires a relevant person to:

  • take appropriate steps to identify and assess the proliferation financing risks to which its business is subject (reg 18A(1));
  • take into account the Treasury’s proliferation financing risk assessment report under regulation 16A, and risk factors relating to its customers, the countries or geographic areas in which it operates, its products or services, its transactions and its delivery channels (reg 18A(2));
  • decide what steps are appropriate by reference to the size and nature of its business (reg 18A(3));
  • keep an up to date written record of the steps taken, unless its supervisor notifies it in writing that this is not required (reg 18A(4)); and
  • provide the assessment, the information it was based on and the record to its supervisor on request (reg 18A(5)).

How does it differ from the money laundering risk assessment?

The structure deliberately mirrors regulation 18, which governs the firm wide AML risk assessment. Three differences are worth noting:

  • The reference point. Regulation 18(2)(a) points to information made available by the supervisory authority. Regulation 18A(2)(a) points instead to the Treasury’s national risk assessment of proliferation financing.
  • The nature of the risk. Money laundering risk is about handling or facilitating the proceeds of crime. Proliferation financing risk is about the practice’s services being used, knowingly or not, to move funds or provide financial services in breach of the North Korea and Iran related UN measures.
  • The follow through. Regulation 19A requires policies, controls and procedures for the PF risks identified. HMRC’s handbook notes that it largely mirrors the money laundering equivalent, but there is no requirement for the PF policies to include reliance on third parties or record keeping.

Most firms do not need a separate document. ICAEW’s firm wide risk assessment Q&A says that where a practice has no clients going anywhere near the relevant jurisdictions and none producing dual use goods, weapons or chemicals, it should be sufficient to write a sentence to that effect at the end of the firm wide risk assessment. ICAEW’s view is that the risk of proliferation financing in its firms is predominantly low.

What does the national risk assessment say about accountants?

HM Treasury published the UK’s first national risk assessment of proliferation financing on 23 September 2021, and it remains the published version. It does not single out accountants as a high risk sector, but several findings bear directly on practices:

  • The ease of establishing companies in the UK is a vulnerability. Proliferators can set up front companies for procurement and replace them quickly when one is exposed.
  • A trust or company service provider can be used to buy “shelf” companies with established banking histories, or to provide nominee shareholders or directors that increase the anonymity of the beneficial owners.
  • Companies House has been linked to a number of PF cases, including UK entities used to own vessels trading North Korean coal.
  • Awareness of PF risk among designated non financial businesses and professions is generally low, which the assessment says could be a particular risk for trust and company service providers.
  • Sanctioned actors linked to North Korea and Iran increasingly use cryptoassets to raise and move funds.

ICAEW reported in early 2026 that HM Treasury was surveying regulated firms ahead of an update to the national risk assessment, so practices should watch for a revised version and refresh their assessment when it appears.

Which clients and services raise the risk?

Using the five risk factor headings in regulation 18A(2)(b), the points a practice should think about include:

  • Customers: manufacturers, distributors or exporters of goods that may be dual use, such as specialist machinery, electronics or chemicals; shipping, freight and logistics businesses; and clients with owners, directors or trading partners connected to North Korea or Iran.
  • Countries: any exposure to the relevant jurisdictions, and to transhipment hubs used to disguise the end user. The FATF high risk lists already captured in the AML assessment are a useful cross check; see high risk third countries.
  • Services: company formation, registered office and nominee services; handling client money; and payroll or bookkeeping that gives visibility of international payments.
  • Transactions: payments routed through unrelated third parties, unusually complex structures, or trade that makes no commercial sense for the client’s business.
  • Delivery channels: clients onboarded entirely remotely, particularly from overseas.

Screening clients against the UK sanctions list sits alongside this and is covered in our page on sanctions checks for accountants.

What policies and controls follow from the assessment?

Regulation 19A requires policies, controls and procedures that are proportionate to the size and nature of the business and approved by senior management, regularly reviewed, and recorded in writing along with the steps taken to communicate them. They must provide for scrutiny of unusually complex or unusually large transactions, unusual patterns, and transactions with no apparent economic or legal purpose, and for assessing PF risks before adopting new products, practices or technology. In practice most firms add a short PF section to their existing AML policies, controls and procedures rather than writing a new manual.

How might a small practice document this?

Illustration only. A three partner practice has about 400 clients, mostly UK owner managed businesses and landlords. It does not offer company formation or nominee services. One client is an engineering company that exports precision components to customers in several countries.

The firm’s assessment records that it has no clients, owners or known counterparties connected to North Korea or Iran, that it screens new clients and beneficial owners against the UK sanctions list, and that its overall PF risk is low. It then identifies the engineering client as the one area of higher exposure, because some components could be dual use. The control is proportionate: the client file records the client’s own export licensing arrangements, the engagement partner reviews the export customer list at each year end, and staff know to refer any unexplained change in destinations or payment routes to the MLRO. The assessment is dated, approved by the partners and diarised for review when the national risk assessment is updated.

What are the common mistakes?

  • Having no PF assessment at all because the firm assumes the risk is nil. HMRC’s guidance says most businesses will not encounter significant PF risks, but this must be carefully considered and documented.
  • Copying the money laundering assessment and changing the heading, without considering sanctions exposure or dual use goods.
  • Treating proliferation financing as the same as terrorist financing or general sanctions screening.
  • Ignoring the firm’s own services, particularly company formation and registered office work, which the national risk assessment identifies as a UK vulnerability.
  • Never revisiting the assessment after 2022.

HMRC’s handbook tells its supervision staff how to approach breaches of regulations 18A and 19A, so this is checked; see our page on AML supervision for accountants.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.