The Money Laundering Regulations 2017 Explained: What UK Firms Must Do
The Money Laundering Regulations 2017, often shortened to the MLRs, are the main UK rules requiring businesses to prevent money laundering and terrorist financing. They set out who is covered, how firms must assess risk, check their customers, keep records and train staff, and who supervises them. For MLROs and compliance officers, they’re the foundation of the role. This guide explains the regulations in practical terms.
What Are the Money Laundering Regulations 2017?
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 came into force on 26 June 2017. They’ve been amended several times since, including to extend their scope to crypto-asset businesses and art market participants, and to add requirements on proliferation financing. They sit alongside the Proceeds of Crime Act 2002, which creates the main money laundering offences and the duty to report suspicions.
Who Do the Regulations Apply To?
The MLRs apply to “relevant persons” in the regulated sector, including:
| Sector | Examples |
|---|---|
| Credit and financial institutions | Banks, building societies, investment firms, insurers (for some products), payment and e-money institutions, consumer credit firms |
| Crypto-asset businesses | Exchanges and custodian wallet providers |
| Professional services | Auditors, external accountants, tax advisers, insolvency practitioners, legal professionals |
| Trust and company service providers | Formation agents and businesses providing registered offices |
| Property | Estate agents and letting agents (above thresholds) |
| Other | High value dealers, casinos and art market participants |
Supervision
Each business is supervised by an anti-money laundering supervisor. The FCA supervises most financial services firms, including crypto-asset businesses. HMRC supervises many others, such as estate agents and money service businesses not supervised by the FCA, and professional bodies supervise their members, overseen by the FCA’s Office for Professional Body AML Supervision (OPBAS).
The Key Requirements
| Requirement | What it means in practice |
|---|---|
| Risk assessment | Assess the money laundering and terrorist financing risks the business faces, documented and kept up to date |
| Policies, controls and procedures | Proportionate policies covering due diligence, monitoring, reporting, record keeping and staff screening |
| Customer due diligence (CDD) | Identify and verify customers and beneficial owners, and understand the purpose of the relationship |
| Enhanced due diligence (EDD) | Additional measures for higher-risk situations, including PEPs and high-risk third countries |
| Simplified due diligence | Reduced measures where risk is genuinely low |
| Ongoing monitoring | Scrutinise transactions and keep customer information up to date |
| Nominated officer | Appoint someone to receive internal reports and report suspicions to the NCA |
| Officer responsible for compliance | Where appropriate to the firm’s size, appoint a board member or senior manager responsible for compliance with the regulations |
| Training | Make staff aware of the law and train them to recognise and report suspicious activity |
| Record keeping | Keep CDD records and transaction records, generally for five years after the relationship ends |
Customer Due Diligence in More Detail
CDD must be applied when establishing a business relationship, carrying out certain occasional transactions, when money laundering is suspected, or when there are doubts about previously obtained information. It involves:
- identifying and verifying the customer
- identifying beneficial owners, and taking reasonable measures to verify them and understand ownership and control
- assessing the purpose and intended nature of the relationship
- conducting ongoing monitoring
Enhanced due diligence applies in higher-risk cases, including relationships with politically exposed persons, customers established in high-risk third countries, complex or unusually large transactions, and correspondent relationships.
Firm-Wide Risk Assessment
Every firm must assess the risks of money laundering and terrorist financing to which its business is subject, considering its customers, countries, products, transactions and delivery channels. The assessment must be documented, kept up to date and provided to the supervisor on request. It should drive everything else: the level of due diligence, monitoring and training. Firms must also assess proliferation financing risk.
Staff Screening and Independent Audit
Where appropriate to the size and nature of the business, firms must screen relevant employees, both before appointment and during employment, assessing their skills, knowledge and conduct. They must also establish an independent audit function to examine and evaluate the adequacy and effectiveness of their anti-money laundering policies, controls and procedures. For smaller firms, this is often provided by an external reviewer. The results should be reported to senior management and acted on.
Penalties
Breaching the MLRs can lead to civil penalties from the supervisor, and some breaches are criminal offences, punishable by fines and imprisonment. The FCA has imposed substantial fines on firms for anti-money laundering failures, often citing weak risk assessments, poor customer due diligence and inadequate transaction monitoring. Individuals can also face action, including prohibition orders.
Guidance
- The FCA’s Financial Crime Guide sets out its expectations and examples of good and poor practice.
- The Joint Money Laundering Steering Group publishes detailed industry guidance for the financial sector, approved by HM Treasury.
- Sector-specific guidance exists for accountants, lawyers, estate agents and others.
Who Is Responsible Inside the Firm?
At firms within the Senior Managers regime, the MLRO holds SMF17 and is accountable for anti-money laundering systems and controls, and a Senior Manager holds the Prescribed Responsibility for the firm’s financial crime policies. See our guide to Prescribed Responsibilities. At smaller firms, the nominated officer and the officer responsible for compliance with the regulations are often the same person.
A growing consumer credit firm’s business-wide risk assessment hadn’t been updated since it launched a new online lending product. An internal audit found that its customer due diligence hadn’t been adjusted for the higher fraud and money laundering risk of the new channel. The MLRO updated the risk assessment, introduced additional verification checks for online applicants, retrained staff and reported the changes to the board in the annual MLRO report.
Recent and Future Changes
The MLRs have been amended several times since 2017, and the government has consulted on further reforms to make the regime more proportionate and effective. Changes have included extending the regulations to crypto-asset businesses, requirements on discrepancy reporting to Companies House, and adjustments to the treatment of domestic PEPs. MLROs should keep track of amendments and update policies accordingly.
Common Weaknesses Found by Supervisors
- generic firm-wide risk assessments not linked to the business
- customer risk assessments that don’t drive the level of due diligence
- weak verification of beneficial owners
- transaction monitoring with poorly calibrated scenarios and backlogs of alerts
- inadequate source of wealth evidence for high-risk customers
- training that doesn’t reflect the firm’s actual risks
Anti-Money Laundering Leadership
Recruitment for the people responsible for MLR compliance. Every SMF search is led personally by Adrian Lawrence FCA
MLRO Recruitment
Permanent, interim and fractional.
→ MLRO recruitment (SMF17)
→ Fractional and interim cover
Financial Crime Guides
Related topics.
→ Politically exposed persons
→ Sanctions screening
When It Goes Wrong
Reviews and enforcement.
→ Section 166 reviews
→ FCA enforcement trends
Every SMF search is led personally by Adrian Lawrence FCA
Frequently Asked Questions
What are the Money Laundering Regulations 2017?
The main UK regulations requiring businesses in the regulated sector to prevent money laundering and terrorist financing, through risk assessment, due diligence, monitoring, reporting and record keeping.
Who do the MLRs apply to?
Credit and financial institutions, crypto-asset businesses, auditors, accountants, tax advisers, legal professionals, trust and company service providers, estate and letting agents, high value dealers, casinos and art market participants.
Who supervises compliance with the MLRs?
The FCA, HMRC and professional body supervisors, depending on the business.
How long must records be kept?
Generally five years after the end of the business relationship or occasional transaction.
Do we need a nominated officer?
Yes. Businesses within scope must appoint a nominated officer to receive internal reports and report suspicions to the National Crime Agency.
About the Author
Adrian Lawrence FCA is the founder of SMF Capital. He is a Chartered Accountant and Fellow of the ICAEW, holds a practising certificate in his own name, and is a former listed-company Finance Director with a BSc from Queen Mary College, University of London. He founded FD Capital in 2018 and has since built a network of five specialist recruitment practices. He leads every SMF Capital MLRO search personally, matching candidates to each firm’s sector and money laundering risks. View Adrian’s ICAEW profile.
Need an MLRO Who Knows the Regulations Inside Out?
Tell us about your firm and its risks. We’ll find an MLRO with the right sector experience, permanent, interim or fractional.