Read with the right scope
UK organisations assessing whether they are relevant persons under the Money Laundering Regulations 2017; sector-specific requirements need separate checking.
Status: Law and supervisory guidance, with suggested assurance steps
Establish the correct perimeter
The Money Laundering Regulations 2017 apply to defined relevant persons and activities, subject to the statutory definitions and exclusions. A company name or broad sector label is not enough to determine scope. Record what the organisation actually does, where it operates and which supervisory authority is relevant. Revisit that assessment before adding a materially different service.
Regulation 18 requires relevant persons to assess money laundering and terrorist-financing risks; regulation 18A addresses proliferation-financing risks. Regulations 19 and 19A connect the identified risks to proportionate policies, controls and procedures. Their requirements should be checked against the current amended text and the guidance applicable to the firm's supervisor.
Join the policy to the case
For firms supervised by it under the MLRs, the FCA emphasises a business risk assessment, appropriate systems and controls, due diligence and ongoing review. It also highlights the need to assess risk before introducing new technology. FCA material is not a substitute for the rules and guidance of another profession's supervisor.
A practical assurance map can link each significant business risk to the operational steps intended to manage it. For example, a complex ownership risk may connect to an ownership investigation, evidence requirements, escalation criteria and approval. The purpose is to make clear what staff should do when the expected evidence is unavailable or contradictory.
Test evidence, not just completion ticks
Use a documented sample tailored to your exposure. Include higher-risk and unusual cases as well as ordinary work. An unexplained green indicator should prompt a question, not end the review.
- Can the reviewer understand why the customer and activity were assigned that risk level?
- Does the file support ownership, due diligence and any enhanced measures relied on?
- Were alerts and exceptions resolved by someone with suitable authority?
- Is ongoing monitoring aligned to the relationship and its changes?
- Were recurring weaknesses taken back into procedures, training and management reporting?
Keep the assurance conclusion bounded
State the population, period, sample, criteria, limitations and findings. Assign remedial actions and retest material weaknesses. Regulation 21's independent audit requirement depends on the size and nature of the business; do not assume every business needs the same audit structure.
AML.me.uk provides a related independent reference library. This guide is a starting point for governance and review, not registration, supervisor approval, a legal opinion or certification of the organisation's controls.
Put the guide to work
Start with the evidence.
- An activity-based scope and supervisor assessment, including exclusions and unresolved questions.
- A business-risk record linked to operational procedures and escalation criteria.
- Restricted case references showing risk rationale, due diligence and the handling of exceptions.
- A defined review sample, findings, management response and retest evidence for significant weaknesses.
Your first three steps
- Confirm the actual activity and supervisory context before choosing the review criteria.
- Choose a material business risk and trace it through selected ordinary and unusual cases.
- Take recurring case weaknesses back into procedures, training and accountable remediation.
Common gaps to look for
- The practice label is treated as a complete scope assessment.
- A green completion indicator lacks supporting case evidence.
- The review uses another sector’s guidance without checking applicability.
Review when: Reassess before a materially different service or technology is introduced, and after recurring case weaknesses or relevant source changes.
Suggested working method. Apply the source requirements and scope explained in this guide.
Part of the compliance guidance hub. See how the GRC framework connects the disciplines.
Connect this to your review
Link the risk, control, obligation and next action in the review workspace. Record what is known, what needs checking and which decision follows. The workspace organises your records; it does not inspect or independently verify evidence.
Sources & verification
- Money Laundering Regulations 2017 — scope, risk assessment, controls and audit ↗Source checked 1 November 2026 · Primary source
- FCA — Money laundering and terrorist financing ↗Source checked 1 November 2026 · Primary source
- Related independent publication — AML.me.uk ↗Source checked 1 November 2026 · Related independent publication · not a primary legal authority
The source list records when each reference was checked. AI-assisted research and drafting; no independent human legal review is claimed. Check for later changes and advice appropriate to your circumstances.