What is AML? Anti-money laundering explained for UK firms

AML stands for anti-money laundering: the risk assessment, controls, checks, records and reports that certain UK businesses must keep up by law so that their services are not used to hide the proceeds of crime. The duties come from the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, which bind the businesses they list when acting in the course of business carried on in the United Kingdom, and from the Proceeds of Crime Act 2002, which makes money laundering itself an offence in England and Wales, Scotland and Northern Ireland.

What counts as money laundering?

The Proceeds of Crime Act 2002 defines money laundering by its offences: concealing, disguising, converting or transferring criminal property; entering into an arrangement known or suspected to help someone else keep or use it; and acquiring, using or possessing it. For people working in the regulated sector, failing to disclose a suspicion is an offence too.

Which businesses does AML apply to?

Regulation 8 of the 2017 Regulations lists them: credit institutions; financial institutions; auditors, insolvency practitioners, external accountants and tax advisers; independent legal professionals; trust or company service providers; estate agents and letting agents; high value dealers; casinos; art market participants; cryptoasset exchange providers; and custodian wallet providers. The same regulation refers to a set of exclusions.

Each term is defined in the regulations that follow, and the definitions are narrower than the everyday words. An independent legal professional is in scope when taking part in financial or real property transactions, such as buying and selling property. An estate agent is a firm or sole practitioner carrying out estate agency work. A letting agent is one carrying out "letting agency work", which regulation 13 defines as work on a let of land for a term of a month or more at a monthly rent of £10,000 or more. A letting agency whose lets are all below that rent is not, on its lettings, within the definition.

Regulation 7 names the supervisors. The Financial Conduct Authority supervises financial firms, and its own page lists financial advisers among those normally covered. Professional bodies, among them the accountancy institutes and the Law Society, supervise their members. HMRC supervises, among others, the estate agents, letting agents and accountants that no other body supervises.

What must a firm in scope do?

• Assess its own risk. The firm identifies and assesses the money laundering and terrorist financing risks its business is subject to, and keeps an up-to-date written record.

• Write its policies, controls and procedures. They are proportionate to the size and nature of the business, approved by senior management and regularly reviewed.

• Appoint a nominated officer. Staff report suspicion to that person, who decides whether to send a suspicious activity report to the National Crime Agency. An individual who neither employs nor acts in association with anyone else is exempt.

• Train its staff. Relevant employees are made aware of the law and regularly trained to recognise what may be money laundering, with a written record.

• Carry out customer due diligence. Identifying each customer and verifying who they are is the part usually called KYC, set out in our explainer on what KYC means.

• Keep records. They are kept for five years, beginning when the business relationship ends or a one-off transaction is complete.

How does AML show up in a working day?

The duties sit on the firm, not on whoever ran a check, and the firm must hand its risk assessment to its supervisor on request. For an owner, AML usually shows up in the risk assessment written three years ago that describes a smaller firm, the training record nobody has updated since two people joined, and the junior who is uneasy about a client and unsure whom to tell. It also shows up in the new client who cannot be taken on until the file is complete: in an accountancy practice after the signed proposal, in a law firm at the opening of a matter within scope, in an estate agency when an offer is accepted.

What is AML confused with?

• KYC. Knowing your customer is one part of AML. The rest is the firm's own: risk assessment, policies, nominated officer, training, reporting and records.

• A duty on every business. The Regulations bind only the businesses they list, while the offences in the Proceeds of Crime Act can be committed by anyone. The FCA makes the point about mortgage brokers: "Although mortgage brokers, general insurers and general insurance brokers are not bound by our AML rules and the Money Laundering Regulations, they still need systems and controls to prevent financial crime." It adds that the Proceeds of Crime Act applies to them.

• A file completed once. The risk assessment is kept up to date, the policies are regularly reviewed and the training is regular.

Where does an AI worker fit, and where does it stop?

The part an AI worker can take on is the administration around due diligence, set out in our explainer on KYC, on our page for client onboarding and KYC and in our guide to onboarding in an accountancy practice. The firm-wide duties in this article are the firm's own and are not administration to hand over.

The risk assessment, the policies, the nominated officer's decision on a suspicion and whether to report stay with named people. An AI worker that meets something that does not look right stops and hands it over, a line drawn in is it safe to let AI handle AML and KYC admin. This article describes the law as read on 3 October 2026 and does not advise on compliance.

For a firm in scope the worker would gather and prepare each client's file, and your people would make every decision in it. If new clients are waiting on an incomplete due diligence file, talk to our agent.