FCA AML supervision is changing. Here's what to do now.

HM Treasury announced its preferred direction for UK AML supervisory reform in its March 2024 response to the June 2023 consultation "Reforming the Anti-Money Laundering and Counter-Terrorism Financing Supervisory Regime." The preferred model consolidates supervision of accountancy and legal practices under a smaller number of supervisors — moving away from the current 22-supervisor patchwork (HMRC plus 13 professional bodies for accountants, plus separate regimes for solicitors and licensed conveyancers). Specific commencement dates depend on the legislation needed to implement the chosen model, and as of mid-2026 not every step has been laid before Parliament — practices should follow gov.uk announcements as the timetable is confirmed.

The 2024 government response set out a preferred model called the Single Professional Services Supervisor (SPSS). The exact institutional housing of the SPSS — whether it sits inside the FCA, inside a new statutory body, or via a strengthened HMRC-PBS structure — is part of the implementation work. What is clear is that supervision will become more centralised, more consistent, and more evidence-driven than the current regime. "FCA-style scrutiny" is shorthand for the operating standard rather than necessarily the institutional name on the door.

Not overnight, and not necessarily in name. HMRC currently supervises around 30,000+ accountancy service providers that are not members of a professional body. The reform is expected to consolidate these into a smaller number of supervisors and raise the operating standard, but the transition will be staged and existing supervisor relationships will continue during any handover. The substantive change for MLROs is the standard of evidence expected, not which logo is on the inspection letter.

The current direction is consolidation rather than wholesale removal. The Office for Professional Body Anti-Money Laundering Supervision (OPBAS) was set up in 2018 specifically to drive consistency between the PBS bodies. The 2024 reform builds on OPBAS's findings, which have repeatedly identified inconsistent application across the PBS network. The practical effect for member firms is that supervision will become more uniform across PBS bodies, with the floor raised to match the better-performing supervisors.

FCA-style supervision means: (a) more frequent inspections targeted by risk and data analysis rather than random selection; (b) emphasis on documented evidence over recalled judgement; (c) thematic reviews that test specific issues across multiple firms; (d) lower tolerance for spreadsheet-based AML where the audit trail is fragile; and (e) more proactive enforcement where systemic failings are found. The Financial Crime Guide (FCG) and SYSC 6.3 set the tone for FCA-supervised firms already — the reform exports that operating standard to the wider accountancy and legal sector.

Based on FCA, OPBAS, and HMRC supervisory practice, the predictable opening requests are: (1) the firm-wide risk assessment under Regulation 18 — dated, signed, and current; (2) the written AML policy and procedures under Regulation 19, naming the MLRO appointed under Regulation 21; (3) a sample of CDD files showing identification, verification, beneficial ownership, source-of-funds where applicable, and ongoing monitoring evidence; (4) the training matrix under Regulation 24; (5) the internal SAR register and the firm's submission record to the NCA; and (6) the sanctions screening audit trail. All of this should be retrievable within the inspection window — typically 14 days.

Regulation 28 sets the standard customer due diligence requirement that applies to every relationship: identify the customer, verify identity from a reliable source, identify and take reasonable measures to verify beneficial owners (25%+ threshold), understand the purpose of the relationship, and apply ongoing monitoring. Regulation 33 is the enhanced due diligence overlay — it lists the situations where the standard CDD is not enough: high-risk third countries, PEPs and their associates, complex or unusually large transactions, transactions without apparent economic purpose, and any case the firm assesses as higher-risk. Regulation 35 then adds PEP-specific steps on top of Reg 33.

No — Regulation 28(2) requires the firm to take "reasonable measures" to understand the source of the customer's funds where the relationship is higher-risk or where Regulation 33 enhanced due diligence applies. For routine, low-risk relationships, source of funds is not formally mandated, but most well-run practices ask for it whenever a transaction is unusual relative to the client's profile. For PEPs, source of funds AND source of wealth are required under Regulation 35.

The OFSI consolidated list is the UK's official list of persons, entities, and ships subject to financial sanctions. It is maintained by the Office of Financial Sanctions Implementation, part of HM Treasury. Every regulated business, including accountancy practices, must screen new clients against the list and re-screen existing clients when the list is updated. A confirmed match triggers an immediate freezing obligation on any funds or economic resources held, plus a reporting obligation to OFSI — usually within the same business day for funds held. Sanctions obligations sit alongside MLR 2017 obligations, not inside them.

Regulation 40 of the MLR 2017 sets a five-year retention period. The clock runs from the end of the business relationship for ongoing relationships, or from the date of the transaction for one-off transactions. The retained records must include the CDD identification documents, the verification evidence, the risk rating decision, the screening results, the ongoing monitoring history, and the relevant correspondence. The five-year period is a minimum — some firms retain longer where there is an ongoing investigation or where their professional body recommends it.

Yes. The MLR 2017 applies to every business carrying on a relevant activity, regardless of size. A sole-practitioner accountancy practice has the same firm-wide risk assessment obligation under Regulation 18, the same CDD obligation under Regulation 28, the same SAR obligation under POCA 2002 sections 330–332, and the same record retention obligation under Regulation 40. The proportionality lies in how much process is appropriate — a sole practitioner with 30 clients runs lighter procedures than a 25-partner practice, but the obligations are not waived.

Spreadsheets are not banned, but they are increasingly hard to defend under FCA-style scrutiny. Three problems: (1) they do not produce a tamper-evident audit trail; (2) they depend on the MLRO who maintains them — when that person leaves, the institutional memory leaves with them; (3) they do not auto-screen against updated sanctions or PEP lists, so the firm misses changes between manual re-screens. Most firms that fail an inspection on evidence quality were running on spreadsheets. The pragmatic move is to digitise before the supervisor visit, not after.

Solicitors regulated by the SRA, CLC, Law Society of Scotland, or Law Society of Northern Ireland sit under their respective AML supervisory regimes, separate from HMRC and the accountancy PBS bodies. The reform direction affects them too — the SRA has been issuing thematic reviews on source-of-funds, particularly in conveyancing, that explicitly raise the evidence bar. Even where the institutional supervisor is unchanged, the operating standard is converging towards FCA-style expectations.

Certivus is built around the MLR 2017 obligations that an FCA-style supervisor will test against. The firm-wide risk assessment module addresses Regulation 18. The configurable AML policy templates address Regulation 19. The client onboarding flow addresses Regulations 28 and 28(2). The EDD workflow addresses Regulations 33 and 35. The OFSI-integrated sanctions screening addresses the SAMLA 2018 obligation. The audit-ready PDF export addresses Regulation 40 retention. Every workflow produces the dated, signed, evidence-backed output that an inspector expects to see. We are not a compliance advisor — your MLRO owns the judgement calls — but we make sure the evidence trail is there when the inspection arrives.

No software prevents enforcement on its own. Enforcement decisions are made by the supervisor based on the firm's overall conduct — including the MLRO's judgement, the practice's culture of compliance, and the substance of the AML work done. What software changes is the speed of evidence retrieval and the consistency of the audit trail. A firm using Certivus that has done the work properly will spend the inspection showing the inspector the evidence rather than reconstructing it. A firm using Certivus that has cut corners is still a firm that has cut corners — the software does not paper over substance.

For most practices, a working setup is in place within an hour. CSV upload imports the existing client list. The first verification runs in three minutes. The first audit-ready PDF exports with one click. For larger practices migrating evidence from existing tools, the typical cycle is one to two weeks — most of which is the firm reviewing and tidying client data, not Certivus implementation. The free tier (5 verifications per month, no credit card) is the right way to test the fit before deciding on a paid plan.