Regulatory glossary

Plain-English summaries of every MLR / POCA / AMLGAS citation the platform surfaces. Inside the app, hover any citation badge to see the same summary in a popover. This article is the consolidated list.

MLR 2017 (Money Laundering Regulations)

reg 18: Firm-wide risk assessment

Every relevant business must identify and assess the risks of money laundering and terrorist financing to which its business is subject, taking account of risk factors relating to customers, products/services, geographic areas and delivery channels.

reg 18(4): Keeping the FWRA up to date

Keep an up-to-date written record of the steps taken to assess risk. AMLGAS expects a review at least annually and after any material change in the firm's business.

reg 18(6): Giving the FWRA to your supervisor

Provide the risk assessment, and the records behind it, to your supervisor when asked.

reg 19: Policies, controls & procedures (the PCP)

Firms must establish, maintain and apply written policies, controls and procedures to mitigate the AML/CTF risks identified in their FWRA. Must be proportionate, approved by senior management, and communicated to staff.

reg 19(3): Staff awareness of the PCP

Make sure relevant employees are aware of the law on money laundering and the firm's own PCP. In practice this means recording that each staff member has read and acknowledged the current PCP.

reg 21: Senior management / MLRO responsibility

A board member or senior officer must be responsible for the firm's compliance with the MLRs. The firm must also appoint a nominated officer (the MLRO) to receive internal SARs, and, where appropriate to the firm's size, arrange an independent audit of the AML controls.

reg 21(1)(c): Independent audit

Regular reviews of the firm's AML policies, controls and procedures by someone independent of the AML function: an external reviewer, or an internal audit, compliance or quality team. A review signed off by the MLRO is not independent. There is no staff-number threshold: the review should be proportionate to the size and nature of the firm, and only a sole practitioner with no relevant employees is exempt (AMLGAS 3.3 and 3.6.25).

reg 24: Staff training

Relevant employees must receive training so they understand the law on money laundering, can identify suspicious activity, and know what to do about it. Keep written records of the training given.

reg 28: Customer due diligence (CDD)

Identify the customer (and any beneficial owner) and verify identity from a reliable independent source. Understand the nature and purpose of the relationship. Conduct ongoing monitoring throughout the relationship.

reg 28(2)(a): Identity verification

Identify the customer and verify the customer's identity on the basis of documents or information from a reliable source which is independent of the customer.

reg 28(2)(b): AML screening

Identify and take reasonable measures to verify any beneficial owner, and screen the customer against PEP and sanctions data sources so adverse hits are surfaced before the relationship begins.

reg 28(2)(c): Risk-based assessment

Assess and obtain information on the purpose and intended nature of the business relationship, and assign a risk rating to the customer (low / medium / high) that drives the level of due diligence applied.

reg 28(4): Beneficial owners

For corporate customers, identify each beneficial owner (anyone who owns or controls more than 25% of the entity or otherwise exercises significant control) and take reasonable measures to verify their identity.

reg 28(11): Ongoing monitoring

Scrutinise transactions, keep CDD information up to date, and re-assess the customer's risk at trigger events or at least periodically.

reg 28(11)(b): Material change triggers

When the firm becomes aware of a change in circumstances relevant to the assessment of risk (new ownership, adverse media, sanctions designation), take steps to update the customer's CDD.

reg 33: Enhanced due diligence (EDD)

EDD must be applied in higher-risk situations: PEPs, high-risk third countries, complex/unusual transactions, or any case where the firm's own risk assessment indicates enhanced measures.

reg 33(1)(b): FATF call-for-action countries

From 30 June 2026 (S.I. 2026/621), EDD is compulsory for a client established in a country on the FATF list of High-Risk Jurisdictions subject to a Call for Action, or for a transaction where either party is established in one. The term "high-risk third country" is no longer used. Certivus also treats countries under UK financial sanctions as compulsory EDD. Countries on the FATF grey list (increased monitoring), or that the UK National Risk Assessment or the AASG Risk Outlook give you reason to treat as higher risk, are risk factors to weigh in the risk assessment, not compulsory EDD (AMLGAS 2026 4.6.17). Certivus refreshes its country list after each FATF plenary (February, June and October); if a newer plenary has been held, the risk assessment says the list is out of date instead of suggesting that a country is not listed.

reg 35: EDD for PEPs

For politically exposed persons (and their family / close associates): obtain senior management approval before opening the relationship, take adequate measures to establish source of wealth and source of funds, and apply enhanced ongoing monitoring.

reg 35(5)(b): Source of funds & wealth

For EDD cases, the firm must take adequate measures to establish the source of wealth (overall accumulated assets) and source of funds (the specific monies used in this relationship). 'Adequate' is risk-based; documentary evidence is usually expected.

reg 37: Simplified due diligence (SDD)

SDD can be applied in low-risk situations: typically listed companies, UK public bodies, or regulated financial institutions. SDD reduces but does not eliminate CDD requirements; the firm must still identify the customer and monitor the relationship.

reg 39: Reliance on third parties

A firm can rely on CDD already performed by another regulated entity (e.g. a UK accountancy firm, FCA-regulated firm) but remains liable for any failure. Reliance requires a written agreement and the underlying CDD information must be obtainable immediately on request. On the client profile, Reliance on Third-Party CDD records the written agreement (upload), the date you obtained the CDD information, and that the other firm confirmed it will provide copies of the documents on request within two working days.

POCA 2002 (Proceeds of Crime Act)

s.330: Failure to disclose (regulated sector)

A person working in the regulated sector who knows or suspects (or has reasonable grounds to) that another person is engaged in money laundering must make a SAR to the firm's nominated officer (MLRO) as soon as practicable. Failure is a criminal offence.

s.333A: Tipping off offence

Once a SAR has been made (or is being considered), it is a criminal offence to tell the customer or any other person that disclosure has been made if doing so is likely to prejudice an investigation.

AMLGAS

The Anti-Money Laundering Guidance for the Accountancy Sector (AMLGAS) is HM Treasury-approved sector guidance published by CCAB. The current edition is July 2026. Under section 1.3, courts must take it into account when deciding relevant breaches or offences, and supervisors will take it into account when assessing compliance. Firms that depart from a requirement labelled "must" should record their decision and why (AMLGAS 1.1.2).

AMLGAS ch.5: AML hit disposition

Every PEP / sanctions / adverse-media hit needs an MLRO disposition (cleared, confirmed, escalated) with reasoning recorded.

AMLGAS ch.6: Internal SARs

Walks accountancy firms through the practical SAR workflow: what to include, when to escalate to the NCA, and how to handle tipping-off risk.

Where to find the full text

Each citation badge in the platform deep-links to legislation.gov.uk for the canonical source. AMLGAS is published by the CCAB.