AML Policies, Controls and Procedures for Accountants: What to Include

Every UK accountancy firm that is covered by the Money Laundering Regulations 2017 needs written anti-money laundering (AML) policies, controls and procedures, often shortened to PCPs. Supervisors ask to see them, test whether staff follow them, and find fault when they are generic or out of date. This guide sets out what HMRC says PCPs must contain, who must approve them, how often to review them, which records to keep and for how long, and what supervisors have found going wrong in practice. It draws on HMRC's AML guidance for supervised businesses and on a published review of firms by the Institute of Financial Accountants (IFA). Other supervisors such as ICAEW and ACCA publish their own templates and expectations, so check yours. This is general information, not legal advice.

PCPs start with the risk assessment

HMRC says you cannot develop effective PCPs until you have properly identified and assessed your risks. The firm-wide risk assessment is the starting point, and the PCPs must address each risk it identifies. HMRC expects the assessment to cover customers and beneficial owners, products and services, delivery channels and geographic areas, to be tailored to your business, and to be adapted if you start from a template. Our guide to the firm-wide AML risk assessment shows how to build it. The rest of this guide assumes you have one.

What the PCPs must cover

According to HMRC, PCPs must be risk-based, with enhanced measures for higher-risk situations, and must address:

• Customer due diligence. Simplified, standard and enhanced, including reliance on third parties. HMRC reminds firms that they remain liable even if a third party applies CDD.
• Politically exposed persons. Including source of wealth and funds, senior management approval and enhanced monitoring.
• Suspicious activity reporting. Internal reports to the nominated officer, and onward disclosure to the National Crime Agency.
• Training and record keeping. Including the ability to respond to enquiries about business relationships from the past five years.
• Monitoring. Of high-risk transactions, with measures for anonymity-favouring transactions and for assessing new products or technology.

A useful way to structure your own document is to follow that list, with a short section for each and a named owner.

Approval, communication and review

HMRC sets out clear housekeeping expectations:

• In writing. PCPs must be recorded in writing and updated after any review or change.
• Senior management approval. Senior management must approve them when first implemented and after any review or change, and the approver's name and the date should be recorded.
• Annual review at least. HMRC says PCPs should be reviewed at least annually, even without changes, and the review recorded. They should also be reviewed whenever the risk assessment changes.
• Communication. They must be communicated to all staff, agents, branches and subsidiaries, with the steps recorded, on appointment, whenever changes are made, and at least annually.
• Version history. Records of changes and previous versions must be kept for at least five years.

For a small practice, a front page with the version number, approval date, approver and next review date does most of this work.

Training and the nominated officer

HMRC says relevant employees and agents must know the law, be regularly trained to recognise risks, and understand their reporting duties. Your PCPs should name who receives internal reports and who decides on onward disclosure. Our guide to the MLRO role in an accountancy firm sets out those duties, and our guide to AML training for accountants explains how to plan and record training.

Staff screening and independent audit

For larger or more complex businesses, HMRC says the PCPs should also cover staff screening, including right-to-work checks for non-UK staff, basic DBS checks before appointment, checks for overseas relevant convictions, and a duty for staff to report relevant convictions. It also expects larger or more complex firms to have a process for independently auditing the PCPs for adequacy, effectiveness and compliance, and adds that relying on an audit does not transfer responsibility from the firm. HMRC expects this where, for example, a business has multiple premises, high customer turnover, cross-border trading or complex service delivery. A sole practitioner may reasonably decide it does not apply, but should record that decision.

Records: what to keep and for how long

HMRC's record keeping guidance says firms must keep copies of the documents and information used for customer due diligence, plus supporting records for transactions that are sufficient to reconstruct each one. It also lists other records worth keeping: risk assessments, policies and procedures, training records, internal and external reports, copies of suspicious activity reports and compliance monitoring records. Identification and transaction records must be kept for five years after the business relationship ends, or after an occasional transaction is complete.

When the five years expire, HMRC says personal data must be deleted unless another law requires retention, there are reasonable grounds to believe it is needed for legal proceedings, or the data subject has consented. Responsibility stays with the firm even if record keeping is delegated, and records held overseas must still meet UK requirements.

What supervisors find going wrong

The IFA published the results of its 2021/22 reviews in March 2023. It found 38 per cent of the firms it reviewed were non-compliant with the 2017 Regulations. Among the non-compliant firms:

• 89 per cent had no written firm-wide risk assessment or an inadequate one, such as a blank template or an unadapted third-party document;
• 79 per cent lacked appropriate policies, or had not reviewed them regularly, and some had copied them from other sources;
• 91 per cent had no annual AML compliance review or had not completed required training; and
• 87 per cent could not show relevant employees had undertaken appropriate, regular AML training.

The figures are a few years old and relate to one supervisor's population, but the pattern is consistent: generic documents and missing records are what cause trouble.

A skeleton for your own PCPs

1. Cover page. Version, approver, approval date, next review date.
2. Risk assessment summary. What your main risks are and where the full assessment is kept.
3. Roles. Who is the nominated officer, who is responsible for AML compliance, and who covers absences.
4. Client onboarding. Which checks apply at each risk level, and what happens if checks cannot be completed.
5. Ongoing monitoring. Review intervals by risk band and what triggers an early review.
6. Reporting. How staff raise concerns and what they must not say to clients.
7. Training. Who is trained, how often and where records are kept.
8. Records. What is kept, where, for how long and how it is deleted.
9. Review and audit. How and when the PCPs are reviewed, and by whom.

Our CPD courses can help your team understand the procedures you write.

Frequently asked questions

Do small firms need written AML policies?

HMRC says PCPs must be recorded in writing. Their length can be proportionate to the size and risk of your firm.

How often must PCPs be reviewed?

At least annually, according to HMRC, and whenever the risk assessment changes. Record the review even if nothing changes.

Can I use a template?

You can start with one, but it must be adapted to your firm. The IFA found firms with unadapted or copied documents among the non-compliant.

How long must I keep AML records?

Five years after the business relationship ends or the occasional transaction is complete, according to HMRC, and then delete personal data unless an exception applies.

Does an outside audit transfer responsibility?

No. HMRC says relying on an audit does not transfer the firm's compliance responsibility.