HMRC AML Enforcement: Visits, Penalties and Appeals

If HMRC supervises your firm for anti-money laundering, it can check your compliance, issue warning letters, charge penalties, and in serious cases suspend or cancel your registration or refer you for prosecution. This guide sets out how that process works, using HMRC's published guidance on GOV.UK: the pages on money laundering supervision sanctions and appeals and on civil measures, and the Economic Crime Supervision Handbook (ECSH) page on types of intervention. It is general information, not legal advice. Some of HMRC's pages were updated at different times, so check the current versions before relying on a detail.

Our guides to HMRC AML supervision, registration and fees and to HMRC's sector risk assessment for accountancy service providers cover the earlier stages.

How HMRC checks compliance

According to the ECSH page on types of intervention (published 26 May 2023 and last updated 20 October 2026), HMRC's Economic Crime Supervision team uses ten types of intervention, which can be combined in a single case: telephone calls; desk-based checks; face-to-face visits; unannounced visits; visits to HMRC large businesses; visits to businesses with branches; visits to money service business agents; periods of intensification or days of action; visits with other stakeholders; and pre-registration interventions.

An intervention can be a full compliance check or an aspect check. A full check examines all of a business's compliance with the Money Laundering Regulations 2017 and is carried out by compliance investigations. An aspect check, sometimes called a targeted intervention, focuses on one or more areas. The handbook says that if an aspect check reveals other breaches, the caseworker should not ignore them and may extend the check or refer the case to another team. Much of the remaining detail on that page is not published.

What sanctions HMRC can use

GOV.UK's guidance on sanctions and appeals lists financial penalties, other civil sanctions that range from warning letters to suspending or cancelling registration, a censuring statement, a management prohibition, publication of details of non-compliant businesses, and criminal prosecution in more serious cases. HMRC's civil measures page adds information notices requiring documents or an interview, refusal or removal of fit and proper status, inspection of premises without a warrant, and court orders.

When HMRC uses warnings and when it goes straight to penalties

The civil measures page (last updated 6 August 2024 when we reviewed it) says most businesses comply and HMRC focuses on higher-risk areas and on the minority that do not. It treats deliberate or persistent non-compliance more severely, and a penalty or criminal investigation can follow even a first breach. Warning letters are typically used first, but they are skipped where breaches are serious, widespread, knowing, involve unregistered trading, or ignore an information notice. Penalties may also be skipped where the business took all reasonable steps, unforeseeable circumstances applied, the business is normally compliant, or it voluntarily disclosed weaknesses and is fixing them.

How penalties are set

HMRC's guidance gives no formula or fixed ranges. It says the amount depends on the reason for non-compliance, the seriousness of the failure, the business's compliance history and relative size, any benefits received, and the amount exposed to money laundering. Penalties must be proportionate and act as a deterrent, and they are not for raising revenue. They are reduced for an unprompted disclosure, meaning you contact HMRC before it contacts you about an enquiry or intervention. Before a penalty, HMRC may issue a pre-penalty notice, which gives 30 days to respond, though this can be skipped for straightforward cases or where speed is needed. Individual officers can also be penalised if they knowingly take part in a breach.

The sanctions administration charge

GOV.UK's guidance describes a charge added on top of the penalty. For breaches such as customer due diligence, failing to register for supervision, policies and controls, record keeping and risk assessment, the charge is £2,000, capped at the value of the penalty if the penalty is under £2,000. For failing to tell HMRC about business changes or failing to provide requested information, it is up to £2,000. The update history records that the charge was extended from 1 December 2025 to cover all civil sanctions, including suspensions, cancellations, censuring statements and management prohibitions, with updates on 23 December 2025, 15 January 2026 and 28 January 2026. We did not review the detail behind the 28 January 2026 amendment to the amount for other sanctions, so check the page for the current figure.

Publication

The civil measures page says HMRC must publish penalties, censuring statements and management prohibitions. Details typically stay online for 5 years and can include the business name, address, the nature and value of the breach and appeal status. HMRC may publish anonymously or delay publication if full disclosure would be disproportionate, and it will not publish if financial market stability could be affected or the penalty is minor. Suspensions and cancellations may also be published, with 14 days to make representations. Our summary of the biggest AML fines and lessons for firms shows what published enforcement can look like.

Challenging a decision

GOV.UK says HMRC usually offers a review by an officer not involved in the original decision. If you disagree with the outcome, you can appeal to the tribunal. If the decision refused registration, or suspended or cancelled it, you cannot carry out regulated activity during the review. The civil measures page gives more detailed timings: 30 days to appeal most decisions, an independent HMRC review usually within 45 days, and then 30 days to appeal to the First-tier Tribunal. Because the two pages were updated at different times, confirm the current timings with HMRC.

Criminal liability

The civil measures page notes that breaches can alternatively be treated as criminal matters. It gives the maximum sentences as up to 2 years' imprisonment plus a fine under the regulations, up to 3 months and an unlimited fine for certain approval offences, up to 5 years under the Terrorism Act and up to 14 years under the Proceeds of Crime Act, each with a fine.

Preparing for a visit (our suggestions)

These points are our own, not HMRC requirements:

• Keep your business risk assessment, policies and training records in one place, dated and signed off.
• Test your controls before HMRC does, using an independent review as described in our guide to independent AML audit and testing.
• Pick sample client files and check that identity, ownership and risk rating are recorded and consistent.
• If you find a weakness, fix it and consider telling HMRC before it contacts you, since the guidance says an unprompted disclosure reduces a penalty.
• Know who in the firm responds to an HMRC information request, and log any deadline HMRC sets in its notice.

Frequently asked questions

Does HMRC always warn before fining?

No. Warning letters are typically used first, but HMRC's civil measures page says a penalty can follow even a first breach, and warnings are skipped where breaches are serious, widespread, knowing or involve unregistered trading.

Will my penalty be made public?

HMRC must publish penalties, censuring statements and management prohibitions, usually for about 5 years, subject to the exceptions in its guidance.

Can I appeal?

Yes. HMRC usually offers a review, and you can appeal to the tribunal if you disagree with the outcome.