HMRC Sector Risk Assessment for Accountants: What AMLG3700 Says

If your firm is supervised by HMRC for anti-money laundering, there is a document you are expected to read and to build into your own risk assessment: HMRC's sector risk assessment for accountancy service providers. A refreshed version was published on 8 July 2026 and updated on 16 July 2026 in HMRC's anti-money laundering guidance for supervised businesses (the page is numbered AMLG3700). It sets out how HMRC sees the risks in our profession, which services and clients worry it most and what it expects firms to do about them. This guide summarises the main points for practitioners and students. HMRC's pages are updated regularly, so read the current version before relying on any detail.

What the document is and why it matters

HMRC prepared the assessment under regulations 17 and 47 of the Money Laundering Regulations 2017. The practical effect is in the next two regulations: accountancy service providers must take it into account when writing their own risk assessment under regulations 18 and 18A. In other words, an assessment that ignores it is incomplete. Our guide to the firm-wide AML risk assessment explains how to build one.

HMRC's overall ratings

• Money laundering: high. This rating is based on the 2025 National Risk Assessment.
• Terrorist financing: low, although firms must stay vigilant.
• Proliferation financing: no rating is given, but the document flags the risk of accepting transaction records at face value.

The high rating is not a criticism of any firm. It reflects the fact that accountants sit close to the movement of money and the preparation of records that other institutions rely on.

The services HMRC worries about

HMRC highlights payroll, bookkeeping, insolvency and tax advice as services that are attractive for money laundering, and treats trust or company services as high risk. It also says that bundling services can widen a firm's exposure. Specific concerns include:

• Audit provided together with other accountancy or trust and company services, which can add legitimacy to illicit funds.
• Accounts or primary records built from incomplete or unverified sources, which can be used to legitimise funds or support tax evasion.
• Tax advice requested under pressure to cut bills, which may signal tax evasion.
• Payroll misused through falsified instructions, fabricated employees or illicit funds paid to staff, with umbrella company fraud and modern slavery indicators also in scope.
• Help with government grants or schemes, which can be used to obtain funds fraudulently.
• Requests for dormant entities or shell companies that lack commercial logic.

Our guides to AML for bookkeepers, virtual assistants and payroll providers and trust and company service provider obligations cover two of those service lines in more detail.

The clients and structures that raise risk

On clients, HMRC lists customers with no clear business reason or whose activity does not make economic sense, customers in financial difficulty who may accept suspicious investment or sale offers, cash-intensive businesses, sectors that are vulnerable to exploitation such as low-margin labour-intensive trades and grant-reliant businesses, frequent changes in ownership, directors or shareholders, unexplained changes in activity or counterparties, secretive customers or those giving false or incomplete information, and customers linked to citizenship by investment schemes. It also includes professional enablers, meaning other professionals who may exploit or neglect their own compliance duties.

On geography, the document points to jurisdictions on the FATF call for action list, overseas jurisdictions with weak AML systems, high corruption, sanctions exposure or secrecy laws, jurisdictions with limited transparency over beneficial ownership, and those bordering high-risk third countries. Supply chains with overseas parties are included too.

On delivery, the risk factors include no face-to-face contact, cash payments or payments from unknown sources, supply chains with several intermediaries, intermediaries without AML supervision, unrestricted deposits and withdrawals in pooled client accounts, premises that do not match the business profile and splitting services across several providers without a valid reason.

Red flags HMRC lists

• Unusual fund flows, borrowing or lifestyle compared with declared income.
• Continuous losses, or sudden changes in transaction patterns or value.
• Reluctance to provide original documents, bank statements or payroll evidence.
• Reluctance for HMRC reporting to be done by the firm, or evasion of HMRC reporting.
• Payroll anomalies such as round-sum salaries, uniform pay despite irregular hours, low National Insurance contributions or no employee costs.
• Overpayments followed by refund requests, or payments out to accounts different from those paid in.
• Premises that appear to be a front, or refusal of visits after an initial visit.
• Frequent switching of accountants.
• Customers who are willing to take tax risks or press for particular tax outcomes.

What HMRC expects you to do

• Take the sector assessment into account in your own business risk assessment, and document your risk appetite for different jurisdictions in your policies.
• Apply customer due diligence, or enhanced due diligence where required, before forming relationships with clients linked to FATF call for action jurisdictions or overseas links, and reassess customer risk when FATF lists change.
• Assess supply chains for length, complexity and whether they make commercial sense.
• Confirm that any intermediary is AML supervised before entering a relationship, and report suspected unsupervised relevant activity to HMRC.
• Treat customers with a passport from a citizenship by investment country as higher risk where their place of birth differs from the issuing jurisdiction.
• Obtain supporting evidence for payroll instructions and source of funds, and avoid relying on unverified records.
• Monitor transactions, client accounts and changes in business activity so that you know your controls remain effective.
• Consider enhanced measures where there is limited face-to-face contact.

A practical way to use the document

Take the headings above and map them to your own client base. For each service line you offer, note which HMRC risk factors apply and what your control is. For each risk, record who owns the control and how you test it. Then sample a few recent client files and check that they reflect the assessment, because that is what an inspector will do. Staff training should cover the red flags in plain terms so that the person preparing the payroll or the accounts knows what to escalate.

Frequently asked questions

Is it mandatory to use HMRC's sector risk assessment?

Firms supervised by HMRC must take it into account when preparing their own risk assessment under regulations 18 and 18A.

Does the high money laundering rating mean accountants are a high-risk sector to work in?

It means the National Risk Assessment judges the sector to face a high risk of being misused, which is why controls are expected to be proportionate to that risk.

Does this apply to firms supervised by professional bodies?

The assessment is HMRC's, but the risks and red flags are a useful reference for any firm. Check your own supervisor's guidance as well.

Where can I get AML training for my team?

See Learnsignal's CPD courses for finance professionals.