Independent AML Audit for Accountants: Regulation 21 Explained

Every UK accountancy firm that is supervised for anti-money laundering has to keep its policies, controls and procedures working, not just written down. One tool the Money Laundering Regulations 2017 name for this is an independent audit function. This guide explains what regulation 21 actually says, which firms need one, and how a practical review can be run and followed up. It builds on our guide to what to include in your AML policies, controls and procedures.

What regulation 21 says about an independent audit

Regulation 21(1) of the Money Laundering Regulations 2017 sets out internal controls that a relevant person must have "where appropriate with regard to the size and nature of its business". Three of them matter here. The firm must appoint a board member or senior manager as the officer responsible for compliance with the Regulations. It must screen relevant employees, both before they are appointed and during their employment. And it must establish an independent audit function.

The regulation describes what that function does. It examines and evaluates the adequacy and effectiveness of the firm's policies, controls and procedures, makes recommendations in relation to them, and monitors the firm's compliance with those recommendations. In other words, the audit function is a check on the whole compliance framework, and it has to lead to action, not only a report.

Does your firm need one?

The test is "appropriate with regard to the size and nature of its business". The regulation does not set a headcount or turnover line. Regulation 21(10) says the firm must take into account its business risk assessment under regulation 18(1), and may take into account guidance from the FCA or from another supervisory authority or body approved by the Treasury. That makes your firm-wide AML risk assessment the starting point: a firm with many staff, several offices, higher-risk clients or complex services will find it harder to argue that an independent check is not appropriate.

There is one clear exemption. Under regulation 21(6), the compliance officer, nominated officer and related requirements in paragraphs (1) and (3) do not apply to a relevant person who is an individual and who neither employs nor acts in association with any other person. A genuine sole practitioner with no staff and no associates falls outside the audit requirement. A sole principal with a bookkeeper or an associate does not.

Because the amendments that took effect on 30 June 2026 changed parts of the regulations, always check the current text of regulation 21 on legislation.gov.uk and the latest guidance from your supervisor before you rely on a summary, including this one.

What your supervisor expects to see

HMRC's internal guidance for its own officers, the Economic Crime Supervision Handbook, is a useful guide to how the regulator thinks about this. It says a business should review its policies, controls and procedures regularly and keep a written record of them, of any changes, and of communications to staff. Senior management should approve them, and they should be proportionate. HMRC tests effectiveness through risk-based checks of customer due diligence and suspicious activity reporting, so the controls have to work in practice. It also says that failing to maintain controls, meaning to implement, monitor and follow them, is a breach of regulation 19(1)(a).

The practical lesson is that the auditor's findings should look like the ones a supervisor would reach: do files show proper due diligence, are risk ratings consistent, were suspicious concerns escalated and recorded, and does the paper policy match what staff actually do?

Who can carry out the audit

The regulation uses the word "independent", so the person doing the review should not be marking their own homework. Larger firms may have an internal audit or quality team that is separate from the compliance function. Smaller firms often use an external consultant, a senior partner who is not involved in day-to-day compliance, or a peer firm. Whoever does it needs access to the files and records they need, and the authority to make recommendations to senior management.

A practical scope: policies first, then files

Guidance written for the legal sector by the Law Society of Scotland (2020), which accountants can adapt, splits the review into two parts. A "macro" review looks at whether the policies, controls and procedures and the risk assessment are up to date and reflect changes in the law, the firm's services and its technology. A "micro" review takes a sample of client files, either whole files or a theme such as source of funds or completed risk assessments. This is a legal-sector article rather than accountancy guidance, so treat it as a model rather than a requirement.

For an accountancy firm, a sensible review might cover the following:

• Whether the business risk assessment and the written procedures are current and approved by senior management.
• A sample of client files across risk levels, checking identification, verification, beneficial ownership and the recorded risk rating. Our guide to ongoing monitoring and periodic CDD reviews shows what a good file looks like.
• Internal suspicious activity reports: whether they were raised promptly, assessed by the nominated officer, and recorded with reasons.
• Training records and staff screening, including whether new joiners were checked before starting.
• Whether recommendations from the previous review were actually carried out.

How often, and what happens afterwards

The regulation does not give a fixed interval, and we have not found official guidance that does. Choose a frequency your risk assessment supports, record why you chose it, and bring the next review forward after a significant change, such as new services, a merger or a supervisor visit. Larger or higher-risk firms will normally look at this more often than a small, low-risk practice.

What matters most is the follow-up. The regulation expects the function to monitor compliance with its recommendations, so keep a simple action log with an owner and a deadline for each finding, report progress to senior management, and minute the decisions. A short note of why you decided an audit function was or was not appropriate, and how it is resourced, is the first thing a supervisor will ask to see.

Frequently asked questions

Is an independent audit the same as the annual risk assessment review?

No. The risk assessment identifies where your firm is exposed. The audit tests whether your controls are adequate and effective in practice, and it checks whether earlier recommendations were followed.

Can the MLRO audit their own work?

That would defeat the point of independence. The reviewer should be separate from the person who runs the controls being tested.

What if we decide an audit function is not appropriate?

Document the reasoning against your risk assessment, and revisit it when the firm grows or its risk profile changes. Ask your supervisor if you are unsure.

If your team needs structured training to support its AML obligations, see Learnsignal's CPD courses for finance professionals.