Independent AML Reviews for Accountancy Practices: What the Guidance Requires

An anti-money-laundering policy that nobody tests is only a document. The UK accountancy sector guidance asks firms to build in a system of regular, independent reviews so that someone other than the people who run the controls checks that they work. This guide explains what the 2026 guidance says, who can carry out a review, and what a sole practitioner can leave out. For the policy framework this sits within, see our guide to the firm-wide AML risk assessment.

Where this guide comes from

We used the CCAB's Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector, July 2026. Paragraph 1.3.1 states it has been approved by HM Treasury, and it is based on the law as of 1 July 2026. Paragraph numbers below are the guidance's own. This is general information, not legal advice.

What the guidance says

Paragraph 3.6.25 says businesses "must introduce a system of regular, independent reviews". It does not specify a frequency beyond "regular". It also says "independent does not necessarily mean external", and that internal audit, compliance or quality functions can carry out the reviews. Reviews should be proportionate, and recommendations should be monitored to make sure they are followed through.

Who does what

Responsibility is shared. Paragraph 3.6.23 says the MLRO and senior management should together monitor the effectiveness of policies, procedures and processes, and changes should be reflected in updated policies in line with the risk assessment. Under paragraph 3.4.10, the MLRO should report to the board or equivalent managing body at least annually, in writing, supplemented by ad hoc meetings or management information. The MLRO should also receive the findings of relevant audits and compliance reviews. That is the loop: a review finds a gap, the MLRO sees it, and senior management acts.

The sole practitioner exemption

Paragraph 3.6.25 says a sole practitioner with no relevant employees need not implement regular, independent reviews unless their AML supervisory authority requires it. Paragraph 3.3.1 adds that such a practitioner need not appoint a board or senior management member responsible for compliance, appoint a nominated officer or establish an independent audit function for AML policies. If you have even one relevant employee, though, check carefully before assuming the exemption applies.

What to review

The guidance text we read does not set out a checklist of review topics, so the list below is our suggestion, built from the areas the guidance covers elsewhere. A review might sample client files for completed customer due diligence, check that records are held for the periods in paragraph 3.6.18 (five years after the relationship ends, or after an occasional transaction is completed), look at whether event-driven triggers led to refreshes, and test whether suspicious activity was escalated to the MLRO. Our 2026 AML changes timeline is useful for checking that your policies reflect the latest rules.

An illustrative review plan

The following is a made-up outline, not a requirement from the guidance. A mid-sized practice might ask its compliance or quality team to review a sample of new client files each quarter, check that every sampled file has identification and beneficial ownership evidence, confirm that high-risk clients had senior management sign-off as paragraph 3.4.2 requires for high-risk third country cases, and test whether any internal suspicion reports reached the MLRO promptly. The reviewer then writes up findings, the MLRO adds them to the annual board report, and the next quarter's sample checks whether fixes worked.

Keeping the review proportionate

The guidance stresses that reviews should be proportionate. A five-partner firm with a stable client base does not need the same programme as a large firm with many service lines. What matters is that the system is real, repeatable and followed up. A short annual review that finds problems and fixes them is more convincing than an elaborate schedule that is never carried out.

Refreshing the risk assessment

Reviews should feed back into the firm-wide risk assessment. Paragraph 4.2.4 requires that assessment to be refreshed regularly by periodic reviews and also by event-driven reviews when events affect risk. A review that finds a weakness in a process is such an event.

Practical steps (our suggestions)

• Decide who will carry out reviews and record why they are independent of the day-to-day work being reviewed.
• Set a review calendar and put it in the MLRO's annual plan.
• Write up findings with owners and deadlines, and track each recommendation to closure.
• Feed the findings into the MLRO's annual report to the board.
• Keep your team current. Our CPD courses include compliance and financial crime content.

What we could not confirm

The guidance does not define how often reviews must happen, who counts as sufficiently independent in every case, or what supervisors expect to see in a review report. We did not read the regulations or any individual supervisor's review expectations, including HMRC's. We also have not covered rules outside the UK. Check the full guidance and your supervisor's expectations before designing your programme.

Frequently asked questions

Does the independent review have to be done by an outside firm?

No. The guidance says independent does not necessarily mean external.

How often should the review take place?

The guidance says regular and proportionate but gives no fixed frequency.

Do sole practitioners have to do independent reviews?

Not if they have no relevant employees, unless their supervisor requires it.

Who should receive the findings?

The MLRO should receive them, and report to the board or equivalent at least annually.

What should happen to the review findings?

The guidance says recommendations should be monitored, and the MLRO should receive the findings and report to the board at least annually.

Can internal staff carry out the review?

Yes, if they are independent of the work being reviewed. The guidance names internal audit, compliance or quality functions as examples.

Explore more guides in our AML and KYC hub.