The UK's AML regime rests on the Money Laundering Regulations 2017 and the Proceeds of Crime Act 2002. Supervision is split between the FCA, HMRC, the Gambling Commission and 22 professional bodies. Reporting runs to the National Crime Agency, and the criminal ceiling for laundering is 14 years.
Key takeaways
- The FCA is not the UK's AML supervisor. It is one of 25, and it supervises only the firms it authorises plus cryptoasset businesses.
- Customer due diligence bites at £12,000 for occasional transactions, £800 for transfers of funds, £10,000 for high value dealers and £2,000 for casinos.
- A refused defence against money laundering request freezes the transaction for 31 days, extendable by court order to 186 days in total.
- Since 10 January 2024 the UK treats domestic PEPs as lower risk by default, which is the opposite of how most global policies are written.
- HM Treasury decided on 21 October 2025 to move legal, accountancy and trust and company service provider supervision into the FCA.
Which body supervises your firm for AML in the UK?
The single most common mistake in a UK entry plan is assuming the FCA supervises everyone. It does not. Regulation 7 of the Money Laundering Regulations 2017 allocates supervision by sector, and the body that supervises you determines who inspects you, who can penalise you and which guidance a court will look at under regulation 86.
| Supervisor | Sectors supervised | Notes |
|---|---|---|
| Financial Conduct Authority | Credit and financial institutions it authorises, electronic money institutions, recognised investment exchanges, cryptoasset exchange providers, custodian wallet providers | Also hosts OPBAS, which oversees the professional bodies |
| HMRC | Nine registerable sectors, including money service businesses, high value dealers, estate and letting agents and art market participants | Also covers accountants and trust or company service providers with no professional body |
| Gambling Commission | Casinos only, remote and non-remote | No other gambling sector sits inside the Regulations |
| 22 professional body supervisors | Members of the named legal and accountancy bodies in Schedule 1 | Includes the SRA, ICAEW and ACCA |
Trading in a registerable HMRC sector without registering is itself a criminal offence, which catches art dealers and letting agents far more often than it catches banks.
What does the Money Laundering Regulations 2017 require, and at what thresholds?
The obligations are risk assessment under regulation 18, written policies and controls, customer due diligence, ongoing monitoring, record keeping and training. What varies by sector is the point at which due diligence is triggered. Regulation 27 sets those triggers in sterling, not euros, and a policy written to the EU figures will be wrong in both directions.
| Trigger | Threshold | Who it applies to |
|---|---|---|
| Establishing a business relationship | Any value | All relevant persons |
| Occasional transaction | £12,000 or more, single or linked | Most relevant persons |
| Transfer of funds | More than £800 | All relevant persons |
| Cash transaction | £10,000 or more | High value dealers |
| Wager or collection of winnings | £2,000 or more | Casinos |
| Trade in a work of art | £10,000 or more | Art market participants |
| Letting agreement | £10,000 or more monthly rent | Letting agents |
| Suspicion, or doubt about identity evidence | No threshold | All relevant persons |
Regulation 8 fixes the scope of "relevant person" at eleven categories, running from credit institutions through independent legal professionals and estate agents to cryptoasset exchange providers and custodian wallet providers. Our United Kingdom coverage page sets out the screening data behind those obligations.
When must a UK firm report, and how long is money frozen?
Reporting runs to the UK Financial Intelligence Unit inside the National Crime Agency, which receives more than 850,000 suspicious activity reports a year and holds a database of over 4.5 million. Section 330 of the Proceeds of Crime Act 2002 requires disclosure as soon as practicable where a person in the regulated sector knows or suspects, or has reasonable grounds to suspect, money laundering.
The clock that matters commercially is the one attached to a defence against money laundering request. Under section 335, the notice period is seven working days from the first working day after disclosure. If the NCA refuses consent, a moratorium period of 31 days begins, during which the firm cannot proceed with the transaction.
A court can extend that moratorium in 31 day increments, but section 336A caps the total extension at 186 days. Customers rarely understand why an account is frozen for six months, so the escalation path and the customer communication script both need drafting before the first refusal, not after it.
What are the penalties for AML failure in the UK?
The UK runs three distinct penalty tracks, and conflating them produces the wrong risk assessment. Criminal liability for laundering itself sits in the Proceeds of Crime Act 2002. Section 334 sets a maximum of 14 years imprisonment on indictment for the principal offences in sections 327 to 329, and five years for failure to disclose under section 330.
Breaching the Regulations is a separate offence. Regulation 86 carries up to two years imprisonment on indictment, with a statutory defence where the person took all reasonable steps and exercised all due diligence, and the court must consider whether they followed supervisory guidance.
The third track is civil. Supervisors impose financial penalties under Part 9 of the Regulations, and the FCA additionally uses its Financial Services and Markets Act powers against authorised firms. A firm can face all three at once from the same set of facts.
Separately, the failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023 came into force on 1 September 2025. It applies to organisations meeting two of three tests, more than 250 employees, more than £36 million turnover and more than £18 million in total assets, and carries an unlimited fine.
What has FCA enforcement actually punished?
Every large UK AML penalty to date has come from the FCA, against firms it authorises. The pattern is not exotic typologies. It is transaction monitoring that was known to be broken and left in place, and customer risk information that was collected and then never used.
| Firm | Date | Penalty | Basis |
|---|---|---|---|
| HSBC Bank plc | 17 December 2021 | £63,946,800 | Transaction monitoring weaknesses, 31 March 2010 to 31 March 2018 |
| Santander UK plc | 9 December 2022 | £107,793,300 | Business banking AML controls, 31 December 2012 to 18 October 2017 |
| Barclays Bank plc | July 2025 | £39,314,700 | Money laundering risk arising from the Stunt & Co relationship |
| Nationwide Building Society | December 2025 | £44,078,500 | Financial crime control failings under Principle 3 and SYSC |
Santander's penalty was set at £153,990,400 before a 30 percent settlement discount, and covered more than 560,000 business banking customers. Barclays paid £42 million in total across two group entities in July 2025, the larger element being the figure above.
How do UK PEP rules differ from the global standard?
This is where imported policies fail an inspection. Regulation 35 requires firms to have systems that identify politically exposed persons, their family members and known close associates, and to obtain senior management approval before establishing or continuing the relationship.
The divergence arrived on 10 January 2024. The Regulations now define a domestic PEP as a person entrusted with prominent public functions by the United Kingdom, and require firms to treat that person as presenting a lower level of risk than a non-domestic PEP as the starting point. Enhanced measures apply only where other risk factors are present.
Enhanced treatment also has a tail. A former PEP must be handled under regulation 35 for at least 12 months after leaving the public function, though the requirement falls away for family members and close associates once the PEP themselves has stopped being one. Getting this wrong in either direction is expensive: too strict and a UK firm de-risks half its local government customer base, too loose and the file fails on a foreign PEP. Structured PEP and sanctions screening has to encode the domestic and non-domestic split rather than applying one global rule, and the terminology is set out in our glossary of AML terms.
What is changing in UK AML supervision?
The fragmented model is being dismantled. On 21 October 2025, HM Treasury published its consultation response on AML and CTF supervision reform and confirmed the Single Professional Services Supervisor model.
Under it, the FCA will supervise every firm carrying out in-scope activity as a legal service provider, accountancy service provider or trust and company service provider. That covers all firms presently supervised by one of the 22 professional bodies, plus the accountancy and trust and company service providers currently sitting with HMRC. A follow-up consultation on the FCA's powers, duties and accountability ran from 6 November to 24 December 2025.
No commencement date has been set. HM Treasury has said the timing depends on parliamentary time, funding and a transition plan, so firms in the legal and accountancy sectors should not assume a switchover before their next supervisory cycle. What is already safe to assume is a shift in supervisory temperature: the FCA inspects and fines on a different scale from a professional body.
What should a firm entering the UK market build first?
Start by establishing which of the 25 supervisors you answer to, then register before you trade rather than after. For cryptoasset exchange providers and custodian wallet providers, FCA registration under the Regulations is a precondition of carrying on business, not an endorsement of it, and operating without it is an offence.
Build the risk assessment under regulation 18 as a real document that names the products, delivery channels, customer types and geographies you actually have. UK supervisors read the risk assessment first and then test whether the controls match it, and the mismatch between the two is the most frequently cited failing in published UK casework.
Then wire the thresholds in the table above directly into onboarding and monitoring rules, keep the training records that regulation 24 requires in writing, and treat enhanced due diligence as a triggered workflow rather than a manual escalation. Casino operators have a further layer on top of all of this, set out in updated casino regulations in the United Kingdom. Other jurisdiction guides sit in our jurisdictions and regulation collection.
