News & Insights

AML Failures Catching Regulated Businesses Out – HMRC Penalties by Sector

3 June 2026

Anti-Money Laundering | Compliance | Regulated Businesses

In an earlier article, we highlighted how it is often the fundamentals, rather than complex laundering schemes, that bring regulated businesses to HMRC’s attention. Read that article here,…

Enquire Now

Join our Mailing list

AML Failures Catching Regulated Businesses Out – HMRC Penalties by Sector

In an earlier article, we highlighted how it is often the fundamentals, rather than complex laundering schemes, that bring regulated businesses to HMRC’s attention. Read that article here, ‘Recent AML Fines: Why Regulated Businesses Are Still Getting the Basics Wrong’.

Recent HMRC Enforcement Data – Important lessons for Regulated Businesses

The most recent enforcement data tells the same story, and it is worth looking at that sector by sector. HMRC’s most recent list of regulated businesses that have not complied with the Money Laundering Regulations, covering penalty notices between 1 April and 30 September 2025, spans several hundred entries. The vast majority (at first glance) are for a seemingly minor administrative error, failing to register for AML supervision at the required time.

However, those penalties are not trivial, and their significance should not be underestimated. One accountancy service provider was fined £52,000 and one high value dealer £104,000, purely for late registration. We covered those specific errors in an earlier article, ‘AML Registration Is Not Optional: What Recent HMRC Enforcement Means for Regulated Businesses’.

But the cases that should be of particular interest to any business already registered are the set of fines that involve failures that go to the heart of AML compliance. These are the businesses that were on HMRC’s radar and still fell short on due diligence, risk assessments, policies and controls, and staff training.

Being registered is not the same as being compliant, and the examples highlighted in this follow-up article make that distinction clear. Below, we look at some of those fines by sector and the core failures in more detail.

Estate Agency and Letting Businesses (EAB)

Property (like conveyancing in the legal sector) remains one of the most high-risk sectors, and several estate agency businesses were penalised by HMRC for substantive control failures rather than just a registration failure.

City Relay Limited was fined £15,000 for failures in having the correct policies, controls and procedures, providing appropriate staff training, and conducting due diligence.
Hopton Marriott Hillier Limited was fined £9,394 for a broad set of failures spanning risk assessment, policies, controls and procedures, staff training, customer due diligence, and its reliance on a third party to carry out due diligence.
Three linked offices, Hearnes Wimborne, Hearnes Bournemouth, and Hearnes Poole, were each fined £3,333 for failures in carrying out risk assessments and conducting due diligence.

The Hearnes example is worth paying close attention to. A shortcoming applied across a group does not result in a standalone penalty. Each office is assessed and penalised as its own individual entity.

Trust and Company Service Providers (TCSPs)

Gilmoora House Limited received one of the most wide-ranging penalties on the list, £18,436, for failures in carrying out risk assessments, having the correct policies, notifying HMRC of a material change, maintaining the correct controls and procedures, providing appropriate staff training, conducting due diligence, and the timing of verification.

This is one of the broadest compliance failures shown, providing a useful illustration of how individual gaps compound when a business does not build its controls around how it operates in practice.

Accountants and Tax Advisors (ASPs)

TAG Accountants (N.I.) Limited was fined £10,000 for failures in carrying out risk assessments and notifying HMRC of a material change.

Risk assessment failures continue to be a recurring weak point for the accountancy sector. A risk assessment that no longer reflects the firm’s client base, services, or geography is treated as a failure, not a formality. Read our earlier article, ‘Small Accountancy Firms Are Failing to Identify Client AML Risks – A Warning from ICAS’, for related information and guidance.

Money Service Businesses (MSBs)

Javan Exchange Limited was fined £15,483 for failures in having the correct policies, controls and procedures, and conducting due diligence.

High Value Dealers (HVDs)

HB Clark & Co (Successors) Limited received the largest substantive-control penalty in this set, £28,126, for failures to maintain correct policies, controls and procedures, to conduct due diligence, and for failing to apply for registration at the required time.

Art Market Participants (AMPs)

Unit London was fined £20,000 for failing to notify the identity of, and changes to, its compliance and nominated officer.

It is worth paying attention to Unit London’s fine for failing to update details regarding the nominated officer. While this may seem like a menial task that can go to the bottom of the to-do list, officer appointments should not be an administrative afterthought. The nominated officer and compliance function sit at the centre of a business’s reporting obligations, and HMRC treats failures here, such as registration timing failures, as a serious control gap.

The Common Failures Catching Out Regulated Businesses

Across each of these regulated sectors, the same AML failures are a common occurrence:

Incomplete or outdated risk assessments
Customer due diligence that does not work in practice
Policies, controls, and procedures (PCPs) that do not match the business
Staff training that is missing or unrecorded

These penalties range from a few thousand to nearly £30,000, but the underlying lessons are linked by a common theme regardless of the final sanction or the sector.

HMRC has been clear that its response can range from warning letters through to criminal prosecution, and that penalties are intended to be both proportionate and a deterrent. Since December 2025, a sanctions administration charge of up to £2,000 can also apply alongside the underlying AML penalty.

HMRC’s approach to publishing penalties is deliberate. Public outcomes are intended to deter non-compliance and encourage businesses to treat AML obligations as an integral part of operating in a regulated environment rather than an afterthought.

Furthermore, with supervision under the UK’s anti-money laundering (AML) regime undergoing a landmark transformation – read our article here, ‘What The AML Supervision Reforms Mean For Regulated Businesses’ – regulated businesses are set to face unprecedented scrutiny.

An Important Note on the HMRC List

HMRC publishes the address each business registered for supervision, and it includes a clear caveat. A published business may have since changed its practices, it may no longer operate from the listed address, and any business now at that address may have no connection to the one named, or may simply share a name under entirely different management. The examples above are drawn from the published enforcement record to illustrate the failures regulators are acting on. They are not a comment on how any of these businesses operate today.

The updated enforcement data can be found here: Businesses that have not complied with the money laundering regulations (2025 to 2026).

What Regulated Businesses Should Be Doing Now

For businesses operating in regulated sectors, early action can significantly reduce regulatory risk. Practical steps include:

Confirming registration status: Check that your business is registered with HMRC if required, and that your registration is current. If you have missed the renewal, register now. Late registration attracts a penalty, but it’s far less than the fine for continuing to trade unregistered.
Reviewing AML risk assessments and conducting an independent audit: It is a regulatory requirement for most businesses operating in the regulated sector to carry out an ‘Independent Audit of AML Policies, Controls and Procedures’ and is essential to comply with Regulation 21 of the Anti-Money Laundering Regulations. Failure to undertake this audit results in failure to comply with the Regulations, and it remains your responsibility to your regulator to ensure this is done effectively. The problem for many businesses is how to satisfy the ‘independence’ requirement of Regulation 21 (1) (c) of the MLR 2017. Our Full Regulation 21 Audit Service provides businesses and their owners with a truly independent audit and report which meets regulatory requirements and is specifically designed to comply with the requirements of the MLR 2017.
Updating policies, controls, and procedures so they reflect current business activity: Our team of business experts will assist you and your staff in navigating the complexities involved with policies, controls, and procedures (PCPs) to ensure they remain compliant with the requirements of the regulations.
Undertaking customer due diligence (CDD) as part of your compliance obligations: Regulated businesses that fall under the scope of the Money Laundering Regulations (MLRs) must undertake customer due diligence (CDD) as part of their compliance obligations. CDD involves putting in place various processes and undertaking necessary checks to ensure your customers are who they say they are. CDD can be onerous, particularly for small businesses or those considered as a high risk of being used as vehicles for financial crime. However, regulated businesses can outsource their responsibility for due diligence to specialist external CDD providers. At the Regulation and Compliance Office (RACO), our experienced compliance experts provide a comprehensive Outsourced Due Diligence & Risk Assessment service tailored to your needs. We carry out the due diligence work and prepare risk assessments, so your internal team can focus on review and oversight.
Ensuring staff understand their obligations, supported by appropriate training: Providing training is a legal requirement for all regulated businesses. All staff are required to understand the actions that need to be taken and how they comply with the legislation, both personally and on behalf of the firm. RACO provides a range of training courses designed to equip compliance officers with the necessary skills and understanding – AML Training for Regulated Businesses.

How RACO Supports Regulated Businesses

AML compliance is about protecting your business, your people, and your reputation, not simply avoiding a penalty. The Regulation and Compliance Office (RACO) works with businesses of all sizes across every regulated sector, including:

Our compliance specialists tailor our approach to how each business actually operates and the risks it carries.

We can help you with:

Outsourced Due Diligence & Risk Assessment: We conduct client due diligence, including source-of-funds checks, and prepare risk assessments, so your internal team can focus on review and oversight.
Anti Money Laundering (AML) Compliance Service: This support service has been designed to provide AML regulated businesses with an effective solution for the management and control of compliance with the Anti Money Laundering Regulations. Our service is an annual subscription that provides Businesses with ongoing support from our compliance team and ensures your Business has in place appropriate and compliant Policies, Controls, and Procedures (PCPs) that are maintained by us.
Risk, Anti Money Laundering Guidance and Register Administration Service: has been designed to provide Businesses and their Money Laundering Reporting Officer (MLRO) with a support function that ensures their regulatory and compliance obligations are fulfilled on an ongoing basis, and staff are provided access to ongoing advice as needed.
Complaint Management: A robust complaints process is increasingly part of the wider compliance picture, and our support helps you handle complaints properly and keep the records regulators expect to see.

RACO provides practical, sector-specific guidance that helps regulated businesses meet their obligations without getting in the way of running the business.

Talk to Our Compliance Team

We work with businesses to create the necessary documentation and have the processes in place to ensure the business and its staff are thoroughly protected.

To enquire about our services and how we can service your business, call us on 0203 985 8550 or email us at info@regulationandcomplianceoffice.co.uk