News & Insights

Do You Need a Regulation 21 AML Audit? Most Regulated Businesses Do

21 July 2026

Accountants | Anti-Money Laundering | Estate Agents | HMRC | Regulated Businesses

There is often the misconception among regulated businesses that a Regulation 21 audit is something only large organisations need to worry about. Banks, large national corporations, and businesses…

Enquire Now

Join our Mailing list

Do You Need a Regulation 21 AML Audit? Most Regulated Businesses Do

There is often the misconception among regulated businesses that a Regulation 21 audit is something only large organisations need to worry about. Banks, large national corporations, and businesses with a dedicated compliance department. For smaller businesses, there is sometimes a myth that they are too small for these requirements to apply. However, that is not always the case, and it is catching regulated businesses out.

Under the Money Laundering Regulations 2017 (MLRs), the recommendation is that all but the smallest micro businesses carry out an independent AML audit. If your business is registered for AML supervision, whether with HMRC, the Financial Conduct Authority (FCA), the ICAEW, or another professional body, and you have not had one, or not done so in some time, there is a reasonable chance you are operating in breach of the AML Regulations without realising it.

What Regulation 21 Actually Requires

Regulation 21(1)(c) of the MLR 2017 requires a relevant person, where appropriate with regard to the size and nature of its business, to establish an independent audit function. That function must examine and evaluate the adequacy and effectiveness of the business’s AML policies, controls and procedures (PCPs), make recommendations for improvement, and monitor whether those recommendations are put into practice.

In its simplest form, that means someone independent must test whether your AML framework holds up against how the business actually operates day to day. An office manual that includes a few policies, controls, and procedures (PCPs) proves very little on its own.

The word “independent” is the crucial aspect of that obligation. While it is possible to carry out the audit internally, it cannot be done by the MLRO, the MLCO, or anyone else responsible for maintaining the AML compliance function. Here is where there is an obvious practical problem. In most regulated businesses, the only people with enough knowledge to audit the AML framework are the very people who implemented the processes and are trained to run it. Unfortunately, they are precisely the people the Regulations say cannot carry out a Regulation 21 independent audit.

For a fuller explanation of the requirement itself, read our earlier guide: “What is a Regulation 21 Audit?”

The “Size and Nature” Question, and the Micro Business Benchmark

The phrase “where appropriate with regard to the size and nature of its business” is where most of the confusion comes from. It is not defined in the MLR 2017, and plenty of businesses read this as a clause that makes them exempt from the rules.

However, regulators who supervise the AML requirements do not read it that way. Supervisors across all the regulated sectors have made clear that most businesses carrying out regulated work are expected to have an independent audit function, and HMRC’s own penalty framework lists failure to establish one under Regulation 21(1) as a sanctionable breach.

So where is the line? A useful benchmark is the micro business threshold: an annual turnover under £1 million, a balance sheet total under £500,000, and no more than 10 employees. A business genuinely operating below all three of those markers may reasonably conclude that a full independent audit function is not proportionate to its size and nature. For all other businesses registered under the MLRs, the recommendation is clear. If your business sits above those thresholds, the likelihood is that you must carry out a Regulation 21 audit. However, that benchmark should be applied carefully, because it is not a statutory exemption as explained below.

There are two caveats that matter here and must be considered. First, this is a benchmark, not a statutory exemption, and the nature of your work counts as much as your size. A small business handling high-risk activity such as property transactions, company formations, or significant cash payments should not assume it falls outside the requirement. Second, even a genuine micro business must still maintain compliant PCPs, carry out risk assessments, and be able to evidence both. Falling below the Regulation 21 audit benchmark takes you out of the independent audit conversation, not out of the Regulations or the wider obligations.

Why So Many Businesses Are Getting This Wrong

Part of the problem is confusion between an audit and a risk assessment. Many businesses have a firm-wide risk assessment in place and believe that box is ticked. It is not the same thing. A risk assessment identifies the money laundering risks your business faces. An audit tests whether the controls you say you have work in practice and are relevant and proportionate for your business. One is a map, the other is an efficiency road test. The other part of the problem is that no one sends you a reminder or sets a deadline for when an audit needs to be carried out. Just like other regulatory memberships, the AML registration comes with a renewal date. The Regulation 21 audit has no such prompt, so it sits quietly unfulfilled until a supervisor asks for it.

These are not small mishaps, and supervisors are asking for evidence. HMRC’s most recent enforcement round included penalties of £18,436 and £28,126 against individual businesses for failures across their policies, controls and procedures, alongside registration fines of £52,000 and £104,000. We covered these in detail in our previous blog, ‘AML Failures Catching Regulated Businesses Out: HMRC Penalties by Sector’. Set against figures like those, the cost of an independent audit is modest. A business that skips the audit to save money has simply moved the expense to a later date and multiplied it.

The Audit as Protection, Not Paperwork

There is a point here that gets missed in most discussions of Regulation 21, and it is arguably the most important one.

An independent audit is recorded evidence that the business has a solid regulatory foundation. If your AML supervisor opens an enquiry, the audit report and the accompanying Directors’ Report show that the business tested its PCPs, identified potential gaps, addressed them, and strengthened its procedures.

The discussion then becomes one about findings and improvements rather than failings. Without it, the enquiry starts with a breach of Regulation 21 already on the table, and everything else gets examined in that light.

Our compliance specialists have seen this play out in practice. Regulators are noticeably more measured with businesses that can hand over a recent audit, because it tells them the compliance framework is being managed rather than left to look after itself.

What a Regulation 21 Independent Audit Involves

Our audit is designed specifically to satisfy the requirements of the MLR 2017, including the independence requirement that internal teams struggle to meet. It includes:

A discovery meeting to scope and agree the approach and focus of the review
A review of your MLR 2017 policies (PCPs) to confirm compliance and identify any gaps or missing policies
A review and analysis of your High Risk and Suspicious Activity Registers
Interviews with staff to evidence how the PCPs are applied in practice and to establish understanding across the business
Optional file reviews to test the application of AML requirements at case or matter level
A formal report setting out findings, gaps, and practical recommendations
Presentation of the findings to directors, partners, or owners
A Directors’ Report evidencing compliance with Regulation 21, covering the policies, the risk assessment, the risk profile, the application of the PCPs, any concerns identified, the solutions to them, and a statement of compliance

Most regulated businesses should carry out an audit every two years. Larger organisations, and those with a higher risk profile, should consider an annual cycle.

We Audit All Regulated Businesses of Every Size

Much of our published work focuses on law firms, but the Regulation 21 requirement reaches across the whole regulated sector: accountants and tax advisers, estate and letting agents, trust and company service providers, high value dealers, art market participants, money service businesses, and financial and credit businesses.

We carry out Regulation 21 audits for all regulated businesses of all sizes, and we frequently audit large, multi-office organisations required to comply with the MLRs 2017. Whether you are a regional estate agency business, a regional accountancy practice, or a national finance group, the process is scaled to fit how your business operates.

You can download our service brochure here: RACO Regulation 21 Independent Audit for Regulated Businesses

Book a Regulation 21 Independent Audit

If your business sits above the risk profile or micro business thresholds, has not had an independent AML audit, or your last one is approaching two years old, now is the time to put that right, before your AML supervisor asks the question for you.

We work with businesses to create the necessary documentation and put the processes in place to ensure the business and its staff are thoroughly protected.

To enquire about our services and how we can service your business, call us on 0203 985 8550 or email us at info@regulationandcomplianceoffice.co.uk

How RACO Supports Regulated Businesses

AML compliance is about protecting your business, your people, and your reputation, not simply avoiding a penalty. The Regulation and Compliance Office (RACO) works with businesses of all sizes across every regulated sector, including:

Our compliance specialists tailor our approach to how each business actually operates and the risks it carries.

We can help you with:

Outsourced Due Diligence & Risk Assessment: We conduct client due diligence, including source-of-funds checks, and prepare risk assessments, so your internal team can focus on review and oversight.
Anti Money Laundering (AML) Compliance Service: This support service has been designed to provide AML regulated businesses with an effective solution for the management and control of compliance with the Anti Money Laundering Regulations. Our service is an annual subscription that provides Businesses with ongoing support from our compliance team and ensures your Business has in place appropriate and compliant Policies, Controls, and Procedures (PCPs) that are maintained by us.
Risk, Anti Money Laundering Guidance and Register Administration Service: has been designed to provide Businesses and their Money Laundering Reporting Officer (MLRO) with a support function that ensures their regulatory and compliance obligations are fulfilled on an ongoing basis, and staff are provided access to ongoing advice as needed.
Complaint Management: A robust complaints process is increasingly part of the wider compliance picture, and our support helps you handle complaints properly and keep the records regulators expect to see.
AML Training: The Anti Money Laundering Regulations dictate that training staff to understand how the AML rules affect them is mandatory. It is also crucial that they understand the company and the processes the business has implemented to prevent and manage the risk of money laundering. RACO provides a range of AML Training for regulated businesses to its staff and compliance officers.

RACO provides practical, sector-specific guidance that helps regulated businesses meet their obligations without getting in the way of running the business.

Read other related articles: