HMRC Anti-Money Laundering Inspection
An HMRC anti-money laundering inspection can feel daunting, particularly for an independent accountancy practice without a large compliance function. The good news is that HMRC inspections are rarely about catching out sophisticated criminals. They are about whether your paperwork holds together and whether what you do in practice aligns with what your policies say you are doing.
Before going further, it is important to point out who this guide applies to. HMRC is the default AML supervisor for accountancy service providers that are not already overseen by a professional body such as the ICAEW or ACCA. If you are a member of one of those bodies, they supervise your AML compliance, not HMRC, and their reviews may differ slightly. This checklist is written for HMRC-supervised firms, although the underlying obligations will look familiar to any accountant.
We covered the wider enforcement picture in AML Failures Catching Regulated Businesses Out: HMRC Penalties by Sector, and the same lesson runs through this one. It is usually the basics, not the exotic schemes, that bring a firm unstuck.
When HMRC writes to arrange a compliance check, which may be a site visit or a remote desk-based review, they expect you to produce specific evidence on request. Here is what to have ready, and where regulated businesses most often come up short.
Your Core Compliance Framework
HMRC starts with the foundations. If these documents do not exist in writing or have not been looked at in a long time, the rest of the inspection tends to go badly.
- A written firm-wide risk assessment. Sometimes called a whole-firm risk assessment, this maps your practice’s exposure across customers, geography, services, transactions and delivery channels. The most common failure here is obvious to an inspector: a generic template pulled off the internet and never tailored to your actual client base.
- A policies, controls and procedures document. This sets out how you manage the risks your assessment identifies, covering onboarding, ongoing monitoring, internal escalation and staff training. It needs to describe your firm, not a hypothetical one.
- Active registration. Proof that your HMRC registration is current, your fees are paid, and the relevant beneficial owners, officers and managers have passed HMRC’s approval checks.
What AML Inspectors May Test on the Day
Once the framework is established, HMRC typically pulls a sample of client files; the amount will depend on the size of your practice, to see whether your day-to-day work matches your written procedures. For each file, you should be able to produce the following without scrambling.
- A documented risk rating for that client, assigned at onboarding, that reflects their structure and behaviour rather than a blanket score applied to everyone.
- Customer due diligence: photographic ID and proof of address for individuals, and for corporate clients a structure chart identifying the ultimate beneficial owners who hold more than 25 percent of shares or voting rights.
- Evidence that the client, and any directors or beneficial owners, were screened against PEP and sanctions lists at onboarding, with screening repeated at sensible intervals.
- Written notes on the purpose and nature of the relationship: what the client’s business actually does, who its main customers and suppliers are, and the expected scale of its transactions. Without this, you have no baseline against which to spot anything unusual later, which is the whole point of monitoring.
Where HMRC Looks to Investigate Further
Certain files attract more attention. If your practice touches any of these areas, expect the auditor to request greater detail on them.
- Source of wealth on high-risk and PEP files. For any client rated high-risk or identified as a PEP, you need evidence of how they built their overall wealth, not just where this month’s payment came from. Think corporate sale documents, inheritance paperwork or audited accounts.
- Trust and company service work. If you form companies, provide registered office addresses or act as a nominee, those services carry heightened due diligence expectations, and HMRC will want to see them evidenced.
- Payroll and bookkeeping. For payroll clients, keep evidence that you periodically sense-check instructions, so funds are not being used to pay people who do not exist or to disguise other money.
The Part Firms Forget: Internal Compliance Governance
Compliance is not only about client files. HMRC also looks at how your firm runs itself.
- Training logs showing that all relevant staff, including administrative and client-facing team members, have had AML training in the last year or two, with dates, topics and sign-off.
- An internal register of any suspicious activity reports raised by staff to your nominated officer.
- Records of external SARs submitted to the National Crime Agency (NCA), including the disclosure reference numbers and any correspondence about a Defence Against Money Laundering request.
- Proof that all CDD, risk assessment and transaction records are kept and retrievable for at least five years after the client relationship ends.
The Rule That Sits Behind All of It
If it is not written down, as far as HMRC is concerned, it did not happen. If you carry out a verbal risk check, record it. If you decide a client is low-risk despite something that looked odd, write down your reasoning. HMRC rarely penalises a firm for a sensible judgement call. It regularly penalises firms for being unable to show the thinking behind one.
Find out what an HMRC officer will do when they visit your business and what records they’ll ask to see by reading the HMRC guidance here: How HMRC checks on businesses registered for money laundering supervision.
What Regulated Businesses Should Be Doing Now
For businesses operating in regulated sectors, early action can significantly reduce regulatory risk. Practical steps include:
- Confirming registration status: Check that your business is registered with HMRC if required, and that your registration is current. If you have missed the renewal, register now. Late registration attracts a penalty, but it’s far less than the fine for continuing to trade unregistered.
- Reviewing AML risk assessments and conducting an independent audit: It is a regulatory requirement for most businesses operating in the regulated sector to carry out an ‘Independent Audit of AML Policies, Controls and Procedures’ and is essential to comply with Regulation 21 of the Anti-Money Laundering Regulations. Failure to undertake this audit results in failure to comply with the Regulations, and it remains your responsibility to your regulator to ensure this is done effectively. The problem for many businesses is how to satisfy the ‘independence’ requirement of Regulation 21 (1) (c) of the MLR 2017. Our Full Regulation 21 Audit Service provides businesses and their owners with a truly independent audit and report which meets regulatory requirements and is specifically designed to comply with the requirements of the MLR 2017.
- Updating policies, controls, and procedures so they reflect current business activity: Our team of business experts will assist you and your staff in navigating the complexities involved with policies, controls, and procedures (PCPs) to ensure they remain compliant with the requirements of the regulations.
- Undertaking customer due diligence (CDD) as part of your compliance obligations: Regulated businesses that fall under the scope of the Money Laundering Regulations (MLRs) must undertake customer due diligence (CDD) as part of their compliance obligations. CDD involves putting in place various processes and undertaking necessary checks to ensure your customers are who they say they are. CDD can be onerous, particularly for small businesses or those considered as a high risk of being used as vehicles for financial crime. However, regulated businesses can outsource their responsibility for due diligence to specialist external CDD providers. At the Regulation and Compliance Office (RACO), our experienced compliance experts provide a comprehensive Outsourced Due Diligence & Risk Assessment service tailored to your needs. We carry out the due diligence work and prepare risk assessments, so your internal team can focus on review and oversight.
- Ensuring staff understand their obligations, supported by appropriate training: Providing training is a legal requirement for all regulated businesses. All staff are required to understand the actions that need to be taken and how they comply with the legislation, both personally and on behalf of the firm. RACO provides a range of training courses designed to equip compliance officers with the necessary skills and understanding – AML Training for Regulated Businesses.
DOWNLOAD OUR HMRC AML AUDIT CHECKLIST HERE.
How RACO Can Help
Getting inspection-ready is mostly a matter of structure, and that is exactly the kind of work that gets squeezed out by fee-earning deadlines. We can take it off your desk.
Our compliance specialists tailor our approach to how each business actually operates and the risks it carries.
We can help you with:
- Outsourced Due Diligence & Risk Assessment: We conduct client due diligence, including source-of-funds checks, and prepare risk assessments, so your internal team can focus on review and oversight.
- Anti Money Laundering (AML) Compliance Service: This support service has been designed to provide AML regulated businesses with an effective solution for the management and control of compliance with the Anti Money Laundering Regulations. Our service is an annual subscription that provides Businesses with ongoing support from our compliance team and ensures your Business has in place appropriate and compliant Policies, Controls, and Procedures (PCPs) that are maintained by us.
- Risk, Anti Money Laundering Guidance and Register Administration Service: has been designed to provide Businesses and their Money Laundering Reporting Officer (MLRO) with a support function that ensures their regulatory and compliance obligations are fulfilled on an ongoing basis, and staff are provided access to ongoing advice as needed.
- Complaint Management: A robust complaints process is increasingly part of the wider compliance picture, and our support helps you handle complaints properly and keep the records regulators expect to see.
RACO provides practical, sector-specific guidance that helps regulated businesses meet their obligations without getting in the way of running the business.
Talk to Our Compliance Team
We work with businesses to create the necessary documentation and have the processes in place to ensure the business and its staff are thoroughly protected.
To enquire about our services and how we can service your business, call us on 0203 985 8550 or email us at info@regulationandcomplianceoffice.co.uk
