The four pillars of UK AML law
The United Kingdom's anti-money laundering framework rests on four primary legislative pillars, each serving a distinct but interlocking function. Together, they create one of the most comprehensive AML regimes in the world, and, since 2025, one of the most actively enforced.
The four pillars are:
- Money Laundering Regulations 2017 (MLR 2017): the primary rulebook for AML compliance obligations
- Proceeds of Crime Act 2002 (POCA): establishes criminal offences and the SAR regime
- Terrorism Act 2000: addresses terrorist financing obligations
- Sanctions and Anti-Money Laundering Act 2018 (SAMLA): the post-Brexit UK sanctions framework
Layered on top of these are the FCA's Financial Crime Guide (FCG), FCA rules in SYSC 3.2.6R (insurers, UK ISPVs, managing agents and the Society) and SYSC 6.1.1R, the Senior Managers and Certification Regime (SM&CR), and a growing body of FCA guidance including the July 2025 PEP guidance (FG25/3).
Money Laundering Regulations 2017
Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
SI 2017/692 ยท In force 26 June 2017 ยท Multiple amendments to 2026, including SI 2026/621 (in force 30 June 2026)
The MLR 2017 came into force on 26 June 2017 and revoked and replaced the Money Laundering Regulations 2007, subject to transitional provisions. They implemented the EU Fourth Money Laundering Directive in part. Their principal business obligations apply to relevant persons within Regulation 8, subject to Regulation 15 and other applicable limitations.
Who is in scope?
The MLR 2017 applies to a wide range of "relevant persons" carrying on business in the UK:
| Sector | Examples | Risk Level |
|---|---|---|
| Credit institutions | Banks, building societies | High |
| Financial institutions | Payment firms, EMIs, insurers, investment firms | High |
| Auditors & accountants | Audit firms, tax advisers, accountants | Medium |
| Legal professionals | Solicitors, barristers (certain activities) | Medium |
| Estate agents | Residential and commercial property agents | Medium |
| High-value dealers | Firms or sole traders dealing in goods who make or receive cash payments totalling at least ยฃ10,000 in respect of a transaction, whether in one operation or several operations that appear linked (changed from โฌ10,000 to ยฃ10,000 on 30 June 2026, S.I. 2026/621) [13] | Medium |
| Casinos | Land-based and online casinos | High |
| Cryptoasset businesses | Exchanges, wallet providers (from Jan 2020) | High |
Core obligations under MLR 2017
The MLR 2017 imposes a number of core obligations on relevant persons. This guide groups six of the most practically significant into the following themes:
- Firm-wide risk assessment: identify and assess your ML/TF risks
- Policies, controls and procedures: implement proportionate controls
- Customer due diligence (CDD): identify and verify customers and beneficial owners
- Ongoing monitoring: keep CDD up to date and monitor transactions
- Record keeping: keep the records specified by Regulation 40 for the applicable retention period. After that period, personal data must be deleted unless a Regulation 40(5) retention ground applies
- Training: ensure relevant employees and qualifying agents are trained
Key amendments since 2017
Proceeds of Crime Act 2002 (POCA)
Proceeds of Crime Act 2002
Chapter 29 ยท In force 24 February 2003 ยท Amended by numerous instruments
The principal money laundering offences in Sections 327 to 329 are not confined to the regulated sector. Part 7 also contains provisions with narrower regulated sector conditions, including Sections 330, 331 and 333A.
The three principal money laundering offences (Part 7)
The SAR regime: Section 330
Section 330 POCA creates the legal obligation to submit Suspicious Activity Reports for persons in the regulated sector. The offence of "failure to disclose" is committed when all of the following statutory conditions are met:
- They know or suspect, or have reasonable grounds to know or suspect, that another person is engaged in money laundering
- The information or other matter on which that knowledge or suspicion is based came to them in the course of business in the regulated sector
- They can identify the other person, or the whereabouts of the laundered property, or they believe (or it is reasonable to expect them to believe) that the information will or may assist in identifying that person or property
- They do not make the required disclosure to a nominated officer or a person authorised for Part 7 purposes by the NCA Director General under Section 330(4), as soon as practicable after the information or other matter described in Section 330(3) comes to them.
Defence Against Money Laundering (DAML)
A person who makes an authorised disclosure under Section 338 may obtain the defence provided by Sections 327(2)(a), 328(2)(a) or 329(2)(a) for a specified act that would otherwise constitute an offence under the corresponding subsection (1). Appropriate consent may be express, deemed where no refusal is given before the seven working day notice period expires (which begins on the first working day after the disclosure is made, Section 335(5)), or deemed where consent was refused but the further 31-day moratorium period has since expired without a restraint or other order extending it. A DAML is not clearance or permission to proceed generally.
Asset recovery powers
POCA also grants law enforcement extensive asset recovery powers including: confiscation orders (post-conviction), civil recovery orders (no criminal conviction required), and cash forfeiture, which an account freezing order (AFO) may precede as a freezing step under Section 303Z9 rather than a recovery mechanism in itself. Unexplained wealth orders (UWOs) are a separate investigative tool, not a recovery mechanism themselves, they compel a respondent to explain the origin of property, and were reformed by the Economic Crime (Transparency and Enforcement) Act 2022. The Economic Crime and Corporate Transparency Act 2023 separately expanded confiscation and civil recovery mechanisms in relation to cryptoassets.
Terrorism Act 2000
Terrorism Act 2000
Chapter 11 ยท Principally in force from 19 February 2001 [5] ยท Amended by Counter-Terrorism Act 2008 and others
The Terrorism Act 2000 (TA 2000) addresses counter-terrorism financing (CTF): the financial crime of funding terrorist activities. POCA addresses criminal property derived from criminal conduct. The Terrorism Act addresses terrorist property: money or other property likely to be used for the purposes of terrorism (including the resources of a proscribed organisation), the proceeds of the commission of acts of terrorism, and the proceeds of acts carried out for the purposes of terrorism.
Key CTF offences
The CTF disclosure obligation: Section 21A
Section 21A creates a failure to disclose offence where its statutory conditions are met. A person who obtains relevant information in the course of regulated sector business must disclose it as soon as practicable to a constable or nominated officer, subject to the section's exceptions. The offence is broadly analogous to POCA section 330, but the provisions are not identical. [7]
Sanctions and Anti-Money Laundering Act 2018 (SAMLA)
Sanctions and Anti-Money Laundering Act 2018
Chapter 13 ยท Royal Assent 23 May 2018 ยท Commenced in stages from 23 May 2018 [4] ยท UK's post-Brexit sanctions framework
SAMLA gives the UK government the power to impose, maintain, and lift sanctions regimes independently following Brexit, without reliance on EU mechanisms. Prior to SAMLA, the UK could only impose sanctions through EU law or UN Security Council resolutions. SAMLA created the autonomous UK sanctions regime administered by the Office of Financial Sanctions Implementation (OFSI) under HM Treasury.
The UK sanctions architecture
- OFSI: implements and enforces UK financial sanctions and issues licences permitting otherwise-prohibited transactions
- FCDO: Foreign, Commonwealth & Development Office: leads on sanctions policy and publishes the UK Sanctions List, the authoritative source for UK sanctions designations
- HM Treasury: ministerial accountability for OFSI and financial sanctions
- FCA: supervises the adequacy of sanctions systems and controls at firms within its remit, including through SYSC where applicable
Civil monetary penalties under SAMLA
The Policing and Crime Act 2017 (section 146) introduced civil monetary penalties (CMPs) for sanctions breaches, meaning OFSI can fine firms without requiring criminal prosecution. SAMLA, passed the following year, later amended the 2017 Act so that sanctions regulations made under SAMLA also fall within its scope. Where the breach or failure relates to particular funds or economic resources and their value can be estimated, the maximum is the greater of ยฃ1 million and 50 per cent of that estimated value. In any other case, the maximum is ยฃ1 million.
The Economic Crime (Transparency and Enforcement) Act 2022 removed the mental element for civil monetary penalties: OFSI no longer needs to show the firm knew, suspected, or had reasonable cause to suspect it was breaching sanctions (section 146(1A)); the underlying evidential standard for establishing a breach remains the balance of probabilities (section 146(1)).
The FCA's financial crime framework
Above the legislative framework sits the FCA's own regulatory architecture for financial crime. For FCA-regulated firms, this layer is where the rubber meets the road: it translates the law into specific supervisory expectations.
SYSC rules: the foundation
Two rules in the FCA's Senior Management Arrangements, Systems and Controls (SYSC) sourcebook are central:
- SYSC 3.2.6R: applies to insurers, UK Insurance Special Purpose Vehicles (ISPVs), managing agents and the Society (per SYSC 1 Annex 1, subject to its stated exceptions and activity scope), requiring reasonable care to establish and maintain effective systems and controls for regulatory compliance and for countering the risk that the firm might be used to further financial crime
- SYSC 6.1.1R: requires firms to which the rule applies to have adequate policies and procedures sufficient to ensure compliance with the regulatory system and to counter the risk that the firm might be used to further financial crime [8]
The Financial Crime Guide (FCG)
FCG is non binding general guidance that provides practical assistance and examples relevant to the FCA's supervisory expectations. Firms may satisfy their obligations in other ways. The FCG covers: [9]
| FCG Chapter | Topic |
|---|---|
| FCG 1 | Introduction |
| FCG 2 | Financial crime systems and controls |
| FCG 3 | Money laundering and terrorist financing |
| FCG 4 | Fraud |
| FCG 5 | Data security |
| FCG 6 | Bribery and corruption |
| FCG 7 | Sanctions, asset freezes and proliferation financing |
| FCG 8 | Insider dealing and market manipulation |
SM&CR: personal accountability for MLROs
Where the SMCR requires a firm's MLRO to perform the money laundering reporting function, that function is SMF17 and requires FCA approval before the individual starts. The individual is subject to the applicable fitness and propriety assessment, Senior Manager Conduct Rules, and personal accountability where the statutory and regulatory conditions for enforcement are met. [10] This means:
- Where SMF17 applies, FCA approval is required before the individual starts the function
- The FCA considers fitness and propriety, including competence, capability, reputation and sufficient capacity for the role
- An approved SMF17 holder is subject to the applicable Senior Manager Conduct Rules, including SC4
- Personal enforcement may follow where the relevant statutory or regulatory tests are met
2025-2026 regulatory changes: What you need to know now
Penalties for non-compliance
The consequences of AML compliance failures in the UK are severe, operating across three dimensions:
Recent FCA enforcement cases: the pattern
The rows below are composite, illustrative scenarios built from recurring FCA enforcement patterns, not named cases with an identifiable Final Notice, they teach the pattern, not a specific firm's history.
| Firm type | Failure | Consequence |
|---|---|---|
| Challenger bank | Inadequate transaction monitoring, weak CDD | Multi-million pound fine, enhanced supervision |
| Payment institution | Sanctions screening gaps, failure to file SARs | Licence restriction, skilled person review (s166) |
| Traditional bank | Systematic AML control failures over multiple years | ยฃ100m+ fine, executive personal censure |
| Cryptoasset firm | Failure to register under MLRs | Cessation of business, FCA public warning |
Frequently asked questions
Sources
Each numbered claim above is checked against the specific source below it. This guide is mid-retrofit onto the site's verification ledger (37 of 103 flagged candidate claims sourced so far); figures without a bracketed number are not yet independently verified, see BACKLOG.md for the open remainder.
- Financial Conduct Authority, FCA Operating Service Metrics 2024/25, Enforcement Data. fca.org.uk/data/fca-operating-service-metrics-2024-25/enforcement-data
- Proceeds of Crime Act 2002, Sections 330 and 334. legislation.gov.uk/ukpga/2002/29/section/330 and legislation.gov.uk/ukpga/2002/29/section/334 (section 334 carries the penalty provisions; section 330 defines the offence)
- Financial Conduct Authority, FG25/3: The treatment of politically exposed persons for anti-money laundering purposes, 7 July 2025 (revised 15 July 2025). fca.org.uk/publications/finalised-guidance/fg25-3-treatment-politically-exposed-persons
- Sanctions and Anti-Money Laundering Act 2018, Section 64, and The Sanctions and Anti-Money Laundering Act 2018 (Commencement No. 1) Regulations 2018. legislation.gov.uk/ukpga/2018/13/section/64 (Royal Assent 23 May 2018; substantive provisions commenced in stages thereafter)
- Terrorism Act 2000 (Commencement No. 3) Order 2001, Article 2. legislation.gov.uk/uksi/2001/421/article/2/made (Act principally in force from 19 February 2001)
- Terrorism Act 2000, Sections 15, 17, 18, and 22. legislation.gov.uk/ukpga/2000/11/section/15, section/17, section/18, section/22 (penalty)
- Terrorism Act 2000, Section 21A. legislation.gov.uk/ukpga/2000/11/section/21A
- FCA Handbook, SYSC 6.1.1R. handbook.fca.org.uk/handbook/SYSC/6/1.html
- FCA Handbook, Financial Crime Guide (FCG), current contents. handbook.fca.org.uk/handbook/FCG
- FCA Handbook, SUP 10C.6.2R, FIT 1 and FIT 2, COCON 2.2.4R. handbook.fca.org.uk/handbook/SUP/10C/6.html
- Financial Services and Markets Act 2000, Section 166(3), and FCA, Skilled person reviews. legislation.gov.uk/ukpga/2000/8/section/166
- National Crime Agency, SARs Annual Report 2024 (872,048 SARs, 2023/24). nationalcrimeagency.gov.uk/who-we-are/publications
- Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, Regulation 14, as amended by S.I. 2026/621, regulation 9 (in force 30 June 2026). legislation.gov.uk/uksi/2017/692/regulation/14
- Financial Conduct Authority, enforcement data 2024/25, Table 7. fca.org.uk/data/fca-operating-service-metrics-2024-25/enforcement-data (17 of 23 enforcement operations opened in 2024/25 were financial-crime-related)
- The Money Laundering and Terrorist Financing (Amendment) Regulations 2023. legislation.gov.uk/uksi/2023/1371/contents/made
- FCA Handbook, DEPP 6.5, 6.5A, and 6.7. handbook.fca.org.uk/handbook/DEPP/6/5.html
- GOV.UK, Financial sanctions: Russia (look up amendments to the Russia sanctions regulations), and GOV.UK, New measures to tackle corrupt elites and dirty money become law. gov.uk/guidance/look-up-amendments-to-the-russia-sanctions-regulations and gov.uk/government/news/new-measures-to-tackle-corrupt-elites-and-dirty-money-become-law