Money Laundering Regulations 2026: What accountants need to know

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 came into effect on 30 June 2026. Certain provisions relating to cryptoassets will come into effect in 2027. For many accountancy firms, the practical impact is likely to be limited. Jeremy Clarke, Assistant Director of Practice explains what you should know about the changes affecting enhanced due diligence (EDD), high-risk third countries and pooled client accounts.

The amendments don’t fundamentally change the UK’s risk-based anti-money laundering framework. But they clarify several requirements and reduce unnecessary regulatory burden.  

A more proportionate approach to enhanced due diligence 

Under the previous regulations, firms were required to apply enhanced due diligence (EDD) to transactions that were “complex or unusually large”.  

In practice, this wording could encourage an overly cautious interpretation. Firms might carry out additional checks even when a transaction didn’t appear unusual in its context. 

The 2026 amendments clarify that EDD should apply where a transaction is “unusually complex or unusually large”, taking account of the nature of the transaction. This focuses enhanced scrutiny on activity that is out of place and presents a genuine red flag. 

This is a clarification rather than a new requirement. It should support a more proportionate and risk-based approach.

Changes to high-risk third country requirements 

The amendments also change how firms must treat high-risk third countries (HRTCs).  

Previously, mandatory EDD applied to jurisdictions on both Financial Action Task Force (FATF) lists:  

• Countries subject to a “call for action”, often described as the black list 
• Countries subject to “increased monitoring”, often described as the grey list. 

Under the updated regulations, mandatory EDD only applies to countries on the FATF call-for-action list. The briefing note identifies Iran, North Korea and Myanmar.  

This change aims to reduce the compliance burden created by frequent changes to the grey list and represents a significant divergence from the European Union’s position. 

However, you should not disregard countries subject to increased monitoring. FATF grey-list status remains a geographical risk factor that firms must consider within their risk assessment under regulation 33(6)(c) of the Money Laundering Regulations 2017.  

For many firms, the change may not materially affect existing client risk assessment processes. 

New rules for off-the-shelf companies 

The amendments bring the sale of ‘off-the-shelf' companies within the scope of trust or company service provider (TCSP) activity.  

In practice, this is unlikely to affect many accountancy firms because companies can now be incorporated quickly online when required. The change is expected to be more relevant to specialist TCSPs and some legal practices. 

Pooled client accounts 

The regulations introduce additional requirements relating to pooled client accounts. 

Financial institutions providing pooled accounts will be required to take reasonable measures to understand the purpose of an account and how the customer will use it. 

Accountancy firms using pooled accounts will also be required to:

• Provide information, on request, about the identity of each person, and any beneficial owners on whose behalf money is held.  
• Maintain accurate, up-to-date written records of all money paid into and out of the account for five years. 
• Provide information to a law enforcement authority, on request, about the firm and the management and use of the account. 

Many firms are likely to maintain much of this information already through existing client money, record-keeping and professional indemnity insurance requirements. 

Other changes 

The regulations include several further amendments that are expected to have limited relevance to most accountancy firms: 

• Monetary thresholds will be stated in pounds sterling rather than euros. 
• A credit institution may open an account for a customer of an insolvent bank before completing full customer due diligence. It must complete the checks as soon as practicable. 
• Cryptoasset exchange providers and custodian wallet providers will be subject to new EDD requirements and stricter controls over changes in control of registered crypto businesses. 
• Trust Registration Service provisions will be revised, mainly for trusts holding land before 6 October 2020, including changes to the de minimis rules.

Updated CCAB AML guidance

Alongside the legislative changes, the CCAB Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector was published in July 2026.

The guidance was approved by the UK accountancy AML supervisory bodies and HM Treasury. It’s based on the law and regulations as at 1 July 2026 and replaces the June 2023 edition.

Many of the revisions provide greater clarity rather than impose new requirements. Key updates include: 

• Enhanced due diligence: The guidance reflects the revised treatment of high-risk third countries. It also clarifies when firms should apply EDD to unusually complex or unusually large transactions. 
• Source of funds: A source of funds check is necessary where a transaction appears inconsistent with the firm’s knowledge of the client, the client’s business or their risk profile. The examples remain non-exhaustive and non-prescriptive, supporting a proportionate, risk-based approach. 
• Customer due diligence: The expanded material includes guidance on sources of evidence and digital identity verification services. 
• Identity verification evidence: A new section provides greater clarity on reliable and independent evidence that may be used to verify a beneficial owner’s identity.
• Geographical risk: The guidance expands the discussion of geographical risk factors. It encourages firms to consider the Accountancy AML Supervisors’ Group Risk Outlook when assessing jurisdictional risk.

The revised guidance gives firms an opportunity to review their AML policies, procedures, and risk assessments.

In particular, you should revisit your approach to source of funds enquiries, identity verification, EDD triggers and geographical risk to ensure it remains aligned with current guidance. 

What firms should do now

The 2026 amendments provide useful clarifications, but they don’t fundamentally change the UK’s risk-based approach to AML compliance. 

You should continue to understand your clients, assess risk appropriately and apply enhanced scrutiny where the circumstances justify it. 

You should also review the July 2026 CCAB guidance and consider whether your firm’s AML policies, procedures, client onboarding documentation, staff training and practice-wide risk assessment need to be updated. 

You should keep your policies and processes under review as the cryptoasset provisions take effect in 2027 and further guidance becomes available.