What are the consequences for failing to comply with AML obligations?

Every regulated business is legally required to have systems in place that prevent money laundering, terrorist financing and proliferation financing. When those systems fail, the consequences can range from reputational risk, to fixed financial penalties, to criminal prosecution.

Although it’s the failed AML inspections in big financial institutions that hit the headlines, the majority of the enforcement action in the UK targets small and mid-sized businesses, because they make up the bulk of the regulated community.

The scrutiny on these businesses is about to get sharper. The government is overhauling the UK’s fragmented supervision system, including replacing the 22 professional body supervisors (PBSs) with a single professional services supervisor (SPSS). The aim is to remove inconsistencies between sectors and close the gaps that have allowed non-compliant firms to slip through the cracks.

Once that change takes effect, it is anticipated that enforcement will be faster and more consistent. Outcomes like “partial compliance” will no longer buy you time. Businesses that can’t show a live, documented AML framework are likely to face penalties where they might previously have escaped with a warning.

The legal framework

Under The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs), every regulated firm must take these actions:

• Appoint the right AML leaders
• Appropriately educate and train employees on money laundering (ML), terrorist financing (TF) and proliferation financing (PF)
• Create written, tailored AML policies, controls and procedures (PCPs)
• Evaluate business and client risk with detailed written risk assessments
• Identify and verify the ultimate beneficial owners of clients
• Keep an audit trail of all AML work
• Report suspicious activity
• Keep all of this work up to date and in line with the business’ current work and client base

Failure to meet these obligations mean that you wouldn’t pass an AML inspection today, which could lead to civil penalties, criminal sanctions, suspension of authorisation or even prosecution under the Proceeds of Crime Act 2002. 

The new supervision reforms

In September 2025, HM Treasury and the Home Office confirmed that the UK’s AML supervision regime will be overhauled following a multi-year consultation. 

The Reform of the Anti-Money Laundering and Counter-Terrorism Financing Supervision response proposes creating a single public-sector supervisor to replace the current 22 professional body supervisors.

According to the government’s consultation outcome, the reform aims to:

• increase supervisory effectiveness;
• strengthen rule-making, investigative and penalty powers;
• improve intelligence-sharing between supervisors, law enforcement and the private sector;
• reduce inconsistencies in the powers of supervisors; and
• increase accountability and transparency among supervisors.

What non-compliance looks like in practice

The same weaknesses appear again and again: outdated policies, missing risk assessments, weak client due diligence and poor documentation. Being partially compliant isn’t enough. If your systems or records don’t fully meet the Regulations, you’re still non-compliant. In an inspection, “almost there” is a failure.

Property sector

Between October 2024 and March 2025, 194 estate and letting agents were fined more than £1 million for breaches of anti-money-laundering (AML) rules, according to Propertymark. The majority of cases involved firms that failed to register for supervision with HMRC or didn’t renew their registration on time, which is one of the most common causes of enforcement across the sector.

Propertymark warned that registration is a core legal requirement, not an administrative formality. Firms that trade without supervision risk severe penalties, including unlimited fines or up to two years’ imprisonment. The latest wave of fines shows how routinely smaller, local agencies are being caught out for avoidable compliance failures.

Accountancy sector

Between October 2024 and March 2025, HMRC issued AML penalties to 336 businesses, including 91 accountancy service providers, totalling around £538,000 in fines.

According to the ICAEW’s latest AML report, only 19.4% of accountancy firms assessed were compliant with AML rules (with the majority – 60.6% – being ‘generally compliant), most often because of lack of understanding of regulations, insufficient risk assessment, and over-reliance on long-standing client relationships.

Legal sector

The SRA’s 2024–25 AML report makes clear how widespread the problem is. Out of 833 law firms reviewed, only 112 were fully compliant. 451 firms, over half, were only partially compliant and 270 were non-compliant.

During the same period, they issued £661,200 in fines agreed through Regulatory Settlement Agreements (RSAs), and £292,133 in fines imposed by adjudicators.

Avoiding non-compliance

Avoiding penalties doesn’t require a huge compliance department. It requires structure, consistency and evidence.

1. Keep AML documentation live: Review and update your business-wide and client risk assessments and PCPs every year, or sooner if something changes.
2. Tailor, don’t template: A compliant AML policy reflects your real services, clients and delivery methods.
3. Record everything: AML Training logs, ID Verification checks and AML Policy updates should be traceable and date-stamped.
4. Embed awareness: Training is only effective when people understand what to do in practice.
5. Act on suspicion: Have a clear escalation path and file SARs when appropriate.

When you treat compliance as a living process rather than a checklist, it protects the wider profession and our economy from criminals. But it also protects you and your business from the consequences of non-compliance.