UK AML and sanctions: what firms must do
Last reviewed 27 September 2026. A summary for orientation, not legal advice.
Three bodies of law set a UK firm's anti-money-laundering and sanctions duties: the Money Laundering Regulations 2017 (who you take on, and how you watch them), the Proceeds of Crime Act 2002 (what you must report), and UK financial sanctions made under the Sanctions and Anti-Money Laundering Act 2018 (who you must not deal with).
The Money Laundering Regulations 2017
- Firm-wide risk assessment (reg 18). Identify and assess the money-laundering and terrorist-financing risks the business faces, in writing, and keep it up to date.
- Policies, controls and a nominated officer (regs 19 and 21). Controls proportionate to that risk, and a nominated officer (the MLRO) who receives internal reports.
- Training (reg 24). Staff must be made aware of the law and trained regularly to recognise and deal with suspicious activity, and the firm must keep a record of it.
- Customer due diligence (regs 27 and 28). Identify and verify the customer and any beneficial owner, understand the purpose of the relationship, and monitor it on an ongoing basis.
- Enhanced due diligence (reg 33). Required where the risk is higher, including customers linked to high-risk third countries.
- Politically exposed persons (reg 35). Senior management approval to establish or continue the relationship, adequate measures to establish the source of wealth and source of funds, and enhanced ongoing monitoring. This extends to family members and known close associates.
- Record keeping (reg 40). Due diligence records and transaction records kept for five years from the end of the business relationship or the completion of the transaction, then deleted unless another obligation requires them.
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 refine the regime to make it more targeted and risk-based; the duties above remain.
Suspicion reporting: the Proceeds of Crime Act 2002
- Reporting. In the regulated sector it is an offence not to disclose knowledge or suspicion of money laundering (s.330). Staff report to the nominated officer, who decides whether to submit a suspicious activity report (SAR) to the National Crime Agency (s.331).
- Tipping off (s.333A). Disclosing that a SAR has been made, or that an investigation is under way, in a way likely to prejudice it, is an offence. Access to SARs inside a firm should be limited accordingly.
- Defence against money laundering (DAML, s.335). A firm that needs to proceed with a transaction it suspects asks the NCA for consent. Consent is deemed after a notice period of seven working days unless refused; a refusal starts a 31-day moratorium, which a court can extend.
UK financial sanctions (OFSI)
- Freeze and do not deal. Funds and economic resources owned, held or controlled by a designated person must be frozen, and nothing may be made available to them, except under a licence.
- Report as soon as practicable. Relevant firms must tell the Office of Financial Sanctions Implementation (OFSI) when they know or reasonably suspect a person is designated or has breached sanctions, with the basis of that knowledge, identifying information, and the nature and amount of what is held.
- Report frozen assets annually. Holdings at 30 September are reported by 30 November each year.
- Licences. General licences permit specified activity for everyone; specific licences are granted on application. Keep records and meet any reporting conditions they carry.
- Strict liability. OFSI can impose civil monetary penalties for breaches without proving knowledge or intent.
How Praman Labs supports this
- Screening against the UK and other sanctions and watchlist sources, with every hit decided and recorded, and critical hits needing a second person.
- Ongoing monitoring: customers are re-screened on a cadence set by their risk.
- Customer risk rated from country, sector and onboarding channel, and raised by confirmed findings; periodic reviews scheduled by risk.
- One alert queue and case management, with an audit trail of every decision.
Official sources
Related: FATF Recommendations · EU AML Regulation · NYDFS Part 504
