What Is a Business-Wide Risk Assessment for Money Laundering? What Regulation 18 Requires

On this page

1. 1What is a business-wide risk assessment for money laundering?
2. 2What does regulation 18 of the Money Laundering Regulations require?
3. 3Who has to carry out a business-wide risk assessment?
4. 4How is it different from a customer risk assessment and from customer due diligence?
5. 5What are the five risk factors, and what do they look like in practice?
6. 6How do you carry out a business-wide risk assessment, step by step?
7. 7How can a small firm rate risk without made-up numbers?
8. 8What does a worked example look like for an accountancy practice and an estate agency?
9. 9How does the risk assessment link to policies, training and the MLRO?
10. 10Who signs off the risk assessment, and how often should it be reviewed?
11. 11What mistakes do supervisors see most often?
12. 12What will a supervisor ask to see at an inspection?
13. 13What should a business-wide risk assessment checklist include?
14. 14Which courses help staff understand the risks in your assessment?
15. 15Frequently asked questions

This guide is for partners, directors, practice managers and MLROs of small regulated businesses, such as accountancy practices, estate agencies and law firms. It explains what the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the “Regulations”) say, what supervisors expect beyond them, and how to build an assessment. The law and guidance were checked on 29 October 2026, and we say where something is guidance rather than law.

What is a business-wide risk assessment for money laundering?

It is a written, firm-level answer to one question: how could this business be used to launder money or finance terrorism, and what stops that happening? The Regulations never use the words “business-wide”. The Financial Conduct Authority (FCA) uses “business-wide risk assessment” in its Financial Crime Guide, the Solicitors Regulation Authority (SRA) says “firm-wide risk assessment”, and HMRC talks about the risk assessment of your business. All mean the document required by regulation 18.

It looks at the business as a whole rather than at one client: the services you offer, the customers you take on, where they and their money come from, and how work reaches you. For each area it records what could go wrong, what you already do about it and what risk is left.

The UK National Risk Assessment published on 17 July 2025 rates the money laundering risk for accountancy service providers as high and for estate agency businesses as medium, and says criminals will look to take advantage of weak or inadequate risk assessments, policies, controls and procedures at accountancy firms.

What does regulation 18 of the Money Laundering Regulations require?

The version on legislation.gov.uk, shown as up to date with all changes known to be in force on or before 25 October 2026, says five things:

• The duty (18(1)). A relevant person “must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject”.
• What to take into account (18(2)). Information made available by the supervisory authority under regulations 17(9) and 47, and risk factors including those relating to customers, countries or geographic areas, products or services, transactions and delivery channels. “Including” means the list is a minimum.
• Proportion (18(3)). The appropriate steps depend on the size and nature of the business.
• A written record (18(4) and (5)). An up-to-date record in writing of all the steps taken, unless the supervisor notifies the business in writing that none is required, which it may do only if the sector’s risks are clear and understood.
• Producing it (18(6)). The assessment, the information it was based on and the record must be given to the supervisor on request.

Two points are worth separating from what you may read elsewhere. Regulation 18 does not name the national risk assessment; it reaches you through the supervisor, because regulations 17(9) and 47 require supervisors to pass on relevant risk information, including from the Treasury and Home Office national report. And regulation 18 sets no review interval and no sign-off: the duty to review and update comes through regulation 19(1)(b) and applies to the policies, controls and procedures, while frequency and approval expectations come from supervisor guidance, covered below.

Proliferation financing. Regulation 18A, in force since 1 September 2022, adds a parallel duty to assess the risk of proliferation financing (funding weapons of mass destruction), with the same five factors, size-and-nature test, written record and duty to produce it. The SRA says firms may cover it inside the firm-wide assessment or separately.

Recent changes. SI 2026/621, made on 9 June 2026 and mostly in force from 30 June 2026, amended several parts of the Regulations, including regulation 19. It does not amend regulation 18 or 18A.

If you do not comply. Regulation 18 is a “relevant requirement” listed in Schedule 6. A supervisor can impose a penalty or publish a censure under regulation 76, and contravention is a criminal offence under regulation 86, punishable on indictment by up to two years’ imprisonment, a fine or both, with a defence where all reasonable steps and due diligence were taken.

Who has to carry out a business-wide risk assessment?

Every “relevant person” under regulation 8: credit and financial institutions; auditors, insolvency practitioners, external accountants and tax advisers; independent legal professionals; trust or company service providers; estate and letting agents; high value dealers; casinos; art market participants; and cryptoasset exchange and custodian wallet providers.

There is no small-business exemption in regulation 18. Regulation 21(6) disapplies only the duties in regulation 21(1) and (3), such as appointing a compliance officer and a nominated officer, for an individual who neither employs nor acts in association with anyone else. A sole practitioner who is a relevant person still needs one; size affects how detailed it is, not whether it is needed.

Your supervisor depends on your sector: broadly the FCA for most financial and credit institutions, HMRC for estate and letting agents, high value dealers and accountants without a professional body, the Gambling Commission for casinos, and professional bodies for the legal and accountancy sectors. Our guide to what an MLRO does has the full supervisor table.

The government has decided that the FCA will take over AML supervision of the legal, accountancy and trust or company service sectors, in its response to the supervision-reform consultation on GOV.UK in October 2025. In the sources we checked on 29 October 2026 we found no confirmed start date, so keep following your current supervisor. The regulation 18 duty applies whoever supervises you.

How is it different from a customer risk assessment and from customer due diligence?

The business-wide assessment asks how risky the business is. A customer or client-and-matter risk assessment asks how risky this customer or job is. Customer due diligence (CDD) is the set of checks you then apply. The Regulations link them: regulation 28(12) says the extent of CDD must reflect both the regulation 18(1) assessment and your assessment of the risk in the particular case.

The FCA’s Financial Crime Guide says an assessment of an individual relationship can inform, but is not a substitute for, the business-wide assessment. The SRA says firms often confused the two, and that client assessments should be informed by the themes in the firm-wide one. For the checks themselves see customer due diligence and source of funds and source of wealth, which we do not repeat here.

What are the five risk factors, and what do they look like in practice?

Regulation 18(2)(b) names five groups of factors. The table gives illustrative questions and examples, drawn from the kinds of indicator HMRC describes in its accountancy and estate agency risk assessments. Your own list must come from your own clients and services.

Two cautions. The SRA’s 2024-25 annual report found assessments that listed the services a firm did not offer instead of the ones it did, and that mentioned high-risk countries without saying where the firm actually works. And HMRC says a business using a compliance company or digital verification service remains responsible for its own obligations.

How do you carry out a business-wide risk assessment, step by step?

The Regulations leave the method to you, and HMRC says it can be simple or sophisticated depending on the size and structure of the business. This sequence is a practical way to meet regulation 18 and supervisors’ expectations; “inherent” and “residual” risk are common practice, not legal terms.

1. Set the scope. List every regulated service, office, team and delivery channel, and cross-check against your website and engagement letters.
2. Gather sources. Read the National Risk Assessment 2025, your supervisor’s sector risk assessment (HMRC’s, or the SRA’s sectoral risk assessment) and the FATF lists. Accountants should also see the CCAB guidance, which ICAEW reported as updated in 2026. Add your own evidence: client mix, payment types, internal reports.
3. Identify the risks. Go through the five factors and write down the specific ways your business could be exploited, including the risks you do face rather than those you avoid.
4. Rate each risk before controls. Judge likelihood and impact to give the inherent risk.
5. List the controls. Note what you already do and link each control to a named policy or procedure.
6. Rate the residual risk. If it is still higher than you are comfortable with, add a control or decline that type of work.
7. Record it. HMRC expects the record to show the risk factors considered, the sources used, the date, and the date and nature of any change. Keep a version history.
8. Approve and communicate. Get senior management approval and tell staff what it says.
9. Diarise the review and the events that trigger an earlier one.

How can a small firm rate risk without made-up numbers?

A plain three-by-three grid of likelihood against impact, with the reasoning written beside it, is enough for most small firms if applied consistently. HMRC’s guidance also says one high-risk indicator does not automatically make a situation high risk overall, but that where you decide the overall risk is not high despite a risk factor, you should record why. The grids below are illustrative.

Define “likely” and “serious” in words that fit your business, then stick to them. The aim is a consistent judgement that a supervisor can follow, not precision.

What does a worked example look like for an accountancy practice and an estate agency?

Illustration only. These registers are invented to show the shape of a small firm’s assessment. They are not a template and not findings about any real business.

First, a small accountancy practice that prepares accounts and tax returns for owner-managed businesses, runs payroll for some clients and holds no client money.

Second, an independent estate agency with two branches that sells mainly homes locally. It does not hold buyers’ money, but it sees offers and how each buyer plans to pay.

Each register names specific risks, ties each to a control and shows what risk remains. A residual “medium” is not a failure; it tells management where to watch.

How does the risk assessment link to policies, training and the MLRO?

Regulation 19(1)(a) requires policies, controls and procedures to mitigate the risks identified in the regulation 18(1) assessment. They must be proportionate, approved by senior management (regulation 19(2)), regularly reviewed and updated (regulation 19(1)(b)), and include internal controls under regulations 21 to 24 and customer due diligence. Regulation 21 adds, where appropriate to the size and nature of the business, an officer responsible for compliance, screening and an independent audit function, and requires a nominated officer, usually called the MLRO. A practical habit, not a legal rule, is to ask the MLRO each year what patterns staff reports show and feed that into the review. Our guide to what an MLRO does explains the role.

Training follows the same assessment. Regulation 24 requires relevant employees to be made aware of the law and regularly trained to recognise suspicious activity, with a written record, and says the business must take account of its nature, size and the nature and extent of its risks in deciding what is appropriate. A practice whose assessment flags payroll and cash-based clients should use those situations in training. Our guide to AML training requirements covers frequency and records, and our guide to suspicious activity reports covers reporting.

Awareness training does not replace any of this. A course such as Anti Money Laundering (AML) Awareness helps staff understand the offences, warning signs and when to report, but it is not a regulated qualification and does not replace your firm’s own assessment, policies and procedures, your supervisor’s guidance or the MLRO’s responsibilities. A dated certificate can form part of the regulation 24 training record.

Who signs off the risk assessment, and how often should it be reviewed?

Sign-off. The Regulations require senior management to approve the policies, controls and procedures (regulation 19(2)(b)); they do not say in terms that the assessment itself must be approved. Guidance goes further: the SRA says its firm-wide risk assessment should be regularly reviewed, kept up to date and approved by senior management. For a small firm, the partners or directors approving it and the MLRO maintaining it keeps ownership clear.

Review. Regulation 18 sets no interval. HMRC’s guidance says it expects a review at least annually, with the review date recorded even if nothing changes, an earlier update when the business, risks or law change, and previous versions kept for at least five years. That is guidance for HMRC-supervised businesses, not a rule in the Regulations; check what your own supervisor says.

HMRC and the SRA name triggers including a new service, a change in client base, a new country, new technology, a change of ownership or management, a change in the law or FATF lists, and an update to the supervisor’s sector risk assessment. Several have happened recently: HMRC’s manual pages carrying its sector risk assessments show a first-published date of 8 July 2026, and the SRA’s sectoral risk assessment was updated on 4 September 2026. A firm whose assessment predates those has a good reason to review now.

What mistakes do supervisors see most often?

The best public evidence comes from the SRA. In its anti-money laundering annual report for 2024-25, published on 30 October 2025, it said it had called in 833 firm-wide risk assessments. Nineteen firms had none and were referred for investigation; of the other 814, 385 were compliant, 357 partially compliant and 72 not compliant. The recurring faults apply to any sector:

• Copied templates. The SRA found almost a third of the 73 assessments it reviewed in 2021/22 used untailored templates. HMRC says a generic or third-party assessment must be fully adapted to your business, and responsibility stays with you.
• Missing the sector picture. In the same sample, almost 20% did not refer to areas in the SRA’s sectoral risk assessment.
• Thin treatment of the five factors. Transaction risk drew the most feedback in 2024-25, followed by product and service risk.
• Describing what the firm does not do instead of the risks it is exposed to day to day.
• Never updated, or written only when asked. The SRA calls firms that write one only after it asks “most worrying” and says it will take robust action.
• No link to controls, so the assessment does not shape policies, take-on rules or training as regulation 19 intends.

An official example. On 16 February 2024 the SRA fined Beighton Singh Limited £19,482 and ordered it to pay £1,350 costs. Between 26 June 2017 and November 2023 the firm had failed to have a compliant firm-wide risk assessment and compliant policies, controls and procedures, as regulations 18 and 19 require. Documents it adopted in September and October 2022, after guidance, were still not compliant. That is a legal-sector decision, and in the sources we checked we found no published HMRC penalty that turned only on a risk assessment. HMRC does say it will refuse a registration where a business has no written risk assessment and policies, so treat the requirement as basic.

What will a supervisor ask to see at an inspection?

The document, and an explanation of it. HMRC’s inspection guidance says officers look at the risk assessment, policies, controls and procedures, test them, and speak to the owner, senior managers and sometimes other staff. They may ask for internal audits, training records, the job description of the senior manager responsible for compliance and records of suspicious activity handling. The SRA’s desk-based reviews examine the firm-wide assessment, the policies, controls and procedures, client and matter risk assessments, and a sample of files. Expect the same questions everywhere: does it fit this business, is it dated and approved, does it lead to controls visible in the files, and do staff know what it says?

What should a business-wide risk assessment checklist include?

• The firm, its supervisor, and the date, version and author.
• All regulated services, offices and delivery channels.
• Sources used, including the National Risk Assessment 2025 and your supervisor’s sector risk assessment.
• All five risk factors, in specific firm-level terms, plus proliferation financing.
• Inherent and residual ratings with the reasons.
• Controls mapped to named policies and owners.
• Senior management approval, with names and date.
• A review date, triggers for earlier review and a version history.
• How it informs customer risk assessments and staff training.
• A copy ready to give the supervisor on request, with the information behind it.

Which courses help staff understand the risks in your assessment?

An assessment only works if the people doing the work can recognise the risks it describes. Our courses are awareness training for the wider team, not specialist AML or MLRO training. Three fit together here:

Together they cost £18 rather than £27 under the pay-for-2-get-3 offer. Employers training 5 or more staff can buy team places at £6 a course place, however many places they buy. For sector duties see accountants, estate agents and solicitors; for the wider picture, what anti-money laundering is.

?

Frequently asked questions

Is a business-wide risk assessment a legal requirement?

Yes. Regulation 18 of the Money Laundering Regulations 2017 requires every relevant person to take appropriate steps to identify and assess the money laundering and terrorist financing risks of its business and keep an up-to-date written record, unless its supervisor says otherwise.

Is a business-wide risk assessment the same as a firm-wide risk assessment?

In practice, yes. The Regulations use neither phrase, but the FCA, the SRA and HMRC all mean the assessment required by regulation 18, as distinct from the risk assessment of each customer.

How often should it be reviewed?

Regulation 18 sets no interval. HMRC’s guidance says it expects a review at least annually, with an earlier update when the business, risks or law change, and the review recorded even if nothing changes.

Can I use a template?

Yes, but it must be adapted to your business. The SRA found almost a third of the assessments it reviewed in 2021/22 used untailored templates, and HMRC says a generic template or third-party assessment must be fully adapted, with responsibility staying with you.

Does a sole practitioner need one?

Yes, if they are a relevant person. Regulation 18 has no small-business exemption. Regulation 21(6) exempts such an individual only from the duties in regulation 21(1) and (3), such as appointing a compliance officer.

What happens if a business does not have one?

The supervisor can impose a penalty or publish a censure, and contravening regulation 18 is a criminal offence under regulation 86, subject to a due diligence defence.

General information, not legal advice. This guide summarises regulations 8, 17, 18, 18A, 19, 21, 24, 28, 76 and 86 and Schedule 6 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 as amended, including by SI 2026/621; the National Risk Assessment 2025; HMRC’s anti-money laundering guidance and inspection guidance; the SRA’s firm-wide risk assessment guidance, sectoral risk assessment, 2024-25 annual report and Beighton Singh decision; the FCA’s Financial Crime Guide; and HM Treasury’s supervision-reform response, as checked on 29 October 2026. The worked examples are illustrations, not findings about any real business. Always check the current law and your own supervisor’s guidance, and take advice on specific cases. Nexis CPD courses are CPD-accredited awareness training: they are not regulated qualifications and do not replace your firm’s own risk assessment, policies and procedures, the MLRO’s responsibilities or supervisor guidance.