HMRC Money Laundering Supervision: 2026 Rules Explained

If you're getting ready to register with HMRC, the hardest part usually isn't the form. It's working out whether your business falls in scope, which supervisor has jurisdiction, and what evidence you'll need ready if HMRC asks you to prove that your AML controls work in practice.

That distinction matters. HMRC money laundering supervision is not just a filing exercise, it's a supervised control environment, and HMRC's published activity shows it actively tests whether firms have real customer due diligence, risk assessment, policies, controls and governance in operation, not just documents on a shelf HMRC annual supervision report 2022 to 2023.

Table of Contents

• What HMRC Money Laundering Supervision Actually Covers
• The Supervised Sectors and the Activity-Specific Route Map
  • Start with the activity, then test the perimeter
  • What founders should document
• Registration Mechanics, Fees and Ongoing Renewals
  • Who gets tested
  • Fees and renewal discipline
• The Five Sanctionable AML Obligations and What Evidence Looks Like
  • Customer due diligence
  • Policies, controls and procedures
  • Record keeping
  • Risk assessment and registration
• How HMRC Supervises in Practice, Interventions, Inspections and Evidence Requests
  • What happens when HMRC engages
  • What the enforcement trend signals
• The Gap Between Having AML Documents and Demonstrating Effective Compliance
  • What “reasonable steps” looks like in practice
  • What supervisors actually want to see
• Building an Audit-Ready Evidence Pack Before and After Registration

What HMRC Money Laundering Supervision Actually Covers

HMRC sits as one of the UK's principal anti-money-laundering supervisors. In 2022 to 2023, it supervised 35,411 businesses and practitioners, made up of 26,917 firms and 8,494 sole practitioners HMRC annual supervision report 2022 to 2023. That population covered businesses in accountancy, estate agency, money services, trust and company services, high-value dealing and art-market activity HMRC annual supervision report 2022 to 2023.

HMRC's role is not universal. A business falls into HMRC supervision only when it carries out an activity within the Money Laundering Regulations' supervised sectors and is not already supervised by the FCA, Gambling Commission, or an eligible professional-body supervisor HMRC anti-money-laundering guidance for supervised businesses. That means the first question is always, “What activity are we doing?” not “What kind of company are we?”

Practical rule: registration is the entry point, not the finish line. HMRC supervises the ongoing control environment, so your application should read like a live business story, not a generic policy pack.

The practical takeaway is simple. If your business sits in an HMRC sector, you need to show both that HMRC is the right supervisor and that your controls are real, current and workable. A founder who treats registration as a one-time admin task usually finds the supervision request later than expected.

The Supervised Sectors and the Activity-Specific Route Map

The route into HMRC supervision is activity-specific, not brand-specific. A firm might be a professional services business, a retailer, or a platform business, but HMRC only cares whether one of the regulated activities brings it into scope HMRC anti-money-laundering guidance for supervised businesses. That is why founders get tripped up, they describe the company, while HMRC looks at the service line.

Start with the activity, then test the perimeter

The route map begins with a simple sequence. Identify the revenue-generating activity, identify the customers, identify the premises and people involved, then test whether another supervisor already covers the business HMRC anti-money-laundering guidance for supervised businesses. If the answer is no, and the activity falls within HMRC's perimeter, registration follows.

The most common mistake is assuming that professional standing or a broader licence removes the need for HMRC registration. It doesn't, if the activity is one HMRC supervises and no exemption applies.

Money service businesses show why the route analysis has to be precise. HMRC gives a limited-activity exclusion only where the currency-exchange or cheque-cashing activity is minor and directly related to the main business, annual money-service turnover is no more than £100,000 or 5% of total annual turnover, transactions above €1,000 per customer are limited to one transaction including linked transactions, and the service is available only to existing customers rather than the public HMRC money service business registration guidance. If those conditions are not all met, registration is required HMRC money service business registration guidance.

What founders should document

Before trading, document the perimeter logic in plain English. That means setting out why HMRC, and not the FCA, Gambling Commission or a professional-body supervisor, has jurisdiction. It also means mapping each relevant service, because the supervisor question may change if the business adds a new line later.

For MSBs, HMRC says relevant fit-and-proper checks must be complete before the business trades, and HMRC must process those checks and confirm registration first HMRC money service business registration guidance. For all sectors, the core discipline is the same: build the jurisdictional analysis before the application, not after a query arrives.

Registration Mechanics, Fees and Ongoing Renewals

Registration with HMRC is a controlled process, not a click-through form. The application pack has to carry the right entity details, the right responsible persons and the right fee position, and some sectors also face fit-and-proper or approval testing for beneficial owners, officers and managers HMRC AML guidance for supervised businesses.

Who gets tested

For money service businesses and trust and company service providers, HMRC uses fit-and-proper testing for the responsible people in the business Know Your Compliance overview of HMRC registration requirements. For accountants, art market participants, estate agents, high-value dealers and letting agents, HMRC uses approval checks on the same population instead of the fit-and-proper route Know Your Compliance overview of HMRC registration requirements.

That distinction matters because HMRC is not just checking the firm. It is checking the people who direct or control the relevant activity. If the details are incomplete, inconsistent or out of date, the application becomes harder to defend.

Fees and renewal discipline

HMRC also expects continuing fee compliance. The guidance states that failure to pay annual supervision fees can lead to automatic cancellation, and re-registration then requires a new application fee in addition to annual premises fees HMRC AML guidance for supervised businesses. For a founder, that means the budget has to include both the initial filing and the renewal rhythm.

Build the calendar early. A missed renewal is not a paperwork nuisance, it can create a gap in supervision that forces a fresh application.

The operational point is straightforward. Treat registration as the first chapter of a recurring compliance relationship, not a one-off approval event.

The Five Sanctionable AML Obligations and What Evidence Looks Like

HMRC's supervision model turns on whether the firm can show working controls. Its guidance makes clear that civil penalties can cover failures in customer due diligence, policies, controls and procedures, record keeping, risk assessment, registration and management oversight, and that a penalty may be avoided where the business took all reasonable steps and exercised due diligence HMRC money laundering regulations appeals and penalties guidance. That is the core standard founders miss when they focus on drafting.

Customer due diligence

HMRC wants to see how you verify customers, not just that you say you do it. Evidence usually means completed onboarding files, beneficial-ownership checks, source-of-funds notes where relevant, and escalation records when something doesn't fit the expected profile. If the file is blank in the places that matter, the procedure is effectively not working.

Policies, controls and procedures

A good policy is only useful if the business can show it has been implemented. HMRC will look for staff training records, internal approvals, role allocation, escalation routes and evidence that the controls were applied consistently. A policy that says one thing and day-to-day files that show another is a problem.

Record keeping

Many firms get caught here. If you can't retrieve files quickly, prove retention, or show that a decision was documented when it was made, HMRC can infer that the control did not exist in practice. Record keeping needs version control, ownership and a retrieval process that someone in the business can genuinely use.

Risk assessment and registration

Your risk assessment should connect the business model to the customer base, products, geography and delivery channels. HMRC's published supervisory data from 2022 to 2023 shows 834 desk-based reviews and 907 onsite visits, a combined 1,741 interventions, reaching roughly 5% of HMRC's supervised population HMRC annual supervision report 2022 to 2023. In those interventions, HMRC identified non-compliance in 493 cases, which was 28% of the supervisory actions HMRC annual supervision report 2022 to 2023.

That data matters because it shows the test HMRC is applying. Registration alone doesn't end the conversation, and written procedures without operational evidence don't persuade supervisors.

How HMRC Supervises in Practice, Interventions, Inspections and Evidence Requests

HMRC's supervision is active, not passive. In 2022 to 2023, it carried out 834 desk-based reviews and 907 onsite visits HMRC annual supervision report 2022 to 2023. Those interventions were not random, they reflected a risk-based approach designed to test whether firms could demonstrate compliant controls in real use.

What happens when HMRC engages

HMRC's supervision staff can require supervised businesses to produce documents or information and can interview members of the supervised population under Regulation 66 HMRC economic crime supervision annual assessment 2022 to 2024. In practice, that means a founder may be asked to explain onboarding decisions, show how risks were classified, or produce evidence that controls operated as written.

The key point is speed. If your team can't retrieve files promptly, the delay itself becomes part of the supervisory story. HMRC is looking for consistency between what the firm said in the application, what the policies say, and what the records show.

What the enforcement trend signals

HMRC's enforcement pattern has also changed. In 2015 to 2016, it issued 1,153 supervisory fines, of which 1,140 were registration penalties, with an average penalty of approximately £500 HMRC annual assessment. By 2019 to 2020, the number of fines had fallen to 31, while the average penalty had risen to approximately £290,000 HMRC annual assessment.

That shift tells founders what HMRC is doing. It is moving away from routine registration-style penalties and towards larger, risk-based sanctions for more serious or systemic failures. In 2024 to 2025, HMRC reported 3,006 supervisory interventions, 59 suspended or cancelled registrations, 485 refused applications and 739 financial penalties worth £5.1 million HMRC annual assessment.

If your records can't answer basic questions quickly, assume HMRC will treat that as a control weakness, not an inconvenience.

The Gap Between Having AML Documents and Demonstrating Effective Compliance

A polished policy pack can still fail under supervision. HMRC's guidance says penalties can arise across customer due diligence, policies, controls and procedures, record keeping, risk assessment, registration and information provision, but also says a penalty may be avoided where the business took all reasonable steps and exercised due diligence HMRC appeals and penalties guidance. That means the central issue is not document volume, it's evidence quality.

What “reasonable steps” looks like in practice

The strongest firms can trace each obligation into an operational record. A customer file links back to the risk assessment, the escalation note explains why enhanced due diligence was triggered, and the training log shows staff were briefed before the issue arose. When those links exist, the firm has a defensible control narrative.

Weak implementations usually fail in the same way. The policy exists, but no one can show how it was applied to a live case. The procedures mention escalation, but the team can't produce the escalation trail or the management decision that followed.

HMRC's more recent published penalties underline the exposure. For penalties issued between 1 April and 30 September 2025, HMRC reported 32 minor penalties with a combined value of £23,297, while individual registration failures included penalties of £2,900, £3,300 and £14,200 HMRC appeals and penalties guidance. Those figures aren't the point by themselves. The point is that weak implementation can trigger enforcement even where the firm did not set out to commit wrongdoing.

What supervisors actually want to see

They want consistency, traceability and governance. If the file says one risk score and the onboarding team applied another, that mismatch creates doubt. If the board approved a policy but never saw an exception log or remediation update, the governance story looks thin.

A supervisor does not need a perfect file. It needs a credible one, built from records that show the firm understood the risk and acted on it.

The founder's job is to make the evidence tell a single story, from risk assessment to customer decision to management oversight. If the story breaks, so does the defence.

Building an Audit-Ready Evidence Pack Before and After Registration

The best way to manage HMRC supervision is to think in evidence modules, not isolated documents. Each module should connect a rule to a record, and each record should be easy to retrieve when someone outside the business asks to see it.

A practical pack usually includes the business-wide risk assessment, customer-risk methodology, CDD and enhanced-DD triggers, suspicious-activity escalation records, training logs, independent testing outputs, management decisions and remediation logs. The point is not to produce a giant archive. The point is to make the control environment visible.

A living evidence pack also reduces panic during an inspection. If the team already knows where the files live, who owns them and how often they're updated, a regulatory request becomes a controlled process instead of a scramble.

The wider lesson is straightforward. HMRC money laundering supervision rewards firms that can explain themselves clearly and prove that their controls work. If you want a structured route map, a registration review, or a supervisory-ready evidence pack built around your actual business model, visit Glentorion.