Revised guidance issued in September substantially expands mandatory AML requirements, turning a wide range of previously advisory checks into legal obligations and introducing a list of 34 named risk indicators that must be incorporated into every Business Risk Assessment and supporting compliance procedures.
Firms that have not updated their documentation and onboarding policies since the update came into effect may now be non-compliant, with recent HMRC enforcement showing potential penalties of up to £158,000.
John Reynolds, chief operating officer at Coadjute, said the full implications of the changes are still emerging. “In recent weeks we’ve seen growing confusion across the industry. Agents are receiving audit requests and warning notices, and many are realising their existing AML files and policies simply don’t meet the new benchmark. If you’re still doing what you’ve always done, you may now be breaking the law.”
HMRC has highlighted several red-flag scenarios that require careful assessment, including super-prime price anomalies, SPVs, offshore entities, intermediaries, remote onboarding and third-party payers. The regulator has also clarified that digital ID tools and sanctions checks alone are not sufficient to meet compliance duties.
Reynolds warned that firms must now evidence how each transaction has been assessed against the 34 risk indicators, including what was identified and what enhanced due diligence was undertaken. “Tick-box apps and partial checks don’t cut it anymore,” he said.
With HMRC continuing to publish the details of firms that breach requirements, Coadjute is urging businesses to ensure their AML processes are robust and up to date. He concluded: “The new rules make ad-hoc compliance impossible to defend. Getting it right protects not just your licence but your brand.”
