A lukewarm rinse:
Changes to the UK Money Laundering Regulations

For financial services firms, the key confirmed changes are:

• Clarification of the meaning of "establishing a business relationship" under the MLRs: This is one of the triggers in the MLRs for the requirement to carry out due diligence on a customer. HMT states that it will ask supervisors and industry bodies to publish further guidance on the meaning of "establishing a business relationship", focusing in particular on when a relationship is considered to arise out of the firm's business and the required element of duration to constitute a relationship.

• Clarification of the obligation to check source of funds under standard customer due diligence (CDD): The MLRs refer to carrying out a source of funds check "where necessary". Again, HMT will request supervisors and/or industry bodies to publish further guidance clarifying that this means that a source of funds check is required where a transaction is inconsistent with what the firm knows about the customer and their risk profile.

• Risk factors to identify when enhanced due diligence (EDD) is required: HMT will also request supervisors and/or industry bodies to issue guidance to clarify how to apply the risk factors set out in the MLRs when determining whether to apply EDD to a client. This is expected to include guidance on when EDD is mandatory.

• High-risk countries requiring EDD: The MLRs require a firm to carry out EDD on a client where the customer or another party to a transaction is in a "high risk third country". That term currently includes any country named on the Financial Action Task Force (FATF) High Risk Jurisdictions "Call for Action" list, and any other country identified as being subject to FATF increased monitoring. HMT will amend the MLRs so that EDD will only be automatically required in relation to countries on the Call for Action list (which currently consists of the Democratic People's Republic of Korea, Iran and Myanmar). Firms will still need to take into account the separate increased monitoring list as part of a customer risk assessment.

• Complex or unusually large transactions requiring EDD: The MLRs currently require EDD for a transaction that is "complex or unusually large". HMT will amend this provision so that it refers to "unusually complex or unusually large transactions". This is designed to address concerns that EDD might otherwise be applied unnecessarily on complex transactions (such as mergers and acquisitions or corporate property sales) which a firm nonetheless considers present a low risk of money laundering.

• Simplified due diligence for pooled client accounts: Pooled client accounts are accounts used by firms to hold multiple clients' money in a single account. Consultation responses indicated that industry participants may be nervous about applying simplified due diligence in relation to these accounts due to the current drafting of the MLRs. HMT will therefore amend the MLRs to remove the existing provisions on pooled client accounts and insert new provisions which are designed to specify a wider set of circumstances in which simplified due diligence may be applied in connection with such accounts.

• Cryptoasset firms – interaction with the Financial Services and Markets Act 2000 (FSMA) regime: Currently, some cryptoasset firms (if they are "cryptoasset exchange providers" or "custodian wallet providers") are required to register with the FCA under the MLRs. As we flagged in a previous briefing, HMT is proposing to bring many UK cryptoasset firms within the scope of the FSMA regulated activities regime, which will require them to obtain full FCA authorisation. HMT has confirmed that it will amend the MLRs to clarify that a cryptoasset firm which is authorised by the FCA does not also need to register under the MLRs. HMT will also amend the change in control thresholds in the MLRs to align them with the FSMA thresholds so that there is greater equivalence between the two regimes.

• Counterparty due diligence requirements for cryptoasset firms: The MLRs will be amended to implement FATF Recommendation 15 on New Technologies, which covers anti-money laundering measures for virtual assets. This will ensure that the requirements in the MLRs applying to cryptoasset firms are aligned with requirements that apply to other financial institutions undertaking traditional finance activities. HMT has not given further details of the specific additional obligations (beyond those that already apply to cryptoasset exchange providers and custodian wallet providers) it considers are required to give full effect to FATF Recommendation 15.

The majority of the key changes above are potentially relevant to any firm that is subject to the UK anti-money laundering obligations in the MLRs. In the financial services sector, this would include, for example, any of the following entities when they are acting in the course of business in the UK:

• banks and investment firms;

• fund managers and investment funds (in the latter case, when marketing or otherwise offering their units or shares);

• insurers and insurance brokers;

• payment service providers and electronic money issuers;

• consumer credit providers;

• custodians; and

• cryptoasset exchange providers and custodian wallet providers.

Some of the above changes will also potentially be relevant to other businesses which are subject to the MLRs (such as legal professionals, accountants, insolvency practitioners, letting agents, casinos, high value dealers and art market participants). This briefing does not focus on the potential impact for those other sectors.

Very broadly, many of the key changes are designed to reduce the regulatory burden on firms by facilitating a more proportionate risk-based approach to applying the customer due diligence requirements under the MLRs. However, on their face, none of the proposed changes seem likely to lead to fundamental changes in the application of the existing regime.

The reduction in the scope of high-risk jurisdictions that trigger automatic EDD may be helpful for some firms with international businesses, allowing a more risk sensitive approach to dealing with customers or transactions involving one of the 24 countries on that list (which include, for example, Bulgaria, Monaco, South Africa and the UK Virgin Islands). However, HMT emphasises that the geographical risk associated with those jurisdictions must still form part of the firm's customer risk assessment and the fact that a country is on FATF's increased monitoring list will still be a relevant risk factor. Therefore, depending on the overall risks presented by the customer relationship or transaction in question, the firm may nonetheless still need to apply EDD but will have some greater flexibility in this area.

The tweak to the wording of the MLRs to refer to "unusually complex" transactions triggering the requirement for EDD is also potentially helpful, although this will depend upon the interpretation of the existing reference to "complex" that the firm has previously adopted. Nonetheless, this may provide more flexibility where the carrying out of objectively complex transactions is consistent with the customer's normal behaviour and a broader assessment of the transaction and relationship does not otherwise identify any material risks of money laundering or terrorist financing.

It is less clear whether some of the other changes will in practice lead to a reduced burden and greater flexibility for firms. For example, HMT has stated that it will seek clarifications in supervisory or industry guidance around when a firm is required to check the source of funds as part of standard CDD. It is adopting a similar approach to relying on supervisors and the industry to clarify when and how risk factors will point towards the use of EDD. While sector-specific industry guidance can be helpful in some situations, experience suggests that it can sometimes also be vague or internally inconsistent and may not always address the most difficult scenarios. Firms and industry associations may therefore wish to monitor for any future consultations on revised guidance to assess whether the proposed clarifications are clear and workable in practice.

The industry will also need to wait to see more detail on the additional counterparty due diligence requirements for cryptoasset firms, as HMT has not specified the uplift it thinks is required to ensure alignment with the FATF standards in this area. Based on the gaps identified in the FATF's May 2022 assessment of the UK's AML regime, it is possible that this could include an express clarification that the MLRs apply to virtual asset transfers and implementing the FATF "travel rule", which relates to collecting and transmitting originator and beneficiary information.

Yes. HMT has specified a range of other amendments to the MLRs and related guidance, although many of these may be less important in practice or may be relevant only in fairly specific circumstances. These include, among others:

• Converting the current euro-denominated amounts in the MLRs into pounds sterling. This will generally be on a 1:1 basis unless this would otherwise result in non-compliance with recommended FATF thresholds.

• Requesting supervisors or industry bodies to clarify in guidance that when an employee is acting on behalf of an employer, the employee is not a "person acting on behalf of the customer" for the purposes of the MLRs (and so the firm does not need to carry out CDD on the employee, but may still wish to operate some anti-fraud checks).

• Publishing further details on how firms should take into account the UK National Risk Assessment and the priorities in the UK's Economic Crime Plan 2 when carrying out customer risk assessments.

• Amending the MLRs so that overseas sovereign wealth funds which are operated by a central bank or one of a list of specified public bodies will no longer be subject to the anti-money laundering obligations under the MLRs.

• Adding a new exemption from CDD to the MLRs where a bank is providing a new account to a customer who is transferring from another bank that has entered the bank statutory insolvency procedure. This would only be available in the immediate aftermath of insolvency and the receiving bank would still need to complete CDD as soon as practicable after accepting the customer. The new bank would also need to notify the FCA.

• Changing the triggers for registering trusts with the UK Trust Registration Service. This will include removing Stamp Duty Reserve Tax (SDRT) from the list of relevant taxes that trigger the registration requirement.

• Amending the MLRs to clarify that the sale of an off-the-shelf company will trigger CDD requirements (rather than only the act of company formation). This closes a potential gap in the legislation where some company service providers had concluded that they were not required to perform CDD if there is a gap between the initial formation of the shelf company and its subsequent sale to a customer. 

HMT states that it will look to publish the draft legislative text amending the MLRs for comment "in the coming months" and hopes to lay the formal legislation before the UK Parliament before the end of 2025 but only if parliamentary time allows. This suggests that the changes to the MLRs will not take effect until H1 2026 at the earliest.

It is possible that changes to sectoral industry guidance and supervisory guidelines could happen sooner, although some industry bodies and supervisors may presumably wish to wait until the revised MLRs are finalised so that they can amend their materials in a single update.