Today, 30 June 2026, most of the amendments introduced by the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 come into force.
The 2026 amendments do not replace the Money Laundering Regulations 2017 (MLRs) or fundamentally change how most bookkeeping and payroll practices comply with them. Instead, they make a number of targeted improvements and clarifications to the existing Regulations.
HM Treasury is currently working with supervisory bodies to update sector guidance, which will be published following Ministerial approval.
The key message
For most ICB supervised practices:
- there is no need to start again;
- your existing AML policies and procedures should still be appropriate;
- this is a good opportunity to review your documentation and ensure it reflects today's risks.
What hasn't changed?
The core principles remain exactly the same.
You should continue to:
- know your client;
- understand the services you provide;
- carry out customer due diligence;
- complete client risk assessments;
- maintain a Whole Practice Risk Assessment;
- apply Enhanced Due Diligence where appropriate;
- monitor client relationships;
- report suspicious activity where required.
Good AML compliance continues to be about understanding your clients and applying a risk-based approach.
What has changed?
The amendments are intended to make the Regulations clearer, more proportionate and more effective.
For bookkeeping and payroll practices, the practical areas to be aware of are:
- greater emphasis on maintaining an up-to-date risk-based approach;
- clearer expectations around documenting Enhanced Due Diligence (EDD);
- greater focus on understanding source of funds where appropriate;
- changes affecting certain Trust or Company Service Provider (TCSP) activities;
- future changes affecting cryptoasset businesses (from February 2027).
For many ICB members, these changes will simply reinforce procedures that are already in place.
What should I do now?
1. Review your Whole Practice Risk Assessment
ICB has updated its Whole Practice Risk Assessment template following these 2026 amendments to the MLRs 2017, the National Risk Assessment (NRA) of Money Laundering and Terrorist Financing 2025 and the Accountancy AML Supervisors' Group (AASG) Risk Outlook.
Most members should simply review their existing assessment using the updated template rather than start from scratch.
2. Review your client risk assessments
ICB supervised practices complete client risk assessments within AML Online.
There is no need to recreate these elsewhere.
Instead, review your existing client records and ensure they continue to reflect:
- the client's business;
- the services you provide;
- ownership and control where relevant;
- geographic risks;
- whether the client's activities remain consistent with what you would reasonably expect for that business; and
- whether Enhanced Due Diligence should be applied.
3. Review your Enhanced Due Diligence procedures
The principle of Enhanced Due Diligence has not changed, but the amendments reinforce the importance of applying EDD in a proportionate, risk-based manner and documenting why additional checks were carried out.
EDD must still be applied where required by the Regulations or where your own risk assessment identifies a higher risk.
Examples include:
- Politically Exposed Persons (PEPs);
- clients connected with high-risk third countries;
- unusually high-risk business relationships;
- other circumstances where your assessment identifies an increased risk of money laundering or terrorist financing.
EDD means carrying out additional customer due diligence and enhanced ongoing monitoring that are proportionate to the higher risks identified.
4. Consider source of funds where appropriate
The amendments place greater emphasis on understanding the source of funds where risk indicates this is appropriate.
This does not mean requesting additional evidence from every client.
Instead, ask yourself:
'Am I comfortable that the funds involved are consistent with what I know about this client and their business?'
Where higher risks exist, your reasoning should be documented.
5. If you provide Trust or Company Service Provider (TCSP) services
Most bookkeeping practices will notice little practical change.
However, if you provide services such as:
- company formations;
- registered office or business address services;
- company secretary services; or
- nominee arrangements,
you should ensure these services are properly reflected within your AML Online client risk assessments and considered within your Whole Practice Risk Assessment.
You will already record whether or not you provide these services within AML Online as part of the client risk assessment, although they are not described collectively on the form as 'TCSP services'.
6. Cryptoasset businesses
Most ICB members will not be affected.
Additional enhanced due diligence requirements for cryptoasset businesses do not come into force until 1 February 2027.
Do I need to update my AML Policy?
Consider whether your policy should:
- reference the 2026 amendments to the MLRs 2017;
- explain when your practice applies Enhanced Due Diligence;
- explain how your practice considers source of funds where appropriate;
- reference the National Risk Assessment 2025;
- reference the latest ICB Sectoral Risk Assessment;
- explain any procedures relating to Trust or Company Service Provider services (where relevant).
Most practices will only require minor amendments.
Frequently Asked Questions
Do I need to verify all my existing clients again?
No.
Continue reviewing clients through your normal ongoing monitoring procedures.
Do I need to complete new client risk assessments?
No.
Simply review your existing AML Online client risk assessments and ensure they remainaccurate.
Do I need to complete a new Whole Practice Risk Assessment?
Not necessarily.
ICB has updated its template to reflect the latest National Risk Assessment, AASG Risk Outlook and regulatory amendments.
For most firms, this will involve reviewing and updating your existing assessment rather than preparing an entirely new one.
Will AML Online change?
Yes.
ICB is currently developing its new technology platform, with an updated version of AML Online planned for March 2027.
The new platform will further integrate client-level and practice-level risk assessments, making it easier for members to maintain a consistent, risk-based approach.
What's next?
Over the coming months, ICB will publish further practical guidance to support you.
As always, our aim is to help supervised practices apply the Regulations in a practical, proportionate and risk-based way.