The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 have now been in force since 30 June 2026. While the amendments may appear technical at first glance, they reflect a wider shift in AML compliance: away from a tick-box exercise and towards a more active, contextual and evidence-based approach.
AML compliance cannot simply be reduced to asking whether the passport has been checked, proof of address obtained, or the form completed. Those steps remain important, but firms must also be able to explain why the checks carried out were suitable for the particular client, matter and transaction.
The emphasis is therefore on reasoning as much as documentation. The SRA will expect firms to show clear judgement, active risk assessment and a proper paper trail explaining how decisions were reached.
Below, we break down the key regulations, their practical effect and where each change can be found in the legislation.
Regulation 11 and 12: Unusually Complex or Unusually Large Transactions
Amending regulation 19 and 19A of the 2017 Regulations
This is a key amendment that firms should pay close attention to. The wording has been changed from “complex or unusually large” to “unusually complex or unusually large in each case given the nature of the transaction.”
While this seems like a minor wording change, it has a major impact. Firms can no longer simply ask whether a transaction is “large” or “complex” in general terms. Instead, they must consider whether the transaction is out of the ordinary for that specific client, matter type or commercial purpose. For example, a high-value transaction may be entirely ordinary for an established commercial client with a clear business rationale, a known source of wealth and a history of similar transaction. By contrast, a small business may require closer scrutiny if they are bringing a high-value matter, but the transaction might not appear to match the client’s usual circumstances.
The amendment therefore requires fee earners to take greater responsibility when onboarding clients and opening matters. It encourages them to look beyond the documents provided and ask whether the transaction actually makes sense in context. Are the client’s instructions consistent with what the firm knows about them? Is the source of funds clear? Does the structure of the transaction appear unnecessarily complicated? Is there a legitimate legal or commercial reason for the work being carried out?
This is where the amendments move firms away from a mechanical approach. It is not enough for a fee earner to say that the passport was checked, the proof of address was obtained, and the AML form was completed. The firm must be able to show that it considered whether the transaction made sense in context. By requiring firms to take a second look and properly digest the information received, the amendments increase the likelihood that potential red flags will be identified before the matter progresses. This is important because AML compliance should not be treated as an automatic checklist designed simply to get the file opened as quickly as possible. Fee earners are part of the first line of defence in identifying and escalating potential money laundering risks.
Professionals are encouraged to exercise professional judgment and make decisions based on their knowledge, reducing the risk that the firm later appears to have accepted information at face value without proper consideration.
Regulation 19: Enhanced Due Diligence and Jurisdictional Risk
Amending regulation 33 of the 2017 Regulations
This section of the amendments simplifies the approach to high-risk countries. Mandatory Enhanced Due Diligence (“EDD”) is now focused strictly on the FATF “blacklist”, officially referred to as “call for action” countries. While this narrows the automatic legal trigger, firms must still use their own risk assessments to decide how to handle countries on the FATF “grey list”.
It is interesting to see that the UK has accepted the risk of severing the connection between the automatic EDD trigger and grey-listed countries. The international community recognises that these countries may have porous banking systems and weaker corporate transparency, so why remove this safety net?
The answer is more nuanced. Just because the government has removed the automatic EDD trigger does not mean the risk disappears. Instead, the responsibility falls more heavily on firms to prove that they have considered the specific transaction properly and reached a reasoned decision. There is still a clear risk to the firm’s compliance record if this is not done correctly.
When you think about it, removing the automatic trigger is quite clever. It means the compliance team needs to be more thorough. A criminal may be able to work around an automated system, but they may struggle to get past a human fee earner who has years of experience and is trained to identify risks that a checklist or computer system may miss.
Realistically, firms can approach this in two ways: either carry on as normal and treat the FATF grey list as a hard trigger for EDD regardless of what the amendment says or build an internal framework that allows the firm to take on matters connected to grey-list countries without unnecessarily risking its position.
Firms, while looking at the entity, should ask questions such as:
- Is this a highly regulated, publicly traded company subject to independent audits?
- Does it have completely transparent and easily verifiable beneficial ownership?
- What is the ownership structure? A clear and open one or complex multi layered structure with the involvement of shell companies?
- Is the transaction being proposed historically consistent with its public filings?
- If the answers are satisfactory, the framework may allow the firm to continue with standard due diligence despite the grey-list connection.
This goes beyond having a gut feeling. Avoiding unnecessary full EDD may help firms expedite the process, complete matters more efficiently, and open themselves up to a market with many verified businesses that simply happen to be based in a higher-risk geopolitical area. Why close the door on them entirely without giving them a fair chance?
Regulation 7: Off-the-Shelf Firms and Corporate Vehicles
Amending regulation 12 of the 2017 Regulations
Regulation 7 amends regulation 12 by adding “selling an off-the-shelf firm” to the activities covered by the trust or company service provider provisions. It also defines an “off-the-shelf firm” as a firm that either does not carry on business or carries on business, but where that business is not the main activity carried on by the trust or company service provider.
In simple terms, this brings the sale of ready-made firms more clearly within the scope of the AML framework. The legislation itself does not say that every off-the-shelf firm is suspicious. However, the practical risk is that ready-made corporate vehicles can be misused where there is no clear commercial reason for the structure, or where the arrangement makes it harder to identify who is really controlling or benefiting from the entity.
The question is therefore not simply whether the company exists on paper. The more important issue is why the structure is being used, who controls it, who benefits from it, and whether the explanation is consistent with the wider circumstances.
The focus should be on substance, not just paperwork.
Regulation 15: Pooled Client Accounts and the Importance of a Paper Trail
Amending regulation 29 of the 2017 Regulations
Regulation 15 introduces new specific provisions on pooled accounts by inserting paragraphs (10) to (18) into regulation 29 of the 2017 Regulations. In practice, this will often affect the relationship between retail banks and law firms, where a bank provides a pooled client account to a firm. The new provisions require the relevant person to understand the purpose and intended use of the pooled account, assess the money laundering and terrorist financing risks attached to it, and take reasonable steps to manage and mitigate those risks.
A pooled client account is a single bank account held by a law firm, where the funds of multiple different clients are held together. From the bank’s perspective, this can create an opaque “black box”, as the bank may not automatically know whose money is being held, why the money is being held, or why certain payments are being made.
The new provisions require the relevant person to understand the purpose and intended use of the pooled account, assess the money laundering and terrorist financing risks attached to it, and take reasonable steps to manage and mitigate those risks.
The amendments also introduce record-keeping obligations. Accurate and up-to-date records of funds paid into and out of the pooled account must be maintained for five years. Where requested, information may also need to be made available about the underlying clients and, where relevant, their ultimate beneficial owners.
This naturally raises questions about legal professional privilege and confidentiality. Information about a client’s matter, and why money is being held or transferred, may be sensitive and potentially privileged. For that reason, the amendment expressly states that:
“(17) A customer is not required under… to provide information which that person would be entitled to refuse to provide on grounds of legal professional privilege in proceedings in the High Court…”
This is an important safeguard. The amendment increases transparency around pooled accounts, but it does not remove the protection of legal professional privilege.
Regulation 14: Customer Due Diligence Thresholds
Amending regulation 27 of the 2017 Regulations
Regulation 14 updates several customer due diligence thresholds, including replacing some euro-denominated figures with sterling amounts. In some areas, the amendment simply replaces €10,000 with £10,000. However, in other areas, the substitution is not on a 1:1 basis, for example where €1,000 is replaced with £800.
So, what gives?
The answer appears to be practicality rather than perfect exchange-rate accuracy. If domestic AML thresholds remain tied to a fluctuating currency, the line keeps moving. This can create unnecessary uncertainty for firms, especially smaller firms, who would otherwise need to keep checking exchange rates to work out whether a threshold has been crossed. Converting the thresholds into sterling makes the rules easier to apply in practice and easier for fee earners to remember.
However, where the amendment does not use a simple 1:1 conversion, there appears to be a different concern. If a sterling threshold were set too high, a change in the exchange rate could risk taking the UK threshold above the equivalent international standard. By setting certain thresholds slightly lower, such as replacing €1,000 with £800, the Regulations leave some room for currency fluctuation while keeping the UK framework safely within the intended limit.
The wider point is that thresholds are only one part of the risk assessment. A matter can fall below a financial threshold and still raise concerns because of the client, source of funds, transaction structure or jurisdictions involved.
In a nutshell
The key question is whether these documents help fee earners make reasoned decisions, or whether they simply encourage boxes to be ticked.
Hence, firms should be able to show that they have reviewed the changes, identified which parts affect their work, and updated their AML documents where necessary.
A strong AML file should not only show that documents were collected. It should show why the firm was comfortable with the client, the transaction and the level of due diligence carried out.
