Minns

    Free tools

    AML risk assessment template for UK practices

    A firm-wide risk assessment and a client risk assessment, set out on the Money Laundering Regulations 2017. Fill it in here, print it, or download it as CSV.

    By Jonathan Farrow, founder.

    Last reviewed . Drafted with the help of AI. Each rule is written from the legislation and gov.uk guidance linked beside it.

    Runs in your browser. No sign-up, and nothing you enter is sent anywhere or saved.

    A starting template, not legal advice. Your supervisor's guidance governs what your assessment must contain.

    Part 1: firm-wide risk assessment

    Money Laundering Regulations 2017, regulation 18. Review it at least once a year and when the firm changes.

    HMRC or your professional body.

    The risk information your supervisor gives the firm must be among it (reg 18(2)(a)).

    Clients

    Who the firm acts for: individuals, companies, trusts, charities; cash-heavy trades; clients with complex or overseas ownership; politically exposed persons.

    Services

    What the firm does: accounts, tax, payroll, company formation, registered office, trust or company services, handling client money.

    Geography

    Where clients, their owners and their money are: the UK regions served, and links to high-risk third countries.

    Delivery channels

    How the firm meets and takes on clients: face to face, remotely, through introducers or other professionals.

    Transactions

    The money the firm sees or handles: client money, unusual payments, payments from third parties.

    Part 2: client risk assessment

    Money Laundering Regulations 2017, regulation 28: one for each client, before you take it on and when it changes.

    Client 1

    Individual, company, partnership, trust, charity.

    The trade, the ownership, how the money comes in.

    Met in person, remotely, through an introducer.

    The client, a family member, a close associate or a beneficial owner (reg 35).

    On the UK's list of high-risk third countries (reg 33).

    A starting template, not legal advice

    The regulations require every practice to assess, in writing, the money laundering risks it faces, and to assess each client before taking it on. This page gives the structure for both. What goes in it has to be the firm's own judgement about its own clients.

    Your supervisor's guidance governs. For most practices that is a professional body (ICAEW, ACCA, AAT and others) or HMRC, and each expects firms to follow the CCAB's Anti-Money Laundering Guidance for the Accountancy Sector (AMLGAS). Read it alongside this template; we name its headings but do not reproduce its text.

    The template flags where the regulations require enhanced due diligence, so a high-risk client cannot be marked for standard checks without the page saying so.

    What the template is built on

    Firm-wide risk assessment

    A firm must identify and assess its money laundering and terrorist financing risks, taking into account its clients, the countries it works in, its services, its transactions and its delivery channels, and the supervisor's own risk information. It must keep the assessment in writing and up to date.

    Source: Money Laundering Regulations 2017, regulation 18

    Policies, controls and approval

    The firm's policies and controls must answer the risks the assessment finds, and be approved by its senior management.

    Source: Money Laundering Regulations 2017, regulation 19

    Customer due diligence

    A firm must identify and verify the client and any beneficial owner, understand the purpose of the relationship, and set the extent of its checks by the client's risk.

    Source: Money Laundering Regulations 2017, regulation 28

    Enhanced due diligence

    Required where the firm has assessed a high risk, for a politically exposed person, and where the client is established in a high-risk third country, among other cases.

    Source: Money Laundering Regulations 2017, regulation 33; Money Laundering Regulations 2017, regulation 35

    Simplified due diligence

    Allowed only where the firm has assessed the relationship as low risk, taking the risk factors in the regulations into account.

    Source: Money Laundering Regulations 2017, regulation 37

    The sector's guidance

    The CCAB's Anti-Money Laundering Guidance for the Accountancy Sector, approved by HM Treasury, covers the risk assessment and due diligence in detail. Check your supervisor's site for the current version.

    Source: CCAB; gov.uk: Money Laundering Regulations, your responsibilities

    Questions practices ask

    Does every practice need a written firm-wide risk assessment?
    Yes. Regulation 18 of the Money Laundering Regulations 2017 requires every firm in scope to assess its risks and keep a written record, which its supervisor can ask to see.
    What risk factors does the firm-wide assessment cover?
    The regulations name five: the firm's clients, the countries or areas it works in, its services, its transactions and its delivery channels. The template has a row for each, with the firm's exposure, a rating and its controls.
    When must a practice apply enhanced due diligence?
    Among other cases, where it has assessed the client as high risk, where the client or a beneficial owner is a politically exposed person, and where the client is established in a high-risk third country. The template warns if a lower level is chosen in those cases.
    Can I use this template as it is?
    Use it as a starting point. It is not legal advice, and your supervisor's guidance governs what your assessment must contain. Have the firm's money laundering reporting officer review and approve it.
    Is what I type saved or sent anywhere?
    No. The template works in your browser and sends nothing. Nothing is saved either, so print it or download the CSV files before you close the page.

    Minns takes a client on in the order the regulations set out, with each due diligence step dated and signed by the person who did it. Onboarding and AML