Money Laundering Regulations 2017
MLRsAlso called MLR 2017, UK Money Laundering Regulations
The Money Laundering Regulations 2017 are the main UK rules setting anti-money laundering and counter-terrorist financing duties for regulated businesses. They require risk assessments, customer due diligence, ongoing monitoring, record keeping and staff training. They cover banks, payment firms, cryptoasset businesses, accountants, lawyers, estate agents and other sectors, supervised by the FCA, HMRC and professional bodies.
How it works
Firms in scope carry out a written business-wide risk assessment and set policies, controls and procedures to match. They identify and verify customers and beneficial owners, apply enhanced due diligence for high-risk situations and politically exposed persons, and monitor relationships. Records are kept for five years. Larger firms appoint a board-level officer for MLR compliance, alongside a nominated officer who handles suspicious activity reports.
The regulations sit alongside the Proceeds of Crime Act 2002 and the Terrorism Act 2000, which create the reporting offences. Supervisors use the MLRs as the basis for inspections, fines and registration refusals. They were amended in 2019 to implement the fifth EU AML directive. SI 2026/621 made further changes, most from 30 June 2026, including restating due diligence thresholds in sterling.
The rules
Sets UK duties on risk assessment, customer due diligence, reliance, record keeping, policies and supervision, replacing the 2007 regulations.
Banks, financial firms, cryptoasset businesses, accountants, lawyers, estate agents and other relevant personsImplemented the fifth EU AML directive, bringing cryptoasset firms into scope and adding discrepancy reporting to Companies House.
Relevant persons under the MLRsAmends the MLRs, including sterling due diligence thresholds and new pooled account rules, with some cryptoasset changes applying in 2027.
Relevant persons under the MLRsCommon questions
Who supervises compliance with the MLRs?
The FCA supervises financial and cryptoasset firms, HMRC supervises sectors such as estate agents and money service businesses, and professional body supervisors oversee accountants and lawyers. The FCA's OPBAS oversees the professional body supervisors.
What changed under SI 2026/621?
The 2026 amendments took effect mostly from 30 June 2026. They restate customer due diligence thresholds in sterling, add rules for pooled accounts and onboarding after a bank insolvency, and bring sales of off-the-shelf companies into scope. Some cryptoasset changes start in 2027.
How long must records be kept under the MLRs?
Firms keep customer due diligence records and supporting transaction records for five years after the business relationship ends or the occasional transaction completes, subject to data protection limits on longer retention.
Do the MLRs still follow EU law?
They were based on EU directives, but EU AML law no longer applies in the UK after Brexit. The UK has not adopted the EU's 2024 AML package. Changes now come through UK statutory instruments.
