AML policies and procedures

Firms must have effective AML policies and procedures that reflect the nature and size of their business and the money laundering risks they face. These should be documented, tailored to the firm’s circumstances and regularly reviewed to ensure they remain effective.

What should AML policies and procedures cover?

A firm's AML policies and procedures should set out how it identifies, assesses and manages money laundering risks. They should explain how the firm carries out customer due diligence (CDD), monitors client relationships, identifies suspicious activity and meets its other obligations under the Money Laundering Regulations.

What we found in our 2025/26 AML monitoring reviews

Our monitoring reviews identified common findings relating to firms' AML policies, procedures and compliance reviews:

4.9% of firms had a lack of written procedures or had not sufficiently tailored them to how their business operates, including how they perform CDD checks. Where we identify non-compliance in other areas, we review the firm's policies and procedures to help establish the root cause.
4.9% of firms had not regularly reviewed the adequacy and effectiveness of their AML policies, controls and procedures using a compliance review.

How to review your AML policies and procedures

Firms should regularly check that their AML arrangements remain appropriate and effective. This includes:

Ensuring policies and procedures reflect the firm's size, services, clients and risk profile.
Tailoring any template or training provider materials to the firm's circumstances.
Checking that procedures clearly explain how staff should carry out CDD and other AML checks.
Identifying gaps or weaknesses in existing controls and documenting the action needed to address them.
Keeping policies and procedures up to date when the firm's business, risks or regulatory requirements change.

Compliance reviews

Firms should plan independent reviews of their AML policies, controls and procedures at a frequency proportionate to the size and nature of their business.

Reviews should identify any gaps or weaknesses, document the findings and record how the firm will address them. The findings should be used to improve the firm's AML arrangements and, where necessary, inform staff training.