UK Money Laundering Regulations 2017

The MLRs apply to defined “relevant persons” across financial services and other sectors exposed to illicit-finance risk. Covered businesses must identify and assess the money-laundering and terrorist-financing risks affecting their operations, document that assessment, and maintain proportionate policies, controls and procedures. Later amendments added parallel duties concerning proliferation-financing risk.

Customer due diligence is central to the regime. When the statutory triggers apply, a relevant person must identify and verify the customer, identify and take reasonable measures to verify beneficial owners, understand the purpose and intended nature of the relationship, and conduct ongoing monitoring. Enhanced due diligence and enhanced monitoring apply in specified higher-risk circumstances, while simplified measures may be available where the regulations and risk assessment support them.

• Internal controls can include senior-management responsibility, screening and training, depending on the size and nature of the business.
• Records supporting due diligence and transactions generally must be retained for the prescribed period, commonly five years, subject to the detailed rules and lawful exceptions.
• Part 7 supports supervision and enforcement of payer and payee information requirements for traditional transfers of funds.
• Supervisors have information-gathering, inspection, registration and enforcement powers. The regulations provide for civil penalties, public statements, management prohibitions and criminal liability for specified contraventions.

The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 brought cryptoasset exchange providers and custodian wallet providers into the MLRs from 10 January 2020. A business carrying on an in-scope cryptoasset activity in the United Kingdom must be registered with the Financial Conduct Authority before beginning that activity, subject to the legislation’s territorial and transitional rules. The FCA applies a fit-and-proper assessment and supervises registered firms for compliance with the MLRs. FCA registration is an AML/CTF legal requirement, not a recommendation or endorsement of the business.

In-scope firms must apply the wider MLR framework, including business-wide and customer risk assessments, customer due diligence, ongoing monitoring, record-keeping, governance and reporting controls. The exact perimeter depends on the definitions in regulation 14A and the facts of the activity; the regime is not a general approval of every product or service offered by a registered firm.

Part 7A, inserted by the 2022 amendment regulations and operative from 1 September 2023, governs specified inter-business and unhosted-wallet cryptoasset transfers. It requires originator businesses to collect, verify and transmit prescribed originator and beneficiary information. Beneficiary and intermediary businesses must check for missing or non-corresponding information, take risk-based action, preserve required information and report repeated failures to the FCA. For certain unhosted-wallet transfers, a cryptoasset business must consider requesting information and cannot release the cryptoasset where requested information is not received.

The regulations have been amended repeatedly since 2017 and should be read in their current consolidated form. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026, S.I. 2026/621, were made on 9 June 2026. Most of that instrument is scheduled to commence on 30 June 2026. A new enhanced-due-diligence rule for cryptoasset correspondent relationships, including a prohibition involving shell banks, is scheduled for 1 February 2027, while remaining change-in-control amendments for registered cryptoasset businesses are scheduled for 25 October 2027. These staged dates mean the text applicable to a firm can depend on the date and activity in question.

This profile is a legal-reference summary of the framework as of 18 June 2026. The official consolidated legislation, commencement provisions and FCA materials should be checked for the version applicable to a particular date.