UK AML supervision · the machine, explained from zero
Suppose you have never heard of the FCA. This dossier explains who polices money laundering in the United Kingdom, where their authority comes from, what each body can actually do to you or your counterparty — and the quiet decision, already taken, that will rewire the whole map. Nothing here assumes prior knowledge; every body is explained the first time it appears.
The three-layer map
Every AML system separates three jobs, and confusion between them causes most misreadings of UK enforcement news:
- Rules say what regulated businesses must do — check customers, monitor transactions, report suspicion. In the UK these live mainly in the Money Laundering Regulations 2017 (as recast in June 2026 by SI 2026/621).
- Supervisors check that businesses follow the rules, and can sanction them for failures — even where no actual laundering happened.
- Enforcers pursue the crime itself: the launderers, and the proceeds, under the Proceeds of Crime Act 2002 (POCA).
A firm can be fined millions by a supervisor for weak controls without a single criminal charge — that is the rules/supervision layer working. Prison sentences and confiscation orders come from the enforcement layer. Different bodies, different powers, different news stories.
Where the rules come from — the FATF, explained
Above every national system sits the Financial Action Task Force — the FATFThe Financial Action Task Force — the inter-governmental body, created by the G7 in 1989, whose Recommendations set the global anti-money-laundering standard. Not a law-maker: its power runs through peer review and its lists. — created by the G7 at its 1989 Paris summit. It is not a court, not a regulator, and its Recommendations are not law anywhere. Its authority works differently, and understanding how is the key to understanding why every serious financial centre runs a broadly similar AML system:
- Membership and standards. FATFThe Financial Action Task Force — the inter-governmental body, created by the G7 in 1989, whose Recommendations set the global anti-money-laundering standard. Not a law-maker: its power runs through peer review and its lists. members — the UK was a founder — commit to implementing its Recommendations, the global template for AML law.
- Mutual evaluation. Members inspect each other, country by country, and publish graded reports on how well each system works in practice, not just on paper.
- The lists. Jurisdictions that fail badly enough go onto the grey listFATF's list of jurisdictions under increased monitoring. Being placed on it triggers extra due diligence from the world's banks — the market consequence that makes FATF standards bite. (formally, "jurisdictions under increased monitoring") or the blacklist. The consequence is not a FATFThe Financial Action Task Force — the inter-governmental body, created by the G7 in 1989, whose Recommendations set the global anti-money-laundering standard. Not a law-maker: its power runs through peer review and its lists. penalty — it is that banks worldwide must treat listed countries as high-risk, which raises the cost of every transaction touching them. Soft law, hard consequences.
So what — Brexit changed the UK's legislator but not its anchor. EU directives no longer bind; the UK now amends its own MLRs on its own timetable (SI 2026/621 narrowing enhanced due diligence is post-Brexit divergence in action). But the UK remains a FATFThe Financial Action Task Force — the inter-governmental body, created by the G7 in 1989, whose Recommendations set the global anti-money-laundering standard. Not a law-maker: its power runs through peer review and its lists. member, evaluated on the same standards as the EU — which is why the systems stay recognisably similar even as the details drift apart.
The supervisors — who checks whom
The UK deliberately has no single AML supervisor. Responsibility is split three ways:
The FCA — the Financial Conduct Authority — supervises banks, investment firms, payment institutions and (since 2020, currently via AML registration) cryptoasset businesses. It is the heavyweight: it authorises firms, inspects their systems, and fines at scale. The concrete example: in October 2024 it fined Starling Bank £28,959,426 for financial-crime control failures — an automated screening system that had, since 2017, checked customers against only a fraction of the sanctions list, and 54,000 accounts opened for high-risk customers in breach of an agreed restriction. No laundering conviction was needed; failing at the controls is the offence at this layer.
HMRC — the tax authority, wearing a second hat — supervises the sectors no one else takes: money service businesses, estate and letting agents, high-value dealers, art market participants.
The professional bodies, overseen by OPBAS. Lawyers and accountants are supervised for AML not by the state but by their own professional bodies — the Solicitors Regulation Authority, the Law Society of Scotland, the accountancy institutes and others: 25 professional body supervisors in all. Because self-supervision invites inconsistency, 2018 brought OPBAS — the Office for Professional Body Anti-Money Laundering Supervision — a unit inside the FCA that supervises the supervisors: it inspects the professional bodies' AML work and publishes uncomfortably candid reports about its variability. The gambling sector has its own supervisor again (the Gambling Commission).
So what — when you assess a UK counterparty, first ask who supervises it. A bank answers to the FCA's dedicated financial-crime teams; a small law firm answers to its professional body, checked only indirectly by OPBAS. The supervision intensity behind a UK-regulated label varies more than the label suggests.
The enforcers and the plumbing
- The NCA — the National Crime Agency — hosts the UK's FIUFinancial intelligence unit — the national office that receives and analyses suspicious activity reports. The UK's sits in the NCA; Switzerland's is MROS., which receives the suspicion reports the whole system generates: more than 850,000 SARs a year. POCA adds a mechanism most countries lack: a business that suspects funds can request a defence against money laundering (DAML) before proceeding — refusals are where accounts freeze.
- The SFO — the Serious Fraud Office — investigates and prosecutes the top tier of complex fraud, bribery and corruption, with laundering charges often attached.
- The CPS prosecutes the general run of POCA offences investigated by police forces and the NCA.
- OFSI — the sanctions enforcer inside HM Treasury — is legally a different regime from AML, but in practice the same compliance desk answers to both; Starling's fine, note, was substantially about sanctions screening.
The rewiring that has already been decided
In October 2025 HM Treasury announced the outcome of its long-running review of AML supervision: the FCA will become the single AML/CTF supervisor for legal and accountancy firms and trust and company service providers. The 25 professional bodies lose their AML role; OPBAS — built to oversee them — will be wound up. The transfer needs primary legislation and is expected to take several years, with further consultations through 2025–26 on exactly what powers the FCA will hold.
So what — this is the largest structural change to UK AML supervision since the MLRs existed, and it is material now, before any statute passes: law and accountancy firms should expect FCA-style supervision — data returns, thematic reviews, a fining culture — and are already being advised to uplift toward it. For counterparty analysis, the fragmented-supervision caveat above has a shelf life: the UK is converging, in its own way, on the concentrated model the EU is building with AMLA — while Switzerland keeps supervision delegated to SROs. Three systems, three directions; the corridor between two of them is the subject of the Berne corridor dossier.
Orientation, not advice · verify against the primary texts · instrument stages tracked on Regulatory Watch