Client risk assessment for small UK firms: how to do one under the MLRs

What the MLRs require

The MLRs never say “client risk assessment”. The duty comes from three provisions read together: reg 18 (assess your firm’s risks in writing), reg 28(12)–(13) (scale CDD to the risk of each case) and reg 28(16) (be able to demonstrate it). Regs 18 and 28 were not changed by the 2026 amendments.

Reg 28(13) sets the minimum factors for each case:

• the purpose of the transaction or business relationship;
• the size of the transactions or the level of assets involved;
• the regularity and duration of the relationship.

The assessment then decides the level of CDD. Simplified due diligence is only allowed where the risk is low (reg 37). Standard CDD applies in most cases (reg 28). EDD applies where reg 33(1) says so or where you identify a high risk. LSAG 2025 §5.10 says plainly that “you must record a risk assessment for every client you act for as a part of CDD”, and the CCAB guidance for accountants (July 2026) expects risk categories such as low, normal and high.

Firm-wide and client risk assessments compared

The two assessments do different jobs. The firm-wide assessment is the map of your business risks; the client assessment uses that map for one client. If a client form contradicts your firm-wide assessment, for example by rating a service low risk that your firm-wide document calls high, inspectors will notice.

If you have not written the firm-wide document yet, start there. Our firm-wide risk assessment template covers the reg 18 risk factors.

How to do a client risk assessment in seven steps

A good client risk assessment takes minutes for a routine case and records more detail for an unusual one. The seven steps below combine reg 28(13), HMRC’s AMLG1800 and the LSAG and CCAB guidance. Do them before or alongside your identity checks, not after the work has started.

1. Identify the client and the service. Record who the client is, who acts for them and any beneficial owners, plus the service and the purpose of the work. For estate agents that means the buyer and the seller; for letting agents it can include guarantors and agents.
2. Record size, regularity and duration. Note the value involved and whether this is a one-off transaction or an ongoing relationship (reg 28(13)).
3. Screen for mandatory EDD triggers. Answer yes or no for each reg 33(1) trigger: high risk in your firm-wide assessment, a FATF call for action country, a PEP or their family or close associate, false or stolen ID, an unusually complex or unusually large transaction, an unusual pattern or no apparent purpose, or any other higher-risk case. Our EDD checklist covers what each one requires.
4. Rate the risk factors. Work through the client, geography, service and transaction, and delivery channel factors (see the table below).
5. Set the overall rating and give your reasons. Use a simple scale such as low, medium and high (CCAB calls the middle band “normal”). A mandatory trigger always means EDD, whatever the score.
6. Decide the CDD level and actions. Simplified, standard or enhanced, plus any extra steps such as source of funds or source of wealth checks.
7. Sign, date and set a review point. Record who did the assessment, who approved it (senior management for PEP and call for action cases) and when you will look at it again.

Risk factors to consider

Reg 33(6) lists the factors that can point to higher risk, and HMRC adds a few of its own. One factor on its own does not make a client high risk: reg 33(7) says so. What matters is the overall picture and a written reason for your conclusion.

LSAG also expects an adverse media check proportionate to the risk. Our guide to PEPs, sanctions and adverse media explains each screen.

Scoring and ratings: avoid the traps

Scoring helps consistency, but it can also hide a serious risk. LSAG §5.13 gives a worked example where a client scores 20 out of 20 for geographic risk and 20 out of 20 for client risk, yet the total of 40 out of 100 falls below a threshold of 50 and comes out as “low”. Build in automatic high-risk triggers so that cannot happen.

• Overrides are allowed, with reasons. LSAG accepts documented overrides of a score.
• Profit must not affect the rating. LSAG says economic or profit considerations, and the wish to keep a client, must not influence it.
• It should not be a tick-box exercise. LSAG §5.12 expects you to describe the circumstances, rate them and justify the ratings.
• Long relationships do not lower the bar. The SRA says there is no provision in the MLRs for waiving CDD because of a long-standing or personal relationship.
• If you decide a risk factor does not make the case high risk, HMRC expects your reasoning to be justifiable and clearly recorded.

Sector notes

The method is the same for every sector, but the risks differ. The notes below pick out the points that most often change a client rating in a small firm. Check which supervisor you have with our AML supervisor finder.

Estate agents. HMRC says both the buyer and the seller are your customers. Treat super-prime transactions as high risk: £5m or more in London and the South East, £1m or more elsewhere. HMRC’s indicators include a client whose means do not match the property, an unexplained link between buyer and seller, evasive answers about source of funds, cash buyers and bridging finance. More in our estate agents hub.

Letting agents. You are in scope only for rents of £10,000 or more a month, or likely to reach that during the term. HMRC says landlords, tenants and everyone acting for them, including agents, trustees and guarantors, are customers. HMRC notes that money moves fast (deposits are often paid on the day of viewing) and flags rent paid to offshore accounts without knowing the beneficial owner. See the letting agents hub.

Accountants and bookkeepers. HMRC’s sector risk assessment, citing the National Risk Assessment 2025, rates accountancy services as high risk for money laundering and says criminals target firms with “weak or inadequate risk assessments”. Payroll, bookkeeping, insolvency and tax advice are singled out. CCAB guidance suggests a simple matrix using legal form, country, sector, service and delivery channel. See the accountants hub.

Solicitors. LSAG expects a client risk assessment and, where needed, a matter risk assessment, signed and dated by the person who did it. A written matter assessment may not be needed for highly repetitive matters fully covered by the client assessment. See the solicitors hub.

Financial advisers. FCA-supervised firms follow the same reg 28 and reg 33 duties. For PEPs, the FCA’s guidance FG25/3 applies. See the financial advisers hub.

Where firms fail at inspection

Supervisors’ own reports show the same weaknesses year after year: no client risk assessment, a rating with no reasons, and screening that was never evidenced. The figures come from three supervisors and different periods, so do not compare them directly.

Most HMRC penalties are for failing to register. Of the 334 named penalties in the April–September 2025 list, 304 cited reg 56 (registration), while only 6 cited reg 18 and 6 cited reg 28 (our count of HMRC’s table). These are systems failures that inspections find, and several estate agency entries combine both: “failures in carrying out risk assessments and conducting due diligence”.

Record keeping and reviews

Keep the client risk assessment with the CDD records it led to. Reg 40 requires CDD records, including EDD and PEP records, for 5 years from the end of the business relationship or the completion of an occasional transaction. After that, delete personal data unless an exception applies.

HMRC’s guidance on the written record (AMLG1800) is a useful standard for each client form too:

• the risk factors you took into account;
• the information and sources you used;
• the date of the assessment, the date of any review and what changed.

Review a client assessment when something changes: a new party, a new source of funds, a screening alert or a change to the FATF call for action list. That list is updated after each FATF plenary in February, June and October. As at 24 October 2026, the latest version is the one published on 19 June 2026.

Use our free template

Our free client risk assessment form gives you a structure for these steps, including the reg 33(1) triggers and the reg 33(6) risk factors. It reflects the 30 June 2026 changes and the FATF list as at 19 June 2026. Adapt it to your firm, as HMRC requires.

AML Buddy can supply some of the evidence for the form: your client verifies their identity through one secure link, and you get sanctions, PEP and adverse media screening in a timestamped report for the file, at £5.40 a check inc. VAT. The risk assessment and the rating stay with your firm.

Not sure where your firm stands overall? Take our 2-minute AML health check, then read our guide to customer due diligence.

This guide is general information, not legal advice. Your supervisor’s guidance and your own risk assessment decide what is right for your firm.