Free AML policy template for UK firms
Two editable AML policy and procedures templates, in Word and PDF: one for estate and letting agents, one for accountancy, bookkeeping and tax practices. Both follow regulation 19 of the Money Laundering Regulations 2017 (MLRs) and reflect the changes in force from 30 June 2026. Add your firm’s details online, then tailor the rest to what your firm actually does.
- Estate & letting agents
AML policy and procedures for estate agents
A written policy for a small estate or letting agency, built around HMRC’s guidance on who your customers are and when checks must be done.
- Accountants & bookkeepers
AML policy and procedures for accountants
A written policy for a small accountancy, bookkeeping or tax practice, aligned with the structure of the CCAB guidance for the accountancy sector 2026.
Who it is for
- Estate agents and letting agents supervised by HMRC, including lettings at a monthly rent of £10,000 or more
- Accountants, bookkeepers, tax advisers and payroll providers supervised by HMRC or a professional body
- Practices that offer company formation, registered office or nominee services, or sell off-the-shelf companies
- Small firms and sole traders writing a first written policy, or updating an older one for the 2026 changes
What’s inside
Firm details and approval record
A cover table for your firm name, AML supervisor, registration or membership number, version, who prepared it, who in senior management approved it, the approval date and the next review date (no later than 12 months after approval).
Purpose, scope and services covered
Tick-box lists of the work the policy covers. The estate agent version lists estate agency work under the Estate Agents Act 1979 and lettings at £10,000 a month or more. The accountant version lists accounts, bookkeeping, tax, payroll and trust or company services, including off-the-shelf companies, which are in scope from 30 June 2026.
Responsibilities
A table for the officer responsible for compliance (reg 21(1)(a)), the nominated officer or MLRO (reg 21(3)), a deputy and all staff, with the 14-day duty to tell your supervisor about appointments and a note on the sole trader exemption in reg 21(6).
Customer due diligence
Who your customers are and when CDD must be done (for estate agents: the seller by the agency agreement, the buyer by the time the offer is accepted, auction bidders before the hammer falls; for accountants: before the engagement starts), what to collect and verify for individuals, companies, partnerships and trusts, and reporting beneficial ownership discrepancies.
Enhanced due diligence, PEPs, sanctions and reliance
The EDD triggers as they stand after 30 June 2026, including FATF call-for-action countries, politically exposed persons (PEPs), source of funds and wealth, UK sanctions list checks, simplified due diligence and reliance on other firms. Options are in square brackets so you choose what your firm does.
Sector red flags
A list of warning signs for staff: for estate agency, based on HMRC’s risk assessment of estate agency businesses (AMLG3200); for accountancy, based on HMRC AMLG3700 and CCAB guidance, including payroll irregularities and pressure to reduce tax unlawfully.
Reporting, monitoring, training and records
Internal suspicious activity reports and SARs to the National Crime Agency, defence against money laundering requests, ongoing monitoring with review intervals by risk, training, employee screening, five-year record keeping under reg 40, and a risk check before new services or technology (reg 19(4)(c)).
Review log and staff acknowledgement
A version history table for each annual review (including “no changes, still valid because…”) and a sign-off table so staff can record that they have read the policy.
How to use it
- Choose the template for your sector and enter your work email in the sign-up box. You get the Word and PDF files straight away; emails from us are optional.
- Use “Fill in your firm’s details online” to add your firm name, supervisor, compliance officer, nominated officer and approval dates once. Download the filled-in Word file. What you type stays in your browser and is not sent to us.
- Complete your firm-wide risk assessment first. Your policy has to be based on the risks it identifies.
- Tailor the policy: replace every [square-bracket placeholder], delete the options and sections that do not apply (estate agents who do not let property at £10,000 a month or more delete section 6) and remove the guidance notes.
- Get the policy approved by senior management, share it with staff and ask each person to sign the staff acknowledgement table.
- Review it at least once a year and whenever your services, your risks or the law change. Record each review in the version history.
The rules behind an AML policy
Regulation 19 of the MLRs requires every relevant person to establish and maintain policies, controls and procedures to manage the risks identified in its risk assessment, to review and update them regularly, and to keep a written record. They must be proportionate to the size and nature of your business and approved by senior management. They must cover risk management, internal controls and customer due diligence, and include steps to take before you adopt new products, business practices or technology.
Regulation 21 sets the internal controls your policy describes. Where appropriate for your size and nature, you appoint a board member or senior manager as the officer responsible for compliance, screen relevant employees and set up an independent audit function. Every firm must appoint a nominated officer and tell its supervisor who holds both roles within 14 days. A sole trader who neither employs nor acts in association with anyone else does not have to make these two appointments (reg 21(6)).
The policy rests on your firm-wide risk assessment under regulation 18. In deciding what is proportionate you may take into account guidance issued by the FCA, or by another supervisor or appropriate body and approved by HM Treasury (reg 19(5)). HMRC expects policies to be reviewed at least once a year, the approver and date to be recorded and earlier versions to be kept for at least 5 years (AMLG1900).
Questions
Does a small firm need a written AML policy?
Yes. Regulation 19 applies to every business covered by the MLRs, whatever its size. It must be in writing, approved by senior management and proportionate to your business. A sole trader with no staff can keep it short, but still needs one.
Which template should I use?
Estate and letting agents should use the estate agent version, which follows HMRC’s guidance for estate and letting agency businesses. Accountants, bookkeepers and tax practices should use the accountant version, which follows the structure of the CCAB guidance for the accountancy sector 2026. The templates are not written for law firms: solicitors and conveyancers should follow the LSAG guidance 2025 and their supervisor’s materials.
Will this template satisfy HMRC or my professional body?
Not on its own. A template is a starting point. Your supervisor will compare what your firm does day to day with what the policy says, and a generic copy-and-paste document is a common inspection finding. Tailor every section, and check your supervisor’s current guidance, as some professional bodies publish their own pro forma policies. This is not legal advice, and your firm remains responsible for its own compliance.
What is the difference between an AML policy and a risk assessment?
The firm-wide risk assessment (regulation 18) identifies the money laundering and terrorist financing risks your business faces. The policy (regulation 19) sets out what your firm does to manage those risks: who is responsible, how you check clients, when you apply enhanced checks and how staff report suspicions. Do the risk assessment first.
How often should I review my AML policy?
HMRC expects a review at least once a year, even if nothing changes, and whenever your services, risks or the law change, for example after the amendments that came into force on 30 June 2026. Record who approved each version and when, and keep earlier versions for at least 5 years.
Related
This template is a starting point to adapt, not legal advice. Check it against your AML supervisor’s current guidance before you use it. Your firm remains responsible for its own compliance.
Run the ID and screening checks your policy calls for
Send your client one secure link. Start with 5 free checks, with no subscription or contract.