Free AML risk assessment template for small UK firms
A firm-wide AML risk assessment template with a simple likelihood × impact scoring table, and a client risk assessment form to use on every file. Both are in Word and PDF, written for small firms supervised under the Money Laundering Regulations 2017 (MLRs) and updated for the changes in force from 30 June 2026.
- All sectors · Regulation 18
Firm-wide AML risk assessment
A practice-wide risk assessment with a simple likelihood × impact scoring table and example risk factors for estate agents and accountants.
- All sectors · Per client
Client risk assessment form
One form per client or matter that records the CDD level you chose and why, including the enhanced due diligence triggers updated for 2026.
Who it is for
- Small firms that need the written firm-wide risk assessment required by regulation 18, with example risk factors for estate and letting agents and for accountants and bookkeepers
- MLROs and compliance officers preparing for a review or inspection by their supervisor
- Firms that want one consistent record of each client’s risk rating, CDD level and the reasons for it
- Firms updating their assessment for the 30 June 2026 changes to enhanced due diligence triggers
What’s inside
About your business
The firm-wide template starts with the facts a supervisor looks for: services within the MLRs, offices and staff, clients or transactions per year, typical transaction or fee size, where clients are based, how clients find you and what has changed since the last assessment.
Information you took into account
A checklist of sources: your supervisor’s sector risk assessment (for example HMRC AMLG3200, AMLG3300 or AMLG3700), the national risk assessment 2025, the current FATF call-for-action list, CCAB or LSAG guidance, and your own data such as client ratings, internal reports and file reviews.
Scoring method
Likelihood and impact each scored 1 to 3 and multiplied: 1–2 is low, 3–4 medium and 6–9 high, with what each band means for the CDD you apply. Neither the regulations nor HMRC prescribe a method, so you can replace it with your own.
Five risk tables
Customer, geographic, product, service and transaction, delivery channel, and your own business. Each row has columns for evidence and volumes, likelihood, impact, score, controls in place and residual rating. Example factors are tagged [EA] for estate and letting agents and [ACC] for accountants, with space to add your own.
Conclusion, risk appetite and action plan
Your overall inherent and residual risk, the top three risks, why you reached that view, the clients or work you will not take on, and an action plan with owners and deadlines. It ends with senior manager approval and a review log.
Client risk assessment form
One form per client or matter: client and matter details and the purpose of the relationship, the mandatory EDD triggers in regulation 33(1) as Yes or No questions, risk factors rated low, medium or high, a source of funds and source of wealth table, the EDD you applied (including PEP details), the overall rating, CDD level, decision and next review date, and a review history.
How to use it
- Enter your work email in the sign-up box to get the Word and PDF files for both templates. Emails from us are optional.
- For the firm-wide assessment, use “Fill in your firm’s details online” to add your firm name, supervisor, preparer, approver and review dates, then download the filled-in Word file. What you type stays in your browser and is not sent to us.
- Fill in “About our business” and the “How it applies to us” column with real numbers: clients, transaction values and percentages. That is the evidence a supervisor looks for.
- Score each risk factor, delete the examples that do not apply, add your own and write your overall conclusion and risk appetite.
- Get the assessment approved by senior management, then write or update your AML policy so it matches the risks you found.
- Complete the client risk assessment form before you start acting for each client, keep it on file with the CDD evidence, and review the firm-wide assessment at least once a year.
What regulation 18 requires
Regulation 18 of the MLRs requires every relevant person to take appropriate steps to identify and assess the money laundering and terrorist financing risks its business faces. You must take into account information from your supervisor and risk factors relating to your customers, the countries or geographic areas you operate in, your products or services, your transactions and your delivery channels. The steps should reflect the size and nature of your business.
You must keep an up-to-date written record of those steps, unless your supervisor tells you in writing that a record is not needed, and give your supervisor the risk assessment and the information it was based on when asked. Your policies, controls and procedures under regulation 19 must then manage the risks the assessment identifies. HMRC expects the assessment to be reviewed at least once a year and earlier versions to be kept for at least 5 years (AMLG1800).
The client risk assessment form records the risk in each case. Since 30 June 2026 (SI 2026/621), the country trigger for enhanced due diligence covers FATF call-for-action countries only. A link to a FATF increased-monitoring (grey list) country no longer triggers EDD automatically, but you should still score it as a risk factor.
Questions
What is a firm-wide AML risk assessment?
It is a written assessment of the money laundering and terrorist financing risks your whole business faces, required by regulation 18 of the MLRs. It looks at your customers, the places you deal with, your services and transactions and how you deliver them, and it is the basis for your AML policy.
What is the difference between a firm-wide and a client risk assessment?
The firm-wide assessment covers the business as a whole and is reviewed at least once a year. The client risk assessment is done for each client or matter before you start acting. It records the level of CDD you chose and why, as regulation 28 requires the extent of your checks to reflect both assessments.
Do I have to use a scoring matrix?
No. Neither the regulations nor HMRC prescribe a scoring method. The likelihood × impact table in the template is one simple option. What matters is that your ratings are explained and backed by facts about your business.
Does a sole trader need a written risk assessment?
Yes, in almost all cases. Regulation 18 applies to every business covered by the MLRs, and the steps you take should reflect your size, so a sole trader’s assessment can be short. You can skip the written record only if your supervisor has told you in writing that you do not need one.
Will this template satisfy my AML supervisor?
Not on its own. It is a starting point to adapt, not legal advice. Supervisors look for an assessment that describes your own clients and services with real figures, so replace every placeholder, delete examples that do not apply and record your reasons. Your firm remains responsible for its own compliance.
Related
This template is a starting point to adapt, not legal advice. Check it against your AML supervisor’s current guidance before you use it. Your firm remains responsible for its own compliance.
Run the ID and screening checks your policy calls for
Send your client one secure link. Start with 5 free checks, with no subscription or contract.