Money Laundering and Terrorist Financing (Amendment) Regulations 2026: A more evidenced approach to risk

For many firms, the substance of the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (“the Regulations”), will not be new. However, the standard against which those requirements are assessed has been sharpened and more clearly defined.

A Stronger Focus on Evidenced Risk Assessment

One of the clearest themes running through the Regulations is the expectation that firm-wide risk assessments must do more than exist as a formal document. There is greater emphasis on how risks are identified, how they are assessed and prioritised, and, importantly, how they translate into operational controls. Firm wide risk assessments should not be treated as a static document, but as a living framework that evidences the firm’s understanding of its risk exposure and how those risks are actively managed in practice.   

This has practical implications for how firms approach this. Firms will need to move beyond high-level scoring matrices. Supervisors are likely to look more closely at the reasoning underpinning risk classifications and whether those judgements are reflected in customer due diligence, monitoring and escalation processes. Where a firm identifies a higher exposure to particular risk factors, such as complex ownership structures or higher-risk jurisdictions, there should be a clear and evidenced link to enhanced scrutiny in those areas.

This reflects a continued shift away from form towards substance: it is no longer sufficient to demonstrate that a risk assessment has been completed; firms must be able to show how it actively informs decision-making. 

In that sense, the firm-wide risk assessment is no longer simply a compliance requirement; it is increasingly a central tool through which firms must evidence the quality and credibility of their overall AML framework.

Refinements to Due Diligence Expectations

The amendments also revisit customer due diligence, with a particular focus on the consistency and appropriateness of its application. While the existing framework of standard, simplified and enhanced due diligence remains intact, the updated Regulations make clearer that these distinctions must be driven by genuine, risk-based assessment rather than convenience or legacy categorisation.

There is a noticeable emphasis on ensuring that enhanced due diligence is triggered where it is warranted, particularly in higher-risk scenarios. At the same time, firms relying on simplified due diligence will need to be confident that the basis for doing so is robust, evidence-based, appropriately justified and well documented. 

Ongoing monitoring also receives renewed attention. Rather than being treated as a periodic compliance step, it is increasingly framed as a continuous and responsive process, reflecting emerging information about the customer and their transactional behaviour. In effect, the lifecycle approach to client risk is reinforced.

Beneficial Ownership: A Continued Area of Scrutiny

Transparency of beneficial ownership remains a priority area. The amendments reinforce the expectation that firms should not simply rely, without questions, on information provided by clients or available on public registers. 

Where inconsistencies arise, firms are expected to probe further, take reasonable additional steps to verify ownership, and escalate discrepancies where appropriate. This aligns with wider regulatory concern about the misuse of corporate vehicles and the risk that superficial verification can obscure underlying exposure.

For many firms, this will mean revisiting how beneficial ownership checks are carried out in practice and ensuring that any challenges or judgements are clearly documented. Regular review of beneficial ownership procedures, alongside targeted training for those responsible for client onboarding, can also help ensure that these checks are applied consistently and remain responsive to evolving risk.

Record-Keeping and the Importance of Audit Trails

Another notable feature of the Regulations is the emphasis on record-keeping. The requirement itself is not new, but the level of detail expected has increased. Regulators are increasingly focused on the ability of firms to demonstrate, after the event, how and why specific AML decisions were made.

This places a premium on maintaining clear audit trails. It is not enough to show that checks were completed; firms must also evidence the rationale behind key decisions, particularly in higher-risk or borderline cases. Documentation should allow a third party, whether a regulator or an internal reviewer, to understand the judgement exercised and the factors taken into account. In effect, firms should approach CDD as they would a worked example, ensuring that both the outcome and the underlying reasoning are clearly visible.

Governance, Controls and Accountability

Finally, the Regulations underline the importance of effective governance. While not introducing entirely new obligations, they reinforce expectations around oversight, accountability and the operation of AML controls.

There is a clear implication that senior management should have sufficient visibility of AML risks and the effectiveness of controls, supported by meaningful management information. Similarly, training is expected to be more closely aligned with risks, moving beyond generic awareness to practical application.

What This Means in Practice

Taken together, the Regulations point towards a more disciplined and evidenced application of the existing AML framework. Firms should expect supervisory attention to focus less on whether processes exist, and more on how effectively they are understood, applied and documented.

In practical terms, this is likely to require firms to revisit their risk assessments with a critically, ensuring that they present a coherent and defensible view about the firm’s exposure and the controls in place. Customer due diligence processes should be tested to confirm that they reflect actual risk, rather than historic or procedural assumptions.

Equally, firms should review the quality of their record-keeping and consider whether their files would stand up to scrutiny and clearly demonstrate the reasoning behind key decisions. Governance arrangements and training programmes should also be assessed to ensure they support informed and consistent application of the risk-based approach.

Ultimately, the message from the Regulations is not that firms must do entirely new things, but that they must do familiar things better, and be able to show that they have done so.