Guidance

Civil measures — money laundering supervision

Updated 23 May 2024

Background

Under the money laundering regulations, all businesses supervised by HMRC for anti-money laundering purposes are subject to either:

• fit and proper requirements
• approval requirements

These requirements apply to those acting as a:

• beneficial owner
• officer
• manager
• nominated officer

The requirements do not test whether the business is professionally run or operated.

Before you can register your business with HMRC, responsible persons must go through the relevant process. They will need to apply for the fit and proper test.

HMRC will also need to complete approval checks.

Registration is a legal requirement to trade in a regulated activity. It is not a recommendation or endorsement of your business by HMRC. Therefore, you should not use language which suggests your business is endorsed or recommended by HMRC.

Read the fit and proper section of this guide to find out more about these requirements.

Find out how to register or renew your money laundering supervision with HMRC.

Introduction

This document sets out how HMRC will use its powers under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, referred to as ‘the regulations’.

If your business breaches legal requirements, HMRC can:

• use the civil measures listed in this guidance
• treat the breach as a criminal matter

HMRC’s role under the regulations

HMRC is a supervisor under the regulations.

If your business is supervised by HMRC, you must have:

• a written risk assessment
• policies, controls and procedures to prevent your business being used to launder money or finance terrorism

You must report suspicious financial transactions to the National Crime Agency (NCA).

As a supervisor, HMRC monitors the businesses we are responsible for and makes sure they follow the regulations. We:

• keep a register of the businesses we supervise
• provide education and guidance to registered businesses, to help them understand their obligations
• carry out compliance activities
• take action against businesses who are non-compliant

HMRC is subject to the Regulators’ Code. This means we will, as a regulator:

• not impose an unnecessary burden on businesses we supervise
• focus civil action on the areas of greatest risk

HMRC recognises most of the businesses we supervise aim to comply with the regulations. We take action against the minority that do not comply. We deal more severely with deliberate or persistent non-compliance.

HMRC’s approach to non-compliance

HMRC works to:

• help businesses get things right the first time
• promote good compliance by designing systems and processes

We do this by:

• focussing on high-risk activity
• flexibly responding to new and evolving threats

We engage with businesses and help them to create appropriate controls against money laundering. This helps high risk businesses to prevent criminals from using them to launder money or fund terrorism.

We prevent non-compliance by looking at business processes and interactions with customers. We challenge high risk businesses and those with inappropriate controls to put things right.

We encourage non-compliant businesses to comply with the regulations in future. We will cancel the registration of businesses that:

• are complicit in criminal activities
• have an illegitimate business model

Where appropriate, we will:

• issue penalties and sanctions
• take criminal action

HMRC’s power under the regulations

HMRC have civil powers under the regulations to tackle non-compliance. This guidance is not a definitive list.

To encourage compliance and respond to non-compliance, we can issue a:

• penalty
• notice to request information or attendance at a meeting
• public statement naming and censuring a business or person

We can refuse or remove:

• fit and proper status from an individual
• an approval from an individual

We can also:

• inspect business premises
• refuse, suspend or cancel a business’s registration
• suspend or prohibit an individual from holding a managerial role
• seek a court order to enter premises or prevent a person from committing a breach

Most breaches are civil matters, however, we can investigate and treat a breach as a criminal matter.

General principles

Most businesses comply with the regulations. They expect HMRC to:

• apply sanctions to businesses that do not comply, whether accidentally or knowingly
• make sure that non-compliance does not create a competitive advantage

Contact HMRC to report non-compliance.

Appropriate penalties

The financial penalties we issue under the regulations must be appropriate. This means they must:

• remove financial gain or competitive benefit from the non-compliance
• encourage the business to become compliant
• be proportionate to the seriousness of the breach or offence — taking previous non-compliance into account

HMRC does not issue penalties to raise money.

We can issue a penalty or start a criminal investigation for any breach, even if it’s the first. We will decide if it’s a civil or criminal matter. If you continue not to comply, we can start a criminal investigation against you.

Our approach must be consistent, but sensitive to the circumstances and behaviours in each case.

A penalty administration charge will apply. The amount you’ll have to pay is given in your penalty documentation.

Who we can apply measures to

HMRC can apply measures to:

• a business required to register
• a registered business
• an officer of the business
• the beneficial owners
• directors, managers and the nominated officer

Inspecting premises

HMRC officers can, on reasonable grounds,:

• enter and inspect premises
• observe the business or professional activities
• interview the business
• require anyone on the premises to tell us where to find documents or information
• require anyone on the premises to explain a document to us
• inspect any documents or information found on the premises and make copies
• inspect any cash found on the premises

We will usually make an appointment to visit you. We can carry out an unannounced visit. Our officers will always identify themselves as HMRC officers.

HMRC officers do not need a warrant to enter and inspect premises. Our power to enter premises also applies to businesses that should be registered but are not.

Find out more about business inspections.

Deciding an application

Refusing to register your business

When you apply to register, we’ll ask you to provide information about your business. We can ask for extra information. If we need extra information, we’ll write to you to explain:

• what information we need
• why we need the information

You must provide the information we ask for within 21 days. We will pause your application at this point.

We will refuse your application if we do not receive the requested information within the specified time period.

We can refuse an application if:

• you have not met the registration conditions
• you have provided false or misleading information
• you have not provided information we requested
• you have not told us about inaccuracies and material changes to information in your application within 30 days
• a person who needs to be tested is not a fit and proper person due to a risk of money laundering or a conviction for a relevant criminal offence
• a person that needs to have approval from HMRC has not been approved because of a conviction for a relevant criminal offence
• you do not have a written risk assessment or policies in place
• we have reason to believe you, or an officer or manager in your business, are not able to carry out the obligations under the regulations
• you have unpaid fees or an unpaid penalty
• your business is a money service  business, and a money transmitter, but is not on the Financial Conduct Authority’s register of payment service providers

If we refuse to register your business for an activity, you cannot lawfully do that activity.

Suspending or cancelling a registration

We can suspend or cancel an existing registration for the same reasons that we refuse to register a business.

We can also suspend or cancel a registration if you:

• do not respond when we send you a notice requesting information
• are prohibited from trading due to your standing with a regulator
• do not pay the annual fee
• are no longer a fit and proper person
• have been convicted of a relevant offence

You will not be able to lawfully do an activity if HMRC cancels your registration for the activity.

If we suspend your registration, we will tell you:

• how long the suspension lasts for
• what you need to do to have your registration reinstated

You will not be able to carry out relevant activity during your businesses’ suspension.

Fit and proper and approved status

Fit and proper

HMRC can refuse or withdraw the fit and proper status from a person in the money service business and trust and company service providers sectors if they:

• have a criminal conviction for a relevant offence
• are not fit and proper because of the risk of money laundering and terrorist financing

We must refuse the registration of a business if a responsible person holding a relevant position is not fit and proper. A person who is not fit and proper cannot act as a:

• beneficial owner
• officer
• manager

You can put forward another person if a nominated officer fails the test. If we later find that a responsible person is not fit and proper, we can suspend or cancel your registration.

HMRC approval

If you have an unspent criminal conviction for a relevant offence, HMRC will not approve you as a sole practitioner, manager, officer or beneficial owner in the following sectors:

• accountancy service provider
• estate agency business
• high value dealer

You are guilty of a further criminal offence if you have a conviction for a relevant offence and you:

• act as a manager or officer
• are knowingly a beneficial owner

You can receive an unlimited fine and up to 3 months in prison.

HMRC can impose sanctions if you do not:

• take reasonable care to ensure the relevant people are approved by HMRC
• tell HMRC about a conviction for a relevant offence within 30 days of becoming aware of it
• tell HMRC you were convicted for a relevant offence within 30 days

We can also:

• refuse, suspend or cancel your business’ registration
• apply to the High Court for an order to sell the beneficial owner’s holding in your business
• consider other sanctions

To find out more, read fit and proper test guidance and HMRC approval checks guidance.

Prohibiting a person from managing

We can issue a temporary or permanent prohibition against you if you:

• hold an office or a decision-making or management position
• were involved in a breach or allowed a breach to happen

You will receive a prohibition notice, explaining which activities you cannot do in a management capacity. This could include any or all activities covered by the regulations.

If you do not comply with the prohibition, we can impose further sanctions on you or your business. This could include criminal prosecution.

Issuing penalties

Compliance penalties

HMRC can test your compliance with the regulations by:

• visiting your premises
• an intervention, either at your premises or over the phone

We can do both.

We can issue either a warning letter or penalty if:

• your business has breached any of the requirements in the regulations
• we treat the breach as a civil matter

Warning letters

We can issue a warning letter to:

• tell you about the breaches
• formally warn you that you have breached the regulations
• tell you the actions you need to take
• give you a deadline to correct the breaches
• tell you we may follow up to check your compliance
• tell you what will happen if we find further breaches

HMRC are not required to send warning letters before we issue penalties or start criminal investigations. We will not send a warning letter and will move straight to issuing a penalty if:

• the breaches are serious
• the breaches happen throughout the business
• you know about the requirements and you still knowingly breach them
• you have been trading while unregistered
• you have not complied with a notice requiring information

If you breach a regulation for a second time, we will not usually issue a second warning letter, except when both of the following apply:

• your business has made significant efforts to address the areas set out in the original warning letter
• there are minor administrative issues you still need to address

After issuing a warning letter, we can take follow-up action to test your compliance.

If you breach the same regulation twice, we can treat the second breach as deliberate. For example, where we have told you how to correct the failures but you have not. If we then decide to issue a penalty, we can apply another sanction.

Pre-penalty notice

If we decide to issue a penalty, we can issue a pre-penalty notice to:

• tell your business that we intend to issue a penalty
• explain the reasons why we are considering issuing a penalty
• explain the breaches that have led to a penalty being considered
• offer you an opportunity to present relevant information that was not considered in the decision

A pre-penalty notice will contain a schedule explaining:

• the breaches
• the penalty amount
• how we calculated the penalty amount

If your business does not respond to the pre-penalty notice within 30 days, we will issue a penalty notice. If you respond by providing new information, we will consider:

• cancelling the penalty
• recalculating the penalty to a lower or higher amount

We will then issue an appropriate penalty notice.

We do not have to send a pre-penalty notice. We can issue a penalty notice without a pre-penalty notice if:

• the case is straightforward
• we need to issue the penalty or other sanction quickly

Penalty notice

We can issue a penalty notice to tell you your business is subject to a penalty. It will explain:

• the penalty amount
• why we are issuing the penalty
• how we calculated the penalty
• the date you must pay the penalty by and how to pay it
• the breaches that have led to the penalty
• your rights to a review and appeal, and the deadlines for requesting these

Registration penalties

Trading while unregistered

Your business must not trade in a regulated sector without registering with either:

• HMRC
• another supervisor listed in Schedule 1 of the regulations

Trading while not registered can result in a civil penalty or prosecution.

If you register after beginning to trade, the penalty will be proportionate to the length of time you have  traded while unregistered.

HMRC works to identify businesses who should be registered but are not. If we identify that you are unregistered, but have been trading, you may get a penalty. You must register for supervision. If you have traded, or continue to trade, without registering, we can:

• issue a larger penalty for the failure to register
• issue a penalty if you are not complying with your other obligations under the regulations — for example, to carry out customer due diligence
• issue the penalty to the person responsible
• use a non-financial sanction

Any period of trading while unregistered can affect:

• our view of your ability to comply with the regulations
• whether we’ll accept your application to register

We can treat any period of unregistered trading as a criminal matter.

Failing to update HMRC

You must tell us within 14 days if your nominated officer or compliance officer changes. If you do not, we can issue a penalty.

You must tell us within 30 days if:

• an approved person in your business is convicted of an offence listed in Schedule  3 of the regulations
• there is an inaccuracy or material change in the information you provided us when registering

A penalty will apply each time you do not tell us of a material change or inaccuracy within 30 days of:

• the change taking place
• the error being discovered

If you tell us about multiple breaches at the same time, each will be penalised individually. For example, if you appointed 2 directors and 3 directors left your business, you would have breached the regulations 5 times.

A change in director is a material change because they:

• are responsible for making sure you are complying with the regulations
• may need to do a fit and proper test

A change may be material if it affects either:

• your ability to comply with the regulations
• HMRC’s ability to test your compliance with the regulations

Failing to comply with an information notice

If HMRC requires information from you, we can issue a notice requiring your business or anyone connected with it to:

• provide the information or records set out in the notice
• go to an interview and answer questions

The notice can apply to:

• an individual
• a partner or officer of the business
• a manager within the business
• an employee or agent of the business
• a person connected to the business

If you receive an information notice, it will tell you:

• why HMRC is asking for information
• when and where to give us the required information

If you do not comply with an information notice, we can:

• issue a fixed penalty
• suspend or cancel your business’ registration
• apply any other sanction, or combination of sanctions, we believe are appropriate
• treat your non-compliance as a criminal matter

When we will not issue penalties or other sanctions

Reasonable steps

HMRC will not usually issue a penalty if we are satisfied you took all reasonable steps to comply with a requirement.

We will also consider whether you followed any relevant guidance that was both:

• available to you when the breach occurred
• issued by us, or another relevant body, and approved by HM Treasury

Other circumstances

HMRC can decide not to impose sanctions if you:

• breached the regulations due to unforeseeable and unavoidable circumstances
• are normally compliant and do not usually make this type of error
• have voluntarily disclosed to us that you have identified areas of weakness and are making significant improvements to correct them

We may send you a written warning. If you do not carry out the action in the warning letter by a given date, we can issue a penalty.

The warnings we issue are without prejudice to any civil or criminal action against you.

Liability of an officer to a penalty

An officer is a person acting as, or saying they act as, a:

• director
• secretary
• nominated officer
• chief executive
• member of the management body
• person who controls a corporate body
• partner
• manager
• secretary or similar officer in a partnership
• member of the governing body or officer of an unincorporated association or sole proprietor

If an officer knowingly takes part in a breach, HMRC can issue a penalty directly to them.

If more than one officer is responsible for the breach, we can impose penalties on all officers involved.

The penalty will reflect the severity of the breach. We can consider other sanctions instead of, or alongside, a financial penalty.

Not paying a penalty

If you do not pay a penalty issued under the regulations, HMRC can recover the amount:

• using bailiffs
• through the courts as a debt

You could also be charged bailiff fees and for the court’s time.

If you still do not pay, we can:

• offset any future payments you make to us against the penalty debt
• reconsider your fit and proper status
• refuse, suspend or cancel your registration
• use other sanctions

HMRC will consider other types of asset recovery if appropriate. We can treat income you received from trading without registering as the proceeds of crime.

Publishing

Publishing statements

HMRC has a duty to publish details of:

• penalties
• censuring statements
• persons prohibited from management

We can name a business or an individual when a notice has been issued relating to these measures. This will be published and remain online for 5 years and include:

• your name or the name of the business
• the registered address of the business
• the nature of the breaches and their value
• the status of any appeals against the penalty or sanction

Find out more about businesses not complying with money laundering regulations.

If publishing details would not be proportionate, we can:

• delay publishing the information
• publish the information anonymously — this means that both you and your business would not be identified

We will not publish the information if:

• doing so could affect the stability of the financial markets
• the penalty or sanction is minor

Only penalties and sanctions that apply to the 2017 regulations will be considered for publishing.

You have 30 days to appeal against publication if we send you a:

• pre-penalty letter
• a letter telling you we may publish a censure statement or prevent a person from managing the business

HMRC makes publishing decisions on a case-by-case basis. We will tell you if we are going to publish the information about your sanction or penalty. If we decide to publish the information, we will tell you if it will be published:

• anonymously
• in full

Publishing suspensions and cancellations

HMRC can publish details of suspensions and cancellations imposed under the regulations. We will only do so if we think it is proportionate. We will send you a notice about these measures, then name your business or an individual in the published information.

We will publish the information online, including:

• your name or the name of the business
• the registered business address
• to and from dates of the suspension and the date of cancellation
• the status of any appeal against the issuing of the suspension or cancellation

Find out more about businesses not complying with money laundering regulations.

When the suspension or cancellation starts, we will delete your details from the list of supervised businesses.

HMRC makes publishing decisions on a case-by-case basis. We will tell you our decision before publishing any information. You have 30 days from the date of the confirmation letter to represent yourself, your business or both against publication.

Reviews and appeals

HMRC will tell you if you have a right of appeal when a decision is made.

Your business has 30 days to appeal our decision to:

• impose a financial penalty
• issue a direction under Regulation 25(2)
• refuse or withdraw a person’s fit and proper status
• refuse, suspend or cancel your business’ registration
• publish a censuring statement
• issue a prohibition on management

You can have the decision reviewed by an independent HMRC team, who were not involved in making the original decision. A review decision is usually made within 45 days. Your business cannot trade during the review if we:

• refused to register your business
• cancelled your business’ registration

If you do not agree with the outcome of the review, you have 30 days to appeal to the First Tier (Tax) Tribunal of HM Courts and Tribunal Service. You can also appeal directly to the tribunal without requesting a review.

Criminal investigation and prosecution

Working with law enforcement agencies

HMRC treats most breaches as civil matters. However, we can investigate a breach as a criminal matter and prosecute the individuals involved.

We also support money laundering prosecutions brought by other law enforcement agency partners.

Consequence of criminal prosecution

If you are convicted of a criminal offence under the regulations, you can receive both:

• up to 2 years in prison
• a fine

We can prosecute an officer of your business or a partner in your partnership if:

• they allow someone to commit the offence
• they are involved in the offence
• the offence happened due to neglect by the officer or partner

You can also be prosecuted under:

• Proceeds of Crime Act 2002
• Terrorism Act 2000

For example, we could prosecute you if all the following apply:

• you own, or work for, a business in the regulated sector
• you fail to report suspicious activity to HMRC
• you tell a person involved in the activity that you intend to report it

The Terrorism Act sets out the main offences related to terrorist funding. As a regulated business, you must report any activity you suspect is funding terrorism. These activities can include:

• fundraising, using or possessing money or other property for the purposes of terrorism
• concealing, transferring or removing from jurisdiction money or property used to finance terrorism
• helping someone to keep or control money which will be used for, or is the proceeds of, terrorism
• not complying with, or helping someone else to avoid complying with, a freezing order
• dealing with, or making available, funds or economic resources which are owned, controlled by, or benefit a designated person (under the Office of Financial Sanctions Implementation List)

If you are convicted under the Terrorism Act, you can receive both:

• up to 5 years in prison
• a fine

If you are convicted of money laundering under the Proceeds of Crime Act, you can receive both:

• up to 14 years in prison
• a fine

Contact HMRC

Contact the money laundering team to:

• report non-compliance with the regulations
• make a general enquiry about HMRC’s supervision of businesses under the regulations