UK Money Laundering Regulations 2026: What the Amendments Change
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 made the biggest set of changes to the UK regime in several years. Most took effect on 30 June 2026. This guide sets out what changed, what firms now have to do differently, the later dates still to come, and what did not change.
The amendments follow HM Treasury's 2024 consultation on improving the effectiveness of the Money Laundering Regulations 2017 (MLRs), its response in July 2025 and a technical consultation on the draft instrument in September 2025. They amend the MLRs directly, and make matching changes to the Terrorism Act 2000 and the Proceeds of Crime Act 2002.
For the regime as a whole — who is covered, the core obligations and how the FCA supervises — see our guide to the UK MLR 2017 and FCA AML requirements.
Key Dates
| Date | What applies |
|---|---|
| 10 June 2026 | Regulation 1 (citation and commencement) only |
| 30 June 2026 | Almost everything else, including the sterling thresholds, the EDD and reliance changes, pooled client accounts, off-the-shelf firms and the new FCA notification duty |
| 1 February 2027 | New regulation 34A: due diligence on cryptoasset correspondent relationships |
| 1 September 2027 | Deadline for non-UK trusts newly required to register because they held UK land before 6 October 2020 |
| 25 October 2027 | Change-of-control rules for cryptoasset businesses registered from that date (Schedule 6B, paragraphs 3–4), in line with the new FSMA cryptoasset regime |
Thresholds Are Now in Sterling
Every euro amount in the MLRs has been replaced with a sterling figure, and the rule for converting other currencies now works from sterling at the London closing rate on the previous working day. Most figures convert one for one; where that would fall short of the FATF standards, the sterling figure is lower.
| Requirement | Before | From 30 June 2026 |
|---|---|---|
| Occasional transaction triggering CDD (reg 27(2)) | €15,000 | £12,000 |
| Occasional transaction that is a transfer of funds (reg 27(1)(b)) | €1,000 | £800 |
| Cryptoasset transfer CDD and travel rule (regs 27(7E), 64C, 64G) | €1,000 | £800 |
| High value dealers, art market participants and letting agents (regs 13, 14, 27) | €10,000 | £10,000 |
| Casinos (reg 27(5), (7)) | €2,000 | £2,000 |
| Occasional or very limited financial activity exclusion (reg 15(3)(b)) | €1,000 | £1,000 |
| Electronic money (reg 38) | €150 / €50 | £150 / £50 |
Check that onboarding rules, transaction monitoring scenarios and travel rule thresholds in your systems use the new figures, particularly the two that went down: £12,000 and £800.
Enhanced Due Diligence: Narrower Mandatory Triggers
High-risk countries. Mandatory enhanced due diligence under regulation 33(1)(b) used to apply to "high-risk third countries", defined by reference to both FATF lists. It now applies only to a "FATF call for action country" — a country on FATF's list of High-Risk Jurisdictions subject to a Call for Action, as that list stands from time to time (Iran, the DPRK and Myanmar after FATF's June 2026 plenary). Countries on the grey list no longer trigger EDD automatically; they remain a geographic risk factor under regulation 33(6).
Complex and large transactions. The trigger in regulation 33(1)(f) changes from transactions that are "complex or unusually large" to transactions that are "unusually complex or unusually large, in each case given the nature of the transaction". A transaction that is complex but normal for its type no longer requires mandatory EDD. The same wording now appears in the policies and procedures requirements, including for proliferation financing. The list of risk factors in regulation 33(6) is unchanged.
Reliance. Firms can now rely on third parties in grey-listed countries; reliance is barred only for third parties established in a FATF call-for-action country.
Pooled Client Accounts
New provisions in regulation 29 set out how banks and other providers can offer pooled client accounts — accounts that hold money for the holder's own clients, such as solicitors' client accounts — on a risk-based approach, without carrying out CDD on every underlying client. They apply to pooled client accounts opened on or after 30 June 2026.
- The account provider must understand the purpose and intended use of the account, check it fits what it knows about the customer (repeating CDD if not), assess and mitigate the money laundering and terrorist financing risk, and be able to show its supervisor that its measures are adequate.
- The account holder must, on request, give the provider identity information on its underlying clients and their beneficial owners, keep records of all payments in and out for five years, and provide information to law enforcement on request, subject to legal professional privilege.
- Simplified due diligence remains available for pooled client accounts where the risk is low.
For when simplified and enhanced measures apply more generally, see our guide to CDD and EDD.
Cryptoasset Businesses: Correspondent Relationships and Change of Control
Correspondent relationships (from 1 February 2027). New regulation 34A requires cryptoasset exchange providers and custodian wallet providers with correspondent relationships with similar providers in third countries to apply extra measures on top of regulation 33:
- gather information about the respondent, its reputation and how it is supervised;
- assess the respondent's AML/CFT controls;
- obtain senior management approval for new relationships;
- document the responsibilities of each party;
- be satisfied about due diligence on customers with direct access to accounts; and
- not deal with shell entities, or with institutions known to let shell entities use their accounts.
Change of control. A new Schedule 6B applies the FSMA change-in-control regime, with modifications, to MLR-registered cryptoasset businesses. Since 30 June 2026, acquiring control means becoming a beneficial owner or holding 10% or more of the shares or voting power, or significant influence, with further steps at 20%, 30% and 50%. The FCA assesses whether the acquirer is fit and proper, and acquiring control without approval is an offence. For firms registered from 25 October 2027, the FSMA regime applies with fewer modifications, in line with the new FSMA cryptoasset regime.
Other Changes
- Off-the-shelf companies. Selling an off-the-shelf firm is now trust or company service provider activity and is treated as a business relationship, so full CDD on the buyer is required. See our page on AML for corporate service providers.
- New FCA notification duty. Under new regulation 23(3A), FCA-supervised authorised persons must tell the FCA within 30 days of any material change to, or inaccuracy in, information they have given it under regulation 23.
- Bank insolvency. New regulation 30ZA lets a receiving bank open accounts for customers of a failed bank or building society, onboarded within 30 days of the insolvency, before completing CDD — provided it first identifies the customer and anyone acting for them, and completes CDD as soon as practicable.
- Trust Registration Service. Non-UK express trusts that acquired UK land before 6 October 2020 and still held it must register by 1 September 2027. New exclusions cover some short-lived trusts arising on death, and a de minimis exemption covers trusts with no UK land and very small assets and income, limited to one per settlor. Access to trust data on legitimate-interest grounds is extended to more trust types.
- Supervision and information sharing. The duty to co-operate now extends to the registrar of companies, and the confidentiality regime covers information on cryptoasset businesses.
- Scope. Reinsurance contracts are excluded from "insurance undertaking", and letting agent and art market participant CDD triggers now refer to occasional transactions, in line with high value dealers.
What Did Not Change
- Digital identity. No amendment was made; instead, HM Treasury and DSIT published guidance in February 2026 on using certified digital identity services to meet the MLR identity verification requirements.
- National Risk Assessment. No new statutory duty to have regard to it; HM Treasury chose guidance instead.
- Proliferation financing risk assessment (regulation 18A) is unchanged, apart from the "unusually complex" wording in the related policies requirement.
- EDD risk factors in regulation 33(6) and bank correspondent relationships in regulation 34 are unchanged.
What Comes Next
HM Treasury has asked supervisors and the authors of sector guidance, such as the JMLSG, to update their guidance, including on when a business relationship starts, when source-of-funds checks are needed and how to treat geographic risk. The Explanatory Memorandum says the next full review of the MLRs is due in 2027, and FATF's mutual evaluation of the UK begins in 2026.
Separately, the government decided in October 2025 to make the FCA the single AML supervisor for legal, accountancy and trust and company service providers. HM Treasury's June 2026 response on the FCA's duties and powers says primary legislation will go through a Financial Services Bill, followed by further amendments to the MLRs. Our pages for accountants and law firms cover what that means for those sectors.
Action Checklist
- Update CDD and monitoring thresholds to the sterling figures, especially £12,000 and £800.
- Change EDD rules so that mandatory EDD applies to FATF call-for-action countries, and treat grey-listed countries as a risk factor in your customer risk assessment.
- Recalibrate the complex-transaction trigger to "unusually complex or unusually large for its type", and record the rationale.
- Review reliance arrangements with third parties in grey-listed countries.
- Banks: set the risk-based approach for pooled client accounts opened from 30 June 2026; account holders: be ready to supply underlying client information.
- Crypto firms: prepare correspondent due diligence for 1 February 2027 and check change-of-control notifications.
- Trust and company service providers: bring sales of off-the-shelf companies into your CDD process.
- FCA-supervised firms: build the 30-day notification duty into your regulatory reporting.
Frequently Asked Questions
When did the 2026 amendments to the Money Laundering Regulations take effect?
S.I. 2026/621 was made on 9 June 2026. Most provisions took effect on 30 June 2026. The cryptoasset correspondent relationship rules apply from 1 February 2027, and some change-of-control provisions for cryptoasset businesses from 25 October 2027.
What is the new CDD threshold for occasional transactions in the UK?
From 30 June 2026, CDD applies to occasional transactions of £12,000 or more, replacing €15,000. For occasional transactions that are transfers of funds, and for cryptoasset transfers, the threshold is £800, replacing €1,000.
Do grey-listed countries still require enhanced due diligence in the UK?
Not automatically. Since 30 June 2026, mandatory enhanced due diligence applies to countries on the FATF call-for-action list. Grey-listed countries remain a risk factor that firms must take into account in their risk assessment.
What is a FATF call for action country?
A country on FATF's list of High-Risk Jurisdictions subject to a Call for Action, as that list stands from time to time. After FATF's June 2026 plenary the list comprised Iran, the DPRK and Myanmar.
Does selling a shelf company now require CDD?
Yes. Selling an off-the-shelf firm is now trust or company service provider activity under the MLRs and is treated as a business relationship, so the seller must apply customer due diligence to the buyer.
What changed for crypto firms?
Their travel rule and CDD thresholds are now £800, new correspondent relationship requirements apply from 1 February 2027, and an FSMA-style change-of-control regime applies, with approval needed when someone acquires 10% or more of a registered cryptoasset business.
Sources
- The Money Laundering and Terrorist Financing (Amendment) Regulations 2026, S.I. 2026/621
- Explanatory Memorandum to S.I. 2026/621
- HM Treasury: Improving the effectiveness of the Money Laundering Regulations (consultation and response)
- Money Laundering Regulations 2017 (consolidated)
- HM Treasury and DSIT: Using digital identities with the Money Laundering Regulations
- HM Treasury: Reforming AML/CTF supervision — duties, powers and accountability (consultation response, June 2026)
This article is general information, not legal advice. Requirements change — check the current text with the regulator before relying on it.
Update Your Thresholds and EDD Rules Without a Rebuild
One Constellation applies CDD triggers, risk scoring and EDD workflows as configuration, so regulatory changes like these can be reflected in rules rather than re-engineering.
