UK MLR amendments

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026, SI 2026/621, amended the UK's Money Laundering Regulations 2017 (MLRs). They were laid on 25 March 2026, made on 9 June and, for the most part, came into force on 30 June 2026. For FCA-supervised payment institutions, EMIs and cryptoasset businesses, the changes require updates to country risk, EDD triggers, thresholds, crypto correspondent due diligence and regulatory reporting.

This checklist is written for MLROs. It sets out each change, the policy and system work it requires, and the evidence to keep for the FCA.

Summary of changes for FCA-supervised firms

Checklist 1: country risk

• Replace references to the UK high-risk third country list with FATF call for action countries for mandatory EDD.
• Keep FATF increased monitoring (grey list) countries as a risk factor in the customer and business risk assessments.
• Decide, and document, the measures for grey list exposure under the risk-based approach.
• Update screening and monitoring rules that apply EDD automatically to grey list countries.
• Brief first line staff so that grey list customers are not de-risked without reason.

Grey list membership changes after each FATF plenary, in February, June and October. Set a procedure to review the list within days of each plenary, update screening and risk scores, and record the effect on customers. Where a country leaves the grey list, consider whether existing enhanced measures are still justified; where one joins, assess the exposure and decide on measures under the risk-based approach. Keep the decision record with the risk assessment.

The October 2026 FATF plenary changed the grey list. Our article on the FATF grey list after October 2026 covers the current position.

Checklist 2: unusual transactions

• Rewrite the EDD trigger to unusually complex or unusually large, assessed in the context of the customer, product, sector, value and normal practice.
• Recalibrate monitoring rules from fixed size thresholds to deviation from expected activity.
• Add a short rationale field for transactions reviewed and closed as normal in context.
• Train analysts on the in-context test with examples from the firm's own products.

Expect a period of adjustment. Analysts trained to escalate every large transaction may continue to do so, and second line reviewers should sample closed alerts to check that the in-context test is applied consistently. Report alert volumes and closure rates to the MLRO monthly for the first two quarters after the change, and adjust training where patterns show inconsistency.

Checklist 3: thresholds and e-money limits

• Update policy figures from euro to sterling, generally at one to one.
• Check the exceptions retained for FATF alignment and leave those figures as the Regulations set them.
• Update e-money simplified due diligence limits, now stated in sterling.
• Update system parameters, test them and keep the test evidence.

Thresholds appear in more places than policy documents: onboarding flows, transaction limits for simplified due diligence products, monitoring rules and management information. Search all of them. Where the firm operates in both the UK and the EU, keep separate parameters for each regime, because the EU figures remain in euro.

Checklist 4: cryptoasset businesses

From 1 February 2027, regulation 34A requires EDD in correspondent relationships between cryptoasset businesses.

• Identify every existing relationship that meets the definition and complete files before 1 February 2027.
• Integrate the review with travel rule counterparty due diligence.
• For MLR-registered firms, review controller records against the wider Schedule 6B definition and prepare notifications for any changes.
• Align this work with the FCA authorisation application, due by 28 February 2027 for firms that want to continue under the new regime; our FCA crypto application checklist covers that file.

Checklist 5: pooled accounts, reporting and governance

• Where the firm holds pooled client accounts at banks, keep records of money in and out for at least five years and be ready to provide underlying client information on request.
• Where the firm offers pooled account features to its own clients, apply the additional due diligence the amendments require to understand purpose and use.
• Add the duty to report to the FCA, within 30 days, inaccuracies or material changes in information provided under regulation 23.
• Update the firm-wide risk assessment to record the changes.
• Present a gap analysis and implementation plan to the board, and record the decision.

Worked examples

A remittance corridor to a grey list country. Before 30 June 2026, every customer sending to that country was subject to mandatory EDD. Now the firm decides on the risk. It might keep EDD above a transaction value, or for customers with unusual patterns, and apply standard due diligence to low-value family remittances with consistent history. The decision, the data behind it and the monitoring that supports it should be recorded in the risk assessment.

A large but ordinary B2B payment. A business customer that regularly pays suppliers abroad makes a payment three times its usual size at year end, matching a documented seasonal pattern. Under the in-context test this may not be unusually large for that customer. The analyst records why and closes the alert. A similar payment from a newly onboarded customer with no history would be treated differently.

A crypto exchange providing liquidity to another platform. The relationship is a correspondent relationship under regulation 34A. From 1 February 2027 the exchange needs a completed EDD file with senior management approval before the relationship continues.

Training and records

Update training for first line staff, analysts and senior managers. First line staff need to understand that grey list exposure is no longer automatically EDD and that de-risking needs a reason. Analysts need the in-context test for unusual transactions. Senior managers in crypto firms need to understand their approval role for correspondent relationships. Keep records of the training content, attendance and assessments, because the FCA asks for them.

What the FCA will expect to see

The FCA supervises payment institutions, EMIs and cryptoasset businesses for AML and has made financial crime a supervisory priority. In a review it will expect a dated gap analysis against SI 2026/621, updated policies and procedures, evidence that systems were changed and tested, training records, and board minutes showing oversight. For crypto firms, it will also expect completed correspondent files from 1 February 2027.

The FCA also looks for proportion. A firm that responded to the narrower country rule by removing all enhanced measures for grey list customers, without analysis, would raise questions; so would a firm that left every old trigger in place and generated alerts it could not work. The record should show that the MLRO considered each change, decided what it meant for the firm's own risks and implemented that decision. Where the firm decided to keep a stricter approach than the Regulations require, record why: it is a legitimate choice under the risk-based approach and examiners respect a reasoned position.

Firms with AML frameworks built on older templates should use the amendments as a prompt for a wider review; our guide to AML/CFT framework design for FCA-regulated firms covers the structure.

Timeline

Our compliance support team prepares gap analyses and policy updates against SI 2026/621.