UK AML amendments phase controls through October 2027

HM Treasury made the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 on 9 June 2026 with commencement dates extending to 25 October 2027. The instrument is already partly in force, so an implementation plan must distinguish completed changes from the two future crypto-asset dates.

The statutory instrument brought regulation 1 into force on 10 June, the day after it was made. Subject to stated exceptions, the remaining provisions took effect 21 days after the making date, on 30 June. Regulation 20 and regulation 36(b) instead commence on 1 February 2027, while regulation 37 has a split application reaching 25 October 2027.

Most of the package is therefore live.

The 30 June changes replace several euro-denominated thresholds in the 2017 Money Laundering Regulations with sterling amounts. They include £800 in place of €1,000 for specified customer-diligence triggers, £12,000 in place of €15,000, £10,000 in place of €10,000 and £2,000 in place of €2,000. Electronic-money thresholds also move to sterling. The instrument changes the wording for linked occasional transactions and narrows references to complex or unusually large transactions by tying the assessment to the nature of the transaction.

New pooled-account requirements also took effect for accounts provided on or after the relevant commencement date. A relevant person must take reasonable measures to understand the purpose and intended use of the pooled account, test that use against its knowledge of the customer and risk profile, update customer due diligence where the position does not fit and assess and mitigate the money-laundering and terrorist-financing risk. The firm must be able to demonstrate to its supervisor that the extent of those measures is appropriate.

The pooled-account customer must make available information identifying the persons for whom money is held and their beneficial owners when the relevant person requests it. The customer must also retain accurate written records of money paid into and out of the account for five years from completion of each payment and provide information about the account to law enforcement on request, subject to the instrument's legal-professional-privilege protections.

For an authorised person supervised by the Financial Conduct Authority, regulation 23 now contains a 30-day correction rule. A material change to information already provided to the FCA, or discovery of an inaccuracy, must be reported within 30 days beginning with the occurrence of the change or discovery of the error. This is an event-driven obligation rather than a fixed calendar filing.

The amendments create a separate route for customers of an insolvent bank. A credit institution may allow an eligible customer to open and use an account before completing all customer-diligence measures, but it must first identify the customer and, where applicable, the person acting for it. The remaining checks must be completed as soon as practicable, and further transactions must stop if an enhanced-diligence trigger emerges before that work is complete. Eligibility is tied to a business relationship begun within 30 days of the bank's insolvency date.

The first future cohort begins on 1 February 2027. Regulation 20 inserts regulation 34A for cryptoasset exchange providers and custodian wallet providers in third-country correspondent relationships. Before a new relationship, the correspondent must understand the respondent's business, assess its reputation, supervision and AML/CTF controls, obtain senior-management approval and document each party's responsibilities. It must also address direct-access customers, and the rules prohibit relationships with shell banks or institutions known to allow shell-bank use.

Regulation 36(b) adds the related regulation 34A reference to Schedule 6 on the same date. Crypto firms should therefore complete respondent inventories, assign owners for reputation and supervision checks, define the control-assessment evidence, update approval papers and document responsibilities before 1 February rather than treating that date as the start of design work.

Regulation 37 substitutes Schedule 6B on changes in control of registered cryptoasset businesses. Paragraphs 1, 2 and 5 of the new schedule applied from 30 June 2026. For all other purposes, the substitution takes effect on 25 October 2027. The schedule applies modified Financial Services and Markets Act control provisions to registered cryptoasset businesses included on the register before the later date, including notification, assessment and control-threshold mechanics.

Under the substituted schedule, an acquisition can involve becoming a beneficial owner or reaching 10% of shares or voting power, or otherwise obtaining significant influence. Later increases are measured at 20%, 30% and 50% thresholds, with corresponding steps for reductions in control. The modified assessment can include whether the acquirer is fit and proper under the cryptoasset-business test.

The correct calendar has five entries: 9 June 2026 for making, 10 June for regulation 1, 30 June for the main package and first Schedule 6B elements, 1 February 2027 for crypto correspondent due diligence, and 25 October 2027 for the remaining Schedule 6B change-in-control regime. The next fixed milestone is 1 February 2027, and the implementation decision before then is approval of the respondent-risk, senior-management and responsibility-documentation controls required by regulation 34A.