The UK’s Consultative Committee of Accountancy Bodies (CCAB) has published updated anti-money laundering guidance for the accountancy sector. It reflects UK law as at 1 July 2026 and replaces the June 2023 edition. The guidance is approved by HM Treasury and adopted by the UK accountancy supervisors. It applies to accountants, bookkeepers, tax advisers, auditors, insolvency practitioners and trust or company service providers (TCSPs) working in the UK.

Key facts

• The CCAB has published an updated Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector (AMLGAS).

• It is dated July 2026, states the law as at 1 July 2026 and replaces the June 2023 edition. CCAB released it on 5 August 2026.

• The guidance is HM Treasury-approved. That matters: the courts must take account of it when deciding whether a firm has breached the Money Laundering Regulations 2017 (MLRs) or committed a failure-to-report offence under the Proceeds of Crime Act 2002. Supervisors will also judge firms against it.

• It applies to anyone providing audit, accountancy, bookkeeping, tax advisory, insolvency or trust and company services in the UK. This is an incremental update, not a rewrite. Most of the text and paragraph numbering is unchanged.

• But the changes that have been made go to the heart of day-to-day compliance: customer due diligence (CDD), identity evidence, source of funds and enhanced due diligence (EDD).

This article

• This article explains what has changed. That covers the amendments to the Money Laundering Regulations that took effect on 30 June 2026, tighter expectations on customer due diligence and identity evidence, new guidance on source of funds checks, and the new treatment of off-the-shelf company sales by TCSPs. It also sets out what each change means in practice for UK firms.

• We also look at what Jersey professionals can take from the update. We compare each UK change with the Money Laundering (Jersey) Order 2008 and the JFSC AML/CFT/CPF Handbook, show where Jersey law differs, and highlight the UK practices Jersey firms may wish to adopt as best practice.

How to read this article

1. For UK readers (accountants, bookkeepers, tax advisers and TCSPs supervised in the UK)

   • What changed in the law

   • What changed in the guidance

   • What it means for your firm

   • The Comsure view

2. For Jersey readers (JFSC-supervised firms, and firms working in both jurisdictions)

   • How the UK changes compare with Jersey law

   • UK best practice Jersey firms can adopt

3. For everyone

   • Action checklist (split into UK firms and Jersey firms)

   • Sources

For UK readers: what changed in the law

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 came into force on 30 June 2026, making 15 targeted changes to the MLRs. Four matters most for the accountancy sector.

1. "Unusually complex or unusually large" transactions

   • EDD is now triggered by transactions that are unusually complex or unusually large in context.

   • Routine complex transactions no longer automatically require EDD.

   • This refines the existing duty rather than creating a new one.

2. High-risk third countries

   • Mandatory EDD now applies only to countries on the FATF "Call for Action" list (the blacklist).

   • Grey-listed countries no longer trigger mandatory EDD.

   • They still belong in your geographic risk assessment.

3. Sterling thresholds

   • Euro thresholds in the MLRs are now expressed in sterling.

   • The occasional transaction threshold for CDD is £12,000, including linked transactions (previously €15,000).

4. Off-the-shelf companies

   • Regulation 12(2)(ab) now lists "selling an off-the-shelf firm" as a TCSP service, and Regulation 4(2) treats it as a business relationship whether or not it is expected to last.

   • Full CDD and ongoing monitoring apply.

Firms should not read the high-risk country change as permission to relax. The guidance still expects firms to consider the FATF list of jurisdictions under increased monitoring, the UK National Risk Assessment and the AASG Risk Outlook when rating geographic risk.

For UK readers: what changed in the guidance

At HM Treasury's request, CCAB also revisited several areas and added new material on evidence of identity.

Directors now feature in CDD. Para 5.1.4 now says that for a corporate client, firms must identify the full names of the board and the senior persons responsible for operations. It also says verification should cover the client, its beneficial owners and its directors. The 2023 edition did not mention directors in this list.

Source of funds during ongoing monitoring. New paras 5.2.9–5.2.10 explain the words "where necessary" in Regulation 28(11)(a). Source of funds checks are needed when a transaction looks inconsistent with what the firm knows about the client, its business and its risk profile. This applies even where the client is not otherwise subject to EDD. The guidance gives examples:

• A significant capital injection that the shareholders do not appear able to fund;

• Significant cash receipts into a business that normally takes electronic payments;

• Payments in new or unusual currencies, including cryptoassets, that do not fit the client's business model.

EDD triggers are not a checklist. Appendix D now opens by stating that the Regulation 33(6) and 37(3) risk factors are neither mandatory nor exhaustive. Firms should set out in policy the point at which a build-up of risk factors triggers EDD.

Evidence of identity and digital ID. Paras 5.5.3–5.5.13 and Appendix B set out a hierarchy of identity evidence, based on JMLSG guidance. Passports and photocard driving licences are treated as best practice. Digital verification services (DVS) can be relied on only if they are on the GOV.UK register of services certified against the UK DVS trust framework. If your provider's brand is not listed but its underlying software is, get written confirmation and consider building it into your contract.

For UK readers: what it means for your firm

1. Accountants

   • Tighter identification and verification of directors of corporate clients.

   • Source of funds checks as part of ongoing monitoring.

   • A review of e-ID providers against the DVS register.

   • Updated EDD policy wording.

2. Bookkeepers

   • No sector-specific changes.

   • Bookkeeping falls within "external accountant", and the bookkeeping supervisors (including ICB and IAB) have adopted the guidance.

   • All the general changes therefore apply.

3. Tax advisers

   • The CCAB supplementary guidance for tax practitioners is unchanged.

   • The main-guidance changes on CDD, source of funds and digital ID still apply in full.

4. Trust and company service providers (TCSPs)

   • A business relationship now arises for the trust and company services in Regulation 12(2)(a), (ab), (b) and (d), whether or not the relationship is expected to last. HMRC's TCSP guidance puts it plainly: "There are no occasional transactions for TCSPs."

   • Off-the-shelf company sales now need full CDD.

   • Firms doing only TCSP work under HMRC supervision follow HMRC's guidance instead.

For UK readers: the Comsure view

The update brings welcome clarity in places. But a close reading shows several points where firms need to make a documented judgement.

Directors: the body and the appendix point different ways. Para 5.1.4 reads as if all directors should be verified. Appendix B (para B.2.8) says that for a normal-risk client, verifying the director who is the key client contact is enough, with more for high-risk clients. Firms that read only the body may over-verify. Firms that follow the appendix should record why in their procedures, so they can show a supervisor which reading they applied.

Digital ID is not second-best. Some summaries say passports are "preferred". In fact, Appendix B puts DVS-registered services in the top tier of evidence, alongside government-issued documents. The real test is whether your provider is on the register, not whether you use paper or electronic checks.

The CCAB text has not caught up with the off-the-shelf change. Since 30 June 2026, Regulation 4(2) of the MLRs refers to Regulation 12(2)(a), (ab), (b) or (d), and the new limb (ab) is "selling an off-the-shelf firm". But paras 5.1.3 and 5.2.2 of the CCAB guidance still refer only to (a), (b) and (d), and the phrase "off-the-shelf" does not appear. TCSPs should work from the amended Regulations and HMRC's TCSP guidance, not the CCAB wording alone.

Terminology has not fully caught up. Some paragraphs still use "high-risk third country" and refer to EU-equivalence, while Appendix D now defines high-risk third countries as FATF Call for Action countries. Policies should use the current definition.

Flexibility cuts both ways. The guidance repeatedly calls its lists non-prescriptive and non-exhaustive. That supports a genuine risk-based approach. It also means firms carry the burden of evidencing their own thresholds, so the rationale behind each decision must be written down.

For Jersey readers: how the UK changes compare with Jersey law

The CCAB guidance does not apply in Jersey, but it is a useful benchmark. Below, each UK change is compared with the Money Laundering (Jersey) Order 2008 (MLO) and the JFSC AML/CFT/CPF Handbook (consolidated version effective 31 October 2026).

1. High-risk countries: the UK has moved towards the Jersey model

   • The UK now limits mandatory EDD to FATF Call for Action countries.

   • Jersey already works this way. Article 15(1)(c) of the MLO requires enhanced CDD where a customer has a relevant connection to an "enhanced risk state", meaning a country for which the FATF has called for EDD.

   • JFSC Appendix D1 lists these countries (currently Iran, North Korea and Myanmar). Appendix D2 lists wider higher-risk countries; those under its Sources 1 and 2 also prevent CDD exemptions being used under Article 17A.

   • Lesson: keep D1 and D2 consequences distinct in your procedures, and update both after every FATF plenary.

2. "Complex or unusually large": a wording point worth noting

   • The UK clarified that EDD applies to transactions that are unusually complex or unusually large.

   • Article 11(3)(a)(i) of the MLO still requires policies to identify and scrutinise "complex or unusually large transactions". In Jersey this is a scrutiny requirement, not an automatic EDD trigger.

   • Lesson: Jersey firms must still scrutinise complex transactions as the MLO requires. The UK's focus on what is unusual for the client and sector is a helpful way to set monitoring rules and to record why a transaction was, or was not, escalated.

3. Thresholds: Jersey stays in euros

   • The UK occasional transaction threshold is now £12,000.

   • Under Article 4 of the MLO, a one-off transaction is still €15,000 or more (€1,000 for money or value transfer services and virtual currency exchange; €3,000 for casinos).

   • The Handbook says that where the value of the underlying assets cannot be determined, firms should assume €15,000 or more.

4. Source of funds: the same words, the same message

   • UK Regulation 28(11)(a) and MLO Article 3(3)(a) both require transaction scrutiny to include the source of funds "where necessary".

   • CCAB now explains when it is necessary: when a transaction is inconsistent with the firm's knowledge of the client, its business and its risk profile.

   • Lesson: Jersey firms can use the CCAB examples (unexplained capital injections, unusual cash receipts, unexpected crypto payments) as practical training material, alongside the Handbook's guidance on scrutinising transactions and warning signs (section 6).

5. Digital ID: different tests on each side

   • The UK test is whether a provider is on the GOV.UK DVS register.

   • In Jersey, MLO Article 3(4A) treats a digital ID system that complies with the FATF Guidance on Digital Identity (March 2020) as a reliable and independent source. Article 11(3)(bb) requires the risks of new technologies to be assessed before use, and Handbook section 4.3.5 covers the use of digital ID.

   • Lesson: UK DVS certification may be useful evidence when assessing a provider, but it does not replace the Jersey test. Firms using one provider in both jurisdictions should hold documented evidence for each.

6. Directors and persons acting for the customer

   • The UK guidance expands director verification, but its main text and appendix point in different directions.

   • In Jersey, MLO Article 3(2)(aa) requires firms to identify anyone purporting to act on behalf of the customer and verify their authority. Article 2 treats individuals who exercise control over management as controllers.

   • Lesson: The UK debate shows the cost of ambiguity. Jersey procedures should state clearly which directors and persons acting are identified and verified, by risk level, and why. The same applies to beneficial ownership thresholds for customer CDD. The Handbook treats 25% only as a general threshold for lower-risk relationships and says smaller interests may be material. Jersey industry practice commonly drops to 10% where the customer is higher risk or any Article 15 EDD trigger applies. This is market practice applying the risk-based approach, not a JFSC rule, and it is separate from the Registry's beneficial ownership disclosure rules.

7. TCSPs: shelf company sales are a real difference

   • The UK has closed a gap. Since 30 June 2026, selling an off-the-shelf firm is a listed TCSP service (Regulation 12(2)(ab)) and is treated as a business relationship whether or not it is expected to last (Regulation 4(2)). Jersey has not made the same change. Selling a shelf company is trust company business: under Article 2(6) of the Financial Services (Jersey) Law 1998, a company formation agent includes anyone who arranges the "sale, transfer or disposal" of companies. But Handbook section 12 (para 12) says a supervised person that acts only as a formation agent "will not be considered to have established a business relationship". A pure shelf sale is therefore assessed as a possible one-off transaction under Article 4 of the MLO (€15,000 or more).

   • Lesson: If the TCSP's own officers or employees act as director, secretary or registered office for the company, section 12 (para 10) treats that as a business relationship, so full CDD applies. For a pure sale, use the sale price as the transaction value, apply the €15,000 assumption in Handbook para 82 where the value is unclear, and record the basis used and why it is appropriate (Code of Practice 171). Even where no identification measures are required, the customer's identity must still be found out and recorded (COP 170), and higher-risk transactions below the threshold must be considered for full CDD (COP 173). The Handbook itself flags shell companies "often purchased off-the-shelf" as a laundering typology (20.3.1.12). Record the decision. The Registry's requirement to notify beneficial ownership changes within 21 days helps, but does not replace the seller's own CDD.

8. Non-resident and non-face-to-face customers: Jersey is stricter

   • Under MLO Article 15(1)(a) and (b), Jersey requires enhanced CDD, on a risk-sensitive basis, where the customer is non-resident or has not been physically present for identification.

   • The UK guidance treats these as risk factors, not automatic EDD triggers.

   • Lesson: Jersey firms using UK group procedures must not import the UK baseline where Jersey's requirements are higher.

The overall message for Jersey: read the UK update as a benchmark, not a template.

For Jersey readers: UK best practice Jersey firms can adopt

None of the points below is a Jersey legal requirement. Each is a UK practice that fits within the MLO and the JFSC Handbook's risk-based approach, and that Jersey firms can choose to adopt and document.

1. Write down worked examples of source of funds triggers

   • UK practice: CCAB paras 5.2.9–5.2.10 explain "where necessary" with examples such as an unexplained capital injection, unusual cash receipts and unexpected crypto payments.

   • In Jersey: MLO Article 3(3)(a) uses the same words. Add similar examples to procedures and staff training, so teams know when a transaction needs source of funds enquiries.

2. Set an "unusual in context" test for monitoring

   • UK practice: EDD now turns on whether a transaction is unusually complex or large for the client and sector.

   • In Jersey: keep scrutinising all complex or unusually large transactions as Article 11(3)(a) requires. Use the UK test to calibrate monitoring rules and to record why each alert was or was not escalated.

3. Document when a build-up of risk factors triggers EDD

   • UK practice: CCAB Appendix D asks firms to set out in policy the point at which several risk factors together trigger EDD.

   • In Jersey: Article 15(1) already lists mandatory triggers. For the "any other higher risk situation" limb in Article 15(1)(g), a written accumulation rule makes decisions consistent and easier to defend at examination.

4. Carry out and record due diligence on digital ID providers

   • UK practice: firms must check that their provider is on the DVS register and, where the brand is not listed, get written confirmation about the underlying software and consider putting it in the contract.

   • In Jersey: the test is the FATF Digital Identity guidance (MLO Article 3(4A)) and a risk assessment before use (Article 11(3)(bb)). Apply the same discipline: get written confirmation from the provider of how it meets the test, and keep it on file.

5. Use a clear hierarchy of identity evidence

   • UK practice: CCAB Appendix B ranks evidence, with government documents and registered digital ID at the top, and asks firms to justify anything lower down.

   • In Jersey: a short written hierarchy, with a note when lower-ranked evidence is accepted, helps show that evidence came from a reliable and independent source (Article 3(4)(b)).

6. State a director verification rule by risk level

   • UK practice: CCAB B.2.8 verifies the key contact director for normal-risk clients and considers more directors for higher risk.

   • In Jersey: set out in procedures which directors and persons acting for the customer are identified and verified at each risk level, and why.

7. Treat shelf company sales as if they were business relationships

   • UK practice: since 30 June 2026, selling an off-the-shelf firm is always a business relationship, with full CDD.

   • In Jersey: the law does not require this for a pure sale. Applying full CDD to every shelf sale, whatever its value, is a simple control for a known higher-risk activity, and avoids debate over valuation under Article 4.

Action checklist

UK firms

• ☐ Update your policies, controls and procedures (PCPs) for the 30 June 2026 MLR changes and the July 2026 guidance, and record the review.

• ☐ Replace grey-list EDD triggers with the FATF Call for Action list; keep grey-list and NRA countries in your geographic risk scoring.

• ☐ Change euro thresholds in procedures and forms to sterling (£12,000 occasional transaction threshold).

• ☐ Decide and document your approach to identifying and verifying directors of corporate clients.

• ☐ Add source of funds triggers to ongoing monitoring and brief engagement teams on the examples.

• ☐ Confirm your e-ID provider, or its underlying software, is on the GOV.UK DVS register, and keep the evidence on file.

• ☐ TCSPs: treat off-the-shelf firm sales as business relationships (Regulation 12(2)(ab) and Regulation 4(2)), working from the amended Regulations and HMRC guidance rather than the CCAB wording alone.

• ☐ Refresh your firm-wide risk assessment and staff training, and reflect the changes in your MLRO's annual report.

Jersey firms

• ☐ Before adopting any UK change, check it against the MLO and the JFSC Handbook (31 October 2026). Keep Jersey requirements in place: euro thresholds, Appendix D1 and D2, the FATF digital ID test, and enhanced CDD for non-resident and non-face-to-face customers.

• ☐ Update procedures for Appendix D1 and D2 after each FATF plenary.

• ☐ TCSPs: for shelf company sales, apply Codes of Practice 170, 171 and 173, and full CDD where your own officers or employees act for the company (Handbook section 12, para 10).

• ☐ Review the seven UK best practices above, decide which to adopt, and record the decision.

How Comsure can help

• Comsure supports accountancy, tax, bookkeeping and TCSP firms with policy and procedure updates, firm-wide risk assessments, independent AML reviews and staff training.

• If you would like help aligning your framework with the 2026 guidance, contact us at mathew@comsuregroup.com or +44 (0) 1534 626841.

Sources

• CCAB, AML Guidance for the Accountancy Sector 2026: https://www.ccab.org.uk/anti-money-laundering-and-counter-terrorist-financing-guidance-for-the-accountancy-sector-2026/

• CCAB, full guidance (PDF): https://www.ccab.org.uk/wp-content/uploads/2026/08/AMLGAS-updated-July-2026-clean.pdf

• ICAEW, 2026 CCAB AML Guidance for the Accountancy Sector: https://www.icaew.com/regulation/regulatory-news/regulatory-news-2026-08/2026-ccab-aml-guidance-for-the-accountancy-sector

• CIOT, AML Guidance for the Accountancy Sector: https://www.tax.org.uk/aml-guidance

• ICAS, Money Laundering Regulations 2026: https://www.icas.com/news-insights-events/news/practice/money-laundering-regulations-2026-what-accountants-need-to-know

• Money Laundering (Jersey) Order 2008 (current version): https://www.jerseylaw.je/laws/current/ro_20_2008

• JFSC, AML/CFT/CPF Handbook: https://www.jerseyfsc.org/industry/financial-crime/amlcftcpf-handbooks/amlcftcpf-handbook/

• JFSC, Appendix D1 (FATF call for action countries): https://www.jerseyfsc.org/industry/financial-crime/amlcftcpf-handbooks/appendix-d1-countries-and-territories-for-which-a-fatf-call-for-action-applies/

• JFSC, Appendix D1 and D2 update of 19 June 2026: https://www.jerseyfsc.org/news-and-events/countries-and-territories-in-amlcftcpf-handbook-appendices-updated-19-june-2026/

• Financial Services (Jersey) Law 1998 (Article 2, trust company business): https://www.jerseylaw.je/laws/current/l_32_1998

• JFSC Registry, updating associated parties (21-day notification): https://www.jerseyfsc.org/registry/register-or-make-a-change/update-associated-parties/

• UK MLRs 2017, Regulation 4 (business relationship): https://www.legislation.gov.uk/uksi/2017/692/regulation/4

• UK MLRs 2017, Regulation 12 (trust or company service providers): https://www.legislation.gov.uk/uksi/2017/692/regulation/12

• HMRC, AMLG2500 TCSP guidance: https://www.gov.uk/hmrc-internal-manuals/anti-money-laundering-guidance-for-supervised-businesses/amlg2500

This article is general information and does not constitute legal advice. Firms should refer to the guidance itself and their AML supervisory authority.

© 2026 Comsure Compliance Limited. All rights reserved.