A firm-wide risk assessment for a small practice: what goes in it
Every practice supervised for anti-money laundering needs a written firm-wide risk assessment, whatever its size. The law sets out what it must cover, the sector guidance explains how, and three supervisors have said what they find when they read them. This page puts those together for a small practice, with the source for each point.
In short
- Every practice needs one, sole practitioners included (regulation 18; ACCA's FAQs; ICAEW).
- It looks at five areas at least: your clients, the countries or areas you work in, your services, your transactions and how you deliver your services (regulation 18(2)). Proliferation financing is assessed too (regulation 18A).
- It is written down, kept up to date, and given to your supervisor if asked (regulation 18(4) and (6)).
- It is sized to your practice (regulation 18(3)). A simple practice can have a short one.
- Templates are allowed. What supervisors keep finding is templates that were never made to fit the firm.
Plus proliferation financing, under regulation 18A, across the same five areas.
1. What the law asks
The duty is in regulation 18 of the Money Laundering Regulations 2017. It asks you to look at your own practice and the risks it faces.
A relevant person must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject.
You must take into account the information your supervisor publishes, and these risk factors.
risk factors including factors relating to—
- (i) its customers;
- (ii) the countries or geographic areas in which it operates;
- (iii) its products or services;
- (iv) its transactions; and
- (v) its delivery channels.
It must be written down and kept current, and your supervisor can ask for it.
A relevant person must keep an up-to-date record in writing of all the steps it has taken under paragraph (1), unless its supervisory authority notifies it in writing that such a record is not required.
A relevant person must provide the risk assessment it has prepared under paragraph (1), the information on which that risk assessment was based and any record required to be kept under paragraph (4), to its supervisory authority on request.
ACCA's FAQs (2025 edition, page 6) put it plainly: “All firms, including sole practitioners, must have a documented firm-wide risk assessment.”
2. The five areas, as questions you can answer
The CCAB guidance for the accountancy sector, known as AMLGAS, turns each area into a question. HMRC's manual says this guidance is “approved and adopted by HMRC”. Answer each one about your own practice.
| Area | The question AMLGAS asks | Paragraph |
|---|---|---|
| Clients | “Do our clients or their beneficial owners (BOs) have attributes known to be frequently used by money launderers or terrorist financiers?” | 4.6.1 |
| Client sectors | “Do our clients have substantial operations in sectors that are favoured by money launderers or terrorist financiers or proliferation financiers?” | 4.6.6 |
| Services | “Do any of our products or services have attributes known to be used by money launderers or terrorist financiers, or proliferation financiers?” | 4.6.9 |
| Geography | “Are our clients established in countries that are known to be used by money launderers or terrorist financiers or proliferation financiers?” | 4.6.14 |
| Delivery channels | “Does the fact that I am not dealing with the client face to face pose a greater MLTPF risk?” | 4.6.19 |
Look at the areas together as well as one by one. AMLGAS 4.3.5 explains why.
When two threats are combined, they can produce a total risk greater than the sum of the parts.
The guidance also tells you where to look for the wider picture.
Businesses should take into account the findings of the most recent UK National Risk Assessment, the most recent UK National Risk Assessment on proliferation financing, together with any relevant information issued by the relevant AML supervisory authority.
3. Proliferation financing
AMLGAS 2.7.1 describes proliferation financing as providing funds or financial services connected with chemical, biological, radiological or nuclear weapons. Regulation 18A asks for the same steps as regulation 18, for that risk, taking into account the Treasury’s own assessment of proliferation financing risk rather than your supervisor’s information (regulation 18A(2)(a)).
A relevant person must take appropriate steps to identify and assess the risks of proliferation financing to which its business is subject.
It is easy to leave out. ICAEW's thematic review found “Many firms did not consider the risk of proliferation financing.” For a small practice the answer may be short. ICAEW says:
For most of you this will be as simple as stating that you have considered the risk and, if appropriate, that there is none.
ACCA's 2026/27 return now asks about it as a question of its own (page 17). Winch's reading:
For many firms, the assessment itself may conclude that the risk is low. That is not the point. The expectation is increasingly that the issue has been considered, assessed and documented.
4. Sized to your practice
The regulation itself allows for size.
In deciding what steps are appropriate under paragraph (1), the relevant person must take into account the size and nature of its business.
AMLGAS 4.4.1 says “A business with a relatively simple client base and a limited portfolio of services may have a simple risk profile.” ICAEW's thematic review spells out what that means for the document.
Sole practitioners with no staff might find it more practical to prepare a shorter streamlined assessment, whereas a larger firm would have a more comprehensive document, reflecting the variety of service lines and sectors served.
Short is not the same as low risk. ICAEW adds: “Do not assume that because you are a smaller firm, your client base is lower risk.”
5. Templates, and what supervisors find
Templates are not the problem. Not tailoring them is. ACCA wrote this in July 2024, when its monitoring found members were not adequately tailoring templates:
ACCA acknowledges that templates can be useful and using them is not an issue; however, they must be accurately tailored to reflect the unique risks that the firm is exposed to and the specific procedures of the firm to mitigate them.
One of its examples will be familiar to many sole practitioners: “references to client onboarding processes involving both the MLRO and an additional partner were retained even when the MLRO was the sole practitioner”. Its June 2026 note says the same in one line.
A generic assessment that simply reproduces template wording is unlikely to satisfy regulatory expectations.
ICAEW and HMRC say the same thing.
Do not simply follow boiler plate templates with minimal changes. Consider the risks your firm might face and only include these. Ensure that any mitigations and controls are applicable to your firm.
However, MLR 2017 require risk assessments to be tailored to the specific business and some of these generic risk assessments may not be tailored to the individual circumstances of the ASP and therefore be inappropriate.
ICAEW also found firms sending the wrong document: “6% of firms stated they had completed a firm-wide risk assessment, but in fact submitted an AML compliance review or a set of AML policies and procedures instead.” The risk assessment looks at the risks. The compliance review checks whether your controls work. Policies say what you do about the risks.
6. Keeping it current and signed off
AMLGAS asks for a regular review and a review when something changes.
The risk assessment must be refreshed regularly by periodic reviews, the frequency of which should reflect the MLTPF risks faced and the stability or otherwise of the business environment.
ICAEW gives examples of a change worth a fresh look.
Examples of changes in risk might include: when you add a new service line, a risk bulletin is issued that might impact your firm, when you submit a suspicious activity report, or when there is an update to the National Risk Assessment.
Someone with authority signs it off.
The risk analysis can be conducted by the MLRO but must be approved by senior management including the senior manager responsible for compliance (if a different person to the MLRO).
And it should connect to what you do. AMLGAS 4.7.1 says “The documentation should demonstrate how the risk assessment informs their policies and procedures.” If you file an annual return, ICAEW adds a check worth making before you submit.
Make sure your annual return accurately reflects the money laundering risks within your client base and that these are similarly included in the firm-wide risk assessment.
7. A checklist for the document
| Section | What it says | Source |
|---|---|---|
| The practice | Who you are, who is responsible, what you do | AMLGAS 4.2, 4.4 |
| Clients and sectors | Your client types, ownership and sectors, and which carry more risk | Reg 18(2)(b)(i); AMLGAS 4.6.1 to 4.6.8 |
| Geography | Where clients are based and do business | Reg 18(2)(b)(ii); AMLGAS 4.6.14 to 4.6.18 |
| Services and engagements | Each service you offer and the engagements you take on | Reg 18(2)(b)(iii) and (iv); AMLGAS 4.6.9 to 4.6.13 |
| Delivery channels | How you meet and serve clients | Reg 18(2)(b)(v); AMLGAS 4.6.19 to 4.6.22 |
| Proliferation financing | The same areas, for proliferation financing | Reg 18A |
| Sources used | The National Risk Assessments and your supervisor's information; the Treasury's assessment for proliferation financing | Reg 18(2)(a); reg 18A(2)(a); AMLGAS 4.3.3 |
| Link to your controls | How each risk shapes your policies and client checks | AMLGAS 4.7.1 |
| Review and sign-off | When it was reviewed, why, and who approved it | Reg 18(4); AMLGAS 4.2.3, 4.2.4 |
How PracticeGuard helps
The AML return pack writes a firm-wide risk assessment from your answers to about 20 minutes of questions, with your facts to hand. It has sections on the firm, services, client base, geography and delivery channel, risk ratings, controls, a separately headed proliferation financing assessment, and review and sign-off. Where a control is not in place yet, the document says so and gives you the action rather than claiming it. You read it, change any answer that is wrong and sign it; the decisions in it remain your MLRO's. If you already have a risk assessment, upload it: the pack reads it once for suggestions you confirm one by one, and lists where it no longer matches the rules as they stand, such as the term “high-risk third country”, which the regulations no longer use, or no proliferation financing section, quoting the passage and the page where there is one. It is not a review of the whole document.
Questions people ask
Is the firm-wide risk assessment the same as assessing each client?
No. Regulation 18 asks about the risks to which your business is subject, across the practice. ICAEW’s thematic review found that firms without one were mostly sole practitioners who thought client-level assessment was enough: “They did not consider it to be of value, because they had oversight of all clients and assessed risk at client level.” ICAEW still expects every firm it supervises to have one.
Does it have to be reviewed every year?
The sector guidance says “A risk assessment should be conducted at least annually, but with new and changing risks considered as and when they are identified.” (AMLGAS, section 3.7, where the paragraph is numbered 3.6.5). ICAEW’s thematic review says the regulations themselves do not require an annual review but that it considers one good practice. Regulation 18(4) requires the written record to be kept up to date.
Do I need a separate proliferation financing assessment?
Regulation 18A asks you to assess proliferation financing risk. ICAEW’s thematic review says you can do it inside your firm-wide risk assessment or as a separate document. ACCA’s 2026/27 return asks about it as its own question (page 17).
Who signs it off?
AMLGAS 4.2.3 says the analysis can be done by the MLRO but must be approved by senior management. In a practice of one, AMLGAS 3.3.1 notes that “the sole practitioner will be held responsible” for compliance.
Can I use a template?
Yes. ACCA (July 2024) says templates can be useful and using them is not an issue, provided they are tailored to the firm. The problems its monitoring found were templates not tailored to the firm.
Sources
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017Revised text as at 30 June 2026 · legislation.gov.uk
- CCAB, Anti-Money Laundering, Counter-Terrorist and Counter Proliferation Financing Guidance for the Accountancy Sector (AMLGAS)July 2026 · CCAB
- ACCA, AML Annual Return FAQs2025 edition · ACCA
- ACCA In Practice, Anti-money laundering firm-wide risk assessmentJune 2026 · ACCA
- ACCA In Practice, ACCA updates firm-wide risk assessment factsheetJuly 2024
- ICAEW, The money laundering firm-wide risk assessment: AML thematic reviewOctober 2024 · ICAEW
- HMRC, Economic Crime Supervision Handbook, ECSH52800: compliance intervention at an accountancy service providerUpdated 27 August 2026 · GOV.UK
- ACCA, 2026/27 Anti-Money Laundering (AML) Annual Return - UKThe published form, 20 pages · ACCA
- David Winch (MLRO Support), "The latest ACCA AML return: A sting in the tail?"AccountingWEB, 14 October 2026 · AccountingWEB
PracticeGuard supports your judgement; it never replaces it. This page describes what the Money Laundering Regulations 2017, the accountancy sector guidance and the supervisors’ own published documents say, with the source for each point, so you can read it yourself. It is not legal advice, and nothing here is advice about what your supervisor will accept. PracticeGuard is not affiliated with or endorsed by ACCA, ICAEW, AAT, HMRC or any AML supervisor. Check the current version of each document before you rely on it.
The AML return pack, written from your answers.
Seven documents from about 20 minutes of questions with your facts to hand, and a sheet of your answers for ACCA, ICAEW, AAT or HMRC. £149 + VAT a year, with or without Verify. You file the return yourself.
See the AML return packClient ID checks with Verify.
PracticeGuard Verify helps you run and record client due diligence. First month free.
Start with Verify