AI tools and anti-money laundering duties in a practice

The duties stay with the practice

MLR 2017 requires written policies, controls and procedures, approved by senior management and in proportion to the size of the business (MLR 2017 regulation 19). Regulation 19(4)(c) requires appropriate measures, before and during the adoption of new technology, to assess and if necessary reduce money laundering and terrorist financing risks. Bringing in an AI tool for due diligence or screening is a change the practice's risk assessment should cover.

GOV.UK guidance published on 26 February 2026 says regulated businesses remain ultimately liable for failures to apply customer due diligence when using digital identity services (GOV.UK: using digital identities with the MLRs). HMRC's supervision handbook says the same of electronic verification (HMRC ECSH33357).

Electronic identity verification

Regulation 28(18) requires identity to be verified from documents or information from a reliable source independent of the person. Regulation 28(19) allows information from an electronic identification process to count as such a source where the process is secure from fraud and misuse and gives the assurance needed for the risk (MLR 2017 regulation 28).

The 2026 CCAB guidance for the accountancy sector, reported by ICAEW on 10 August 2026, says digital verification services used to verify identity should be certified against the UK digital verification services trust framework and appear on its register. A service not on the register cannot be relied on alone, and other evidence of identity is needed (ICAEW: 2026 CCAB AML guidance). The register is published on GOV.UK (GOV.UK: find registered digital verification services).

What HMRC expects a business to know about its checks

• The datasets and databases the provider searches.
• The results that count as a pass, a fail or a refer.
• Confirmation that everyone who needed checking was checked.
• The place results are stored, and how long they are kept.
• The steps when a check fails or raises a concern, the person who reviews the reports, and how matters are escalated.
• HMRC's handbook lists these points, updated on 10 December 2025, and says electronic checks should draw on multiple sources across time, or include qualitative checks (HMRC ECSH33357).

Screening and risk assessment tools

The PCRT AI guidance describes AI tools that support client due diligence by searching public databases, sanctions lists and media and by matching faces in images (PCRT AI topical guidance, January 2026). A screening result is information for the practice's judgement. A false match on a common name needs a person to rule it out and record why. A clear result does not replace the practice's own risk assessment of the client and the work.

A decision to refuse to act, or to end a relationship, on the strength of an automated result may also be a significant decision under data protection law. See AI and data protection.

Record keeping

Regulation 40 requires copies of the documents and information obtained for due diligence, kept for five years from the date the business knows, or has reasonable grounds to believe, that the business relationship has ended or the occasional transaction is complete. Personal data must then be deleted unless an exception applies (MLR 2017 regulation 40). GOV.UK guidance says businesses must make sure digital identity services can meet these record-keeping requirements (GOV.UK: using digital identities with the MLRs).

Where a check is run on a supplier's platform, the practice needs its own copy of the result, or a contract that keeps it available for the full period, including if the subscription ends.

Suspicious activity reports and tipping off

A person in the regulated sector who knows or suspects, or has reasonable grounds to suspect, money laundering must report to the nominated officer or the National Crime Agency (NCA) as soon as practicable (Proceeds of Crime Act 2002 section 330). Reports go through the NCA's SAR Portal (NCA: suspicious activity reports).

Section 333A makes it an offence to disclose that a report has been made, or that an investigation is contemplated or under way, where the disclosure is likely to prejudice an investigation. The maximum penalty on indictment is two years' imprisonment, a fine or both (Proceeds of Crime Act 2002 section 333A).

Tipping-off risks with AI tools

• Drafting. A tool asked to draft a client email about delays could include wording that hints at a report, if the prompt mentions the suspicion.
• Shared tools. Notes about a suspicion typed into a tool that other staff, or the client through a portal, can see may reach people who should not know.
• Suppliers. Information about a suspicion sent to an outside tool leaves the practice, and the duty of confidentiality and the tipping-off offence both apply.
• Keep notes about suspicions and reports with the nominated officer, outside general AI tools and outside anything the client can see.

Questions