The small-firm compliance challenge

Smaller regulated businesses face a fundamental challenge: meeting the same AML obligations as large financial institutions with a fraction of the resources. The FATF Recommendations recognise this through the risk-based approach, which allows firms to apply proportionate controls based on their specific risk profile - but the obligation itself is non-negotiable.

Step 1: conduct a firm-wide risk assessment

Regulation 18 requires a written assessment of the money laundering and terrorist financing risks your business faces. The rest of your programme should follow from it.

Identifying your risk profile

Every AML programme begins with a firm-wide risk assessment. The UK National Risk Assessment provides a framework for identifying sector-specific risks. Letting agents, art dealers, and high-value goods dealers each face different risk profiles that inform their control requirements.

Risk factors to consider

Customer risk

Consider the types of customers you deal with, their geographic locations, whether you encounter PEPs, and the complexity of ownership structures. A TCSP forming entities for international clients has a different customer risk profile than a domestic letting agent.

Geographic risk

Transactions involving FATF grey or black-listed jurisdictions require enhanced due diligence. Even firms operating domestically may encounter customers with connections to higher-risk jurisdictions.

Service risk

Certain services carry inherently higher money laundering risk. Company formation, trust administration, conveyancing, and high-value goods transactions are all flagged in the UK's National Risk Assessment as higher-risk services.

Step 2: implement proportionate controls

A study in Crime, Law and Social Change found that the most effective small-firm AML programmes combine three elements: automated screening tools, documented policies and procedures, and regular staff training.

Automated screening

FirmScreen is built for smaller regulated firms: one search across the official sanctions lists and PEP data, daily re-screening, and an append-only audit trail that demonstrates compliance to supervisory bodies. Automated name screening eliminates the manual cross-referencing of customer names against sanctions lists - a process that is error-prone and impossible to audit.

Written policies and procedures

Regulators expect written AML policies proportionate to your firm's size and risk profile. These should document your risk assessment methodology, CDD procedures, screening approach, escalation procedures for potential matches, and SAR filing processes.

Step 3: appoint a Money Laundering Reporting Officer

All regulated firms must appoint an MLRO with sufficient seniority and authority. In smaller firms, the MLRO is often a principal or partner. The key requirement is that they have the knowledge, authority, and time to fulfil the role effectively - including making SAR filings to the National Crime Agency when necessary.

Step 4: documentation and record-keeping

The UK Money Laundering Regulations 2017 require firms to retain records for at least five years. Automated screening with append-only audit trails satisfies this requirement while reducing the administrative burden on small compliance teams. Every screening event, match decision, and disposition is recorded and retrievable for regulatory inspection.

Common pitfalls for small firms

Most AML failures at small firms come from a handful of familiar mistakes.

  • Treating AML as a one-off exercise: Compliance is ongoing. Sanctions lists change daily, customer circumstances evolve, and regulations are updated regularly.
  • Relying on manual processes: Manual name checks against PDF sanctions lists are neither reliable nor auditable. Regulators increasingly expect automated solutions.
  • Ignoring training requirements: All relevant staff must receive AML training appropriate to their role. Training records should be maintained as evidence of compliance.
  • Failing to update risk assessments: Risk assessments should be reviewed at least annually and whenever there are material changes to the business.