Every UK practice is supervised for anti-money laundering purposes. For most firms that means a professional body, usually the one that also awards the qualifications on the office wall, or in some cases HMRC. That arrangement is ending. The Financial Conduct Authority will become the single AML and counter-terrorist financing supervisor for accountancy firms, legal firms and trust and company service providers, and the Office for Professional Body AML Supervision will cease to exist once the reform is complete.
This is no longer a consultation to keep an eye on. The government announced its decision in October 2025, HM Treasury published its response to the duties, powers and accountability consultation in June 2026, and the enabling legislation is progressing through Parliament. The policy position is settled. Only the mechanics are still being written.
The Supervisor Is Changing, Not the Rulebook
This is the single most important point to get straight before your team panics. Your legal obligations still come from the Money Laundering Regulations 2017 and the Proceeds of Crime Act 2002. Firm-wide risk assessments, customer due diligence, ongoing monitoring, record retention, training and suspicious activity reporting are all unchanged.
What changes is who asks you to prove it, and how hard they ask. The FCA supervises on a risk-based, data-driven model built around demonstrable control effectiveness. In practice that means it is less interested in whether a policy document exists and far more interested in whether you can show the policy was actually applied to a named client on a specific date, and what you concluded.
What Has Actually Been Confirmed
- The FCA will take over AML supervision from the 22 professional body supervisors, and from certain parts of HMRC's AML role
- The FCA will register in-scope firms and maintain a public register, giving a single authoritative source of which firms are permitted to carry out AML-regulated work
- Existing Money Laundering Regulations enforcement powers will be extended to the FCA, including civil sanctions and, where appropriate, criminal proceedings
- The FCA will gain a wider toolkit, including formal information requests, desk-based and on-site reviews, directions and skilled-person reviews
- Supervision will be funded by supervised firms on a full cost-recovery basis, with the detailed fee model still to be consulted on
- Your professional body continues to regulate professional standards, so most firms will end up with two supervisory touchpoints rather than one
The Fit and Proper Test Arrives in Accountancy
This is the element the profession pushed back on hardest, and it is going ahead. Regulation 58 fit and proper requirements will be extended to accountancy and legal service providers. Until now these sectors have been outside that regime because professional bodies run their own suitability and character assessments under separate statutory frameworks.
Regulation 58 goes beyond checking for criminal convictions. It allows a supervisor to assess the integrity, competence and compliance history of the firm and of its beneficial owners, officers and managers. For a partnership or a small limited company practice, that means the people at the top need to be able to evidence competence and a clean compliance record, not simply assert it. Respondents argued the test was duplicative given existing professional body checks. The government has accepted the concern but concluded its approach is proportionate given the sector's high-risk rating.
Dual Regulation Is the Unresolved Question
The loudest theme in the consultation responses was the risk of being investigated twice for the same failure, once by the FCA and once by a professional body, and potentially sanctioned twice. Some respondents wanted legislative primacy so that only the FCA could enforce where a breach touches both the Regulations and a professional code.
The government has declined to legislate for primacy. Instead it intends to require ongoing information sharing between the FCA and professional bodies, plus a permanent duty to cooperate, with the aim of minimising duplication. The precise mechanics remain to be determined. Firms should plan on the basis that both relationships will need managing.
What It Will Cost
Nobody can give you a figure yet, and you should be sceptical of anyone who tries. The FCA will consult separately on fee structure, bands and any reliefs. What is confirmed is the funding principle: full cost recovery from supervised firms.
The realistic risk is duplicative cost. If FCA fees arrive without a corresponding reduction in professional body practising or supervision fees, firms pay twice for overlapping oversight. Smaller practices and sole practitioners have the least capacity to absorb that. Alongside the fee itself, budget for familiarisation time, interaction with a new IT system, registration or data confirmation work, and file remediation.
Here is the uncomfortable truth about remediation cost. It is not the largest firms that will pay the most. It is the firms with the messiest evidence trail. Costs escalate when a file cannot be followed: missing ownership checks, thin risk rationale, no monitoring notes, evidence scattered across email, shared drives and handwritten file notes.
Timeline: Treat 2028 or 2029 as Your Planning Horizon
HM Treasury has been explicit that there is no fixed go-live date and that implementation will inevitably take several years. Until the transfer happens, OPBAS continues to operate and your existing supervisor keeps its responsibilities. A sensible working shape looks like this:
- Remainder of 2026: design and preparation. Monitor secondary legislation, FCA implementation material and consultations on registration, data transfer and fees
- 2027: legislation and FCA build-out. Treat readiness as an internal project with an owner, not a policy story you are following
- 2028 to 2029: the sensible window to expect phased migration, registration or data confirmation, and fit and proper checks
The government's stated intention is that already-supervised firms should not need to go through full re-registration, but should expect to confirm their details and undergo fit and proper checks. That makes clean, consistent firm data a genuine asset.
Six Things Worth Doing Before Christmas
None of this requires the final rulebook. All of it improves your position under your current supervisor too, which is the point.
- Name your transition owner. Usually the nominated officer or MLRO, with an administrative deputy. Keep a simple log of developments, decisions and actions
- Document nominated officer arrangements and deputy cover. A sole practitioner with no employees must hold the role personally and cannot outsource it to an external consultant
- Rebuild the firm-wide risk assessment so it is defensible. It should explain the risks arising from your actual client base, services and operating model, and reflect HMRC's published sector risk assessment. Set an explicit refresh rule
- Make policies operational. For each policy statement, identify who is responsible, what record is kept and where the evidence sits. That is the difference between paper compliance and a system that survives review
- Sample-test existing client files. Pick a handful and ask whether a stranger could follow the risk rationale, the CDD evidence and the periodic review decisions without asking you a question
- Make training auditable. A single log showing who attended, what was covered and when. Training records are routinely requested under FCA-style supervision because they show controls operating in practice
The Scope Traps That Catch Smaller Practices
Two assumptions are worth challenging now. The first is that payroll or bookkeeping work is too low-touch to matter. CCAB guidance makes clear that scope depends on the service provided, and HMRC's risk guidance specifically flags payroll, bookkeeping, insolvency and tax advice as services attractive for misuse. The National Risk Assessment rates accountancy service providers as high risk.
The second is that being small means being invisible. Published disciplinary outcomes across the professional bodies include findings against small firms and sole practitioners for exactly the foundational failures you would expect: no adequate firm-wide risk assessment under Regulation 18, inadequate policies and procedures under Regulation 19, missing training under Regulation 24, and failure to respond to supervisory information requests under Regulation 66. Failing to answer the post is a real enforcement risk, and it will not become less of one.
Where This Sits Alongside Everything Else
2026 has already asked a great deal of UK practices. Quarterly updates are live, e-invoicing is confirmed for 2029, payrolling of benefits arrives in April 2027 and Companies House filing is being overhauled. Adding a supervisory transition that may not complete until 2029 can reasonably feel like a problem for another year.
The argument for acting now is not the deadline. It is that every one of the steps above pays for itself immediately. Cleaner AML files mean faster onboarding, shorter inspections under your current supervisor, less partner time spent reconstructing decisions, and a smaller professional indemnity risk. The transition simply converts good housekeeping from optional to unavoidable.
The cheapest possible moment to fix a gap in an AML file is before somebody asks to see it.
Next Steps
Start with one action: pull three client files at random and see whether the risk rationale, the CDD evidence and the last periodic review are all easy to find and easy to follow. What you learn in that half hour will tell you how much work the next two years hold.
