How to use HMRC’s accountancy-sector risk guidance in a firm-wide risk assessment
Accountancy practices must evaluate how HMRC’s sector guidance affects their firm-wide risk assessment (FWRA). The FWRA should show which risks are relevant to the practice and how the firm reached its conclusion.
How HMRC’s guidance is applied will depend on the size and structure of the practice. A sole practitioner, for example, might approach the assessment differently from a mixed-service firm, provided the FWRA shows clear reasoning and supporting evidence.
Key takeaways
- HMRC’s guidance should inform the firm-wide risk assessment, and the practice should start with the regulated services it actually provides.
- Service risks should be assessed by scale, client profile, and the firm’s visibility of client activity.
- Client, country, transaction, and delivery risks should be linked to the firm’s real work.
- Excluded risks need a clear factual reason.
- The assessment should show how HMRC’s guidance changed the firm’s conclusions, AML controls, or review triggers.
Use HMRC guidance as assessment evidence
Use the sector findings to frame questions about the firm’s own services, clients, and operating model, rather than copying HMRC’s conclusions into the assessment. This is especially important when applying sector-level risk ratings.
The 2025 National Risk Assessment classifies accountancy service providers as high risk for money laundering, while HMRC describes the sector-level terrorist-financing risk as low and identifies separate proliferation-financing exposures.
These findings set the context without justifying one rating across every engagement.
Importantly, firms should use HMRC’s assessment alongside the legal framework and other current authoritative sources.
Match sector risks to the practice’s work
Begin with an accurate inventory of the regulated services the practice provides. From that starting point, match HMRC’s service-specific warnings only to work that the firm undertakes.
That said, the existence of a service only gives part of the picture, as proportionality also needs to be considered. Firms should assess the significance of client work to the practice and the extent to which it provides insight into client activity or control over it.
HMRC highlights two broad sources of exposure: unreliable client information and pressure to facilitate wrongdoing. In practice, these risks could arise because formal accounts or audit work can make misleading information appear legitimate.
Services also need to be considered together. For example, a practice providing both bookkeeping and payroll to labour-intensive clients might gain broader visibility of their activity than a firm offering just one of those services.
This point is also reflected in HMRC’s compliance-visit guidance, which notes that officers should understand how every service has been assessed alone and in combination. Separate specialist guidance applies when trust or company services are offered.
Assess client, geographic, transaction, and delivery risks
| Regulation 18 area | What the firm should check |
|---|---|
| Client risk | Client-base profile, ownership transparency, financial pressure, and third-party involvement. |
| Geographic risk | Registered address, wider commercial footprint, ownership links, fund flows, and relevant high-risk country exposure. |
| Transaction risk | Activity without a clear commercial rationale, or transactions outside the client’s expected pattern. |
| Delivery-channel risk | Use of distance, intermediaries, or indirect contact that limits the firm’s visibility of the client. |
Organise the remaining HMRC material around the Regulation 18 risk factors.
For clients, examine the profile of the client base and any concentrations within it. Check whether a lack of transparency exists around the business or ownership structure, then determine whether financial pressure or third-party involvement adds to the risk.
In terms of geographic analysis, the process extends beyond the client’s registered address. Firms should consider their wider commercial footprint, including its ultimate ownership and flow of funds.
For instance, a prescribed high-risk third-country connection requires the relevant regulatory treatment, while other overseas links can still raise risk if they reduce transparency or create wider jurisdictional exposure.
It is good practice to use the current HM Treasury advisory and Financial Action Task Force lists instead of embedding a fixed set of countries in the assessment.
The next area is transaction exposure, which can appear through activity that lacks a clear commercial rationale or falls outside the client’s expected pattern. Focus on transaction patterns that the practice can realistically identify from the client records, instructions, and information it handles.
In addition, distance or intermediaries can increase delivery-channel risk by reducing the firm’s direct visibility of the client. Assess how often the practice relies on remote contact, agents, or other intermediaries, and whether that limits its understanding of the client.
Weight risks by firm-wide significance
For each material HMRC risk, the assessment should show three things:
- What the exposure is: Describe the relevant aspect of the practice and support it with evidence that reflects the firm’s circumstances.
- How significant it is: Evaluate how common the exposure is across the practice and whether interacting factors increase the risk.
- What changes as a result: Record the effect on the firm-wide assessment, any adjustment to the risk category, and any review trigger arising from changes in the practice or source guidance.
For example, non-face-to-face contact should not be treated as automatically high risk without considering how often it occurs, what safeguards are used, and whether it affects the firm’s visibility of the client.
The same distinction applies when separating firm-wide exposure from individual client warning signs.
A substantial remote payroll portfolio, for instance, is a feature of the practice’s business model, while one client refusing to support an unusual payroll instruction is a client-level concern.
Repeated refusals across a service line may show that the issue has become material at the firm level.
Record how HMRC risks were applied
Firms should maintain a source-application log with the title and date of the HMRC guidance reviewed. Each material risk should be linked to the way the firm has applied it, including any adaptation or exclusion.
An exclusion is defensible only when the documentation identifies the fact that makes the risk inapplicable to the firm. Put otherwise, a bare statement that a risk is irrelevant gives the reviewer no evidence or reasoning.
The assessment should also make clear where each conclusion sits within the FWRA. Any resulting implications for controls or monitoring should be recorded while keeping the underlying exposure visible.
Regulations 18 and 18A require firms to document the steps taken and keep the assessment current, with that record and its supporting evidence available to the supervisor on request. CCAB also expects senior management approval and ongoing review of the assessment.
Ultimately, the result should provide a traceable account of how HMRC’s sector risks affected the firm-wide assessment.
In summary
The firm-wide assessment needs to show clear professional reasoning and explain which HMRC risks apply, why they’re relevant, and how strongly they affect the firm’s AML exposure.
The record needs to connect HMRC’s guidance to the firm’s services, clients, and evidence, which allows a reviewer to follow how the accountant reached a proportionate assessment.
FAQs
Compare HMRC’s findings with the work the firm actually carries out. Consider which services, client types, and working arrangements create relevant exposure, then explain how those factors affect the firm-wide risk assessment. A sector-level rating provides useful context, but the firm’s conclusions should reflect the scale and nature of the practice.
Different services can create different levels of exposure, so each material service should be considered on its own facts. Look at how often the service is provided, which clients use it, and what the work allows the firm to understand about their activity. Also consider whether providing two related services to the same clients changes the overall outlook.
Firms should look beyond where the client is registered, as the assessment needs to consider the parts of the business that involve other countries, such as ownership, trading activity, or the movement of funds. Give greater attention to connections that make the client’s affairs harder to understand, and use current official country-risk information when reaching your conclusion.
Remote contact can affect risk when it makes client identity, control, or activity more challenging to verify. Consider how much of the practice operates remotely and whether the firm still receives reliable information and meaningful contact. The AML effect can be greater if remote delivery appears alongside another concern, such as unclear ownership or activity that does not fit the client’s usual business.
State the specific fact that makes the risk inapplicable. For example, a risk linked to a particular service can be excluded if the firm does not offer that service. The explanation should be clear enough to show how the firm reached its conclusion and identify the HMRC guidance that was considered.
A review might be needed when the firm changes the services it offers, takes on a different type of client, or alters how it delivers its work. Updated guidance from HMRC or another relevant authority can also affect the assessment. The firm should decide which changes are significant enough to trigger a fresh review.
References and Source Material
- HMRC, Accountancy sector guidance for money laundering supervision
- HMRC, Risks common to accountancy service providers
- HMRC, Risk assess your business for money laundering supervision
- HMRC, Economic Crime Supervision Handbook (ECSH52650 – Accountancy service providers)
- Money Laundering Regulations 2017(Regulation 18 and 18A)
- Financial Action Task Force, Black and Grey Lists
- CCAB, Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector
- HM Treasury and Home Office, National Risk Assessment of Money Laundering and Terrorist Financing 2025
- HM Treasury, Money Laundering Advisory Notice: February 2026
- HM Treasury, National Risk Assessment of Proliferation Financing
