Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Customise an anti-money-laundering and counter-terrorist-financing (AML/CTF) policy by starting with the activities your practice actually performs, the people it serves, how work is delivered and the jurisdictions involved. Then document proportionate controls, assign each control to a named person, train the people who use it and review the policy whenever risk changes. A generic template can provide headings, but it cannot demonstrate that your practice has assessed its own exposure or that staff follow workable procedures.
Before editing any policy, confirm which of your activities fall within the Money Laundering Regulations 2017 and whether HMRC, the FCA or another professional supervisor is responsible for them. The applicable supervisor, current sector risk assessment and approved professional-body guidance determine which details you must include. This article is practical information, not a substitute for legal advice or the guidance governing your practice.
As an Amazon Associate I earn from qualifying purchases.
What a customised AML/CTF policy must achieve
For a supervised business, the policy is the operating framework for preventing and detecting money laundering, terrorist financing and proliferation financing. Under regulations 18 and 19 of the Money Laundering Regulations 2017, the business must assess relevant risks and maintain policies, controls and procedures based on that assessment. HMRC’s general guidance also expects procedures to be suitable for the risks identified and followed effectively by senior managers, front-line staff and agents.
Your document should let a new member of staff answer four questions without guessing:
#1 Best Overall
- Which services, customers, transactions and delivery channels create risk here?
- What checks and approvals are required before and during an engagement?
- Who performs, reviews and escalates each check?
- What records prove that the control was completed and that a decision was reasonable?
The firm-wide risk assessment explains why your controls are designed as they are. A customer-level assessment then applies those controls to a particular client or matter. A risk indicator is a reason to investigate or apply enhanced measures; it is not proof that a customer has committed an offence.
Confirm your regulatory scope and supervisor first
Map the activities that bring the practice into scope
List every service line, including occasional or ancillary work. Accountancy, legal, estate-agency and other supervised activities can have different registration and guidance routes. A hybrid practice may have more than one relevant rule set. Do not assume that the supervisor for your main profession covers every service you offer.
For each activity, record:
- the exact service and whether you provide it regularly or occasionally;
- the legal entity and offices delivering it;
- the likely supervisor and registration status;
- the current regulations, supervisor guidance and approved professional-body guidance you relied on; and
- the person responsible for checking that this mapping remains current.
If you cannot confidently identify the correct route, contact the relevant regulator or HMRC before finalising the policy. HMRC’s guidance covers several supervised sectors, while the FCA publishes requirements and guidance for firms it supervises; neither should be treated as a universal rulebook for every UK practice.
Use current national and sector assessments
Use the National Risk Assessment 2025 and the risk assessment published for your sector as inputs, not as a substitute for your own analysis. HMRC says an accountancy service provider must take its sector risk assessment into account in its own assessment. HMRC added accountancy-sector guidance on common risks on 9 January 2026. Check the publication date whenever you save a copy and note which edition your policy uses.
Sector material describes how a service may be misused, but it does not make every client equally risky. Your policy should explain which sector risks apply to your work, which do not, and what practice-specific facts led to the resulting controls.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
Build a risk assessment around your actual practice
Examine six dimensions
| Dimension | Questions to answer | Evidence to retain |
|---|---|---|
| Services and transactions | Do you handle client money, form companies, prepare accounts, advise on property or tax, make payments, or arrange transactions for others? | Service catalogue, engagement letters and process maps |
| Customers and behaviour | Who owns or controls the customer? Are structures complex, information inconsistent, or instructions unusual for the stated business? | Customer profiles, beneficial-ownership records and escalation notes |
| Delivery channels | Is work face-to-face, remote, introduced by an agent, or completed through digital systems? Where can impersonation or weak verification occur? | Onboarding workflow, identity method and agent arrangements |
| Geography | Which countries are involved through residence, ownership, payments, suppliers or assets? Are any relevant to sanctions, corruption, conflict or proliferation concerns? | Country-risk rationale and payment or ownership information |
| People and structure | How many staff and agents perform checks? Who can approve exceptions, and how is independent review obtained? | Organisation chart, authority matrix and training records |
| Supervisor and guidance | Which authority supervises each activity, and which current sector guidance applies? | Registration details, guidance register and review log |
For each dimension, describe the risk, the circumstances that increase or reduce it, the control you will apply and the evidence that control creates. Record the reasoning, including why a risk is not relevant. This is stronger than copying a list of risks from a template.
Separate firm-wide and customer-level assessments
The firm-wide assessment covers the practice’s exposure across all services and channels. A customer-level assessment considers the particular customer, beneficial owners, purpose of the relationship, expected activity and any adverse or inconsistent information. Keep the two documents linked: the firm-wide assessment should determine the range of controls available, while the customer assessment determines which of those controls are necessary for that relationship.
Do not let a low-risk label remove ordinary identification and verification duties. Likewise, do not apply enhanced measures automatically because a customer has one risk indicator. Require staff to document the facts, seek corroborating information and explain the decision.
Turn identified risks into named controls
Governance and accountability
Name the senior manager with overall responsibility and the money-laundering reporting officer (MLRO), where your sector requires one. State who can approve a higher-risk relationship, who deputises during absence, who receives internal disclosures and who decides whether an external report is needed. Include responsibilities for partners, managers, front-line staff, contractors and agents rather than assigning all duties to the MLRO.
For every material risk, write a short control statement in this form: “Because [risk], the practice will [action], performed by [role], reviewed or escalated by [role], with [record] retained.” This connects the assessment to day-to-day work and exposes gaps such as a check with no owner or an approval with no evidence.
Customer identification and verification
Describe when identification starts, what information is collected, how identity is verified and when verification must be complete. Explain how the practice identifies beneficial owners and controllers, understands the purpose and intended nature of the relationship, and handles customers who cannot provide reliable information. If remote onboarding or an introducer is used, state the permitted method, its limitations and the circumstances requiring additional evidence or a face-to-face step.
Set an approval rule for exceptions. Staff should know that an incomplete check is a reason to pause work or escalate, not an invitation to proceed informally. The policy should also explain how information is updated when ownership, directors, address, business activity or expected transactions change.
Due diligence, monitoring and escalation
Explain how the practice decides whether standard or enhanced due diligence is appropriate, what additional information may be requested and who authorises the decision. Include screening and other checks required by your supervisor or sector guidance, but avoid promising a tool or data source that the practice does not actually use.
Define ongoing monitoring in terms staff can apply: compare activity with the customer’s stated purpose and expected profile, investigate unexplained changes and record the outcome. Give examples relevant to your services, such as an unexpected change in ownership, an instruction routed through an unrelated third party or payments that do not fit the engagement. State how concerns are reported internally, how confidentiality is protected and how the MLRO records the decision.
Training, supervision and agents
Training should cover the risks in your practice, the checks each role performs, warning signs, escalation routes, confidentiality and record keeping. Induction alone is not enough: set refresher training and targeted updates when procedures or risks change. Keep attendance, material used, questions raised and any follow-up actions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
If agents or contractors perform regulated tasks, the policy must explain their permitted activities, supervision, access to procedures, quality checks and escalation route. HMRC’s general procedures guidance expects effective compliance across senior managers, staff and agents; a contract that simply says an agent will comply is not operational assurance.
Make the policy usable at the point of work
Convert principles into short procedures, forms or system prompts. A practical onboarding sequence is:
- Open a risk record. Capture the service, customer, ownership, purpose, expected activity, delivery channel and relevant geography.
- Collect and verify information. Follow the approved identification method and record the source, date and reviewer.
- Assess the relationship. Document factors that raise or reduce risk and select standard or enhanced measures with reasons.
- Obtain approval. Route higher-risk cases or exceptions to the named manager or MLRO before work begins, unless a documented legal exception applies.
- Set monitoring expectations. Note what activity, documents or events will prompt a review and who will perform it.
- Record decisions. Keep the assessment, evidence, approvals, queries and escalation outcome together so another reviewer can reconstruct the decision.
Add a “cannot complete the check” branch. It should tell staff to stop or restrict the relevant work, inform the designated person, avoid alerting the customer to a suspicious-activity report decision and record the reason. The exact action depends on the circumstances and applicable law, so the procedure should direct staff to the MLRO or legal adviser rather than improvise.
Choose proportionate controls for different operating models
| Practice characteristic | Customisation focus |
|---|---|
| Small owner-managed practice | Use a concise policy, but separate the person performing a check from the person approving an exception where possible. If one person must perform both roles, record the compensating review. |
| Multiple offices or teams | Set one standard, a central version-controlled procedure and local escalation contacts. Test that each office uses the current version. |
| Remote-first delivery | Specify identity-verification limits, document quality standards, secure communication and when stronger evidence or an in-person step is needed. |
| Agent or introducer network | Define due-diligence responsibilities, permitted reliance, supervision, sample checking and immediate escalation of concerns. |
| Complex or international work | Document ownership chains, jurisdictions, payment routes and any sanctions, corruption or proliferation-financing concerns before accepting the engagement. |
Size alone does not determine risk. A small practice handling complex structures may need more stringent controls than a larger firm serving straightforward local customers. Proportionality means matching controls to the assessed exposure, not reducing them merely because the firm has few employees.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Set a review and change-control process
Choose a recurring review interval that you can justify for the practice’s risk profile and record the date, participants, evidence considered and changes made. In addition, require an out-of-cycle review when any of these events could affect risk:
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
- a new service, transaction type, customer segment or payment method;
- a new office, agent, ownership structure or delivery channel;
- material changes to countries involved or the firm’s customer base;
- new legal, supervisory or sector-risk guidance;
- a significant incident, internal disclosure, failed check or quality-assurance finding; or
- changes in staffing that affect segregation, approval or MLRO cover.
HMRC’s estate-agent risk guidance expressly treats a new service or changed operating model as a reason to update the assessment and procedures before the change begins. The same discipline is sensible for other practices, subject to their own sector rules: assess the change, amend controls, brief staff and verify that the new process works before launch.
During each review, test a sample of completed files, look for overdue updates, check that escalations reached the right person and ask staff to explain what they would do with an incomplete check. Record remedial actions with an owner and deadline. FCA guidance similarly emphasises regular assessment of whether controls remain relevant and appropriate.
Keep evidence that proves the policy operates
Maintain a controlled copy of the policy with an owner, approval date, version number, effective date and change history. Keep the underlying risk assessment, customer assessments, verification evidence, approvals, monitoring records, training logs, internal disclosures, quality checks and review minutes for the retention period required by your supervisor and the regulations. Restrict access to sensitive information and make clear who may amend records.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →A procedure is not demonstrated by its existence. Evidence should show that staff received it, understood it and used it. Periodic file reviews, management information and recorded corrective actions help demonstrate effective compliance without relying on assurances.
Common customisation mistakes and their fixes
- Copying a sector checklist unchanged. Add a paragraph for every material risk explaining whether it applies to your services and why.
- Listing duties without owners. Add a role, reviewer, escalation route and required record to each control.
- Treating the firm assessment as every customer’s assessment. Use a separate customer-level record tied to the engagement’s facts.
- Using “enhanced due diligence” as a conclusion. Specify the additional information, approval and monitoring that the phrase means in your practice.
- Ignoring agents and front-line staff. Include their training, supervision and access to current procedures.
- Reviewing only on a calendar date. Add change triggers so new services or operating models are assessed before launch.
- Leaving a template’s blanks or obsolete references. Remove irrelevant sections, verify the supervisor and record the guidance edition and review date.
Implementation checklist for the owner or MLRO
- List regulated activities, legal entities, offices and likely supervisors.
- Collect the current regulations, national assessment, sector assessment and approved professional-body guidance that apply.
- Interview staff who deliver each service and map customers, channels, geographies and transactions.
- Write and approve the firm-wide risk assessment, including proliferation-financing risk.
- Map each material risk to a control, owner, reviewer, escalation route and record.
- Document onboarding, verification, enhanced measures, monitoring, internal reporting and failed-check procedures.
- Define training, agent oversight, quality assurance, retention and access controls.
- Publish the controlled policy, brief every affected person and retain evidence of communication.
- Set the routine review and change triggers, then test a sample of files after implementation.
A policy is credible when it mirrors the work your practice actually does, gives staff an answer at each decision point and leaves an auditable trail. Confirm the regulatory route first, use current sector guidance, and revise the assessment and procedures whenever the practice’s risk changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
