ICAS Firm-wide Risk Assessment Thematic Review

While the government has recently announced that AML supervision will move to the FCA in the future, we remain the AML supervisor for ICAS firms until these changes take effect. We continue to devote significant resources to conducting risk-based AML supervision of accountancy firms and TCSP providers.

As highlighted in our annual AML Report for the last two years, we’ve identified that not all firms are conducting effective risks assessments. This is particularly noticeable for firms which we consider to be at the lower end of the risk spectrum who are missing key risks. We’ve therefore conducted a thematic review of over 10% of the firms in the low and lowest risk categories to understand the extent of the issue and to understand where firms may be going wrong.

Our findings are included in this thematic review report, which we recommend all firms review as it provides an insight into the common risks missed by firms in undertaking their Firm-Wide Risk Assessment, and in completing the AML Declaration, and the underlying causes of these omissions.

Background

Regulation 18 of The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) require that every relevant person (be that firm or sole practitioner) take appropriate steps to identify and assess the risks of money laundering and terrorist financing faced by the firm. We therefore expect all of our supervised firms to conduct a firm-wide risk assessment and to keep an up-to-date record of this in writing in accordance with the MLRs.

The firms use the information in their risk assessment to complete their annual AML Declaration to us. As the AML Declaration is used to risk score and categorise each firm, errors and omissions made by the firm in their risk assessment have a real-impact on our risk-based monitoring programme.

Summary of the main findings raised during the thematic review   

1. Client risks:

The thematic review found that while most firms understood the service risks facing their firm, the majority of firms failed to identify all of their client risks on their firm-wide risk assessment and AML declaration. The main client risks omitted were:

• Cash-based businesses 
• Clients with overseas connections 
• High net worth clients 
• Non-face-to-face clients  
• Organisations vulnerable to human trafficking  
• Clients with connections to high-risk or sanctioned countries  
• High value dealer clients 

2. Service risks

Most firms were more effective at identifying their service risks on their risk assessment and AML declaration, however the most common service risk missed was in relation to Trust and Company Service Provision (TCSP). 

3. Insufficient CDD procedures: 

21% of the firms reviewed had overstated the effectiveness of their CDD procedures on their AML declaration.

The underlying cause of these omissions/errors was mainly a lack of understanding of the risks and ML requirements. Following the conclusion of the thematic review, the Monitoring team produced AML Declaration Guidance for all MLROs/MLCPs alongside the link to the 2025 AML Declaration. The guidance was also published on icas.com here and should help firms in their understanding of risk.

Impact of omissions on the monitoring regime

• The knock-on impact of these errors and omissions was that 55% of the participant firms had a higher risk category following the thematic review than based on the information submitted to us on their AML Declaration.
• Firms are reminded that the Authorisations Committee will be notified of instances where there have been significant omissions identified during monitoring reviews. This may attract regulatory action and/or penalties. Where there’s a valid AML risk which hasn’t been adequately identified and assessed by the firm, there may be a knock-on impact on the level of due diligence conducted by the firm putting the firm at risk.

Next steps

We encourage all supervised firms to take the following steps:

• Review this thematic review report.
• Review the 2025 AML Declaration Guidance which explains the key risk.
• Use the above information to then review the firm’s approach to the completion of the annual firm-wide risk assessment and AML declaration, including knowledge of client base and services provided, template used, commentary provided within the assessment, etc.

Support

Three ‘ICAS anti-money laundering in focus’ videos were published by us in 2025 to assist firms in understanding two higher risk service areas (TCSP and overseas entity agent services) and in understanding the main findings of the Monitoring Report. The videos can be found at icas.com here.

Firms are reminded that our Practice Support team are available to assist firms with, and provide guidance on, AML queries and firms shouldn’t wait for the results of a monitoring review to take action in respect of AML matters.