AML penalties issued to firms for non-compliance

ICAS is a supervisory body for anti-money laundering (AML). We take a risk-based approach to supervision, focusing our efforts on firms where the risk of facilitating money laundering is greatest. Here, we explain the most common areas of non-compliance and the regulatory penalties issued since April 2025.

In April 2025, ICAS introduced new guidance which sets out the approach we’ll take when we encounter firms who aren’t meeting the requirements of the Money Laundering Regulations 2017. 

Where we identify non-compliance, we may: 

• Arrange additional monitoring visits to make sure concerns are addressed. 
• Impose conditions or restrictions on a firm’s licence. 
• Make a regulatory (financial) penalty.  

Penalties issued since April 2025 

Since the guidance was introduced last year, the Authorisation Committee has issued 21 regulatory penalties to firms.  

The penalties ranged in size from £100 to £3,000, depending on the number and seriousness of the breaches found. All penalties issued by the Committee are published on our website. 

Common areas of AML non-compliance 

The most common areas of AML non-compliance include: 

• Customer due diligence failures such as: 
  • Failing to identify all beneficial owners (and for corporate clients, identify the names of directors of the board). 
  • Failing to carry out appropriate verification to demonstrate that the client, its beneficial owners and directors are who they claim to be. 
  • Failing to complete client risk assessments for all clients, or identify all the relevant risks presented by the client. 
  • Failing to record Know Your Client records on every file. 
  • Failing to consider the potential requirement for enhanced due diligence. 
  • Failing to document evidence of ongoing monitoring.

• Failure to adequately document the firm’s AML policies or procedures, or to have an AML policy document in place and available to staff.

• Failure to conduct a whole firm risk assessment.  

• A lack of adequate training of the firm’s employees. 

• Failures to communicate with ICAS. Firms must cooperate fully and promptly with ICAS Committees and staff and use their best endeavours to accommodate the monitoring process. They must also provide full and accurate information when completing the ICAS AML Declaration. 

The largest penalties were applied to firms that had adopted sufficiently robust enhanced due diligence procedures for higher-risk clients.  

Our approach to penalties 

The 2025 guidance represents a change in approach to ICAS’ AML enforcement, moving to a tariff-based system of regulatory penalties for relatively low-level AML offences.  

We will not offer a regulatory penalty if a breach is serious enough to raise questions about whether we should continue to supervise the firm. If there are questions over the firm’s fitness to be supervised, or significant ethical concerns, the Committee will take other regulatory action instead.   

We only raise regulatory penalties where a monitoring visit identifies repeated or systemic issues. As our annual AML Supervision Reports highlight, most firms take their AML responsibilities seriously. Where we identify issues, most firms take appropriate action and complete the visit process with positive outcomes.