Money laundering fines have cost UK financial services firms hundreds of millions of pounds — not because they lacked a policy, but because their policies were incomplete, untested, or disconnected from how the business actually operated. The FCA doesn't just want an AML policy — it wants evidence that your entire programme works. A board-level governance structure, full risk-based methodology, complete CDD/EDD procedures, transaction monitoring, SAR reporting, sanctions and PEPs management, third-party oversight, staff training, internal audit, and breach response — all connected, all documented, all auditable. Most firms have pieces of this. Few have it all in a single, coherent framework.
What's included:
Full legislative framework: POCA 2002 Sections 327–333D, Terrorism Act 2000, Criminal Finances Act 2017, MLR 2017, FATF Recommendations, SAMLA 2018, and FSMA 2000 — with criminal penalties of 14 years' imprisonment and unlimited fines
Three-lines-of-defence governance model: MLRO, Deputy MLRO, AML Committee, and Board Risk Committee — with five-level internal escalation and AML Committee reporting schedule (monthly dashboard, quarterly Board report, annual risk assessment)
Enterprise-wide risk assessment methodology: customer, product, delivery channel, and geographic risk — with FATF, Transparency International, World Bank, and OFSI integration and four customer risk categories (Low, Standard, High, and Prohibited)
Standard CDD, EDD, and SDD: four-element Regulation 28 framework, beneficial ownership to 25% threshold, full trust framework, deferred verification (15-business-day maximum), and documentary evidence hierarchy including digital and biometric verification
SAR internal reporting: five-step process, MLRO assessment framework, NCA consent regime (7-working-day response/31-day restriction), and tipping-off prohibition under POCA Sections 333A and 342
Breach classification: Minor, Material, Serious, and Criminal — with four-stage investigation process and 14-day FCA notification standard under SUP 15.3
Ready-to-use appendices: CDD checklist, EDD assessment form, business-wide risk assessment, customer risk rating matrix, suspicious activity investigation form, SAR filing checklist, training record, and audit compliance review checklist
+ much more
Who is this for?
MLROs, Compliance Officers, risk functions, and Boards at FCA-regulated firms who need a complete, board-approved AML policy framework that satisfies MLR 2017, POCA, and FCA supervisory expectations — everything the FCA expects to see, in a single audit-ready document.
How it works
Step 1 — Read it. Every section exists for a reason, grounded in a specific regulatory obligation.
Step 2 — Understand it. Map the content against your current practices. Identify where you're strong and where gaps exist.
Step 3 — Make it yours. Tailor the language to reflect how your organisation actually operates. A policy that sounds like your firm is a policy your people will follow.
Step 4 — Take ownership. Assign clear accountability — Board approval, named SMF holder, designated policy owner. A policy without an owner is a liability, not an asset.
Step 5 — Operationalise it. Embed the policy into your governance calendar, training programme, and annual review cycle. This is where compliance becomes culture.
Or, get this free with RegTechPRO
Access this alongside the full compliance policy library — SM&CR, COBS, AML, Consumer Duty, GDPR, and more — for a fraction of the cost of consultancy.
View RegTechPRO pricing and packages →
Money laundering fines have cost UK financial services firms hundreds of millions of pounds — not because they lacked a policy, but because their policies were incomplete, untested, or disconnected from how the business actually operated. The FCA doesn't just want an AML policy — it wants evidence that your entire programme works. A board-level governance structure, full risk-based methodology, complete CDD/EDD procedures, transaction monitoring, SAR reporting, sanctions and PEPs management, third-party oversight, staff training, internal audit, and breach response — all connected, all documented, all auditable. Most firms have pieces of this. Few have it all in a single, coherent framework.
What's included:
Full legislative framework: POCA 2002 Sections 327–333D, Terrorism Act 2000, Criminal Finances Act 2017, MLR 2017, FATF Recommendations, SAMLA 2018, and FSMA 2000 — with criminal penalties of 14 years' imprisonment and unlimited fines
Three-lines-of-defence governance model: MLRO, Deputy MLRO, AML Committee, and Board Risk Committee — with five-level internal escalation and AML Committee reporting schedule (monthly dashboard, quarterly Board report, annual risk assessment)
Enterprise-wide risk assessment methodology: customer, product, delivery channel, and geographic risk — with FATF, Transparency International, World Bank, and OFSI integration and four customer risk categories (Low, Standard, High, and Prohibited)
Standard CDD, EDD, and SDD: four-element Regulation 28 framework, beneficial ownership to 25% threshold, full trust framework, deferred verification (15-business-day maximum), and documentary evidence hierarchy including digital and biometric verification
SAR internal reporting: five-step process, MLRO assessment framework, NCA consent regime (7-working-day response/31-day restriction), and tipping-off prohibition under POCA Sections 333A and 342
Breach classification: Minor, Material, Serious, and Criminal — with four-stage investigation process and 14-day FCA notification standard under SUP 15.3
Ready-to-use appendices: CDD checklist, EDD assessment form, business-wide risk assessment, customer risk rating matrix, suspicious activity investigation form, SAR filing checklist, training record, and audit compliance review checklist
+ much more
Who is this for?
MLROs, Compliance Officers, risk functions, and Boards at FCA-regulated firms who need a complete, board-approved AML policy framework that satisfies MLR 2017, POCA, and FCA supervisory expectations — everything the FCA expects to see, in a single audit-ready document.
How it works
Step 1 — Read it. Every section exists for a reason, grounded in a specific regulatory obligation.
Step 2 — Understand it. Map the content against your current practices. Identify where you're strong and where gaps exist.
Step 3 — Make it yours. Tailor the language to reflect how your organisation actually operates. A policy that sounds like your firm is a policy your people will follow.
Step 4 — Take ownership. Assign clear accountability — Board approval, named SMF holder, designated policy owner. A policy without an owner is a liability, not an asset.
Step 5 — Operationalise it. Embed the policy into your governance calendar, training programme, and annual review cycle. This is where compliance becomes culture.
Or, get this free with RegTechPRO
Access this alongside the full compliance policy library — SM&CR, COBS, AML, Consumer Duty, GDPR, and more — for a fraction of the cost of consultancy.
View RegTechPRO pricing and packages →
Image 1 of 10
Image 2 of 10
Image 3 of 10
Image 4 of 10
Image 5 of 10
Image 6 of 10
Image 7 of 10
Image 8 of 10
Image 9 of 10
Image 10 of 10
