UK Money Laundering Regulations 2026: what the amendments mean for payment, e-money and crypto firms

By Harry Khan, Founder · Published 8 November 2026 · Last reviewed 8 November 2026

The short answer

The UK amended its Money Laundering Regulations (MLRs) in 2026. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026, SI 2026/621, were laid before Parliament on 25 March 2026, made on 9 June and largely came into force on 30 June 2026. They narrow some requirements that had created work without reducing risk, tighten others, and add new duties for cryptoasset businesses.

For payment institutions and EMIs, the main changes are to enhanced due diligence (EDD) for high-risk countries and for unusual transactions, and the move from euro to sterling thresholds. For cryptoasset exchanges and custodian wallet providers, there is a new EDD duty for correspondent relationships from 1 February 2027 and a wider change in control regime ahead of the new FSMA authorisation regime.

The main changes at a glance

High-risk countries: a narrower mandatory list

Before the amendment, firms had to apply EDD to business relationships and transactions involving any country on the UK's high-risk third country list, which followed the FATF's grey list as well as its black list. The 2026 Regulations replace that definition with "FATF call for action country", meaning the black list.

This does not mean grey list countries can be treated as low risk. They remain a geographic risk factor, and a firm's risk assessment should still lead to enhanced measures where the risk warrants it. What changes is that EDD for grey list exposure becomes a risk-based judgment rather than an automatic requirement. Payment firms with corridors to grey list countries should update their policy, record their reasoning and check that monitoring rules still reflect the risk.

Unusual transactions

The previous wording required EDD for transactions that were complex or unusually large, or part of an unusual pattern. The amendment changes this to transactions that are unusually complex or unusually large given their nature. In practice, firms must assess complexity in context: the customer, the product, the sector, the value and normal practice. A complex structure that is normal for the customer and the product no longer requires EDD on that ground alone, but the firm should record why it was considered normal.

For payment firms, this affects monitoring rules and alert handling. Rules that flagged every transaction above a fixed size for EDD may produce alerts that the new test does not require. Rather than switching them off, recalibrate them against the customer's expected activity, so that unusual size relative to the customer is what triggers review. Train analysts on the in-context test, and keep a short written record when a transaction that looked complex is closed as normal for that customer and product.

What changes for cryptoasset firms

Cryptoasset exchange providers and custodian wallet providers have three changes to plan for.

• Correspondent relationships. From 1 February 2027, a new regulation 34A requires EDD in correspondent relationships with other crypto firms, in line with FATF recommendations 13 and 15. Firms must understand the respondent's business, assess its reputation and supervision, review its AML controls, obtain senior management approval, document responsibilities and make sure customer information can be obtained where needed.
• Change in control. For firms registered under the MLRs, a new Schedule 6B widens the change in control notice requirement to anyone who would be a controller under the Financial Services and Markets Act, ahead of the new regime on 25 October 2027.
• Financial institution provisions. Several provisions that applied to credit and financial institutions now also apply to cryptoasset businesses, including FCA information gateways.

These sit alongside the FCA's application window for the new cryptoasset authorisation regime, which runs to 28 February 2027. Our guide to the UK crypto application window covers that process, and our page on UK cryptoasset authorisation explains the regime.

Correspondent due diligence for crypto firms in practice

The new regulation 34A applies where a UK cryptoasset business provides services to another crypto business, its respondent, in a way comparable to correspondent banking. Exchanges that provide liquidity, settlement or custody to other platforms, and custodians that hold assets for other firms, are the most likely to be affected. The steps for each relationship are:

Existing relationships should be reviewed before 1 February 2027 so that each has a completed file on that date.

Pooled client accounts

Pooled client accounts are bank accounts held by one firm for the money of several clients, used by solicitors, letting agents, payment firms and others. The amendments require banks to understand the purpose and intended use of such accounts and to assess the money laundering risk, while still allowing simplified measures where the conditions are met. Account holders must keep written records of money paid in and out for at least five years and provide information about underlying clients on request, subject to legal privilege. Payment firms that use pooled accounts at banks, or that offer accounts with similar features to their own clients, should expect more questions and should check their records meet the standard.

Sterling thresholds

Euro thresholds in the MLRs are converted to sterling, generally on a one to one basis, so EUR 10,000 becomes GBP 10,000 in sectors such as high value dealing, art and letting. A small number of thresholds are excluded from the one to one conversion so that the UK stays aligned with FATF standards. The e-money exemption limits are restated in sterling. Firms should update policies, system parameters and training materials so the figures match the Regulations.

What changes for payment institutions and EMIs

Payment institutions and EMIs are supervised for AML by the FCA. For them, the 2026 Regulations mainly mean updating policies, procedures and monitoring rules:

• revise the country risk methodology to reflect the black list rule, keeping grey list countries as a risk factor;
• update EDD triggers for unusual transactions and train staff on the in-context test;
• update thresholds in policies and systems from euro to sterling, including the e-money exemption limits;
• for firms whose customers use pooled client accounts, expect banks to ask more about the purpose and use of those accounts.

Firms should also record the change in their risk assessment and board reporting, because the FCA will expect to see that the firm has considered the amendments.

FCA reporting and supervision

The amendments strengthen cooperation and information sharing between supervisors, widen the FCA's gateways for disclosing information and add a duty for authorised persons to report to the FCA, within 30 days, any inaccuracy in or material change to information provided under regulation 23. Firms should add this to their regulatory reporting calendar and make sure changes to the information held by the FCA, such as changes in business activities or key people, are notified on time.

The FCA remains the AML supervisor for payment institutions, EMIs and cryptoasset businesses, and it has made financial crime a supervisory priority. A documented gap analysis against the 2026 Regulations is a simple way to show the FCA that the firm has responded.

The travel rule and other crypto obligations

The 2026 amendments sit on top of the UK travel rule, which has applied to cryptoasset transfers since 1 September 2023 and requires firms to collect, verify and share information on originators and beneficiaries. Correspondent relationships with other crypto firms are where travel rule data is exchanged, so the new EDD duty and the travel rule should be handled together: the review of a respondent's AML controls should include how it complies with the travel rule and how it handles transfers from jurisdictions without one. Firms preparing their FCA authorisation applications should describe both in their financial crime documentation, because the FCA reviews them as part of the application.

A short implementation plan

How Buckingham Capital Consulting helps

We update AML policies, risk assessments and EDD procedures for payment, e-money and crypto firms, and prepare crypto firms for the FCA's authorisation regime. Our financial crime services cover gap analyses against the 2026 Regulations, and our UK EMI licence guide covers the wider requirements for e-money firms.

Questions

Get in touch: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].

This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.