Supervised for money laundering?
Your risk assessment and procedures, written for your firm.
Every supervised business has to hold both, and be able to hand them over on request. We build them for four sectors — HMRC-supervised estate and letting agents, accountancy service providers and trust or company service providers, and SRA-regulated solicitors' firms in England and Wales — and each sector gets its own questions, its own risk factors and its own regulator cited, not an estate agent's pack with the words swapped. Most firms we speak to have neither document, or have a template bought years ago that was never written against their own business, which is the one thing regulation 19 asks it to be. We show the working behind every risk rating so you can check it, correct it and defend it.
Led by a Chartered Accountant — a CA ANZ member with 20+ years of experience across public practice, business operations, audit, and government sectors.
Four sectors, and the question that decides each one.
Who supervises you decides which regulator your documents cite, which guidance they are written against and which forms they name — so it is the first question on the form, not the last. Answer it wrong and every page of your pack names the wrong body. We ask before you pay, and where the answer means we are the wrong people, we say so and stop.
Both are supervised by HMRC and both need the same two documents, and we have not built them. The risk factors, the thresholds and the guidance are genuinely different, and handing you another sector's pack with the words swapped would be worse than saying no. Ask anyway and you will get a straight answer, with no payment link, because there is nothing for you to pay for yet.
Twenty-one days is enough to send documents. It isn't enough to write them.
When you apply to register with HMRC, regulation 57(2)(f) lets HMRC specify, as information it requires, a risk assessment which satisfies the requirements in regulation 18. If it issues a requirement for further information, regulation 57(3) gives you 21 days beginning with the date that requirement is issued to provide it. Under regulation 59(1)(a), HMRC may refuse to register you where a requirement imposed under regulation 57 has not been complied with.
Read that carefully, because the version that circulates is wrong in a way that matters: the 21 days runs from HMRC's letter, not from the day you applied, and refusal is discretionary rather than automatic. So there is no countdown on your calendar. The letter simply arrives, and from that moment you have three weeks — which is plenty of time to attach two documents to an email, and nowhere near enough to write them properly for the first time.
HMRC's own registration guidance tells applicants to complete a risk assessment and put policies, controls and procedures in place before applying, and says in terms: "We may reject or refuse your application if you do not have these in place."
Nearly half of every penalty HMRC published landed on an estate agent, and almost all of it was late registration.
In the list HMRC published covering 1 April to 30 September 2025, there were 334 penalties across every sector it supervises. 160 of them were against estate agency businesses, totalling £826,655. That is the population HMRC is actively working through.
Now the part most people selling AML packs leave out, because it is inconvenient: 149 of those 160 were for failing to apply for registration at the required time — regulation 56 — rather than for a document failure. So we are not going to tell you agents are being fined for not having a risk assessment. On the published evidence, they are being fined for not registering properly.
Which leads to the same place by a more honest route. Registration is where this goes wrong, registration is where HMRC can ask for your risk assessment, and regulation 59(1)(a) is what happens if you cannot produce it. Get registered, on time, with the documents already sitting there.
The pattern holds across the other HMRC sectors on the same list. 113 penalties were against accountancy service providers, totalling £495,220, and 106 of those were regulation 56 again. Ten were against trust or company service providers, totalling £80,206, nine of them regulation 56 — which bites harder in that sector, because regulation 56(1)(c) does not let you trade while your application is pending at all. Solicitors' firms are not on this list: the SRA publishes its own enforcement, and its named failures are the opposite shape — client and matter risk assessments, source of funds, and firm-wide risk assessments missing or written from a template.
The regulation asks for something a download cannot be.
Regulation 19(1)(a) requires policies, controls and procedures that mitigate the risks of money laundering and terrorist financing identified in any risk assessment undertaken by the relevant person under regulation 18(1).
That is not a drafting preference, it is the test. A template was not written against any risk assessment, let alone yours — so it cannot meet regulation 19(1)(a) however good the writing is. It is the wrong shape, not the wrong quality.
So each section of your policies opens by naming the risk it answers and the rating that risk carries in your own assessment. Change an answer, and the rating moves, and the policy that answers it moves with it.
Four documents, generated from your answers.
Anything you cannot answer comes back marked needed from you rather than guessed at, and anything genuinely unsettled comes back flagged rather than quietly decided. Send the answers and we rebuild.
Two flat fees. Launch pricing.
Both prices are launch pricing, confirmed in writing before anything is charged. The Documents Pack is paid in full up front and is refundable until we start generating your documents; done-with-you takes half to begin and the balance on your approval, before anything is delivered. Separate from our fees, HMRC charges its own — £300 to apply, £400 per premises at registration and again each year, and £40 per person for the approval checks on beneficial owners, officers and managers. Those are paid by you to HMRC and we never handle them.
If you only do lettings, you may not need this at all.
A letting agent is caught by regulation 13(4) only where an agreement is concluded for a term of a month or more at a monthly rent of £10,000 or more. That is £120,000 a year on a single tenancy. Most high-street letting agents never conclude one, and on their lettings work alone they are not letting agents for these purposes.
One detail worth knowing, because it changed recently and the guidance has been slow to catch up: that threshold was 10,000 euros until 30 June 2026, when S.I. 2026/621 replaced it with £10,000. If you are anywhere near the line, it is worth checking against the sterling figure.
If you also do sales, none of that helps you — you are captured as an estate agency business regardless of your lettings book. Tell us your highest monthly rent and what else the business does, and you will get a straight answer before anything is invoiced. We would rather tell you that you do not need this than take £295 for a pack you cannot use.
What we don't do.
Being straight about the limits is part of the pitch, not a disclaimer bolted to the bottom of it.
Expertly designed. Commercially grounded.
Led by a Chartered Accountant — a CA ANZ member with 20+ years of experience across public practice, business operations, audit, and government sectors.
We prepare; you adopt. Regulation 19(2)(b) requires your policies to be approved by your senior management, so the approval is yours and so is everything that follows from it. Your nominated officer under regulation 21(3) and your compliance officer under regulation 21(1)(a) are your own people — the regulation requires an individual in your firm, and we could not hold either role if we wanted to.
This is not an audit, review or other assurance engagement, and it is not legal advice. Everything is prepared from the answers you provide and has not been independently verified — every document in the pack says so on its face.
Questions firms actually ask.
Tell us about your firm.
Not sure whether you're captured, who supervises you, or whether you already registered years ago and forgot? Say so. We'll come back with a straight answer on what you need — including that you need nothing from us — before anything is invoiced.
You answer questions about your own business — no statutory language, no jargon. We build the risk assessment, the policies, the gap analysis and the calendar, and show the working behind every rating. You read it, correct anything we got wrong, and adopt it.
“Compliance shouldn't paralyze your operations. Our frameworks are developed and led by a Chartered Accountant with 20+ years of experience bridging the gap between government audit requirements and real-world business operations.”
We read every message the day it arrives. Most responses come within a few hours.
Have the documents before HMRC asks for them.
A risk assessment under regulation 18 and policies under regulation 19, built from your answers with the working shown. £295 for the pack, £495 done with you — launch pricing, confirmed before anything is invoiced.
Start now — 20 minutes →We prepare anti-money laundering documents for your review and adoption. This is not legal advice, and it is not an audit, review or other assurance engagement. Your policies are approved by your own senior management under regulation 19(2)(b), and your nominated officer and compliance officer are your own people under regulation 21. We do not make suspicious activity reports and do not submit anything to HMRC on your behalf. Deplexify is not affiliated with, endorsed by, or acting on behalf of HM Revenue & Customs.