ACCA's 2026/27 AML Return: Document Upload Raises the Bar

The ACCA's 2026/27 anti-money laundering annual return looks familiar at first glance. The first 16 pages cover ground that supervised firms will recognise: firm size, structure, client base, service lines, risk profile, and the controls in place. Then the final four pages arrive, and the exercise changes. For the first time, firms must upload their firm-wide risk assessment and their AML policies and procedures directly into the return. That single shift, from answering whether documents exist to actually producing them, has significant implications for how ACCA supervises the profession and for how firms, including those using any form of crypto accounting software, should prepare.

What Has Actually Changed

Previous annual returns asked firms a series of questions about their AML arrangements. A firm would confirm, for example, that it had a firm-wide risk assessment in place, that its money laundering reporting officer (MLRO) had conducted the required activities, and that client onboarding procedures were documented. That confirmation, essentially a declaration, formed the basis on which ACCA built its risk profiles and decided which firms warranted a closer inspection.

The New Upload Requirement

The 2026/27 return retains those questions but adds a document-upload requirement covering two core items: the firm-wide risk assessment and the AML policies and procedures manual. According to ACCA's AML Lead, Steven Armstrong, the change is framed as a minor administrative update. Both documents are legally required under the Money Laundering Regulations 2017, so firms that already comply should, in theory, face no additional burden.

The practical reality is more nuanced. A firm can confirm that a document exists. Once that document is in ACCA's hands, however, the supervisor can assess its quality, its currency, and whether it genuinely reflects the firm's current practice. That is a fundamentally different form of scrutiny.

The Link to the UK National Risk Assessment

ACCA has connected the return's enhanced requirements to the UK National Risk Assessment published by HM Treasury in July 2025, which identified persistent knowledge gaps across the accountancy sector as a material AML vulnerability. The return is positioned as one mechanism for addressing those gaps through improved supervisory intelligence, alongside guidance and technical resources that ACCA makes available to supervised firms.

From Declarations to Evidence: Why This Matters

The distinction between declaring compliance and demonstrating it is not a bureaucratic technicality. It sits at the heart of how risk-based AML supervision is supposed to work.

What an Experienced Reviewer Can Spot Quickly

An experienced AML inspector can identify weaknesses in a document within seconds. Over-reliance on generic template wording, references to superseded legislation, a failure to tailor the risk assessment to the firm's actual client base and service mix, and the absence of any discussion of emerging risks are all visible at a glance. A tick-box answer conceals all of that. The uploaded document reveals it.

ACCA has not stated that every uploaded document will receive a line-by-line review. Given the number of firms it supervises, that may not be operationally realistic. However, once documents are in the system, they can be sampled for quality assurance, incorporated into automated or manual risk-scoring, or retained for use in future supervisory interactions. The information is there, whether it is reviewed immediately or not.

The Risk of an Artificially Clean Return

The return also cautions against a particular type of optimistic reporting. A firm that classifies a very high proportion of its clients as low-risk may expect that to signal a well-controlled practice. ACCA's guidance suggests the opposite response is possible: an unusually high low-risk ratio may prompt questions about whether the firm's risk identification methodology is sufficiently rigorous, particularly if the firm's client base or service lines would ordinarily carry elevated exposure.

Proliferation Financing: The Area Most Firms Have Under-Documented

The 2026/27 return specifically asks whether the MLRO has undertaken a documented proliferation financing risk assessment and whether that assessment has been periodically updated. This is the area where the gap between regulatory expectation and documented practice is most acute across the profession.

Low Risk Is Not the Same as No Assessment

Many firms that have considered proliferation financing will conclude that their exposure is low. That conclusion may well be correct. The regulatory expectation is not that every firm must identify a high risk; it is that every firm must show the issue has been considered, assessed, and recorded. A risk assessment that does not address proliferation financing at all no longer meets that standard, and the annual return now provides ACCA with direct visibility of that omission.

For firms with any exposure to digital asset transactions, whether through clients using crypto accounting software, clients holding tokenised assets, or clients operating in sectors that intersect with virtual asset service providers, the proliferation financing question carries additional weight. The UK's AML framework treats virtual assets as a heightened-risk area, and ACCA's supervisory focus reflects that.

Implications for Firms with Crypto and Digital Asset Clients

Accounting practices that service clients with digital asset activity face a specific challenge in this context. A firm-wide risk assessment drafted before crypto assets became a material part of the client base may not address virtual asset exposure at all, or it may address it only in passing. If the upload reveals an assessment that predates the firm's crypto-related work, that absence is informative.

Document Currency and Crypto-Specific Risk Factors

Firm-wide risk assessments should address the specific risk characteristics of the services and client types actually present in the practice. For firms using digital asset accounting software to manage client portfolios, or advising clients on crypto bookkeeping software and record-keeping, the risk assessment should consider: the AML risk profile of clients holding or transacting in virtual assets; the degree to which those clients are themselves regulated or unregulated; the nature of the underlying assets, including whether any derive from decentralised or anonymity-enhanced sources; and the geographic exposure of the firm's crypto-adjacent client base.

None of this requires a firm to treat every crypto client as high-risk. It does require that those clients have been considered within the firm's risk framework and that the assessment is reflected in the documentation now being uploaded to ACCA.

Ongoing Monitoring Records

The return also asks detailed questions about client onboarding, ongoing monitoring, and periodic reviews. For firms servicing clients with active digital asset portfolios, ongoing monitoring is not a static exercise. Transaction volumes, wallet addresses, counterparty profiles, and jurisdictional exposures can change materially over a short period. The expectation embedded in the return is that monitoring arrangements are documented, calibrated to client risk, and actually operating in practice, not merely described in a policy manual.

What OPBAS Pressure Means for ACCA's Supervisory Approach

ACCA does not operate in isolation. The Office for Professional Body Anti-Money Laundering Supervision (OPBAS) oversees professional body supervisors in the UK and applies consistent pressure to demonstrate that supervision is genuinely risk-based and effective, not merely procedural. That pressure has intensified following successive OPBAS reviews identifying inconsistency in supervisory standards across the professional body sector.

Better Data, More Targeted Supervision

One direct response to OPBAS scrutiny is to gather better quality information. If ACCA can see not only what firms declare about their AML arrangements but also the actual documents underpinning those arrangements, it can develop a more granular understanding of where risks are concentrated within its supervised population. This allows a more targeted allocation of inspection resource, directing attention towards firms whose documentation suggests weaker compliance rather than selecting firms on a purely random or declaration-based basis.

The practical effect for firms is that the return is no longer simply a tool for generating a binary high-risk or low-risk classification. It is a source of qualitative evidence that may influence supervisory decisions for multiple cycles to come. Those decisions include, but are not limited to, the selection of firms for monitoring visits, the framing of questions during those visits, and, where weaknesses are persistent or serious, the escalation of formal supervisory action. For context on how AML-linked supervisory failures are playing out in other jurisdictions, AML licensing requirements for crypto firms have triggered exchange blockings and enforcement actions internationally, illustrating the broader direction of travel.

Practical Steps Before the Return Deadline

The documents being requested are documents that the Money Laundering Regulations 2017 already require firms to maintain. The return does not create new legal obligations. What it does is create new visibility of whether those obligations are being met in substance, not just in form.

A Document Review Checklist

Before submitting the return, firms should satisfy themselves on several points:

• The firm-wide risk assessment reflects the current client base, including any digital asset or virtual asset clients, and current service lines. A document drafted several years ago and minimally updated is unlikely to pass a quality review.
• The assessment addresses proliferation financing explicitly, even if the conclusion is that the risk is low. The absence of any discussion is the problem, not a low-risk conclusion.
• AML policies and procedures are tailored to the firm's actual practice, not reproduced verbatim from a generic template. Supervisors are experienced at identifying template language.
• Records exist to demonstrate that ongoing monitoring, client risk categorisation, and periodic AML effectiveness reviews have actually been carried out, not merely that procedures for carrying them out are documented.
• The MLRO has carried out, and can evidence, the activities the return asks about.

Firms that have not reviewed their AML documentation recently should treat the upload requirement as a hard deadline, not a routine administrative step. The accountancy sector's engagement with crypto-adjacent clients is also expanding the relevant risk surface in ways that older documentation may not capture. Globally, supervisors are sharpening their approach to AML oversight, as illustrated by developments such as AMLA simplified due diligence roundtables and what EU firms must do, where even simplified procedures now carry stronger evidential requirements.

Frequently Asked Questions

Does the upload requirement apply to all ACCA-supervised firms?

Based on the source reporting, the document-upload requirement applies to all firms completing the 2026/27 ACCA AML annual return. Firms should review the return itself and any accompanying ACCA guidance for the precise scope, but the change is not limited to firms already identified as higher-risk.

What documents specifically need to be uploaded?

The return requires firms to upload their firm-wide risk assessment and their AML policies and procedures. These are documents that the Money Laundering Regulations 2017 require firms to have in place. The return does not create new documentation requirements; it requires firms to produce documents they should already hold.

What if a firm's risk assessment is several years old?

An outdated risk assessment is unlikely to reflect the firm's current client base, service lines, or geographic exposure. It may also fail to address proliferation financing, which the return now specifically asks about. Firms should update their risk assessments before uploading them rather than submitting documentation that may signal weaknesses to ACCA's supervision team.

Does a very high proportion of low-risk clients improve a firm's supervisory standing?

Not necessarily. ACCA's own guidance warns that an unusually high proportion of low-risk client classifications may prompt questions about the rigour of the firm's risk methodology, depending on its client base and services. A credible risk categorisation process, properly documented, is more valuable than a particular outcome.

How does this affect firms with crypto or digital asset clients?

Firms servicing clients who hold or transact in virtual assets should ensure their firm-wide risk assessment explicitly addresses that exposure. If the assessment predates the firm's involvement with crypto clients, or if it does not consider the specific AML risk characteristics of virtual asset activity, that gap will be visible in the uploaded document. Ongoing monitoring records should also reflect the dynamic nature of digital asset portfolios.

Source: AccountingWEB