UK AML June 2026 Changes: Is Your Onboarding Up to Date?

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 came into force on 30 June 2026, amending the 2017 Regulations with a set of targeted but consequential changes. Updated CCAB guidance for the accountancy sector followed over the summer. Four months on, the gap between what the rules now require and what many firms are actually doing in practice is wider than it should be, and a supervisory visit will expose it quickly.

This piece sets out the specific changes that matter most to accounting firms, auditors and CFOs onboarding clients with digital asset exposure, explains the practical compliance risk each one carries, and offers a route to closing the gap before a supervisor reviews your files.

What Actually Changed on 30 June 2026

Professional bodies, including ICAS, have described the bulk of the amendments as clarifications rather than wholesale reform of the risk-based approach. That framing is accurate, but it is also the reason many firms have moved slowly. A clarification can still require a form to be rewritten, a threshold to be recalculated, or a provider to be re-evaluated. Below are the four areas where the practical impact is sharpest.

Sterling replaces euros for monetary thresholds

Monetary thresholds in the regulations are now expressed in sterling. The occasional transaction threshold has moved from €15,000 to £12,000. Any onboarding form, cash-acceptance policy or internal procedure that still quotes a euro figure is non-compliant as of 30 June. This is one of the simplest fixes on the list, yet because the change reads as administrative rather than substantive, it is frequently missed. A supervisor reviewing a client file will spot a euro figure immediately, and it signals that the broader review of your onboarding documentation has not been done.

Enhanced due diligence triggers redrawn around FATF lists

Mandatory enhanced due diligence for high-risk third countries now applies to jurisdictions on the FATF "call for action" list, which currently covers Iran, North Korea and Myanmar. Grey-list countries remain a geographical risk factor and still belong in your risk assessment, but the mandatory EDD trigger is now specifically tied to the "call for action" designation rather than a broader high-risk category.

The regulations also refer to transactions that are "unusually complex or unusually large" as assessed against the nature of the transaction in question, rather than against a fixed monetary ceiling. Firms need to document, for each relevant file, why EDD was applied or why it was judged unnecessary. That reasoning, recorded at the time, is what a supervisor wants to see. A checklist that simply asks "is the country high-risk? Yes/No" is no longer adequate on its own.

Source of funds enquiries now have a sharper focus

The updated CCAB guidance directs firms towards transactions that appear inconsistent with what the firm already knows about the client: their business model, their stated risk profile, and the pattern of work engaged so far. For clients with digital asset exposure, this has direct relevance. A client onboarded as a passive crypto investor who then presents a series of high-frequency, high-value transactions across multiple wallets deserves documented scrutiny. The question is no longer simply "where did the money come from?" but "does this look consistent with what we know about this client?" The distinction matters for how your source-of-funds template is drafted.

Electronic identity verification and the DVS trust framework

Electronic identity verification remains optional under law; document-based checks are still permitted. What has changed is how HMRC's guidance characterises providers certified under the UK Digital Verification Services trust framework and listed on the government's DVS register. Such providers are now described as a reliable and independent source of information. Providers not on the register cannot be treated as suitable on that basis alone.

For any firm using electronic ID checks, the immediate practical question to put to your provider is straightforward: are you on the DVS register? If the answer is no, your MLRO needs to decide what additional evidence is required to plug the gap, and that decision must be documented. Firms relying on electronic verification that has not been re-evaluated against the DVS register since June are carrying undocumented risk.

Why Manual Processes Make Compliance Fragile

Each of the four changes above is individually manageable. The structural problem is that in a manual or semi-manual onboarding environment, the rules live across Word templates, spreadsheets, email habits and individual memory. Updating them means reissuing documents, retraining everyone who brings in new clients, and hoping that earlier versions are retired. In practice, they rarely disappear entirely.

The version-control problem

A senior manager reuses last year's checklist because it is saved on their desktop. A risk assessment template circulates in a shared drive with no version control. A new client file gets assembled partly from a June 2025 form and partly from a June 2026 one. The file may satisfy the regulations as they stood before the amendments, but it does not satisfy them now. That is the file a supervisor will pull.

For firms with digital asset clients, the version-control problem is compounded by the speed at which the regulatory environment moves. A practice using crypto accounting software or digital asset accounting software to manage client portfolios needs its AML onboarding workflow to keep pace with those same clients' risk profiles. A fragmented, document-based process makes that synchronisation very difficult. Our recent coverage of how AI agents are raising the bar for AML compliance illustrates how quickly the risk landscape is evolving for firms that serve this client segment.

The retraining burden

Every regulatory change in a manual process becomes a firm-wide retraining exercise. Guidance must be written, distributed and absorbed before a single new client file reflects the updated rules. For a multi-office practice, the lag between a regulation taking effect and the last team member being trained on it can be measured in months. That lag is exactly the exposure period a supervisory visit can land in.

Accounting and Tax Implications for Firms with Digital Asset Clients

The June 2026 amendments are not sector-specific, but they carry particular weight for accounting practices serving clients with crypto or digital asset exposure. Several of the changes interact directly with the risk characteristics of this client segment.

EDD and source of funds for crypto clients

Clients involved in crypto trading, staking, yield farming or tokenised asset investment frequently have transaction patterns that can look unusual against a conventional business profile. The updated source-of-funds guidance, which focuses on consistency with what the firm knows about the client, requires firms to build and maintain a richer client picture than a standard onboarding form captures. For a client whose portfolio is managed with crypto bookkeeping software or a digital asset accounting platform, that software's transaction records can be a legitimate part of the evidential picture, but only if the firm has a documented process for using them in risk assessment.

EDD for clients transacting with high-risk third countries also warrants fresh review. The FATF "call for action" list is not static. Iran, North Korea and Myanmar are currently on it, but the list is updated periodically. A firm's AML process needs to reflect the current list, not the list as it stood when the onboarding form was last printed. That is another argument for a process that updates centrally rather than document by document.

Audit trail requirements and crypto accounting software

Supervisors are increasingly focused on whether firms can demonstrate, file by file, which checks were carried out, when, and on what basis. For practices using crypto accounting software to manage client reporting, the natural next step is to ensure that the AML audit trail sits alongside the accounting record, not in a separate paper file that may or may not be retrievable. The firms best placed in a supervisory review are those where the onboarding evidence, the risk assessment rationale and the ongoing monitoring record are all accessible in a consistent, timestamped format.

This connects directly to the broader regulatory direction of travel. The FCA and other UK regulators have been clear that they expect firms to be able to demonstrate their compliance processes, not just assert them. Our coverage of FSB, HKMA and FCA tightening AI accountability rules for financial firms shows how that expectation is extending to technology-assisted compliance, including the tools used in onboarding and monitoring workflows.

What Firms Should Do Now

The window before the next round of supervisory visits is the time to act. The following steps address the most common gaps identified by the June 2026 amendments.

Immediate actions for MLROs and compliance leads

First, pull every active onboarding form, risk assessment template and cash policy document and check each one for euro-denominated thresholds. Replace them with the correct sterling figures. This is a one-day exercise that eliminates one of the most visible compliance signals.

Second, review your EDD trigger logic against the current FATF "call for action" list. Confirm that your documentation distinguishes between mandatory EDD jurisdictions and grey-list geographical risk factors, and that your files record the reasoning for EDD decisions rather than simply a yes/no answer.

Third, contact your electronic identity verification provider and ask directly whether they are listed on the DVS register. If they are not, document the MLRO's decision on what additional evidence compensates for that gap. Do not leave that decision undocumented.

Fourth, update your source-of-funds template to reflect the consistency-based focus in the updated CCAB guidance. The question to prompt on the form is not just "what is the source of funds?" but "is this transaction pattern consistent with what we know about this client?"

Finally, consider whether your onboarding infrastructure, whether manual, semi-automated, or fully integrated, can absorb the next regulatory change without another firm-wide retraining cycle. The June 2026 amendments will not be the last, and the gap between a regulation taking effect and a practice's forms reflecting it is the period of greatest supervisory risk.

Frequently Asked Questions

What is the new occasional transaction threshold under the June 2026 UK AML amendments?

The threshold has moved from €15,000 to £12,000, expressed in sterling rather than euros. Any onboarding form or policy still quoting the euro figure needs to be updated immediately.

Which countries trigger mandatory enhanced due diligence under the amended regulations?

Mandatory EDD now applies to jurisdictions on the FATF "call for action" list. As of the amendment date, that list covers Iran, North Korea and Myanmar. Grey-list countries remain a geographical risk factor within your risk assessment but do not trigger mandatory EDD in the same way. The FATF list is updated periodically, so your process needs to reference the current list rather than a fixed enumeration in your template.

Do we need to switch to electronic identity verification under the new rules?

No. Electronic verification remains optional. Document-based checks are still permitted. What has changed is how HMRC's guidance treats providers: those certified under the UK Digital Verification Services trust framework and listed on the DVS register are described as a reliable and independent source. Providers not on the register cannot be assumed to meet that standard on their own. If your provider is not on the register, your MLRO should document what additional evidence fills the gap.

How do these AML changes affect firms using crypto accounting software to serve digital asset clients?

The amendments apply to all regulated firms, not specifically to those with crypto clients. However, clients with digital asset exposure often have transaction patterns that warrant closer scrutiny under the updated source-of-funds guidance, which focuses on consistency with the firm's existing knowledge of the client. Practices using crypto bookkeeping software or digital asset accounting software should ensure their AML onboarding process captures enough client context to make that consistency assessment, and that the resulting documentation is accessible in a supervisory review.

What does the updated source-of-funds guidance actually require firms to document?

The updated CCAB guidance shifts the focus from a standalone "source of funds" question to an assessment of whether the transaction or pattern of activity is consistent with what the firm knows about the client, their business and their risk profile. Firms should record that reasoning at the time of the assessment, not retrospectively. A template that only asks for the stated source of funds, without prompting a consistency check, is likely to be insufficient under the current guidance.

Source: AccountingWEB