In scope: What centralised AML supervision under the FCA means for professional services

The government’s decision to let the FCA take responsibility for AML/CFT oversight for a large part of the regulated sector has profound and long-term implications for professional services, write Neill Blundell and Phil Taylor.

UK professional services firms face a complex system of regulation, including strict risk-based requirements for anti money laundering (AML) and counter financing of terrorism (CFT) compliance as set out in the Money Laundering Regulations 2017 (as amended) (MLRs). The rules are enforced by more than 20 professional body supervisors (PBSs), with the Financial Conduct Authority’s (FCA) Office for Professional Body Anti-Money Laundering Supervision (OPBAS) responsible for ensuring the PBSs meet the standards set out in the MLRs. OPBAS does not directly supervise regulated persons.

Soon, however, the FCA will gain a dramatically expanded remit to supervise the legal and accounting sectors, as well as trust and company service providers, for AML/CFT purposes. This change will remove a layer of supervision, in theory leading to improved efficiency and effectiveness. But this comes with some significant implications for in-scope firms.

Background

During the government’s 2023 consultation on reform of the AML/CFT regime, there was general agreement among respondents that the effectiveness of AML/CFT supervision needed to be improved. However, consensus on the best way of doing this was harder to find.

One option presented in the consultation was consolidation of PBSs; another option would have seen OPBAS given enhanced powers while the structure of PBSs stayed the same. In 2025, the government rejected the more radical option of having all AML/CFT supervision in the UK carried out by a single public body and chose to give the FCA the authority to supervise all relevant firms for AML/CFT, while PBSs continue to supervise firms for other purposes.

What will the impact be?

While the details of the powers and accountability mechanisms the FCA will need are not yet finalised, what is clear is that for many firms, oversight will naturally become more centralised.

In the past, the FCA has commented on the quality of AML supervision of the professional services sector, and its overall tone has been consistently critical. For example, in OPBAS’s 2019 report, the supervisor noted that the vast majority of PBSs had weaknesses in their AML supervision frameworks. For example, 80% of PBSs ‘lacked appropriate governance arrangements’ and 91% ‘were not fully applying a risk-based approach to supervising members with the highest inherent profile of being exposed to money laundering’.

In OPBAS’s 2024/25 supervisory report, it noted that standards at PBSs ‘have improved, providing a strong foundation on which to build a new regulatory model’, with most PBSs rated as largely effective in applying a risk-based approach. However, the pace of improvement was slow, uneven and inconsistent.

Arguably a model relying on a network of PBSs which are both regulators and membership organisations inherently leads to softer enforcement and there may be limits to how far improvements could progress. For example, some PBSs may be reluctant to sanction member firms, and there could be conflicts of governance and resourcing strains which lead to uneven application of rules.

The move to a single supervisor should effectively deal with persistent inconsistencies. Indeed, ‘strong, consistent and systemwide supervision’ is a frequently repeated goal of the imminent changes.

The planned reforms will also address some other issues which OPBAS has previously highlighted: potential conflicts of interest within professional bodies that have both representative and supervisory functions, and poor information sharing between PBSs themselves which has led to fragmented oversight of firms supervised by more than one body.

The move to a single supervisor should effectively deal with persistent inconsistencies.

Concerns and challenges

There has been considerable pushback against the government’s chosen option for reform. In relation to the legal sector, for example, The Law Society has raised a number of concerns about moving to a single supervisor for such a large part of the supervised population. The Law Society has argued that creating a single professional services supervisor will bring ‘many challenges’, stressing that the FCA’s supervision will need to reflect solicitors’ ethical duties, professional training, and legal professional privilege. It is also concerned about duplication of regulation, stating that the case for expansion of the FCA’s powers is ‘unproven’ due to ‘minimal evidence of money laundering in the [legal] profession’.

Similar points (wariness of one-size-fits-all standards, loss of sectoral nuance, and risk of regulatory duplication) are relevant in other professional service domains.

What will supervision look like?

Clues to the approach the newly empowered FCA is likely to take can be gleaned by looking at how it currently operates. In its supervision of the financial services sector, the FCA is known for its data-driven and outcomes-focused approach. For example, the FCA relies heavily on both quantitative and qualitative data to assess risk and plans to focus even further on this approach with one of its broad goals being to become ‘a smarter, more data-driven regulator’.

Professional services firms will therefore need to demonstrate meaningful financial crime metrics, quality assurance over file reviews and escalation, and a clear link between risk assessments, controls and client selection. Firms may be required to provide data points such as the proportion of high-risk clients exited in a given period, thematic quality assurance findings, or a trend analysis of Suspicious Activity Reports they have submitted.

The way in which the FCA’s Handbook has been frequently and significantly updated over the years illustrates the agency’s approach to identifying issues and ensuring changes are clearly recorded in a centralised and accessible document. This is potentially a more prescriptive approach than certain types of firms will be used to.

The FCA will be taking on a difficult job. OPBAS has previously highlighted how PBSs often have insufficient resources dedicated to AML supervision (for example, too few qualified supervisory staff, mis- or non-prioritisation of AML supervision, and limited investment in relevant technology and data analytics). With the FCA about to see a very significant increase to its supervised population, it will require a correspondingly significant increase in its resources if it is to improve the supervision picture.

The use of AI in AML risk assessment

AI-driven tools have been dramatically reshaping how firms conduct key areas of compliance, including customer due diligence and ongoing monitoring. However, the FCA has raised clear concerns around the use of AI in AML risk assessments, and how this in fact carries its own risks. These include opaque decision making, over reliance on vendor assurances, weaknesses in model explainability and governance, and issues with data quality and bias. The latter is likely to be a particular risk area in professional services. AI models built on incomplete, historical or poorly curated data may systematically under or over estimate risk for certain client types or geographies, undermining the risk-based approach mandated by the MLRs.

As firms inevitably move to the use of AI tools, they will need to be prepared to demonstrate robust governance to persuade the FCA that their systems and controls are effective. Firms should be able to explain, in plain language, how their tool generates risk scores or alerts; how responsibility for AI tools has been allocated; how AI output is monitored, validated and, where necessary, escalated; and to what extent AI driven tools support, rather than replace, professional scepticism and robust challenge by humans.

AI-driven tools have been dramatically reshaping how firms conduct key areas of compliance, including customer due diligence and ongoing monitoring.

What will enforcement look like?

Again, it is instructive to look back and examine OPBAS’s previous comments on how PBSs have made use of their enforcement powers. In summary, OPBAS has regarded that usage as inadequate. For example, it has noted low rates of formal enforcement actions against supervised entities found to have AML deficiencies; where sanctions were imposed, OPBAS has regarded these as disproportionately low relative to the seriousness of the breach; and OPBAS has noted a culture among PBSs of preferring remediation and guidance over robust regulatory action, which it regards as an insufficient deterrent.

The FCA, in contrast, is generally known as an active enforcer, so it is likely that, in time, supervised firms will see a higher likelihood of enforcement action. However, it is not currently clear exactly what new powers will be given as the results of the most recent consultation have not yet been published.

Investigations under the new model may become more formal, document-heavy and prolonged, with the FCA combining desk-based analysis of data that firms have provided with deep-dive reviews. The FCA’s historical use of thematic reviews and Section 166 investigations in the financial services sector may be useful templates for newly supervised firms to consider.

There is also a likelihood that the FCA will be issuing higher civil penalties for systems and controls failures, and using public communications (of penalties and other outcomes) as a way of deterring the wider market.

Perhaps the most significant change will come as a result of the FCA taking over part of the supervisory roles of the Solicitors Regulation Authority (SRA) and the Bar Standards Board (the largest PBSs in the legal sector). The FCA will, of course, only be responsible for AML supervision; supervision of conduct will remain with the current bodies. This raises the spectre of dual risk. For example, a law firm may in future need to deal with FCA attention in relation to suspected AML breaches along with action from the SRA for potential Code of Conduct issues.

A new landscape

The impending shift to AML/CFT supervision under the FCA will mark a decisive break with the PBS model. For supervised firms this will mean more data-heavy scrutiny, higher expectations around governance and technology, and an increased likelihood of enforcement. The new landscape will be more unified but could paradoxically lead to new complexity, particularly where conduct and AML oversight sit with different regulators.

Those professional services firms that strengthen management information, revisit their risk assessments and test the governance of AI and other tools will find themselves in a better place when the new regime takes effect.

The impending shift to AML/CFT supervision under the FCA will mark a decisive break with the PBS model.