The government thinks payroll is riskier than accountancy. Here's why.

David Winch, of MLRO Support, dropped this into our September webinar almost in passing, and noted it might come as a surprise to payroll bureaus. David said that HMRC and the government regard payroll as higher risk for money laundering than ordinary accountancy work.

Most people's instinct is the other way round. Payroll is arithmetic. Tax codes, gross, net, national insurance, submit. What's risky about that?

The answer has nothing to do with what payroll is. It's about what you don't know.

The risk is the information gap

David's reasoning runs like this. Banks know a great deal about their account holders. Accountants know a great deal about their clients, because they prepare annual accounts, file tax returns, and handle VAT. Information accumulates.

A payroll bureau might run payroll for a company and not know what that company does. Manufacturing or services. Growing or failing. The bureau sees the pay run and very little else.

Less information means fewer opportunities to notice that something is wrong. That's the whole argument, and it's a fair one.

It sharpens where a bureau works through an accountant, because now there are two firms and the one closest to the numbers is the one furthest from the client.

Worth noting this cuts both ways for accountants too. ICAEW classes payroll as a high-risk service. In Kevin Lord's experience (Firmcheck CRO), accountants who offer payroll often don't know that, and their firm-wide risk assessment doesn't mention it.

What you're supposed to be looking for

The session listed five red flags specific to payroll:

1. Total payroll disproportionate to the business activity. A company with three vans and forty employees on the books invites a question.
2. Significant deductions from pay for rent or similar. This is a modern slavery indicator.
3. Pay for unconnected employees credited to the same bank account.
4. Gross pay varying significantly month to month.
5. Abnormal deductions generally.

David has worked criminal cases in the Crown Court involving PAYE frauds and modern slavery, where people were paid below minimum wage or had heavy deductions taken for accommodation. The concern that payroll can be used to move criminal proceeds around as apparently legitimate wages isn't theoretical. Neither are ghost employees, who exist on the payroll and nowhere else.

And now the honest part

Kevin called these screaming hot red flags that payroll professionals must see daily. David pushed back on his own list, and this is the most useful thing he said.

Take gross pay varying significantly. There might be excellent reasons. Someone's entitled to a quarterly bonus, so this month their pay is three times normal. That's fine.

The difficulty, in his words, is that you're expected to notice when something doesn't look right, and it isn't as simple as saying if A plus B doesn't equal C then something's wrong. Sometimes it only looks wrong afterwards, when the police have asked for the payroll records for a particular employer and you go back through them and think: that does look bizarre.

But you should have noticed at the time.

That's an uncomfortable standard, and pretending otherwise doesn't help anyone. A checklist won't discharge it. What the checklist does is tell you where to look.

Ghost employees, without IDing everyone

An attendee asked how you'd ever spot a ghost employee without going to the extreme of identifying every individual on the payroll.

David's answer was reassuring and practical. You're not expected to ID employees. But when a new employee joins, you'll be asking for a PAYE code, a National Insurance number, a name and address. If someone arrives with no National Insurance number, stays two months and disappears, that's odd enough to ask about.

And the first step isn't a report. If you work through an accountant, it's a phone call: can you explain what's going on here, because it looks a bit strange. There may well be a perfectly sensible explanation.

What this means for your risk assessment

If you're a bureau, the practical consequence is that "we just do the sums" is not a defensible position. David was direct about it: the government isn't going to see it that way. You're expected to be aware of these risks and to have documented how you address them.

If you're an accountant offering payroll as a service, the consequence is narrower but sharper. Check whether your firm-wide risk assessment mentions payroll at all. If it doesn't, and your supervisor treats payroll as high risk, that's a gap sitting in the document they'll ask for first.

What to do this week

Take one client you run payroll for and write down what you actually know about their business. Not what you know about their payroll. What they do, how they make money, whether it makes sense that they employ the number of people they employ.

If that paragraph is hard to write, you've found the information gap the government is worried about. That doesn't make the client a problem. It tells you where your attention should go.

This came from our September webinar on AML for payroll, with Kevin Lord and David Winch of MLRO Support. We run a monthly AML Ask Me Anything where the questions come from firms like yours. Email support@firmcheck.com to make sure you're invited to the next one, or submit a question in advance.