AML is coming to payroll. Get ready now.
From November 2026, payroll firms that deal with HMRC for clients need AML supervision. Firmcheck makes getting compliant radically simple, and you can start for free.
Your new AML requirements
Firm-wide risk assessment
A documented view of your risks, templated and ready to sign off.
Customer due diligence
Verify who your clients are with ID checks and risk assessments built in.
Ongoing monitoring
Automatic checks on your existing clients to ensure ongoing compliance.
AML training
Assign your reporting officer and keep staff training on record.
AML policies
An auditable trail of actions from your policies, controls, and procedures.
FCA-ready
Controls and records built to meet FCA-grade expectations, so you're prepared as AML standards tighten.
It's not really about the fine. It's about HMRC access.
Payroll providers acting for clients are being brought into AML supervision for the first time. Miss the deadline and the risk isn't just a penalty; it's losing the ability to run payroll at all. For most payroll bureaus, HMRC access is the business, and this is a one-time thing to get right.
Does this apply to you?
It's the activity that counts, not what you call your service. If your firm submits PAYE/RTI to HMRC, handles CIS payroll or files FPS/EPS, responds to HMRC queries or fixes tax codes, or acts as a paid agent for clients' payroll tax, then AML supervision almost certainly applies to you. If you only supply payroll software with no analysis of financial info, or run payroll for your own staff, you may fall outside scope. When in doubt, assess your actual activities and check with HMRC.
.png)
Try the software before you commit a penny.
Set up your firm, run real client checks, and see how simple compliance can feel. Create your firm profile and risk assessment, run your first client due-diligence checks, and try biometric ID and sanctions screening, with no card, no sales call, or time limit to explore. Upgrade only when you're ready to roll it out across your whole client base.
The questions payroll firms actually ask
Straight answers to the questions payroll firms actually ask about the new AML rules.
There is a growing shift toward stronger, more centralised oversight, with the FCA expected to play a more direct role. This means more consistent standards, increased scrutiny, and a move toward data-driven supervision across accounting firms.
Firms can expect more frequent and detailed audits, higher expectations on documentation, and greater emphasis on being able to evidence every AML decision. Manual processes and inconsistent workflows will become harder to justify.
The FCA typically expects systems that are consistent, auditable, and capable of demonstrating real-time oversight. This includes clear audit trails, centralised data, and the ability to quickly evidence compliance decisions.
Firms that delay may face rushed system changes, increased audit pressure, and higher exposure to enforcement if gaps are identified. Reactive fixes are often more costly and disruptive than proactive preparation.
Firmcheck provides a centralised platform for managing AML workflows, standardising processes, and maintaining a complete audit trail. It enables firms to meet rising FCA expectations with less manual effort and greater confidence.
Not necessarily overnight. However, the direction of travel suggests reduced fragmentation and greater FCA involvement in setting and enforcing standards. Firms should prepare for a model that looks and feels more like FCA-style supervision.
Yes. Audits are likely to become more regular, more detailed, and more focused on outcomes and evidence rather than just process. Firms will need to be audit-ready at all times, not just ahead of scheduled reviews.
While not explicitly banned, they create risk. Under increased scrutiny, disconnected systems, email trails, and manual tracking make it difficult to demonstrate control and consistency, which can lead to issues during audits.
Firms should be digitising AML workflows, centralising their data, and ensuring all compliance activity is recorded and auditable. The focus should be on building a consistent, system-driven approach rather than relying on individuals or manual processes.
No. While larger firms may feel the impact first, expectations are likely to apply across the market. Smaller and mid-sized firms that act early can gain a significant advantage by building scalable, compliant systems now.
"The Firmcheck team’s deep expertise in AML compliance and their ongoing support have been invaluable, making them a trusted partner for our firm."
Try Firmcheck
for free
Start your compliance journey for free. Try Firmcheck's beautifully designed platform and see why firms trust us with their AML compliance.