The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 — universally referred to as the MLR 2017 — came into force on 26 June 2017, implementing the EU's Fourth Anti-Money Laundering Directive (4AMLD) into UK law. Since that date, the regulations have been amended seven times. Each amendment has changed the substance of what regulated firms must do, but the changes are not always clearly signposted in the amending instruments themselves, and compliance teams do not always have a reliable record of what changed when.
This article provides a structured account of the principal MLR 2017 amendments, their key obligations, and their practical implications for payment firms and e-money institutions supervised by the FCA.
The Original 2017 Regulations
The original MLR 2017 brought four main changes from the previous Money Laundering Regulations 2007. It applied a more risk-sensitive approach to customer due diligence (CDD), introduced explicit requirements for enhanced due diligence (EDD) in relation to high-risk third countries, required registered firms to document and disclose their beneficial ownership information, and expanded the definition of politically exposed persons (PEPs) to include domestic PEPs — not just foreign ones — for the first time.
For payment firms, the most operationally significant provisions of the original 2017 regulations were Regulation 33 (enhanced CDD for high-risk situations), Regulation 35 (PEP obligations), and Regulation 19 (policies, controls and procedures — including transaction monitoring). The obligation in Regulation 19 to maintain "systems and controls" appropriate to the nature, scale and complexity of the firm's activities has become the cornerstone of the FCA's supervisory approach to payment firm AML.
The 2017 Amendment: PSRs Alignment
The Money Laundering and Terrorist Financing (Amendment) Regulations 2017 (SI 2017/692) made minor technical adjustments to align the MLR 2017 with the Payment Services Regulations 2017. These changes were primarily definitional and had limited operational significance for most payment firms beyond ensuring that the two sets of regulations referred to the same legal concepts in the same terms.
The 2019 Amendment: 5AMLD Implementation
The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (SI 2019/1511) are the most substantively significant of the MLR amendments to date. They implemented the Fifth Anti-Money Laundering Directive (5AMLD) and introduced a substantial number of new requirements.
For payment firms, the key changes introduced by the 2019 amendment were:
Expanded scope for cryptoasset exchange providers and custodian wallet providers. These entities became obliged entities under the MLR 2017, bringing them within the AML registration and supervision framework for the first time in the UK. Payment firms with cryptoasset product lines became subject to the full MLR 2017 regime for those products.
Enhanced due diligence for high-risk third country transactions. The 2019 amendment strengthened Regulation 33 by specifying that enhanced CDD must be applied not just to business relationships but to transactions with parties established in high-risk third countries on the FATF or EU list. The amendment made EDD obligatory rather than discretionary in these situations.
Ultimate Beneficial Owner (UBO) register interface. UK companies were required to maintain a register of people with significant control (PSC register) under the Companies Act 2006. The 2019 amendment aligned the MLR 2017's beneficial ownership verification requirements with the PSC register, requiring regulated firms to cross-check customer UBO information against the register for UK corporate customers.
Pre-paid card threshold reduction. The 2019 amendment lowered the CDD exemption threshold for pre-paid instruments from €250 to €150 (or sterling equivalent), reducing the population of pre-paid card transactions exempt from full CDD. This had direct product implications for payment firms operating consumer pre-paid programmes.
The 2020 Amendment: Brexit Transition
The Money Laundering and Terrorist Financing (Amendment) (EU Exit) Regulations 2019 (SI 2019/1511) and the subsequent Financial Services (Consequential Amendments) Regulations 2020 addressed the UK's departure from the EU. Post-Brexit, UK firms are no longer bound by EU AML legislation directly, and the reference points in the MLR 2017 — including references to the EU's list of high-risk third countries — were updated to refer to the UK's own list maintained by HM Treasury.
The practical implication for payment firms: the UK list of high-risk jurisdictions for EDD purposes is now a UK government instrument rather than an EU delegated regulation. UK firms must monitor HM Treasury notifications for updates to the UK high-risk list independently, rather than relying on EU directives to trigger review. The UK and EU lists have diverged since the end of the transition period as each jurisdiction has made independent assessment decisions.
The 2022 Amendment: Register of Overseas Entities
The Economic Crime (Transparency and Enforcement) Act 2022 and accompanying MLR 2017 amendments introduced the Register of Overseas Entities (ROE), requiring foreign entities that own UK land to register their beneficial owners with Companies House. For payment firms conducting CDD on corporate customers, this created a new verification resource for identifying UBO information on overseas corporate customers with UK property interests — and a corresponding obligation to check the ROE where relevant.
More broadly, the 2022 Economic Crime Act strengthened unexplained wealth orders (UWOs) and introduced new powers for sanctioned asset freezing. Payment firms updated their sanctions screening programmes to account for the expanded OFSI designation powers introduced by the Act, including the ability to impose targeted financial sanctions without requiring UN Security Council or EU designation as a precondition.
The 2023 Amendment: AEOI and Reporting Updates
The Money Laundering and Terrorist Financing (High-Risk Countries) (Amendment) Regulations 2023 updated the UK high-risk third country list in line with FATF's February 2023 plenary decisions. This amendment brought jurisdictions including Myanmar and the Russian Federation into a higher scrutiny category, requiring payment firms to review their customer populations for exposure to these jurisdictions and apply enhanced due diligence where relevant.
Areas of Persistent Supervisory Concern
Against the backdrop of these amendments, the FCA's thematic reviews have consistently identified three areas where payment firms fall short of MLR 2017 requirements regardless of the amendment cycle:
Transaction monitoring rule currency. Regulation 19's requirement for systems and controls appropriate to the firm's risk profile is a live obligation that changes as the firm's business evolves and as typologies change. FCA examinations have found firms operating with rule sets last reviewed in 2018 or 2019 that had not been updated to reflect either business model changes or the updated risk guidance in JMLSG Part II, Section 17 (payment services).
PEP screening completeness. Regulation 35 requires EDD for PEPs, including enhanced ongoing monitoring. FCA findings have noted PEP screening gaps caused by name variant handling, transliteration mismatches, and failure to screen all parties to a transaction (not just the account holder). The FCA's guidance on domestic PEPs — a category specific to the UK post-5AMLD implementation — has also been inadequately implemented at some payment firms.
Board-level engagement with AML reporting. The MLR 2017 Regulation 19 and SM&CR together require that the board and senior management receive sufficient management information on AML controls to enable meaningful oversight. FCA reviewers have found that MLRO reports to boards often focus on SAR volumes without providing context on false positive rates, investigation quality, or rule change activity — information the board needs to discharge its SM&CR obligations.
Forward: The AML Single Rulebook and UK Equivalence
The EU's forthcoming AML Single Rulebook — a directly applicable regulation replacing the directive-based approach — will not apply in the UK. However, payment firms with UK and EU entities will need to maintain two compliance frameworks with increasing divergence between them. The UK's own Economic Crime and Corporate Transparency Act 2023 continues to develop the domestic AML architecture independently of EU direction. MLROs at group firms should ensure their governance arrangements clearly delineate which regime applies to which legal entity and transaction flow.
This article is published for informational purposes and reflects the position as understood at the time of writing. Regulatory frameworks change; firms should refer to current HM Treasury, FCA, and JMLSG publications for definitive guidance. RegSynq Ltd is not authorised or regulated by the Financial Conduct Authority. Nothing in this article constitutes legal advice.