UK compliance briefing 17th August

There are two consequential developments this week, plus one important regulatory update that was published just before the previous briefing.

1. Companies House publishes its ACSP “fit and proper” criteria

Published 11 August 2026

Companies House has explained in detail how it will decide whether an applicant or existing Authorised Corporate Service Provider is fit and proper.

The assessment is continuing rather than confined to registration. Companies House may consider:

• continued AML supervision and competence;

• insolvency, bankruptcy or director disqualification;

• criminal convictions and regulatory findings;

• repeated Companies House filing failures;

• false or misleading filings or statements;

• failure to answer Companies House enquiries;

• the quality of identity verification, reverification and filing activity; and

• the compliance history of companies associated with the ACSP.

Companies House can cross-check information with public registers, regulators, law enforcement and other government bodies. An existing ACSP can be suspended or removed if it no longer satisfies the test—even where its AML supervisor has not removed its supervision.

Companies House: Fit and proper criteria for ACSPs

Why it matters

ACSP status is no longer something firms can regard as secured permanently once the initial application succeeds. Poor filing practices, deficient identity checks or simply failing to respond to Companies House could jeopardise a firm’s ability to perform ACSP work.

This matters directly to accountants, solicitors and registered office or formation-service customers. It also strengthens the value of an identity-checking service that maintains a clear, retrievable audit trail.

2. New accountancy-sector AML guidance changes how several rules should be applied

Published 10 August; reflects regulations effective from 30 June 2026

The Consultative Committee of Accountancy Bodies has issued its updated 2026 AML guidance:

• Enhanced due diligence is required for transactions that are unusually complex or unusually large in context—not merely every transaction that could be described as complex or large.

• The statutory high-risk-country trigger is now focused on FATF (Financial Action Task Force) “call for action” countries, although firms should still assess wider geographic risk.

• MLR thresholds have been converted from euros into sterling.

• Selling off-the-shelf companies is expressly within the regulated activities of a trust or company service provider.

• Source-of-funds checks are required where activity appears inconsistent with what the firm knows about the customer, their business or risk profile.

• New guidance establishes a hierarchy of reliable evidence for verifying beneficial owners, with passports described as the preferred documentary evidence.

ICAEW summary of the 2026 CCAB AML guidance

This is directly relevant to accountants using Mobunti for customer or beneficial-owner checks. It reinforces a risk-based approach: an identity result is part of customer due diligence, but it does not replace consideration of ownership, source of funds, geography or unusual activity.

The off-the-shelf-company provision is especially relevant to company formation businesses and registered office providers that also sell existing companies.

3. SRA highlights deepfakes and remote on-boarding as emerging identity risks

Updated regulatory risk assessment, published 6 August

The Solicitors Regulation Authority has substantially revised its sectoral AML risk assessment. Solicitors must take the assessment and its updates into account when maintaining their firm-wide risk assessments.

The SRA specifically identifies:

• AI-generated impersonation and deepfakes;

• synthetic identities;

• risks created by remote and video-based on-boarding;

• inappropriate reliance on due diligence performed by another office or jurisdiction;

• nominee or “ghost” directors;

• outdated Companies House documents being used after a company has been struck off;

• opaque company and trust structures; and

• over-reliance on automated sanctions screening.

The SRA says the assurance provided by a digital identity service is relevant when assessing remote-verification risk. It also advises firms acting for companies to check that they are properly and currently registered rather than relying solely on Companies House documentation supplied by the client.

Routine updates

HMRC refreshed its public AML Supervised Business Register on 12 August. This is not a regulatory change, but it is useful when checking the AML-supervision claims of HMRC-supervised accountants, estate agents and trust or company service providers. HMRC warns that new registrations can take time to appear.

The UK Sanctions List was updated on 14 August with four variations under the ISIL/Da’esh and Al‑Qaeda regime.