← All insights Finance and crypto

Money laundering duties reach businesses that never considered themselves regulated

A payment has been offered in a form that does not match the transaction, or a bank has asked a question that sounded like an accusation. The instinct is that none of this concerns a business like yours, because you are not a bank. The rules that create the real exposure here do not ask whether you are one.

Two different things travel under one name in the United Kingdom. The first is the supervised regime: a defined list of activities places a business inside the regulated sector, and brings with it registration with a supervisor, a documented assessment of the business's own exposure, checks on customers proportionate to that exposure, and records capable of being produced when somebody asks for them. The second is the general criminal law on the proceeds of crime, which is attached to no sector at all. It reaches any person who deals with property while suspecting that the property represents the benefit of somebody's criminal conduct.

Businesses check the first and assume the second follows from it. It does not. Sitting outside the supervised regime relieves a company of a compliance burden. It does not place that company outside the offences, and it is the offences that convert an ordinary trading business into a defendant. A supervised firm at least has machinery: a named person, a procedure, and somebody whose job includes noticing. The unsupervised business carries the same criminal exposure with none of the apparatus.

What follows is where the line actually falls, and why it falls where honest people do not expect it.

Being caught is decided by activity, not by self description

The regulated sector is defined by function rather than by trade name. It takes in estate agency and letting agency work, accountancy, audit and tax advice, certain legal services, dealing in goods where substantial cash payments are accepted, participation in the art market, and the exchange or custody of crypto assets on behalf of other people. It also takes in trust and company service provision, which is a formal way of describing something small firms do casually: forming companies for clients, acting as or supplying a director or secretary, or offering a registered office or correspondence address.

None of those descriptions requires a business to regard itself as a financial one. A consultancy that incorporates vehicles for clients as a courtesy, an agency that allows clients to use its address on the register, a dealer who takes a large cash payment because a valued customer asked: each has performed a regulated activity, and in most cases nobody made a decision to start doing so.

This is a common route by which an honest business acquires a criminal problem. Carrying on a regulated activity without the registration it requires is itself an offence in the United Kingdom, complete whether or not a single tainted pound came near the company, and it requires no dishonesty on anybody’s part.

Exposure without regulation

The general offences are drawn very widely. Broadly, it is unlawful to conceal or transfer property that is the proceeds of crime, to become concerned in an arrangement by which such property is retained or controlled for another person, or to acquire, use or possess it, where the person doing so knows or suspects what the property is. Nothing there depends on the sector the business trades in, on the business profiting, on the sum being large, or on the property being money at all. It need not be your property, and the underlying wrongdoing need not be yours or your customer's.

That is why the point at which a business becomes exposed is almost never the point it expects. It is not the moment the crime happens. It is the moment somebody inside the business forms a doubt and then carries on: banking the payment, releasing the goods, paying the supplier, refunding the deposit. Each of those is a dealing, and the doubt is what changes its character.

There is a route by which a person who has formed a suspicion can seek to protect their position before going any further, and it is open to businesses inside and outside the regulated sector alike. Whether to use it, at what point, and in what terms, is a judgement carrying a cost on both sides. Used as a reflex it damages customer relationships and proves nothing about the controls the business actually has. Left unused where it was needed, it becomes the gap that everything afterwards is measured against.

Suspicion sits lower than people assume

Most business owners hear the word suspicion and picture something close to certainty. The courts of England and Wales have treated the threshold as considerably more modest: a possibility that is more than merely fanciful, rather than a settled belief or anything approaching proof. It does not require evidence, an investigation, or a reason that could be written down and defended.

Two consequences follow, and both are uncomfortable. A suspicion once formed does not dissolve because it was inconvenient and nobody wrote it down. And a decision not to look, taken because the answer might be awkward, is not the protection it feels like; what was in front of the business tends to be reconstructed afterwards from its own emails, and reconstructed by people who already know how the story ended.

The opposite error is equally real. Unusual is not the same as criminal. Plenty of legitimate customers pay from an account in a different name, buy through an intermediary, or hold funds abroad for reasons that are dull once explained, and a business that treats every oddity as a suspicion becomes unusable to its own market.

The duty falls hardest on the least equipped

In a large institution the person who notices an anomaly is not the person whose income depends on the customer. In a smaller company they are usually the same person, and often the owner. The payment is seen first by whoever does the bookkeeping, who has no standing to challenge a sale. The customer you would least like to question is almost always the one who matters most commercially, which is exactly why the question does not get asked.

Asking clumsily carries its own hazard. A business that has begun to suspect and then goes to the customer for an explanation may have made its position materially worse, because there are restrictions on what may be said once a matter has been taken further, and prejudicing an investigation is not a concern confined to supervised firms.

Honest, and still with a serious problem

The penalties are the least of it for most companies. Banks and payment providers form their own view of risk, are under no obligation to explain that view, and a facility withdrawn on those grounds is not something a business argues its way back into. Card acquiring goes with it. Replacing either while carrying that history is considerably harder than opening the arrangement was in the first place.

Funds can also stop moving while a matter is examined, which lands not on profit but on payroll and suppliers. Commercial contracts governed by the law of England and Wales frequently entitle the other party to terminate on a financial crime concern alone, with no finding by anybody. The same gap resurfaces during a sale or a fundraising, when the customer files are asked for and cannot be produced. What follows is more often a warranty the seller gives personally, or a sum held back against a risk nobody can size, than a collapsed deal.

Exposure also attaches to people and not only to the company. The individual who handled the transaction, and the director who set the tone, can find themselves the subject of the enquiry rather than a witness to it. None of this requires the business to have been dishonest. Honesty is no answer to failing to register, and none to having dealt with property while harbouring a doubt.

When to spend nothing

Many businesses need no programme at all, and telling them otherwise is how compliance becomes an industry rather than a safeguard. If you sell ordinary goods or services, your customers pay from accounts in their own names, and you perform none of the listed activities, the proportionate answer is to understand precisely where your line sits and to stop drifting across it as a favour to people.

Several energetic responses make matters worse. Reviewing the whole customer history and telephoning people about old transactions creates alarm, damages relationships and generates a written record of enquiries nobody was equipped to answer. Running identity checks indiscriminately across every customer costs money, raises data protection duties the business has not considered, and dilutes the record so that the file which mattered looks like all the others. Above all, delete nothing. The uncomfortable email thread is the evidence of what the business knew and when.

What remains is a single judgement, and it is worth being honest about its nature. Somebody has to decide whether what is in front of them is a commercial oddity or a suspicion, and then decide what may lawfully be done next. That decision is made once, on incomplete information, usually under pressure to complete a sale, and its consequences are criminal rather than commercial.

This guide is general information about how these matters usually run. It is not advice, and nothing becomes advice until terms are agreed in writing. Brandleys Legal Ltd delivers reserved legal activities alongside regulated partners.