Regulation 19/19A MLR17 – Policies and Procedures

IPA Insolvency Practitioner newsletter AML Digest, August 2026

As advised previously, there have been several recent findings in AML Inspections and AML Compliance Reviews on issues with the policies and procedures required of relevant persons under Regs 19/19A of the MLR17. The following outlines what is required and provides some guidance tips that may assist in ensuring you effectively comply with the Regulations.

What does Reg 19/19A say?

A ‘relevant person’ (i.e. an Insolvency Practitioner) must:

(a) establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing identified in any risk assessment undertaken by the relevant person under regulation 18(1);

(b) regularly review and update the policies, controls and procedures established under sub-paragraph (a);

(c) maintain a record in writing of:

(i) the policies, controls and procedures established under sub-paragraph (a);

(ii) any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (b); and

(iii) the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person’s business

Para 19A has similar wording but requires consideration of proliferation financing risks. The IPA has previously advised that whilst the risk of proliferation financing is low for insolvency work, IPs should still consider the types of industry where the risks may be heightened.

For policies and procedures, it would be prudent to add in a reminder that the risks of proliferation financing must always be considered, and refer staff to the details in the firm risk assessment under Regs 18/18A.

What policies and procedures are required?

Para 3 of Reg 19 (and 19A) advise of five policies which are required:

(a) risk management practices;

(b) internal controls (see regulations 21 to 24) – this includes a training policy as per Reg 24;

(c) customer due diligence (see regulations 27 to 38);

(d) reliance and record keeping (see regulations 39 to 40);

(e) the monitoring and management of compliance with, and the internal communication of, such policies, controls and procedures

Members must also look at Para 4 Reg 19 (and 19A) as this also provides further detail on policy and procedure requirements which deal with:

• Further details on Enhanced Due Diligence (EDD) considerations where a policy is required (para 4a)
• Consideration of new products, business practices and technology are adopted to consider if the adoption of these products, business practices and technology increase any money laundering risk and how these risks may be mitigated (para 4c)
• Reporting of suspicions under the Proceeds of Crime Act 2002 – a SARs policy (para 4d). For more details on SARs compliance, please review our article on SARs from the April 2025 AML newsletter.

Seven Tips for effective Reg19/19A compliance

1. Have policies! Having robust and relevant policies and procedures from ‘day 1’ means that any updates or amendments should be lesser and easier to implement and introduce across your teams.
2. Your policies should capture what happens in your firm; do not only take a downloaded template and add your firm name. As with your Reg18/18A firm wide risk assessment – whilst parts will apply across firms – AML policies and procedures must be firm-specific.
3. Double check the guidance – remember the CCAB Guidance and Insolvency Appendix which will assist in the drafting of compliant policies.
4. Keep policies and procedures under review. The IPA suggests having a review date on the policy/procedure and diarising the review date. A good policy or procedure should only require minor changes (if any).
5. Remember to circulate policies and procedures – especially after any updates. The IPA would recommend that any new or amended policies and procedures are introduced during any team meetings you have to allow matters to be discussed, and changes ran through with relevant staff to try to ensure that there is a good understanding of what is required by your teams to ensure ongoing effective compliance.
6. Check staff understanding of what is required under policies and procedures – remember that AML training can also include what you require staff to do to ensure that AML work and risk considerations are compliant with the MLR17. This could highlight a knowledge gap where you can have a team training session to go over any issues.
7. Consider having an independent review of your policies – see para 21(c) MLR17 – which may assist highlighting any issues or minor amendments required to ensure policies and procedures remain effective.