Money Laundering Regulations 2017 for estate agents: what you must have in place
If you run an estate or letting agency business in the UK, the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 — usually shortened to MLR 2017 — are not optional. Property is one of the highest-risk sectors for money laundering, HMRC actively supervises the sector, and it regularly publishes the names of agencies it has fined.
This guide explains, in plain English, who is covered, what HMRC expects to see when it inspects an agency, and the documents and controls the regulations require.
1. Which businesses are covered
Estate agency businesses are in scope whenever they act in relation to the buying or selling of property — including online and hybrid agents, commercial agents, and businesses handling overseas property. It applies regardless of size: a one-person high-street agency has the same core obligations as a national chain.
Letting agency businesses were brought into scope in 2020 for lets where the total monthly rent is €10,000 or more (or equivalent). Even below that threshold, letting agents still have separate obligations to report sanctions matters — so "we only do lettings" is not a free pass.
2. HMRC registration — before you trade
Estate agency businesses must register with HMRC for AML supervision before trading. This is not a one-off box-tick: registration must be kept up to date, renewed annually with the supervision fee, and updated when premises or responsible people change. Officers of the business (directors, partners, beneficial owners and senior managers) must also pass an HMRC fit-and-proper / approval check.
3. The seven things MLR 2017 requires
3.1 A firm-wide risk assessment (regulation 18)
A written assessment of the money-laundering and terrorist-financing risks your business faces, considering your customers, the countries you deal with, your services, your transactions and how you deliver them. It must be kept up to date and shown to HMRC on request. "It's all in my head" does not satisfy the regulation — inspectors ask for the document.
3.2 Written policies, controls and procedures (regulation 19)
Your day-to-day AML rulebook, proportionate to your size and nature: how you identify customers, when you escalate, how you handle high-risk situations, and how the policies are approved by senior management, communicated to staff and kept current.
3.3 Customer due diligence (regulations 27–31)
Identify and verify your customers before establishing a business relationship, understand who the beneficial owners are when you act for companies or trusts, and keep the evidence. For estate agents this applies to both sides of the deal — see the next section.
3.4 Enhanced due diligence and PEP checks (regulations 33 and 35)
Extra scrutiny where risk is higher: transactions linked to high-risk third countries, unusually complex or large transactions, and customers who are politically exposed persons (PEPs) or their family members and close associates. You also need to screen against the UK financial sanctions list — dealing with a designated person is an offence in its own right.
3.5 A nominated officer / MLRO (regulation 21)
Someone senior must be appointed to receive internal suspicion reports and decide whether to file a Suspicious Activity Report (SAR) with the National Crime Agency. In a small agency this is often the owner — but the appointment, and the reporting route staff should use, must be documented.
3.6 Staff training (regulation 24)
Anyone whose work touches transactions must be trained to recognise red flags and know what to do about them — and you must keep a record of who was trained, when and on what. At inspection, HMRC asks for the training log, not just good intentions.
3.7 Record keeping (regulation 40)
CDD documents and transaction records must be kept for five years after the business relationship ends, then deleted unless there is another lawful reason to retain them (which is also a UK GDPR point — over-retention is its own compliance problem).
4. CDD on buyers and sellers
The single most misunderstood point in the sector: since MLR 2017, estate agency businesses are deemed to enter a business relationship with both the seller (your client) and the buyer. In practice:
- Seller: verify identity when you take the instruction, before marketing.
- Buyer: verify identity at the point their offer is accepted, before the transaction proceeds.
- Companies and trusts: identify the beneficial owners — the humans behind the structure — not just the entity name.
Relying on "the conveyancer will do the checks" is not a defence. The obligation sits with the agency.
5. Penalties for getting it wrong
| Failure | What HMRC can do |
|---|---|
| Trading unregistered | Civil penalty, backdated fees, possible prosecution |
| No firm-wide risk assessment / policies | Civil penalty (unlimited), published on HMRC's penalty list |
| CDD failures | Civil penalty; in serious cases criminal prosecution — up to 2 years' imprisonment |
| Fit-and-proper failures | Refusal, suspension or cancellation of registration |
Beyond the fine itself, HMRC publishes the names of penalised businesses — a reputational cost that outlasts the penalty.
6. Quick compliance checklist
- Registered with HMRC for AML supervision (and renewal paid)?
- Written, current firm-wide risk assessment?
- Written policies, controls & procedures, approved by senior management?
- Nominated officer / MLRO appointed and documented?
- CDD done on both buyer and seller, with evidence retained?
- EDD, PEP and sanctions screening in place for higher-risk cases?
- Staff trained, with a training log?
- Records kept for five years and then disposed of?
Two of these points have their own detailed guides: HMRC registration step by step, and what the firm-wide risk assessment must include.
How many of those eight can you evidence today?
Run the free vrisk AML readiness check: answer a few questions and see where your agency stands against MLR 2017 — and generate the documents HMRC expects, ready for professional review.
Run my free AML check →7. FAQ
Do estate agents have to register with HMRC for AML?
Yes — every estate agency business must register before trading. Unregistered trading is penalised and, in serious cases, prosecuted.
Do the regulations apply to letting agents?
Yes, where managed lets reach a total monthly rent of €10,000 or more (or equivalent). Below the threshold, sanctions-reporting duties still apply.
Do I really need to check buyers too?
Yes. CDD is required on the buyer once their offer is accepted, as well as on your selling client at instruction.
What is a firm-wide risk assessment?
A written document (regulation 18) assessing your business's exposure to money-laundering risk across customers, geography, services, transactions and delivery channels. HMRC expects to see it at inspection.
What happens if I breach MLR 2017?
Unlimited civil penalties, publication of your business name, suspension or cancellation of registration, and up to two years' imprisonment for serious breaches.
Does a small agency need an MLRO?
A nominated officer must be appointed where appropriate to the size and nature of the business; sole traders with no staff can act as their own.