HMRC sets the objective, not the method. The July 2026 guidance defines what estate agents must achieve. Designing the function that achieves it is left to each agency
There are 39 risks to consider on every instruction. HMRC’s risk assessment now includes five risks added in July 2026, and agents must evidence that each one has been considered
AML is an operating model, not an ID check. It covers customers, channels, accountability, activities, resources, partners, costs and revenue, and the whole model fits on a single page
HMRC’s compliance checks test the whole model. Officers review your risk assessment and policies, test a sample of case files and interview your staff.
The work is the same in-house or outsourced. What changes is who carries it out
HMRC’s July 2026 AML guidance runs to hundreds of pages. It is precise about what estate agents must achieve.
It is almost silent on how. That leaves every agency facing the same question: what does a compliance function that actually delivers all of this look like?
This question shaped Coadjute’s recent webinar, Building and running a compliance function: what it takes to get it right. It was presented by John Reynolds, Co-Founder and COO of Coadjute, who has more than 30 years of experience building functions in highly regulated sectors, and hosted by Jo Burman, Coadjute’s Marketing Director. Run as a practical workshop, the session set out how to design, test and run AML across an estate agency business.
Here are the insights every agency leader and MLRO should take away. You can watch the full webinar on demand.
The regulatory bar has risen every year since the Money Laundering Regulations 2017, and the last twelve months have seen the steepest climb yet.
In September 2025, HMRC published detailed risk indicators that every estate agent must look for. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 came into force on 30 June 2026. And in July 2026, HMRC brought its guidance together in a single manual. It has three parts: guidance for all supervised sectors, sector-specific guidance for estate agency businesses, and sector risk assessments. The new guidance also recommends completing buyer checks before an offer is accepted, and it adds further risks to address.
The result is 39 risks to consider on every instruction, across customer, transaction, geography, delivery channel and service, plus five new risks. Few of them can be answered with a passport. A customer profile that doesn’t fit the deal. Secretive or evasive behaviour. Third-party payments, gifts, and whether you have met the customer face to face.
“The guidance is completely silent on how you implement it. It sets the objective.”
— John Reynolds, COO, Coadjute
Enforcement is rising in step. Figures shared during the webinar show that 60% of businesses HMRC assessed in 2024–25 were found non-compliant. HMRC’s formal enforcement actions rose fivefold in a year, from 157 to 798. Estate agents received 673 penalties between January 2024 and September 2025, worth £3.77m. The most common findings were inadequate policies and procedures, inadequate customer risk assessment, and inadequate records.
The focus of enforcement has shifted too. First, HMRC asked whether an agency was registered. Then it asked whether the agency had a risk assessment. Now it asks whether that risk assessment matches what actually happens in branch, day to day.
That is the question most agencies will now face.
Under HMRC’s guidance, both buyers and sellers are your customers. Every one of them goes through the same seven steps:
Educate the customer. Explain what AML is, why you are asking, and what they should expect
Identify who is in scope. This includes co-buyers, everyone on the title, trustees, gifters, executors and attorneys, not just the person in front of you
Carry out ID, PEP and sanctions checks. Verify and screen every person in scope
Collect the documents. This includes Source of Funds evidence, title documents, trust deeds, death certificates, grants of probate and powers of attorney
Complete the risk assessment. Assess every instruction against all 39 risks
Carry out Enhanced Due Diligence where risk is higher. Some scenarios are mandated by HMRC. Others are set by your own risk-based approach
Decide and write the report. Choose whether to proceed, hold and follow up, exit the relationship, or escalate to the MLRO. Record why.
Timing matters. Seller checks should be completed before the property is marketed. HMRC recommends that buyer checks are completed before an offer is accepted, and exchange is the deadline.
The report is where a file stands or falls. If you are audited in three years’ time and the person who ran the check has left, the file has to explain itself.
“You need the report to be freestanding, so anybody can read through it and understand exactly what process the customer went through.”
— John Reynolds, COO, Coadjute
Files also rarely run in a straight line. Company records may reveal another beneficial owner. A second name may appear on the title. A new gifter may emerge weeks before completion. A well-designed operating model handles the straightforward route and the route that loops back to earlier steps. And the step most often skipped is the very first one.
“No customer that you’re dealing with today, buyer or seller, has ever bought or sold a house under the existing AML regulations.”
— John Reynolds, COO, Coadjute
If customers understand early on why they are being asked for bank statements and gift declarations, they are far less likely to see it as an intrusion. They are also more likely to provide what you need first time.
What is an AML operating model?
Most agencies think of AML as an ID check. HMRC thinks of it as a function.
An AML operating model is the complete set of people, processes, channels, partners and costs an estate agency uses to meet its legal obligations on every transaction.
Designing one is less daunting than it sounds, because agency owners already think this way about their own business. They know their customers, their goal of winning instructions and completing sales, their channels from the high street branch to the portals, who owns each customer relationship, and the activities, resources, partners, costs and revenue that make it all work.
The Business Model Canvas captures exactly this, and it applies just as well to compliance:
Customers: the buyers and sellers in scope, whether individuals, companies or trust
Business goal: three goals work well. Pass HMRC’s audit of your operating model, minimise the cost of compliance, and minimise customer friction
Channels: how AML information moves between customers and your team, and where it is stored. Security and UK GDPR both appl
Customer relationships: who is responsible for guiding each buyer and seller through the process
Key activities: the governance work (business-wide risk assessment, policies, training and records), followed by the seven steps on every sale
Key resources: the MLRO, staff, training and IT systems
Key partners: for example, ID verification providers, screening tools, training providers or an outsourced service
Costs: MLRO and compliance staff time, HMRC fees, training, and the time negotiators and valuers spend on AML
Revenue: whether you charge for AML
The costs box is where many agencies get a surprise. Once you account for the time valuers, negotiators and receptionists spend chasing documents, the true cost of AML is rarely the price of an ID check.
How can estate agents stress-test their AML operating model?
An operating model is only as strong as the hardest file it can handle. The best way to test yours is to run real scenarios through it, from simple to complex.
The buyer with £300k in the bank. James Williams is buying a £750k home, with a £450k mortgage and £300k in his account. Job done? Not quite. The balance is made up of a gift from his mother, a payment from a family trust and a cash deposit described as a bonus. And the bonus doesn’t match his payslip. (We explored this scenario in detail in our previous webinar.)
The probate sale with a second executor. The title confirms the late owner, and the death certificate is in place. Then the grant of probate names two executors, not one, and both must go through the process.
The cash buyer whose deposit came from Bitcoin. A buyer is purchasing a £520k flat with a £200k deposit from selling cryptocurrency, now sitting in a UK bank account. As with any bank transfer, Source of Funds must be traced upstream. In this case, that means through the exchange and the wallets the cryptocurrency passed through. HMRC’s guidance now specifically addresses tracing funds through crypto accounts.
The separating couple who want nothing shared. This file is complex in a different way. Both owners must be checked, but neither wants their information seen by the other. Your operating model has to run two AML processes in parallel, with no information crossing between them.
For a closer look at the evidence these files require, see our guide to Proof of Funds, Source of Funds and Source of Wealth.
When HMRC calls, it isn’t testing your ID check. It is testing whether your operating model delivers consistently, file after file.
A recent HMRC check of an estate agency followed a typical sequence:
The call. HMRC phones the agency’s nominated officer to arrange a visit
The letter. HMRC confirms the visit and requests documents in advance. These include the AML risk assessment, policies, controls and procedures, training records, and a list of properties sold. The request typically covers the last 12 months, and can stretch to 36
The documents. These are submitted by email or through HMRC’s portal, often within around two weeks
The visit. Typically, two officers work through the risk assessment and policies, test around 20 case files, interview the MLRO and speak to staff about their training
The follow-up. Notes of the meeting are agreed, and further files may be tested.
Here’s the part many agencies overlook: HMRC can interview your staff. If your procedures say one thing and your branch teams do another, the officers will notice the gap.
Few agencies set out to build an ad hoc compliance function. Most simply grow one, with an ID app here, a template risk assessment there, and a busy branch owner as MLRO.
The table below shows how that compares with a deliberately designed in-house model and an outsourced one.
| Canvas element | Ad hoc model | Well-designed in-house model | Outsourced model |
| Customers | Only the person in the branch is checked. Co-owners, gifters and trustees are missed. | Everyone in scope is identified. | The provider identifies everyone in scope. |
| Business goal | Compliance is seen as “the ID check”. | Pass HMRC’s audit, minimise cost and minimise friction. | The same goals. |
| Channels | Evidence is scattered across inboxes, phones and WhatsApp. | A secure, central channel, plus an in-branch route for elderly or digitally excluded customers. | The provider’s secure portal and app, with specialists contacting customers. |
| Customer relationships | No clear owner. Negotiators improvise. | Clear accountability for every step. | Your team owns the relationship, and the provider’s compliance team guides the customer. |
| Key activities | A template risk assessment that doesn’t match practice, no record of the risks considered, and undocumented decisions. | Governance and all seven steps fully cover the guidance. | The provider supplies the risk assessment, policies and training for you to tailor, and runs the seven steps. |
| Key resources | Training isn’t done or recorded. The MLRO has no time and no cover. | An MLRO with deputy cover, and trained staff. | MLRO oversight, plus the provider’s specialist AML analysts. |
| Key partners | Unclear what providers actually do. | Clear roles for ID, screening and training partners. | An outsourced provider, with ID and screening built in. |
| Costs | Hidden in staff time, delays and the risk of penalties. | Fully understood, including indirect staff time. | Largely transferred to the provider. |
| Revenue | None. | A decision on whether to charge an AML fee. | Depending on the model, the consumer may pay the provider directly, and some models include a revenue share. |
The channels row deserves particular attention. Bank statements on WhatsApp, passports in email attachments and scans saved to desktops are a security risk and a UK GDPR problem, all at once.
“Don’t let people’s really private personal data get spread around your different systems. Over time, it’s creating a lot of risk in your business.”
— John Reynolds, COO, Coadjute
Whichever model you choose, the work doesn’t change. Only who does it.
Running AML in-house means resourcing everything yourself: an MLRO with cover, trained staff, ID and screening tools, and the negotiator and valuer time the process absorbs. In effect, HMRC assumes a complete compliance department.
Outsourcing moves that work to a specialist partner, just as many agencies already outsource finance, payroll or legal work.
“It’s the same set of things that need to happen. It’s just that they can be taken off you.”
— John Reynolds, COO, Coadjute
Outsourcing is not a hand-off, though. It is a partnership. Your people still own the customer relationship and work closely with the outsourced compliance team, and your agency stays involved in tailoring the risk assessment and policies to your business. This is the model Coadjute provides.
Print the canvas. Put it on a wall. Score it honestly with your team.
Mark each element red for “not in place”, amber for “partly in place or ad hoc”, and green for “in place, and we could evidence it”. Then ask three questions. Where are we red today? Who carries out steps 1, 2 and 4, which usually fall to negotiators? And could we evidence step 5, the risk assessment against all 39 risks, on every instruction?
If any of those answers give you pause, read HMRC’s latest AML guidance raises an important question: can you prove your compliance?
This article covers the highlights. To see the full walkthrough of the AML operating model canvas, the seven-step workflow and the HMRC compliance check, watch the webinar on demand.
And if you’d like a clear view of where your operating model stands, book a demo with Coadjute. In 30 minutes, we will help you map your operating model with you, whether you run it in-house, with software, or with a managed partner.