The reality of what is required
HMRC has published extensive guidance for what estate agents need to do at every moment of a sale, for every customer, across your whole firm. Here are the key points… in plain English.
Six stages with one continuous obligation
Choose a stage to see what HMRC expects, in plain English, with HMRC’s own words where we quote them, and what Coadjute does for you.
Your firm’s AML framework comes first
What HMRC expects
- A written, firm-specific risk assessment of money laundering, terrorist financing and proliferation financing risk, reviewed at least annually and whenever the business changes
- Policies, controls and procedures approved by senior management, shared with every colleague and re-shared whenever they change
- A Nominated Officer appointed and HMRC told of the appointment within the time the Regulations set; every relevant colleague trained
What Coadjute does
- Your risk assessment built digitally on the platform, from the Coadjute AML Standards Library
- A customisable policy library, with controls, procedures and evidence standards linked to every check
- Training assigned by role and recorded in the Training Hub
What stays with you
The decisions only your firm can make, with the evidence in front of you.
A template is fine, but it “must be fully adapted”
- Source
- HMRC AMLG1800
The seller is your customer from the moment terms of business are signed
What HMRC expects
- The seller must be verified when they sign your terms, before the property is marketed: name, photo, date of birth and address, with documents checked for genuineness
- For companies and trusts, identify and verify the beneficial owners: the Companies House register alone isn’t enough
- Digital identity services should be certified and on the government’s register
- Check the authority of anyone acting for the seller, such as an executor or attorney
What Coadjute does
- Guided digital ID from a government-certified digital identity provider, with face matching and liveness checks, or Agent Assisted when a seller needs help
- Company, officer and beneficial-owner checks; title and ownership checks with HM Land Registry and Registers of Scotland
- Specialist review of every result, recorded in the AML report
What stays with you
The decisions only your firm can make, with the evidence in front of you.
Every sale is a business relationship with the seller and the buyer
- Source
- HMRC AMLG2200 (summary)
Now the buyer is your customer too
What HMRC expects
- The buyer becomes your customer at the point their offer is accepted; verification is expected then, and must be complete before contracts are exchanged
- Source of funds “must always be scrutinised” on a purchase. Knowing it came from a UK bank account is not enough
- Gifted deposits: check the giftor and also where their money came from
What Coadjute does
- Buyer, joint-buyer and giftor checks, with live source-of-funds declarations and chained gifts recorded as they happened
- Specialists trace the money, request the right evidence and follow up until the picture is complete
What stays with you
The decisions only your firm can make, with the evidence in front of you.
Source of funds “must always be scrutinised”
- Source
- HMRC AMLG3200
Keep watching until completion
What HMRC expects
- Monitor the relationship throughout: keep information current and act on changes such as new funding or new parties
- If something looks wrong, report internally; your Nominated Officer decides whether to make a SAR and seek a DAML before proceeding
- Never tip off the customer, and never assume another firm will report
What Coadjute does
- Ongoing monitoring and re-screening throughout the relationship (at least 12 months), red-flag escalation and a clear outcome on every case: Proceed; Consider, for your MLRO’s review; or Stop, where the relationship ends, with a SAR and any DAML prepared where there is suspicion
- SAR preparation and DAML support for your Nominated Officer
What stays with you
The decisions only your firm can make, with the evidence in front of you.
Never assume “another entity is going to make a SAR”
- Source
- HMRC AMLG2200
Close the case with a complete record
What HMRC expects
- Keep the evidence and enough information to reconstruct the transaction
- Check that the fee is paid by the customer you verified
What Coadjute does
- A structured AML report for every customer: checks, evidence, risk decisions, mitigations and history
What stays with you
The decisions only your firm can make, with the evidence in front of you.
Records must allow you to reconstruct the transaction
- Source
- HMRC AMLG11700
Be able to evidence it all, years later
What HMRC expects
- Keep records for five years after the relationship ends, then delete personal data unless an exception applies
- Produce your risk assessment, its previous versions, your policies and your training records on request
What Coadjute does
- Every case, framework version and training record retrievable in one place
- Coming soon for MLROs: Compliance Insights, showing your firm’s risk profile from its own checks
What stays with you
The decisions only your firm can make, with the evidence in front of you.
Provide records “to HMRC on request”
- Source
- HMRC AMLG11030
Higher risk means enhanced due diligence
Politically exposed persons
PEPs, their family and close associates need enhanced checks and senior-management approval before the relationship begins. Foreign PEPs are treated as higher risk.
High-risk countries
Any link to a FATF “call for action” country (currently North Korea, Iran and Myanmar) means enhanced checks before the relationship starts.
Unusually complex or large
Transactions that are unusually complex, unusually large or follow an unusual pattern with no apparent legal or economic purpose.
Super-prime
£5m or more in London and the South East, or £1m or more elsewhere in the UK.
Property funds and trusts
REITs and OEICs are higher risk; trusts should be treated the same way, with beneficial owners identified.
Citizenship by investment
HMRC expects customers holding a passport from a country that offers citizenship by investment to be treated as higher risk, particularly where they were born elsewhere.
The Coadjute AML risk library
Coadjute covers all the risks HMRC’s guidance describes under customer, transaction, geography, service and delivery-channel risks, plus the new risks HMRC added in July 2026.
Customer risks
10 risks
- Customer profile not in line with transaction
- Customer behaviour (secretive or evasive)
- PEPs, family and close associates
- Corporate structure not wholly UK-based
- Trust customers
- REIT / OEIC
- Cash-intensive businesses
- Joint ventures and reliance agreements
- Customers linked to governments of PF-sanctioned regimes
- Customers sanctioned by the UK for terrorist activity
Transaction risks
14 risks
- Super-prime property
- Multiple property transactions
- Price not reflective of market value
- Complex or unusual corporate structure
- Non-transparent legal entity
- Potential professional enablers
- No commercial purpose
- Payment and source-of-funds risks
- Bridging finance
- Multiple connected companies / common UBOs
- Proof of ownership
- Identifying co-owners
- Property used to manufacture dual-use goods
- Linked to PF-sanctioned regimes
Geography risks
4 risks
- High-risk third countries (HRTC)
- Overseas (non-HRTC)
- Intermediaries
- Virtual office locations
Service risks
4 risks
- Multiple services on the same asset
- Payments for estate agency services
- Offshore ownership or intermediary
- Property auctions
Delivery channel risks
2 risks
- No face-to-face contact
- Third-party ID or compliance providers
New risks
5 risks
- Organised immigration crime
- Citizenship by investment
- Northern Ireland-related terrorism
- Terrorism and serious organised crime
- Foreign policy sanctions, including proliferation financing
Risk categories are Coadjute’s own, built on HMRC’s guidance; they are not a count of HMRC’s risk indicators. Your firm’s risk assessment sets which apply to you and how.
Your AML compliance taken care of in full
Speak to an expert
What many agents believe, and what HMRC actually says
Myth
“We use an ID app, so we’re compliant.”
What HMRC actually says
Identity is one part. The Regulations also expect source of funds to be considered on every purchase and scrutinised where the risk requires (regulation 28(11); HMRC’s sector assessment says it “must always be scrutinised”), plus beneficial owners, enhanced checks, a firm risk assessment, policies, training and records.
Myth
“Our provider does the checks, so it’s their responsibility.”
What HMRC actually says
Using a third party “does not absolve you”. You must be able to examine what they provide.
Myth
“Source of funds is only for high-risk buyers.”
What HMRC actually says
The Regulations require source of funds to be considered on every purchase and scrutinised where the risk requires (regulation 28(11)); HMRC’s sector assessment goes further and says it “must always be scrutinised”, and a UK bank account alone is not enough.
Myth
“The buyer’s solicitor checks the buyer.”
What HMRC actually says
The buyer is your customer too. Each firm does its own checks, and should never assume another will report a suspicion.
Myth
“We did our risk assessment when we registered.”
What HMRC actually says
It must be reviewed at least annually and whenever the business changes, with previous versions kept.
Myth
“A template policy will do.”
What HMRC actually says
Templates are allowed, but they must be fully adapted and approved by your senior management.
Myth
“Our staff read the manual.”
What HMRC actually says
Training is needed at the start and regularly after (most firms will need to do it annually), and manuals alone are generally not enough.
Myth
“We’re too small for HMRC to look at us.”
What HMRC actually says
The obligations apply to every estate agency business, and HMRC can ask for your records at any time.
AML compliance is our speciality. Let us show you how
Book a free 30-minute AML health check. We’ll map your agency against what HMRC expects and advise you exactly how compliant your current processes are.