AML Risk Assessment for TCSPs: A Practical Guide to UK Compliance (2025 Update)

Understanding AML Risk Assessments: A Simple Yet Essential Step for TCSPs

If you’re a Trust or Company Service Provider (TCSP) in the UK, completing an AML risk assessment isn’t just a regulatory checkbox – it’s a vital step in protecting your business and staying on the right side of HMRC.

Under Regulations 18 and 19 of the Money Laundering Regulations 2017 (as amended), all TCSPs must conduct and document a Business-Wide Risk Assessment (BWRA) as well as customer-specific assessments.

At Flex AML, we know this can feel overwhelming, especially when juggling client onboarding and service delivery. So here’s a clear, jargon-free breakdown of the five key AML risk areas, with practical tips to help you get started.

The 5 Core AML Risk Categories You Must Assess

1. Customer Risk

Evaluate the client’s background, ownership structure and motivations.

Are they a PEP or close associate?
Using nominee directors or offshore structures?
Acting on behalf of someone else?

💡 Flex Tip: Log all third-party relationships with supporting documentation such as powers of attorney or declarations.

2. Jurisdiction Risk

Where are the client, UBO, and services based?

Are they in a high-risk country?
Linked to sanctioned or secrecy jurisdictions?

💡 Flex Tip: Keep a risk matrix of jurisdictions and use it in client scoring.

3. Service Risk

What type of services are being provided?

Company formations, nominee roles, or registered offices are higher risk.
Less face-to-face interaction = more inherent risk.

💡 Flex Tip: Use EDD and require sign-off for higher-risk services.

4. Delivery Channel Risk

How is the relationship managed?

Is onboarding remote?
Are intermediaries used?

💡 Flex Tip: Use ID providers with liveness checks, document authentication, and PEP/sanctions screening.

5. Transaction/Activity Risk

What will the client actually do with your service?

Complex structures with vague purpose?
Cross-border payments or sensitive sectors?

💡 Flex Tip: Ask: “What is the purpose of this structure or service?” If unclear, escalate.

Comparison Table: Low-Risk vs High-Risk Clients

Risk Area	Low Risk Example	High Risk Example
Customer Risk	UK national, transparent ownership	Offshore nominee, PEP, unclear ownership
Jurisdiction Risk	Based in UK or EU, low-risk jurisdictions	Based in sanctioned or secrecy jurisdiction
Service Risk	Basic company formation with oversight	Nominee directorship, no service monitoring
Delivery Channel	Face-to-face or video-verified onboarding	Remote onboarding via unverified third party
Activity Risk	Clear business model in regulated sector	Import/export with complex cross-border flows

Why It Matters

Demonstrates you understand your AML risks
Helps you apply correct CDD or EDD
Shows HMRC you use a risk-based approach
Supports internal training and decision-making

💡 Flex Tip: Review and update your BWRA at least annually or when your services or threats change.

Common Mistakes TCSPs Make

Using outdated or generic risk templates
Not tailoring risk scores to actual services
Failing to document scoring rationale
Disconnection between BWRA and onboarding process
No ownership or oversight of AML documents

FAQs: AML Risk Assessments for TCSPs

Do I need a risk assessment if I only offer registered office services?

Yes. All TCSPs, fall under AML obligations.

How often should I update my risk assessment?

At least annually, or when your business model or risk profile changes.

Can I use a template?

Yes, but only if you tailor it to your actual services, clients, and delivery model.

What do I do with high-risk clients?

Apply Enhanced Due Diligence, document your assessment, and seek internal sign-off.

Need Help Getting Started?

Flex AML offers:
✅ Custom AML risk assessments
✅ Ready-to-use policies and procedures
✅ CDD file templates
✅ PEPs and sanctions screening checklists
✅ Staff AML training – CPD certified
✅ Ongoing support for your MLRO

👉 Contact us today and book your free consultation to talk through your current setup.

Further Reading:
🔗 Understanding risks and taking action for Trust or Company Service Providers
🔗 Money laundering supervision for TCSP registration