CLARITY

FATF grey-listing changes your EDD obligations. The bigger risk is the correspondent relationships you don’t see coming.

The introducer definition under Paragraph 9 is wider than most firms realise. That creates gaps.

Firms that treat a remediation direction as a boundary miss the point — and the regulator notices.

A client who was clean at onboarding may not be now. One-and-done screening isn’t enough.

The revised test is simpler than the old one, but use it as a floor, not a ceiling

The TCSP Sector NRA has named the compliance function gap the sector has been feeling for two years. Here is what it means and what firms can do about it.

Every year you hand the FSA a detailed snapshot of your business. Here’s how to make that same data do the heavy lifting in your BRA.

The Handbook changed on 1 April. So did the clock: minor updates, consequential timing.

Are we becoming risk blind because we’re capable practitioners?

Proliferation financing training sounds like weapons and state actors. Here's where it's relevant to the file on your desk, and how to spot it.

Compliance often earns its nickname. Here’s how to make sure yours doesn’t.

Most firms believe they're doing the right things. The FSA measures what's written down, not what's intended.

Firms that integrate compliance from the start run better than those that bolt it on.

The FSA is moving from governance-on-paper to expecting governance-in-practice. Most boards aren’t ready.

A board that never disagrees isn’t governing — it’s ratifying.

Most businesses don’t have a culture problem. They have an alignment problem.

The “too many hats” problem and managing commercial conflict for MLROs

Your BRA doesn’t sit in isolation. It sits in a framework — and regulators expect you to know where.

The TRA isn’t an IT document (thankfully!). It’s a risk management document — and the distinction matters.

A risk rating that doesn’t change what you do isn’t a risk rating. It’s a label.

Your BRA is the foundation for everything else in your AML framework. Most of them aren’t built that way.

Firms think the regulator wants every risk rated Low. Carrying residual risk is fine, if it's handled correctly.

What you need to know 

A quick and simple strategy to keep your risk framework living and breathing

The expanded registers help. Ticking the box doesn’t.

Enhanced due diligence has four stages. It's probable you are only doing two of them. 

Source of wealth and source of funds answer different questions. Confusing them is one of the most common mistakes in practice.

Limited services arrangements carry a structurally different risk profile from fully administered ones. This piece sets out why standard risk frameworks are not enough, and what a properly designed RORA monitoring regime actually looks like.

Ongoing monitoring is as much about business intelligence as it is about AML

Two changes to the beneficial ownership regime took effect in 2026. I'm not convinced either one gets us any closer to knowing who actually owns what.

Cyber security gets the headlines. Physical data protection is where firms get caught out.

By the time the FSA schedules an inspection, they’ve already formed a view from your data.

You can commit a failure to disclose offence where no money laundering has taken place. That surprises most people.

In the Isle of Man, accepting payment for services can be a criminal offence. This isn’t theoretical.

When an FSA decision arrives, you have 21 days to appeal. Most firms aren’t ready.

Unusual activity isn't necessarily suspicious. Questions aren’t tipping off. Knowing the difference, and what to do at each stage, is a skill.