Payroll providers and HMRC AML supervision: why registration is the easy part

TLT picks out the key points you shouldn't miss...

What's this about?

HMRC has confirmed that payroll service providers acting on behalf of clients in dealings with HMRC will need to register for an Agent Services Account and be subject to anti-money laundering (AML) supervision. While much of the focus has been on registration deadlines and application requirements, the more significant issue is that many payroll providers will, for the first time, become subject to the UK's AML regime. This means firms will need to understand their regulatory perimeter, assess AML risks and implement appropriate governance, policies and controls. For many providers, registration is likely to be the easy part. The bigger challenge is preparing for life as an AML-supervised business.

Partner in Risk and Financial Crime, Ben Cooper, says...

"Many payroll providers are focused on the registration process. In our view, the more important issue is what comes afterwards. Firms need to understand whether they fall within scope, what AML obligations apply and whether their governance and compliance arrangements are fit for purpose. Registration is likely to be the easy part."

What the new requirement tells us...

1. Firms need to understand whether they are in scope

HMRC's announcement will affect many payroll providers that act on behalf of clients in dealings with HMRC. However, the position is not necessarily straightforward.

Some businesses provide a relatively narrow payroll processing service. Others submit PAYE information to HMRC, act as tax agents, manage HMRC correspondence, resolve tax code issues, provide wider HR support or operate as part of a broader outsourced business services model. Those distinctions matter.

The starting point for payroll providers should be a clear assessment of the services they provide and how those services are delivered in practice. The key issue is not the label the business uses, but the underlying activity. Firms should use the registration window to understand their regulatory perimeter and identify whether any areas of uncertainty require further analysis.

2. Registration is only the start

Many providers will be capable of completing the registration process without significant difficulty.

The greater challenge is preparing for ongoing AML supervision.

Once supervised, firms will need to take a risk-based approach to AML compliance, including maintaining appropriate risk assessments, policies, procedures, governance arrangements and staff training. For businesses entering an AML regime for the first time, this may require considerably more preparation than the registration process itself.

The key question is not whether a firm can register. It is whether it is ready to operate as an AML-supervised business once registration has been completed.

3. Governance and controls will come under scrutiny

AML supervision is not simply a compliance exercise.

HMRC will expect firms to demonstrate that they understand their money laundering risks and have implemented proportionate controls to manage them. Senior management should therefore consider now who is responsible for AML compliance, whether existing controls remain appropriate and how the business would evidence compliance in practice if challenged.

For some payroll providers, AML responsibility may sit naturally within an existing compliance or risk function. For others, particularly smaller payroll bureaux, new governance arrangements may be required. Either way, accountability, oversight and documented decision-making will become increasingly important.

4. Early preparation will make compliance easier

The firms most likely to navigate the new requirements successfully will be those that start preparing before registration deadlines become pressing.

A structured readiness review can help firms understand whether they are in scope, identify compliance gaps and prioritise the steps needed to prepare for supervision. In many cases, organisations already have elements of the required framework through existing compliance, risk management or governance arrangements. The challenge is ensuring those arrangements are suitable for an AML-supervised environment.

What this means for payroll providers

The new HMRC requirements represent more than an administrative registration exercise. They bring many payroll providers into a regulated AML environment for the first time.

There are three clear takeaways:

Understand whether you are in scope. The key issue is what the firm actually does for clients and whether those activities bring it within the AML regime.
Treat registration and AML readiness as separate issues. Completing a registration application does not mean a business is ready for supervision.
Use the lead-in period wisely. Firms that assess governance, controls and compliance arrangements now will be in a much stronger position than those that wait until deadlines are approaching.

Payroll providers that focus only on registration risk overlooking the wider regulatory obligations that come with AML supervision.

Our view

The registration process itself is unlikely to be the greatest challenge for most payroll providers. The real issue is understanding what operating as an AML-supervised business means in practice.

For firms that have never previously been subject to AML supervision, now is the time to assess regulatory scope, governance arrangements and compliance readiness. Those that prepare early will be significantly better placed than those that wait until registration deadlines are approaching.

Registration is the easy part.

AML readiness is the issue firms should be focusing on now.

How TLT can help

TLT is supporting businesses that may be affected by the new HMRC AML supervision requirements.

Our AML Readiness Assessment for Payroll Providers helps organisations:

understand whether AML supervision applies;
assess their regulatory perimeter and risk profile;
identify compliance gaps;
review governance arrangements;
develop proportionate AML frameworks and policies; and
prepare for ongoing supervision.

Early assessment can help firms establish a clear and proportionate roadmap towards compliance before registration deadlines become pressing.

If your business provides payroll services and is considering the impact of the new HMRC requirements, now is the time to assess your readiness. Early preparation is likely to be considerably easier and more cost-effective than trying to address AML compliance requirements immediately before registration deadlines.

At a glance...

Publication link	HMRC AML guidance
Who has published it?	HMRC
Publication type	Regulatory update
Any key dates?	Registration opens 18 May 2026. Mandatory from 18 November 2026. Registration deadline 18 February 2027.
What's it relevant to?	AML supervision, payroll providers, HMRC, economic crime, governance, compliance frameworks, tax agents and outsourced payroll services

This publication is intended for general guidance and represents our understanding of the relevant law and practice as at July 2026. Specific advice should be sought for specific cases. For more information see our terms & conditions.

No items found.

Written by