Guidance

Risks common to accountancy service providers

Updated 9 January 2026

Risk assessment

This risk assessment by HMRC is prepared and made available to you under regulations 17 and 47 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

All accountancy service providers (ASPs) must carry out a risk assessment in line with regulations 18 and 18A of the Money Laundering Regulations to identify and assess the risks to their business for:

• money laundering
• terrorist financing
• proliferation financing

You must take this HMRC risk assessment into account when carrying out your business’s own risk assessment.

Money Laundering

Accountancy services are used globally to facilitate and conceal money laundering. UK companies and partnerships are especially attractive because of the UK’s international reputation for trade and finance and upholding the rule of law. ASP services can be misused to legitimise illicit transactions, conceal the criminal origin of funds, and hide the identities of beneficiaries.

Businesses across many UK industries use accountancy service provider (ASP) services, which means there’s a wide risk of these services being misused. ASP services may routinely have sight of a customer’s transactions and movements of funds which puts them in a good position to spot risks like money laundering, terrorist financing and proliferation financing.

The National Risk Assessment 2025 assessed ASP services as high risk for money laundering. The assessment highlights that criminals will try to misuse ASP services with weak or inadequate risk assessments, policies controls and procedures. It also highlights payroll, bookkeeping, insolvency and tax advice as services attractive for money laundering purposes. 

Some ASP services also offer trust or company services, which are considered high risk for money laundering. Criminals may target businesses that offer a wide range of services to exploit them more easily. However, they might use multiple ASP services to hide the full scope of their operations.

For more information about the risks, read the Trust or Company Service Provider guidance for money laundering supervision.

Find out how to risk assess your business for money laundering.

Terrorist financing

The National Risk Assessment 2025 assessed ASPs as facing a low risk for terrorist financing purposes.

However, ASPs must remain vigilant as to the risk.

For example, an ASP client might get money from a company that either:

• operates in a high-risk area and pays protection money to a terrorist group

• knowingly or unknowingly buys from a supplier connected to a terrorist group

Proliferation financing

The national risk assessment of proliferation financing considered specific proliferation risks associated with how easy it is to set up companies in the UK and access the UK financial system. Criminals seeking to establish a UK company or access to the UK financial system for the purposes of proliferation financing may engage an ASP for their services. For example, engaging an accountant to draw up company accounts or to notarise documents needed to open a business bank account.  

The assessment highlighted the risk of accepting records of transactions at face value without considering the risk that transactions are linked to illegal activity, including proliferation financing or to high-risk third countries.

Risks common to accountancy service providers

1. The request or business activity does not have a clear business reason or make economic sense

Requests without a clear business reason, especially complex or cross-border, may signal higher risk, especially if the customer is secretive.

A lack of economic sense may be shown by:

• money flows generated by a company that do not match the company’s business or industry
• a company mainly moving funds, collected from various sources, to unrelated local or foreign accounts
• transactions that do not fit with what is known about the client
• a business continuously making losses
• the lifestyle or wealth of a customer or owner which does not match their known income

Accountancy services provided on a short-term basis with a valid business reason to UK-based owner-managed businesses may present a reduced level of risk. The risk level may be increased depending on geographical area, being part of a supply chain and other factors set out in this guidance.

If you’re unfamiliar with a customer’s industry or typical practices, there’s a higher risk of being misled. You may need more information to assess if the request makes business sense.

2. The customer or service is from or linked to a high-risk third country

High-risk third countries are jurisdictions considered by the Financial Action Task Force (FATF) to have strategic deficiencies in their regimes to counter:

• money laundering
• terrorist financing
• proliferation financing

Providing services to or from high-risk third countries including people or businesses based there, carries a high risk.

You must apply enhanced due diligence measures before you form a business relationship or transact with a person established in a high-risk third country.

As the Financial Action Task Force (FATF) lists can change, a customer’s country may become high-risk during your relationship. If that happens, you’ll need to reassess the risk linked to that customer.

3. The customer or service is from or linked to an overseas jurisdiction

Providing services to or from overseas jurisdictions including people or businesses based there, may pose an increased risk of:

• money laundering
• terrorist financing
• proliferation financing

You must apply the appropriate customer due diligence or enhanced due diligence measures and consider your business’s risk assessment before you form a business relationship where there is a link to an overseas jurisdiction.

If an overseas jurisdiction is also a high-risk third country, you must apply enhanced due diligence measures before you form a business relationship.

Your assessment of the level of risk must include consideration of the geographical risk factors in Regulation 33(6)(c) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 that can indicate that an overseas jurisdiction poses an increased level of risk.

Some jurisdictions are deemed a higher risk than others and can:

• have poor or insufficient money laundering and terrorist financing measures
• have a significant level of corruption, terrorism or supply of illicit drugs
• are subject to sanctions or embargoes issued by the UK, EU and UN
• provide funding or support for terrorism
• have organisations designated under domestic sanctions legislation or ‘proscribed by the UK’
• have terrorist organisations designated by the UK, EU other countries and international organisations

Some countries do not implement measures to counter money laundering and terrorist financing that are consistent with the FATF recommendations. These are assessed by organisations such as:

• FATF
• FATF style regional bodies
• World Bank
• Organisation for Economic Co-operation and Development (OECD)
• International Monetary Fund

HMRC also considers there may be an increased geographical risk where the overseas jurisdiction:

• is not subject to anti-money laundering or counter terrorist measures equivalent to the UK
• shares a border with a high-risk third country as money laundering, terrorist financing or proliferation financing often involves the movement of funds across borders
• has limited corporate registration requirements or limited beneficial ownership information requirements (for example, where there is no requirement to update ownership changes)
• allows unrestricted bearer share usage
• has laws aiding financial secrecy
• has high levels of tax evasion
• has high levels of capital flight
• is a conflict zone

Information about high-risk jurisdictions is widely available from several open-source documents and media.

All ASPs will need to decide their own level of comfort when assessing jurisdictional risk. The business will be expected to develop and maintain awareness around this topic and include it in their written policies and procedures and risk assessment.

4. Accountancy services are provided with other financial, legal or trust or company services

The addition of these services can increase the overall risk of a business relationship.

If you also offer trust or company services alongside ASP services you must identify and assess the risks of your business being exploited for money laundering, terrorist financing or proliferation financing purposes.

For more information about the risks, read the Trust or Company Service Providers for money laundering supervision.

5. Supply chains

A supply chain is created when a relevant service is provided to an end-user through an intermediary.

Supply chains can increase risks presented by individuals and intermediaries by creating distance between the service providers and end users of the relevant service, which may allow anonymity for those involved.

Signs of an increased level of risk are:

• supply chains which involve overseas jurisdictions
• intermediaries who promote secrecy or hidden ownership
• requests that could help disguise income, assets, and ownership
• the number of intermediaries in the supply chain
• the frequency of requests for services from intermediaries seems excessive
• no clear reason why an end user has not approached you directly for the service

Supply chains can vary in length. They may be either:

• short, with a single intermediary acting as a ‘middleman’
• lengthy and involving many ASP providers or third parties acting as intermediaries

Accountancy services provided through a shorter supply chain may present less of a risk than those provided through a lengthy chain involving many parties. Other factors, such as the jurisdictions involved and reasons for the service and supply chains involved, will also determine the risks involved.

HMRC expects you to properly assess:

• the services, customers, intermediaries and locations in the supply chain, as well as its length or complexity
• how the risk associated with providing the service as part of a supply chain may differ from the risks associated with providing the service where there is no supply chain

You need to understand why you and others form part of the supply chain and whether this makes commercial sense.

Supply chains that involve intermediaries or end users based outside of the UK increase the risk, as this combines the risk of the service being provided overseas or to high-risk third countries with risk linked to supply chains.

6. Dealing with a business, customer or intermediary that has no anti-money laundering supervision

Before entering into a business relationship with a business, customer or intermediary who is carrying out relevant activity, you should take appropriate measures to check they are anti-money laundering supervised for that activity. If not, you should not enter into the business relationship.

They may not understand their legal obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and are unlikely to have proper controls in place to identify, assess, and manage the risk of their services being used for:

• money laundering
• terrorist financing
• proliferation financing

This increases the risk for anyone doing business with them.

There’s also a possibility that they are deliberately avoiding anti-money laundering supervision, potentially to enable illegal activity.

HMRC is one of 25 supervisory authorities that provides anti-money laundering supervision to businesses carrying out relevant activity. You can check the types of businesses that should be supervised, including those specifically under HMRC supervision.

If the business should be supervised by HMRC, you can check HMRC’s supervised business register. This will not include businesses supervised by another authority.

If the business does not appear on the HMRC register or its entry does not reflect all types of relevant activity they carry out, you should not enter into a business relationship.

If another authority should supervise the business, you should check if anti-money laundering supervision is in place. To do this, you may need to ask the business who its supervisory authority is.

In all cases, if you are not satisfied that the business is appropriately supervised for anti-money laundering, you should not enter into a business relationship.

If you believe a business is conducting relevant activity without appropriate supervision, you should report them to HMRC by either:

• using our online form
• sending an email to Money laundering: enquiries

7. Accountancy service provider services are requested for an entity which appears to be dormant

ASP services are less likely to be required by entities which are declared as dormant, or not trading. Consideration should be given to whether a request for ASP services makes good business sense and has a clear commercial reason.

Entities involved in money laundering schemes may falsely declare themselves dormant to Companies House. This helps them avoid sharing financial details and reduces the chance of being investigated. Businesses may also declare themselves as dormant for the purposes of Corporation Tax despite trading, to evade tax.

If an entity is reported as dormant with Companies House or HMRC but does not have a valid business reason for needing ASP services which relate to a dormant period, the risk increases.

8. Services are provided with no face-to-face interaction

Meeting your customer in person and checking original documents can help confirm they are who they say they are.

If you do not meet them face-to-face, there’s a higher risk they might be using a false identity.

Fake documents are harder to spot when sent online or remotely.

Regular in-person contact lowers the risk compared to only meeting once at the start.

Even if you checked their identity at the beginning of the business relationship, they might be working for criminals just to get access to your services. Without ongoing face-to-face contact, you might not realise the business is linked to organised crime.

The customer due diligence measures you take where there is little or no face-to-face contact must reflect the additional risk.

9. Services are paid for in cash or the customer operates a cash intensive business

Criminals like using cash because it provides anonymity and is harder to track. If cash is used to pay for ASP services, or if you’re working with a business that deals mostly in cash, it’s harder to know where the money came from.

Even though these services are usually paid for online, cash paid directly into your business bank account from unknown sources can pose an increased risk of money laundering. Keeping an eye on cash payments and making sure they’re from approved customers can help you to identify payments from unknown sources.

Cash intensive businesses can be used by criminals to launder illegal money, making it look legitimate. If you’re providing services to one of these businesses, there’s a risk they’re trying to hide where the money really came from.

Where the volume of cash transacted through the customer’s business is not consistent with what you know about your customer’s business activity or does not make commercial sense, this poses an increased level of risk. Where you form a business relationship with a cash intensive business, monitoring the volume of cash transacted through the business can help you to consider whether the measures you have in place to manage and mitigate the risks posed remain effective.

10. Accountancy services are requested for an apparent shell company

Shell companies are entities created to protect or hide the assets of another company. They only exist on paper and have no physical location, staff, revenue, or significant assets, but they may have bank accounts or investments. Whilst they are not necessarily illegal, they are often used in money laundering operations.

If the commercial purpose of an entity you are requested to form, or provide other ASP services to, appears to be that of a shell company you must consider the risks it will be used for illicit purposes.

Shell companies can be set up in overseas jurisdictions that have strict secrecy laws, making it hard to see who really owns them. This makes them useful for hiding illegal money, avoiding sanctions, and getting around anti-money laundering rules.

If the beneficial owner is not immediately identifiable, this poses a risk the shell company is being used to hide their identity and any criminal activity they’re involved in.

There is an increased level of risk when money is moved through the shell company as ‘loans’ from trusts or other non-bank companies, and then paid back regularly by individuals. This could be a way to move illegal money while making it look legitimate.

11. Frequent changes to beneficial ownership or those acting in roles such as directors and shareholders

Changes to the controlling parties of an entity, which are not consistent with the purpose you understood when the business relationship started, can be a sign of a firm being used for illicit purposes.

12. Forming a business relationship with a professional enabler

Firms and practitioners offering professional services include but are not limited to:

• accountancy services
• financial services
• trust or company services
• legal services
• estate agency
• art market participants

Most of these professionals follow the rules and help stop criminals from misusing their services, especially under laws like the Money Laundering Regulations 2017. However, some have helped commit crimes like fraud or supported serious organised crime in the UK. They may also enable criminality through negligence of their own compliance with professional and regulatory obligations. This group is known collectively as ‘professional enablers’.

There is a risk that you may deal with these ‘professional enablers’ through the course of your business. They may deliberately seek to exploit your services and any weaknesses in your professional and regulatory compliance procedures, to enable criminality. They may also expose you to these risks through neglect of their own compliance.

Not all professionals follow the rules in the same way. Some may know your responsibilities and try to take advantage of your trust in others in the industry. You might assume they’re doing the right thing but they could be helping criminals.

It can be difficult to identify professional enablers, but you can look out for warning signs in how they behave. For example, individuals or organisations who:

• in relation to their regulatory or professional obligations (including but not limited to the Money Laundering Regulations 2017):
  • appear to avoid or shortcut rules they’re supposed to follow
  • display behaviour that seems dishonest, careless, or irresponsible
  • do not take proper care to meet their professional or legal duties
• carry out activities under the Money Laundering Regulations 2017 but do not appear to be anti-money laundering supervised

13. Significant changes to a customer’s business activity or records

Be alert to any significant, unexplained changes in a customer’s business activity or records. These may occur without warning or a clear commercial reason.

Changes could include:

• moving from non-cash to cash transactions, and significantly changing the value of transactions (for example, moving from high to low or low to high amounts)
• evidence of changes to the parties the customer does business with, such as:
  •  the geographic locations or industries of those parties
  •  changes to those parties over a short period
• evidence of purchases and sales which seem unrelated to core business activity
• unusual or unexpected borrowing activity

These changes can indicate a customer is vulnerable to being exploited by criminals or engaged in facilitating money laundering themselves, for example as a perpetrator or a victim of a fraud scheme.

Changes in transaction patterns can indicate a business is under financial pressure and may be more likely to take financial risks.

Monitoring transactions through the customer’s business can help you check whether the activity matches what you know about the business and the reason for your services. It also helps you decide if your current risk controls are still suitable.

14. Unrestricted deposits and withdrawals by clients in designated or pooled client accounts

Where an ASP service provider uses a designated client account for holding and managing client funds, there is a risk that criminal funds could be paid into and out of the account to disguise them as legitimate business transactions.

Overpayments of fees or accidental payments, with requests to an ASP service provider to make a refund, indicate a risk the account is being used to legitimise illicit funds.

Funds paid in from unknown or cash sources, and funds paid out to a different account than that used to initially pay in, may indicate an attempt to hide the origin or true ownership of the funds.

Customers that can pay into and out of a client account without restriction could use this account to:

• lend credibility to fraudulent schemes
• launder the proceeds of their criminal activity

This is especially the case when using a pooled client account, where multiple clients’ funds are held and managed together in a single pot. This presents an attractive method of mixing illicit funds with legitimate funds and making it difficult to trace the origin of the money.

Monitoring transactions through a client account can help you to consider whether the account is being used:

• for the purposes you expect
• by customers you have given permission to

This can help you to identify any unusual activity and consider whether the risk controls you have in place still apply and remain effective.

15. Restricted access to business premises or the business premises do not appear appropriate

In order to hide their illicit activities, criminals may prevent access to their business premises, including by ASPs whose services they exploit.  

Criminals may:

• prevent access entirely
• provide limited access to sites or employees
• give access to front premises 

Indicators of these behaviours can include:

• refusal to hold meetings at business premises without clear reasons
• where access to business premises is given, its employees:
  • are reluctant to discuss business
  • do not appear to match the business’ profile, (for example the number of employees does not match what would be expected or employees appear to be undertaking work unrelated to the business)
• where access to business premises is given, the premises:
  • are not suitable for what you understand about the customer, their business operations or level of turnover
  • show a lack of physical equipment or materials, or of active trade in advertised opening hours
  • do not match locations like those in existing accounting records

There is a risk that the premises are being utilised for criminal activity, or that the premises you see are not the main place of business.

ASPs may be allowed access to premises at the start of a business relationship, with customers later refusing further visits. This could indicate the:

• premises are only a front, with real activity elsewhere or no genuine business at all
• customer has started criminal activity at the premises and wants to avoid detection

In both cases, refusal of visits may be a deliberate attempt to hide signs of criminal activity.

16. Services are provided to a business in financial difficulty

Businesses in financial difficulty are vulnerable to exploitation by criminals due to the financial pressures their owners or management may be facing.

Criminals look to exploit weaknesses in how businesses work, often targeting the individuals in charge or those who work there. These individuals might take bigger risks because of money worries, and can get involved in money laundering, sometimes without realising it or sometimes on purpose.

For example, a customer in financial difficulty may accept an investment into their business from a new third party to allow its operations to continue. The customer may do little research into the third party or the terms of the investment may appear unusually favourable. There is a risk the investment from the third party is the proceeds of crime and the customer’s financial difficulties have led them to become a victim of exploitation.

A customer may accept offers to buy their struggling business, even when those offers appear to lack commercial or economic sense based on what you know about the customer and business. For example, a customer selling their business for a price not reflective of its current worth for cash.

Criminals can exploit these opportunities to purchase businesses, which they then use to disguise illicit cash or funds as legitimate trading income. Cash-intensive businesses are particularly attractive tools for money laundering schemes, and so cash-intensive businesses experiencing financial difficulty may be more likely to be vulnerable to this risk.

Monitoring changes to activity or proposed ownership of your customer’s business can help you to consider whether they may be in or approaching financial difficulty.

17. The customer operates in an industry or uses practices unfamiliar to the accountancy service provider

If you’re unfamiliar with a customer’s industry or typical practices you may be at greater risk of exploitation. You may be less likely to identify suspicious or unusual activity or transactions that are linked to:

• money laundering
• terrorist financing
• proliferation financing

This includes where a customer uses government grants or schemes and you are less familiar with these.

Criminals may seek assistance from ASPs with grant or scheme applications or renewals to fraudulently get funds.

You may need to gather more information to understand the commercial viability of the request for services and to assess the risks arising in a particular case.

18. Providing services to a customer operating in an industry sector at increased risk of exploitation

Providing services to customers whose business is in a sector associated with potential exploitation of vulnerable persons or of public or private institutions can present an increased risk of money laundering. 

Businesses particularly vulnerable to this risk include:

• labour intensive trades with low profit margins
• businesses reliant on government grants such as grant aid or employment support schemes
• any other type of business model or trade considered likely to be exploited for the purposes of modern slavery or human trafficking

Modern slavery is when adults or children are deprived of their freedom by individuals exploiting them for personal or commercial gain. It takes many forms and includes debt bondage and forced labour. Human trafficking, a subset of modern slavery, is the recruitment, movement, harbouring or receiving of children and adults through force, coercion or deception for the purposes of exploitation.

Modern slavery and human trafficking are financially motivated crimes and criminals may seek to legitimise the illicit funds from these activities through businesses you provide services to.

Find information from the National Crime Agency (NCA) on:

• indicators of modern slavery and human trafficking (MSHT) in the accountancy sector
• how to spot the signs of modern slavery and human trafficking and how to report it

19. Separation of accountancy service provider services without valid reason

Where a customer uses multiple ASP service providers at once, or changes them often without reason, may indicate an attempt to hide the full picture of the business’s operations and history.

This includes where a customer:

• uses other ASPs while requesting your services, for example you handle payroll, but they use separate providers for accounts and tax advice
• changes ASPs

There is an increased risk where accountancy and tax advisory services are provided to the same customer by separate ASPs without valid reason.

Customers may switch ASPs often to avoid long-term relationships. Providers with long-term arrangements are able to spot unusual or unexpected changes in business activity because they understand the customer’s normal operations.

20. Customer is secretive about their business and financial activities

If a customer is not open and honest about their business activities and financial indicators do not follow expected trends, this is a risk this may extend to other parts of their business operations.

This behaviour indicates an increased risk that they may be involved in money laundering, terrorist financing or proliferation financing. For example, by providing fraudulent documents or false information relevant to the nature or purpose of their business activities.

Risks related to accountancy services

Accountants are often the link between a business and HMRC or third parties such as financial institutions, who will rely on the formal accounts and statutory returns accountants produce. 

21. Preparing accounts or completing returns from incomplete records

Accounting records or returns created from incomplete or unverified records or documents may be used to provide an apparently legitimate record for the source of illegitimate funds.

Pressure from customers for you to rely on unverified information or records they provide indicates a risk that the accountancy service is being sought to legitimise illicit business activity and funds.

There is a risk that the records you will produce will be accepted by third parties without further checks.  

These records can then be used to facilitate tax evasion, as they will be accepted as evidence of a business’s operations.

A lack of original documentation (bank statements, invoices), or reluctance by customers to provide these, can be an indication of increased risk.

22. Unusual level of requests for financial references for borrowing with no commercial need or with early repayment

Repeated, unnecessary, or unusual requests for borrowing may indicate a customer intends to repay the loans using illicit funds. This could be to secure a legitimate source of income into the business and obtain a corresponding record of legitimate payments flowing out to a lender. 

There is a risk that customers may seek references from an ASP to support borrowing from third parties to facilitate money laundering.

Where a customer borrows without commercial need, or they repay loans early, this is a clear sign of risk.

Risks related to bookkeeping

Bookkeepers will be engaged by customers to maintain their primary businesses records. They are often the link between a business and an accountant who will complete the formal accounts and submit statutory returns based on these primary records.

23. Preparing primary records from incomplete sources

Records or returns created from incomplete or unverified records or documents may be used to provide an apparently legitimate record for the source of illegitimate funds.

Pressure from customers for you to rely on unverified information or records they provide indicates a risk that the bookkeeping service is being sought to legitimise illicit business activity and funds.

There is a risk that the records you produce will be accepted by third parties without further checks. These records can be used to facilitate tax evasion, as they will be accepted as a primary record.

A lack of original documentation (bank statements, invoices), or reluctance by customers to provide these can be a clear sign of increased risk.

Risks related to tax advice, assistance and material aid

Evading tax is against the law, so any money gained from tax evasion is considered to be the proceeds of crime. Criminals may ask for help or advice with their taxes to avoid paying what they owe, or to pay tax on illegally earned money to make their business look legitimate.

24. Customer pressure or willingness to take risks to reduce tax bills

Where a customer places pressure on an ASP to reduce their tax bills, this could be an indicator of willingness to carry out tax evasion, which is illegal.

There is an increased risk where a customer:

• is willing to take risks to reduce their tax costs
• is dismissive of advice that their financial plans may be viewed as tax evasion
• applies pressure on you to help them meet relevant criteria for a tax regime they wish to use

Risks related to Payroll

Payroll services can enable money laundering by making illicit funds appear legitimate as employee pay or other compensation.

25. Falsified payroll instructions

There is a risk that criminals may exploit payroll services you provide by:

• misrepresenting employee pay or benefits in payroll instructions
• using illicit funds to pay employees
• fabricating employees

Employers in the UK are required to undertake checks on employees’ right to work and will collect a range of information during onboarding and ongoing employment. Your customers should have a range of information available to demonstrate to you that their payroll instructions are legitimate.

Requesting supporting information for payroll instructions, a customer’s employees and source of funds used to pay employees, can help you to consider whether that information is consistent with what you know about the purpose and nature of the business relationship with the customer.

There is an increased risk where:

• customers are reluctant to provide supporting information to prove their payroll instructions are legitimate
• you pay employees directly from the customer’s bank account

A criminal may seek this additional service to further legitimise this movement of funds through a business.

Information you request from customers about their payroll instructions may vary on a case-by-case basis but must be appropriate to your assessment of risk in a particular case, and your business-wide risk assessment.

26. Unusual service requests

Unusual requests, with weak or no commercial reasons, can be a sign of attempts to use a payroll service to legitimise movement of illicit funds.

For example, the use of a deduction or payment through the payroll service which does not match what you know about a customer’s operations.

Where you deal with transfers of funds for a customer, unusual requests or changes to these transfers that do not fit with what you know about them, suggest a higher risk.

27. Customer limits, prevents or changes interactions with HMRC

Employers or their payroll service providers are required to report certain information to HMRC regarding compensation paid to their employees.

If a customer stops you from reporting directly to HMRC on their behalf, or cannot confirm or show evidence that they have made the required reports themselves, this signals a risk of payroll fraud.

Where customers change or reduce how they interact, or request you interact on their behalf with HMRC without a valid commercial reason, this can also indicate an increased risk.

If a customer will not confirm or provide evidence of National Insurance numbers, tax codes, or other related information needed for these reporting purposes, it can indicate that employees may be fabricated, or vulnerable persons’ identities may be being abused.

28. The customer’s business involves a risk of employee exploitation through modern slavery or human trafficking

By exploiting victims of modern slavery, criminals operating businesses can make large profits, provide cheaper prices and undercut legitimate businesses. The victims of modern slavery may have also been victims of human trafficking.

The profit criminals gain from failing to pay employees in line with UK law is proceeds of crime. Criminals may seek to disguise these illicit funds through their business by using fraudulent employee and pay records.

There is a risk criminals may seek a payroll service to give legitimacy to these fraudulent records.

Factors indicating this potential risk can include where:

• your customer’s business involves a low paid manual labour workforce which is more vulnerable to modern slavery or human trafficking
• records show irregular hours or pay, yet all employees are paid the same
• there appears to be lower National Insurance contributions than expected
• records show round sum salary payments are made
• discrepancy within wages of workforce (this can indicate a mix of legitimate and exploited workers)
• suspicious lack of employee costs for example, the customer is in a service industry with little or no staff

Find information from the National Crime Agency (NCA) on:

• indicators of modern slavery and human trafficking (MSHT) in the accountancy sector
• how to spot the signs of modern slavery and human trafficking and how to report it

29. The customer may be involved in umbrella company fraud or similar fraudulent schemes

There is a risk that customers running umbrella fraud schemes may use ASP services to legitimise transactions and channel illicit funds through corporate structures.

ASP customers themselves may be agency workers or contractors employed by fraudulent umbrella companies, leaving them liable to HMRC even if they did not intend to avoid tax.

Find more information about:

• umbrella companies
• named tax avoidance schemes, promoters, enablers and suppliers

Risks related to Audit

Auditors carry out formal reviews and report to shareholders on the ‘truth and fairness’ of the financial statements prepared by directors of a business. Audits are performed in accordance with UK auditing standards with which all UK auditors are required to comply.

30. Audit services provided with other accountancy services or Trust or Company Service Provider services

Audit services can provide an additional layer of legitimacy to business accounts and documents. These services are attractive to criminals who seek to disguise any movements of illicit funds through a business and present them as legitimate business activity.

The risk is increased where audit services are provided alongside other ASP services or Trust or Company Service Provider services. Providing them together combines opportunities for criminals to hide both the true criminal origin and gain a seemingly legitimate record for transactions and movements of their illicit funds.

This includes where a:

• customer asks you to provide audit services alongside other ASP services or Trust or Company Service Provider services
• prospective customer has previously received audit services alongside other ASP services or Trust or Company Service Provider services