Guidance

Risks common to trust or company service providers

Updated 19 November 2025

Risk assessment

This risk assessment by HMRC is prepared and made available to you under regulations 17 and 47 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

All trust and company service providers must carry out a risk assessment in line with regulations 18 and 18A of the Money Laundering Regulations to identify and assess the risks to their business for:

• money laundering
• terrorist financing
• proliferation financing

You must take this HMRC risk assessment into account when carrying out your business’s own risk assessment.

Money laundering

Criminals use corporate structures worldwide to launder money, especially when those structures lack transparency and can hide who really owns them. UK companies and partnerships are especially attractive because the UK is seen as a trustworthy place for business. This puts trust or company service providers at risk of their services being misused. These services can be used not just to start companies, but also to help criminals hide illegal activity or disguise who is really behind it.

Businesses across many UK industries use trust or company service providers, which means there’s a wide risk of these services being misused. Even though these providers do not usually handle customer money directly, they are in a good position to spot risks like money laundering, terrorist financing and proliferation financing based on who they work with and what services they’re asked to provide.

The National Risk Assessment 2025 assessed trust or company service providers as high risk for money laundering. The assessment highlights key concerns like how these services can hide people’s identities, the use of nominee arrangements, and risks linked to supply chains.

Find out how to risk assess your business for money laundering.

Terrorist financing

The National Risk Assessment 2025 assessed trust or company service providers as facing a medium risk for terrorist financing purposes.

The risk involves trusts, partnerships and companies that might receive money from businesses whose funds are linked to terrorist activity.

For example, a trust or company service provider client might get money from a company that either:

• operates in a high-risk area and pays protection money to a terrorist group
• knowingly or unknowingly buys from a supplier connected to a terrorist group

Proliferation financing

The national risk assessment of proliferation financing considered specific proliferation risks associated with how easy it is to set up companies in the UK and access the UK financial system. It found that this ease makes UK trust or company service providers attractive to criminals who want to use these services to support illegal activities related to the spread of weapons or other dangerous materials.

Some trust or company service providers sell ready-made companies, called shelf companies, that already have UK bank accounts. This can give proliferation-linked criminals easy access to UK financial services. These criminals may also use UK business structures to hide their identities and connections to illegal activities or high-risk countries.

Nominee shareholder or director services provided by trust or company service providers can be misused to hide beneficial owners of a company, which may then be used to facilitate proliferation financing.

Risks common to trust or company service providers

1. The request or business activity does not have a clear business reason or make economic sense

Requests without a clear business reason, especially complex or cross-border, may signal higher risk, especially if the customer is secretive.

A lack of economic sense may be shown by:

• money flows generated by a company do not match the company’s business or industry
• a company mainly moving funds, collected from various sources, to unrelated local or foreign accounts
• transactions that do not fit with what is known about the client
• a business continuously making losses
• the lifestyle or wealth of a customer or owner which does not match their known income

Trust or company services provided on a short-term basis with a valid business reason to UK-based owner-managed businesses may present a reduced level of risk. The risk level may be increased depending on geographical area, being part of a supply chain and other factors set out in this guidance.

If you’re unfamiliar with a customer’s industry or typical practices, there’s a higher risk of being misled. You may need more information to assess if the request makes business sense.

2. The customer or service is from or linked to a high-risk third country

High-risk third countries are jurisdictions considered by the Financial Action Task Force (FATF) to have strategic deficiencies in their regimes to counter:

• money laundering
• terrorist financing
• proliferation financing

Providing services to or from high-risk third countries including people or businesses based there, carries a high risk.

You must apply enhanced due diligence measures before you form a business relationship or transact with a person established in a high-risk third country.

As the FATF lists can change, a customer’s country may become high-risk during your relationship. If that happens, you’ll need to reassess the risk linked to that customer.

3. The customer or service is from or linked to an overseas jurisdiction

Providing services to or from overseas jurisdictions including people or businesses based there, may pose an increased risk of:

• money laundering
• terrorist financing
• proliferation financing

You must apply the appropriate customer due diligence or enhanced due diligence measures and consider your business’s risk assessment before you form a business relationship where there is a link to an overseas jurisdiction.

If an overseas jurisdiction is also a high-risk third country, you must apply enhanced due diligence measures before you form a business relationship.

Your assessment of the level of risk must include consideration of the geographical risk factors in Regulation 33(6)(c) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 that can indicate that an overseas jurisdiction poses an increased level of risk.

Some jurisdictions are deemed a higher risk than others and can:

• have poor or insufficient money laundering and terrorist financing measures
• have a significant level of corruption, terrorism or supply of illicit drugs
• are subject to sanctions or embargoes issued by the UK, EU and UN
• provide funding or support for terrorism
• have organisations designated under domestic sanctions legislations or ‘proscribed by the UK’
• have terrorist organisations designated by the UK, EU other countries and international organisations

Some countries do not implement measures to counter money laundering and terrorist financing that are consistent with the FATF recommendations. These are assessed by organisations such as:

• FATF
• FATF style regional bodies
• World Bank
• Organisations for Economic Co-operation and Development
• International Monetary Fund

HMRC also considers there may be an increased geographical risk where the overseas jurisdiction:

• is not subject to anti money laundering or counter terrorist measures equivalent to the UK
• shares a border with a high-risk third country as money laundering, terrorist financing or proliferation financing often involves the movement of funds across borders
• has limited corporate registration requirements or limited beneficial ownership information requirements (for example, where there is no requirement to update ownership changes)
• allows unrestricted bearer share usage
• has laws aiding financial secrecy
• has high levels of tax evasion
• has high levels of capital flight
• is a conflict zone

Information about high-risk jurisdictions is widely available from several open-source documents and media.

All trust or company service providers will need to decide their own level of comfort when assessing jurisdictional risk. The business will be expected to develop and maintain awareness around this topic and include it in their written policies and procedures and risk assessment.

4. The customer is linked to or receives funds from businesses in areas with a higher risk of terrorist financing

If a customer gets money from a business with links to an area controlled by terrorists, there’s a risk the money could be linked to terrorist activity.

Businesses operating in areas where terrorists are active or in control might end up funding terrorist groups, either knowingly or without realising it. For example, a business might pay a terrorist group to be allowed to operate there, or it might hire a subcontractor that has hidden links to terrorism. If any of the business’s money is used to fund terrorism, then that money is considered to be connected to terrorist activity and that affects the customer who receives it.

For more information on terrorist financing read section 4 of the National Risk Assessment 2025.

5. Trust or company services are provided with other financial, legal or accountancy services

The addition of these services can increase the overall risk of a business relationship.

If you also offer accountancy services alongside trust or company services you must identify and assess the risks of your business being exploited for money laundering, terrorist financing or proliferation financing purposes.

For more information about the risks, read HMRC’s risk assessment of accountancy service providers.

6. Supply Chains

A supply chain is created when a relevant service is provided to an end-user through an intermediary.

Supply chains can increase risks presented by individuals and intermediaries by creating distance between the service provider and the end users of the service which may allow anonymity for those involved.

Signs of an increased level of risk are:

• supply chains which involve overseas jurisdictions
• intermediaries who promote secrecy or hidden ownership
• requests that could help disguise income, assets, and ownership
• the number of intermediaries in the supply chain
• no clear reason why an end user has not approached you directly for the service

Supply chains can vary in length. They may be either:

• short, with a single intermediary acting as a ‘middleman’
• lengthy and involving many trust or company service providers or third parties acting as intermediaries

Trust or company services provided through a shorter supply chain may present less of a risk than those provided through a lengthy chain involving many parties. Other factors, such as the jurisdictions involved and reasons for the service and supply chains involved, will also determine the risks involved.

HMRC expects you to properly assess:

• the services, customers, intermediaries and locations in the supply chain, as well as its length or complexity
• how the risk associated with providing the service as part of a supply chain may differ from the risks associated with providing the service where there is no supply chain

You need to understand why you and others form part of the supply chain and whether this makes commercial sense.

Supply chains that involve intermediaries or end users based outside of the UK, increase the risk as this combines the risk of the service being provided overseas or to high-risk third countries with risk linked to supply chains.

7. Dealing with a business, customer or intermediary that has no anti money laundering supervision

Before entering into a business relationship with a business, customer or intermediary who is carrying out relevant activity, you should take appropriate measures to check they are anti-money laundering supervised for that activity. If not, you should not enter into the business relationship.

They may not understand their legal obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and are unlikely to have proper controls in place to identify, assess, and manage the risk of their services being used for:

• money laundering
• terrorist financing
• proliferation financing

This increases the risk for anyone doing business with them.

There’s also a possibility that they are deliberately avoiding anti money laundering supervision, potentially to enable illegal activity.

HMRC is one of 25 supervisory authorities that provides anti-money laundering supervision to businesses carrying out relevant activity. You can check the types of businesses that should be supervised, including those specifically under HMRC supervision.

If the business should be supervised by HMRC, you can check HMRC’s supervised business register. This will not include businesses supervised by another authority.

If the business does not appear on the HMRC register or its entry does not reflect all types of relevant activity they carry out, you should not enter into a business relationship.

If another authority should supervise the business, you should check if anti money laundering supervision is in place. To do this, you may need to ask the business who its supervisory authority is.

In all cases, if you are not satisfied that the business is appropriately supervised for anti money laundering, you should not enter into a business relationship.

If you believe a business is conducting relevant activity without appropriate supervision, you should either:

• report them to HMRC
• contact HMRC’s fraud hotline

8. Trust or company service provider services are requested for an entity which appears to be dormant

Trust or company service provider services are less likely to be required by entities which are declared as dormant, or not trading. Consideration should be given to whether a request for trust or company service provider services makes good business sense and has a clear commercial reason.

Entities involved in money laundering schemes may falsely declare themselves dormant to Companies House. This helps them avoid sharing financial details and reduces the chance of being investigated.

There’s a risk that the services are being used to hide who really owns the entity or to move illegal money, rather than for a genuine business reason.

9. Services are provided with little or no face-to-face interaction

Meeting your customer in person and checking original documents can help confirm they are who they say they are.

If you do not meet them face-to-face, there’s a higher risk they might be using a false identity.

Fake documents are harder to spot when sent online or remotely.

Regular in-person contact lowers the risk compared to only meeting once at the start.

Even if you checked your customer’s identity at the beginning, they might be working for criminals just to get access to your services. Without ongoing face-to-face contact, you might not realise the business is linked to organised crime.

The customer due diligence measures you take where there is little or no face-to-face contact must reflect the additional risk.

10. Services are paid for in cash or the customer operates a cash intensive business

Criminals like using cash because it provides anonymity and makes it harder to track. If cash is used to pay for trust or company services, or if you’re working with a business that deals mostly in cash, it’s harder to know where the money came from.

Even though trust or company service provider services are usually paid for online, cash paid directly into your business bank account from unknown sources can pose an increased risk of money laundering. Keeping an eye on cash payments and making sure they’re from approved customers can help you to identify payments from unknown sources.

Cash intensive businesses can be used by criminals to launder illegal money, making it look legitimate. If you’re providing services to one of these businesses, there’s a risk they’re trying to hide where the money really came from.

Where the volume of cash transacted through the customer’s business is not consistent with what you know about your customers business activity, or does not make commercial sense, this poses an increased level of risk. Where you form a business relationship with a cash intensive business, monitoring the volume of cash transacted through the business can help you to consider whether the measures you have in place to manage and mitigate the risks posed remain effective.

11. Trust or company service provider services are requested for an apparent shell company

Shell companies are entities created to protect or hide the assets of another company. They only exist on paper and have no physical location, staff, revenue, or significant assets, but they may have bank accounts or investments. Whilst they are not necessarily illegal, they are often used in money laundering operations.

If the commercial purpose of an entity you are requested to form, or provide other trust or company service provider services to, appears to be that of a shell company you must consider the risks it will be used for illicit purposes.

Shell companies can be set up in overseas jurisdictions that have strict secrecy laws, making it hard to see who really owns them. This makes them useful for hiding illegal money, avoiding sanctions, and getting around anti-money laundering rules.

If the beneficial owner is not immediately identifiable, this poses a risk the shell company is being used to hide their identity and any criminal activity they’re involved in.

There is an increased level of risk when money is moved through the shell company as ‘loans’ from trusts or other non-bank companies, and then paid back regularly by individuals. This could be a way to move illegal money while making it look legitimate.

12. Frequent changes to beneficial ownership or those acting in roles such as directors and shareholders

Changes to the controlling parties of an entity, which are not consistent with the purpose you understood when the business relationship was started, can be a sign of a firm being used for illicit purposes.

13. Forming a business relationship with a professional enabler

Firms and practitioners offering professional services include but are not limited to:

• accountancy services
• financial services
• trust and company services
• legal services
• estate agency
• art market participants

Most of these professionals follow the rules and help stop criminals from misusing their services, especially under laws like the Money Laundering Regulations 2017. However, some have helped commit crimes like fraud or supported serious organised crime in the UK. They may also enable criminality through negligence of their own compliance with professional and regulatory obligations. This is group is known collectively as ‘professional enablers’.

There is a risk that you may deal with these ‘professional enablers’ through the course of your business. They may deliberately seek to exploit your services and any weaknesses in your professional and regulatory compliance procedures, to enable criminality. They may also expose you to these risks through neglect of their own compliance.

Not all professionals follow the rules in the same way. Some may know your responsibilities and try to take advantage of your trust in others in the industry. You might assume they’re doing the right thing but they could be helping criminals.

It can be difficult to identify professional enablers, but you can look out for warning signs in how they behave. For example, individuals or organisations who:

• in relation to their regulatory or professional obligations (including but not limited to the Money Laundering Regulations 2017):
  • appear to avoid or shortcut rules they’re supposed to follow
  • display behaviour that seems dishonest, careless, or irresponsible
  • do not take proper care to meet their professional or legal duties
• carry out activities under the Money Laundering Regulations 2017 but do not appear to be anti money laundering supervised

Risks related to providing multiple trust or company service provider services

The more trust or company service provider services are offered, the greater the risk that criminals will misuse them to hide ownership or control. Each combination of trust or company service provider services can create more chances for criminals to exploit them together.

14. A trust or company service provider is asked to provide multiple services with little commercial basis

Trust or company service providers often offer packages that help set up and manage corporate structures. These may include:

• company formation
• registered office address
• mail forwarding services

Once a firm has been formed, it is usually expected that roles like director or nominee are transferred to the customer. If the customer does not intend to take over these roles, the commercial rationale behind this should be considered. Combined services may be used to hide beneficial ownership by adding layers to the corporate structure.

You should be alert if you’re asked to provide multiple services:

• with little commercial basis, in particular from overseas intermediaries
• over a longer period of time than would normally be expected

15. The trust or company service provider is providing multiple services to overseas beneficial owners and intermediaries

A beneficial owner seeking a range of trust or company service provider services that distances them from the legal entity can signal an increased level of risk.

Risks related to firm formation

A firm formation agent is a business that helps customers set up new firms.

16. UK firms forming part of overseas corporate structures

Customers may request the formation of UK firms that will be part of a corporate structure based partly or wholly overseas. These structures may span multiple jurisdictions.

When a corporate structure is not fully based in the UK, it becomes harder to:

• trace ownership and control
• scrutinise business activity
• understand financial arrangements

This lack of transparency may be intentional, aiming to:

• obscure the flow of funds
• hide the identity of beneficial owners

In particular, the risk is high where the corporate structure will be wholly or partially based in a high-risk third country as they are more likely to be linked to:

• money laundering
• terrorist financing
• proliferation financing

17. Firms formed that may become part of a complex or unusual corporate structure

A complex corporate structure refers to a firm or network of firms, where there is no immediate transparency of its ultimate ownership and control. For example, it has:

• several layers of indirect ownership, subsidiaries and divisions
• multiple shareholders, corporate officers and people with significant control

Customers asking for firms to be formed as part of an unusual or overly complex structure may present an increased level of risk.

This could be an attempt to:

• obscure the flow of funds
• hide the identity of beneficial owners

When a corporate structure is complex or unusual, it becomes harder to trace ownership and control, particularly where it extends overseas.

18. Bulk or frequent firm formation requests

Customers may request either:

• multiple formations at once
• several formations in quick succession

These patterns may indicate attempts to:

• use firms as layers to obscure ownership or channel funds
• open multiple bank accounts across jurisdictions to move illicit funds
• avoid scrutiny by spreading requests over time instead of submitting them all at once

Monitoring the volume and frequency of requests for formations from customers can help you consider whether the:

• activity aligns with the customers known business model
• risks controls you have in place still apply and remain effective

19. Requests for ‘shelf’ firms (also known as ‘aged’ firms)

Shelf firms are those which have been previously formed and time has passed since their formation.

A shelf firms’ company history will vary in its attractiveness for use by criminals. Those with older incorporation dates and established banking or credit facilities are more likely to be attractive than firms more recently formed.

Criminals may find these companies appealing because they’re less likely to be closely monitored when opening bank accounts or using other financial services.

An increased level of risk can occur where the customer is requesting a shelf firm instead of seeking a new firm formation.

20. Forming firms with no obvious business purpose

If a customer asks to form a firm but there’s no obvious commercial reason, this could be a sign of increased risk. For example, a customer requests a new company even though they already have multiple dormant companies listed on Companies House.

Whilst there may be a valid reason for a customer having multiple dormant companies, these may be falsely declared as dormant.

21. The customer is secretive about their company set up

If a customer avoids explaining why they’re setting up a company or why they’re structuring it in a specific way, this could be a sign of increased risk.

Before you provide services or start a business relationship, you must:

• carry out proper customer due diligence
• take steps to meet your legal obligations
• decide whether it’s appropriate to work with the customer based on what you know

22. The customer favours legal entities that hide ownership

If a customer prefers to set up companies in places where ownership details do not have to be registered, this could be a sign they are trying to hide who really owns the business.

This is more likely where an overseas formation is being requested.

In the UK:

• companies must register beneficial ownership information with Companies House
• an overseas entity that owns UK property must register with the Register of Overseas Entities

Some countries do not have these rules which make them attractive to people who want to:

• hide the identity of the real owners
• move or hold illegal funds without being noticed

23. Unexpected changes after company formation

If a company changes the controlling parties or the commercial activity of an entity, shortly after formation, and they do not match the purpose you understood when the formation request was made, this can be an indication the company was set up for criminal purposes.

You may have been provided with false information on the intended purpose and nature of the firm being formed, or its controlling parties, as they may be part of criminal operations.

If your relationship with the customer continues after the company is formed (for example, if you provide other trust or company service provider services), you must:

• monitor changes to the company’s activity or ownership
• assess any new risks these changes might present
• make sure your actions meet your legal obligations under the regulations

Risks related to Director services

Director services involve acting as, or arranging for someone to act as, a director (or similar role) on behalf of a company. This is often referred to as a nominee director. While the nominee may appear to be in control, the beneficial owner retains actual control and expects the nominee to follow their instructions.

Director services may be used as an administrative tool during merger negotiations. For example, a neutral person might act as a director until all the legal steps are completed and the company is handed back to the customer. However, if you’re asked to provide a director for a longer period, not just during setup or a short-term change, you need to be sure who you’re really acting for (the beneficial owner) and why the service is needed long-term.

A trust or company service provider should understand the business it is providing the service to and be satisfied that any transactions that it is required to approve as a nominee director are commercially sound and legitimate.

Whilst there may be legitimate reasons why a beneficial owner of a business may want to remain anonymous, it can also be part of a process to disguise misuse of funds. There is also a risk that a disqualified director may use another person to act in their place. As part of your risk assessment you may want to check Companies House disqualified directors register to protect your business from accusations of acting as a ‘sham’ director.

24. Nominee director with limited knowledge or control of the business

A lack of understanding, or lack of oversight of the customer’s operations and their banking activity, reduces the ability of nominees to identify suspicious or unusual activity or transactions, and could therefore indicate an increased level of risk.

If the nominee does not understand how the business works or cannot see what’s happening with its finances, it becomes harder to spot anything unusual or suspicious. This increases the risk to your business.

There’s also more risk if the customer has business bank accounts in overseas jurisdictions and the nominee director cannot access or monitor them.

Monitoring the money going in and out of the business can help you check whether the activity matches what you know about the business and why a nominee is involved. It also helps you decide if your current risk controls are still suitable.

25. Nominee director is acting for multiple companies

Where you act (or you arrange for someone to act) as a director, that nominated person is expected to spend enough time and resource to properly carry out their duties.

When someone is a nominee director for many companies at once, it becomes harder for them to spot suspicious or unusual activity. This can increase the risk of the service being misused.

The National Risk Assessment 2025 highlights that it’s especially risky when a nominee is linked to an unrealistically high number of companies.

26. Requests for nominees to act for multiple linked companies

Requests to act for more than one firm, which share either a common beneficial owner or a common group of beneficial owners, can be an indication of attempts to hide the link between firms they own.

27. Requests for too many nominees but no clear business reason

The customer may be using a nominee to hide their connection to the company and avoid detection.

Risks related to company secretarial services

Company secretarial services refers to acting as, or arranging for someone to act as, the company secretary of an entity. They are responsible for making sure the entity meets its statutory compliance obligations.

While the requirement for UK companies to have a company secretary has been removed for most companies, some will still require one. Those that do require one or decide to appoint one will generally present a reduced risk, such as public limited companies.

Jurisdictions other than the UK, may also require companies to have a company secretary. The risk is increased where this service is provided to jurisdictions other than the UK.

28. Company secretaries with limited knowledge or control of the business

This includes where company secretarial services are provided to overseas companies.

A lack of understanding, or lack of oversight of the business activity, reduces the ability of the secretary to identify suspicious or unusual activity or transactions, and could therefore indicate an increased level of risk.

There’s also more risk if the company is based outside of the UK, and the requirements of the secretary differ from those as set out in UK legislation.

There is a risk that an appointed person may lack the necessary understanding or competence to meet the legal and regulatory requirements of a specific jurisdiction. This can lead to non-compliance, which may be linked to activities such as:

• money laundering
• terrorist financing
• proliferation financing

Risks related to shareholder services

Shareholder services refers to acting as, or arranging for someone to act as, a nominee who holds shares on behalf of a firm’s beneficial owner. This is commonly used for admin purposes when a company is being set up. It can also be used in investment management, for example, when investment firms or stockbrokers hold shares and make decisions on behalf of their clients.

While there may be legitimate reasons why a beneficial owner of a business may want to remain anonymous, it can also be part of a process to disguise misuse of funds.

If you’re asked to provide shareholder services for several companies that have the same owners, it could be a sign that those owners are trying to hide how the companies are connected. In providing such services, you need to understand the rules in the country where the company is based. For example, like the UK, some countries require companies to report who really owns or controls them through a register of people with significant control.

29. Providing nominee shareholder services over a long period

If you’re asked to act as a nominee shareholder beyond the firm’s formation, or in situations where there’s no clear business reason for it, it can indicate an increased level of risk.

This might suggest that the service is being used to hide who really controls the company, possibly to cover up criminal activity.

30. Providing shareholder services for multiple linked companies

Requests to act for more than one firm, which share either a common beneficial owner or a common group of beneficial owners, without a valid business reason can be an indication of attempts to hide the link between firms they own.

31. Requests for unnecessary use of nominees with no clear business reason

The customer may be using a nominee to hide their connection to the company and avoid detection.

Risks related to virtual office services

These services provide a company with an official address and may include mail forwarding or collection. They’re often offered alongside serviced office services, like meeting room hire or phone answering, which are not covered by the regulations.

It is possible that customers of serviced office services begin to use access to a premises for virtual office services, which are covered by the regulations.

A trust or company service provider offering both virtual and serviced office services, needs to clearly understand which ones fall under the regulations. This helps you stay compliant and manage any risks.

Where both virtual and serviced office services are provided, it is likely that access to its premises is available to customers of either service. 

Monitoring how they access your premises and use your services can help you check if:

• they’re using the services as agreed
• their activity matches what you expect
• your risk controls are still appropriate

32. Little or no face-to-face contact

Regular face-to-face contact with a customer using virtual office services lowers the risk compared to never meeting them or only meeting once at the start. This includes customers who initially request serviced office services, for example the hire of meeting rooms or office space, but then do not use them and there is no longer an ongoing physical presence.

There is a risk that physical office services are required by the customer with the intention only to use them as virtual office services. This may be to avoid the customer due diligence measures that using a virtual office service will require you to carry out. It is known that in the early days of certain types of fraud there is a great deal of activity, which then lessens, and the criminals reduce their presence.

Physical interaction can help reduce risks of the customer using fraudulent documents, pretending to be someone else, or changing how the services are used.

If virtual office services are provided overseas or through a supply chain, there’s a higher risk they could be used for money laundering, terrorist financing, or proliferation financing.

There’s also a risk that overseas accountancy service providers and trust or company service providers may use a UK address to make it look like they’re based in the UK when they’re not.

33. Physical mail collection by unfamiliar or changing individuals

The personnel of criminal organisations may change regularly to avoid detection.

Frequent changes to those collecting mail, or collections by unknown individuals without a valid and reasonable business reason, may indicate either:

• an abuse of the service
• changes to the beneficial ownership which have purposefully not been declared

Monitoring who is collecting and how often can help you check if this matches what you know about your customer’s business and ownership. It also helps you decide if your current risk controls are still suitable.

34. Regular forwarding of large volumes of mail

Without a valid business reason, the forwarding of mail can be an indication that the use of the address is to support fraud schemes, such as investment frauds and particularly those that are promoted with long term returns.

Potential victims are often contacted by mail and criminals will issue letters to engage recipients in large volumes. This is to increase the pool of potential victims they can reach, knowing it is likely only a small proportion will respond.

Changes to the volume or frequency of mail received on behalf of a customer without a valid business reason can indicate an increased level of risk.

Monitoring the volume and frequency of mail forwarded to customers can help you check if this matches what you know about your customer’s business and ownership. It also helps you decide if your current risk controls are still suitable.

35. Multiple addresses supplied to the same or linked businesses

Without a valid business reason, the supply of multiple addresses may indicate an attempt to make a business involved in illegal activity appear more reputable, more substantial than it is, and to create an impression to its customers that they are dealing with a local company.

Potential victims of fraud schemes may be more likely to trust businesses with such qualities. The virtual office services may therefore have been required with that purpose to aid those illegal activities.

Where trust or company service providers are asked to provide multiple addresses for connected businesses or those with the same owner, it could be a sign someone is trying to hide links between them. Without a clear business reason, this might suggest a higher risk of money laundering, terrorist financing, or proliferation financing.

Monitoring the number of links between requests for virtual office services can help you check if this matches what you know about your customer’s business and ownership. It also helps you decide if your current risk controls are still suitable.

36. Use of virtual office services by unknown individuals or companies

A trust or company service provider offers a virtual office service, such as a registered office address, but this might be used by a person or company without their knowledge or authorisation.

Receiving mail for unknown persons or companies, or discovering that unknown persons or companies are listing their address as that of a trust or company service provider without permission, indicates an increased level of risk.

Criminal organisations may use your address to:

• hide their real location and activity
• prevent law enforcement tracing the beneficial owners

Even known customers might ‘sub-let’ the address to others without permission, possibly to avoid fees or due diligence checks. These hidden users may be trying to conceal illegal links or identities.

Monitoring the recipients of mail you receive can help you check:

• whether your services are being sub-let or used by those without your permission
• if your current risk controls are still suitable

You must report a discrepancy between Companies House records and your customer due diligence information if they could suggest money laundering, terrorist financing, or attempts to hide business details.

Risks related to trust services

Trust services refers to acting, or arranging for another person to act, as a trustee of an express trust or similar legal arrangement. This is also known as acting as a ‘professional trustee’. A professional trustee should consider how freely they can act in the best interests of the beneficiaries, without being improperly influenced by the person who created the trust or others.

The beneficial ownership of most trusts must be declared to the Trust Registration Service. Where you form a business relationship with a trust, you must obtain proof of the trust’s registration with the Trust Registration Service.

You must report a trust discrepancy between the proof of registration and your customer due diligence information if they could suggest money laundering, terrorist financing, or attempts to hide business details.

A professional trustee:

• must understand the intended usage of the trust and its assets, to then be vigilant to risk of its exploitation for illegal purposes
• should have oversight to identify where bank accounts or assets may be used for non-trust purposes

Trusts which may present a reduced risk include those where the source of funds is clear. These include those for:

• disabled persons
• life interest
• charities
• share schemes
• company pension funds

The National Risk Assessment 2025 considers the not-for-profit sector as low risk for money laundering. However, if acting as a professional trustee of a charity, you should have appropriate measures in place to confirm the nature and purpose of the charity. If it’s a new charity, you’ll need evidence that it can meet its objectives, the source and control of its funds, and that appropriate decision-making processes are in place.

37. The source of the trust’s funds or assets is not clear

This could be a way to hide who really owns the assets or where the money came from.
There’s also a risk that the trust’s money is linked to corruption or terrorist financing.

38. Professional trustees with limited knowledge or control of the trust

A lack of oversight of the trust’s operations and their banking activity, reduces the ability of professional trustees to identify suspicious or unusual activity or transactions. This could therefore indicate the trust is not being used for its intended purpose.

If the professional trustee does not understand how the business works or cannot see what’s happening with its finances, it becomes harder to spot anything unusual or suspicious. This increases the risk to your business.

Where the trust has bank accounts in other jurisdictions but oversight of these by a professional trustee is not available this presents a further risk.

Monitoring incoming and outgoing payments through the trust that a professional trustee is acting for can help you to check whether the activity matches what you know about the trust’s purpose and the reason a trust service is in place. It also helps you decide if your current risk controls are still suitable.

39. Settlor, beneficiary or other person has significant control over the trust

If a professional trustee is pressured to manage assets differently from how it was originally agreed, it could be a sign that the trust was set up to move illegal money or to hide who really owns the assets.