Anti-money laundering guidance for supervised businesses

AMLG3100 - Sector Risk Assessments: Risk Assessment of Art Market Participants

About this risk assessment

This risk assessment by HMRC is prepared and made available to you under regulations 14 and 47 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (referred to as ‘the regulations’ throughout this guidance).

It tells you about the key risks that your business might face as an art market participant (AMP).

There is separate guidance to support AMPs in complying with their obligations under the Regulations in Parts 1 and 2 of this guidance.

In line with regulations 18 and 18A of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the Regulations) all AMPs must carry out a risk assessment to identify and assess the risks to their business for:

• Money laundering.
• Terrorist financing.
• Proliferation financing.

You must take this risk assessment published by HMRC into account when carrying out your business’s own risk assessment. 

You must also read and consider other relevant documents such as:

• The National Risk Assessment of Money Laundering and Terrorist Financing 2025 - GOV.UK (We strongly recommend you read the whole document as important risk information is likely to be missed if only parts of the NRA are considered. In particular, you should read and consider Section 2, 3 and 4).
• The National Risk Assessment of Proliferation Financing published in 2021.
• Guidance produced on the Financial Action Task Force (FATF) website.

As an AMP, you must take appropriate steps, taking into account of the size and nature of your business, to identify and assess the risks your business may be exposed to. You must consider the following risk factors:

• Your customers – are they private individuals, companies or trusts etc?
• The geographical areas of your operations – where your customer is based or the country the goods are exported to?
• Your products or services - whether some are more attractive to criminals seeking to launder money and/or fund terrorism?
• Your transactions - how you are paid and the types and values of those transactions?
• Your delivery channels - how you interact with your customers., whether in person or remotely, e.g. via intermediaries?

The steps you have taken to identify and assess these risks must be properly reflected in your business’s risk assessment and you must keep an up-to-date written record of these steps. 

You must be able to provide an up-to-date copy of your risk assessment, and the information you have used to carry out that risk assessment to HMRC when requested.

This risk assessment by HMRC is to help you to identify and assess the risks of money laundering, terrorist financing and proliferation financing that your business may be exposed to. It also highlights where that level of risk may be increased or decreased depending on your business model. Whilst all these risks must be taken into account in your risk assessment and PCPs, you may also find additional risks when evaluating your own business.  You must apply the appropriate measures as set out in the regulations where there is a high or higher level of risk.

Your risk assessment must identify and assess any risks where your business could be exploited for:

• Money laundering
• Terrorist financing
• Proliferation financing

HMRC expects a risk assessment to be more than a ‘tick box’ approach. You must be able to provide an up-to-date copy of your risk assessment, and the information you have used to carry out that risk assessment to HMRC upon request. 

When you have identified the risks that are relevant to your business, you must put in place policies, controls and procedures (PCPs) to effectively manage and mitigate those risks.

If you begin to provide additional or new services, or if you change how your services are provided, or how your business operates, you must make sure your risk assessment reflects these changes. Your policies, controls and procedures (PCPs) must also be updated to reflect how you will effectively manage and mitigate any additional or new risks, before you start the new services or business operating model.

The requirements in the regulations for risk assessment and associated policies, controls and procedures to manage those risks within this guidance only apply to cash transactions – including linked transactions – over the AMP threshold.

The presence of one or more of the risk indicators contained within this risk assessment in AMP transactions means that there is a heightened risk of money laundering, terrorist financing or proliferation financing. You should consider carefully the risks involved and whether enhanced due diligence and/or enhanced ongoing monitoring measures should be applied, in line with regulation 33(1)(ii) of the Regulations and whether a suspicious activity report (SAR) should be submitted.

AMP Risk Characteristics

The regulations define an AMP as anyone who as part of their business:

Trades in or acts as an intermediary in the sale or purchase of works of art and the value of the transaction, or series of linked transactions, is of at least £10,000.

Operates as the operator of a freeport or any other business by way of business stores works of art in the freeport and the value of the art is 10,000 pounds or more.

A work of art is defined in the Value Added Tax Act 1994 section 21(6) to (6B) for the purpose of section 21(5)(a) of that Act. This is summarised as:

• A painting, drawing, collage, decorative plaque or similar picture.
• An original engraving, lithograph or other print.
• An original sculpture or statuary.
• A sculpture cast.
• A tapestry or other hanging.
• A ceramic.
• An enamel on copper.
• A photograph.

But not:

• A technical drawing, map or plan.
• Any picture comprised in a manufactured article that has been hand decorated.
• Scenery (including backcloths).

As an AMP you must submit a Suspicious Activity Report (SAR) to the National Crime Agency (NCA) as soon as possible if you know or suspect that a person is engaged in or attempting:

• Money laundering.
• Terrorist financing.

Find out how to submit a Suspicious Activity Report on the NCA website.

Money Laundering (ML)

AMPs are assessed in the NRA 2025 as facing a medium risk of money laundering. This score has decreased from a high risk for money laundering in the previous NRA due to improved understanding of the risk in the sector and improved supervision. However, there remains a risk of the sector being used for money laundering.

The high volume of funds moveable in a single transaction, the ability of artworks to increase in value over time, alongside the enjoyment or status gained by owners makes art appealing to both legitimate and criminal investors.

The art market is diverse; whilst some firms mostly buy or sell to longstanding clients they know well, some operators frequently buy or sell in private or through intermediaries, decreasing visibility of the true buyer or seller of the artwork.Whilst there are legitimate reasons for operating in such a way, this trading environment is advantageous to those seeking to launder money and hide their true identity. Even where an AMP has long-standing relationships with clients, you should monitor changes of circumstance or behaviour.

Any transactions carried out using crypto assets are potentially higher risk due to the ease in obscuring the source and ownership of funds, as are cash transactions.

The value of art can vary significantly, making it attractive to varying levels of criminality and a useful mechanism to move or store value over a period of time.

Price fluctuations in the value of art allow both for profits to be made by sale of the art and to conceal the movement of value where criminals manipulate the price of artwork.

Terrorist Financing (TF)

AMPs are assessed by the NRA 2025 to face a low risk for use for TF purposes.  Overall, the art sector appears to be unattractive to terrorists as the buying and selling of artwork involves time-consuming processes and requires high levels of liquidity.

While the sector can facilitate the movement of large amounts of money in a single transaction, high-value purchases typically require knowledge of art and a trusting relationship within the sector.

Low risk does not mean no risk, however, and artefacts which may fall into the definition of art have been known to have been sold by terrorist groups to raise funds.  In addition, you may face risk from customers known to be associated with terrorist organisation, as in this case:  Art dealer jailed for failing to report sales to suspected terrorist.

 

Proliferation Financing

Proliferation financing is defined in regulation 16A(9) of the Regulations as “the act of providing funds or financial services for use, in whole or in part, in the manufacture, acquisition, development, export, trans-shipment, brokering, transport, transfer, stockpiling of, or otherwise in connection with the possession or use of, chemical, biological, radiological or nuclear (CBRN) weapons. This includes the provision of funds or financial services in connection with the means of delivery of such weapons and other CBRN-related goods and technology, in contravention of a relevant financial sanction’s obligation”.   PF measures exist to prevent the build-up of chemical, biological, radiological or nuclear (CBRN) weapons of mass destruction (WMD) by certain regimes, meeting UK obligations under relevant United Nations (UN) Security Council Resolutions. 

Current PF sanctions caught by the MLRs target organisations, businesses, and individuals in:

• Iran
• North Korea

Whilst the risk of PF through the AMP sector is very low, you should carefully consider the PF risks associated with your customers and transactions, especially when they involve these and bordering countries.

The UK proliferation financing sanctions are regularly updated, so it is important to be aware of any changes and additions by checking the UK sanction list (more on this below).

 

Lack of clarity or transparency with the customer 

Use of unclear company structures trusts, and intermediary jurisdictions would indicate a higher risk in a transaction or series of transactions.  You should consider carefully whether to proceed with a transaction (see Part 1 guidance on customer due diligence) and/or whether to file a SAR with the NCA under such circumstances.

Similarly, AMPs may be exposed to the risk of surrogate shopping or “Daigou”, where individuals outside China purchase goods on behalf of customers in mainland China.  These are often luxury or high-demand/high-value products, which are sent back to China for resale or personal use.  Whilst these purchases are typically of higher-demand items such as fashion, jewellery or cosmetics, there is a risk of AMPs being exposed to Daigou. 

Daigou can be above board, but there are risks associated with it that AMPs must carefully assess and manage, including:

• Identifying and risk assessing the true customer.
• What is the money laundering risk associated with the UK cash pool used to purchase the goods including:

• The source and origin of funds (China – and several other countries, including India) has restrictions on currency exports: is the source of the cash legitimate?
• Were the funds moved through UK- supervised businesses or from unregistered or Informal Value Transfer Systems (for example, Chinese underground banking)? 

• If the goods are to be exported, are there risks associated with tax and export duties and controls to consider? 

The customer is from or linked to a FATF Call for Action (“black listed”) country

FATF Call for Action countries (formerly referred to in the Regulations as High Risk Third Countries (HRTCs)) are jurisdictions considered by the FATF to have strategic deficiencies in their regimes to counter money laundering, terrorist financing, or proliferation financing.

These countries are listed in the following publication, which is subject to change and revision: High-Risk Jurisdictions subject to a Call for Action (black list).

Services provided to or from FATF Call for Action countries or customers, intermediaries and third parties who are resident, have their principal place of business, or are incorporated in one, pose a high risk of money laundering, terrorist financing and/or proliferation financing.

You must apply enhanced due diligence measures before you form a business relationship with a person established in a black-listed country.

As the FATF lists are subject to change, there is a risk that that customers you have an existing business relationship with are established in a jurisdiction which may become black listed during the business relationship. You should factor this into your ongoing monitoring, alongside other considerations, like changes in country risk profiles, changes to sanctions and embargoes.

The customer is from or linked to an overseas jurisdiction

Services provided to or from overseas jurisdictions or customers, intermediaries and third parties who are resident, have their principal place of business, or are incorporated overseas may pose an increased risk of money laundering, terrorist financing or proliferation financing.

In determining the appropriate customer due diligence or enhanced due diligence measures to take where there is a link to an overseas jurisdiction in a business relationship, you must consider your business’s risk assessment, as well as your assessment of the level of risk arising in that particular case.

Your assessment of the level of risk arising in a particular case must include consideration of the following geographical risk factors in Regulation 33(6)(c) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

The following can indicate, where identified by a credible source, that an overseas jurisdiction poses an increased level of risk:

• Not having effective systems to counter money laundering or terrorist financing.
• Having a significant level of corruption, terrorism, or supply of illicit drugs.
• Subject to sanctions or embargoes issued by the EU or UN.
• Providing funding or support for terrorism.
• Having organisations designated under domestic sanctions legislation or if they are proscribed terrorist groups or organisations by the UK.
• Having terrorist organisations designated by the UK, EU, other countries or international organisations.
• Countries that have been assessed by organisations such as FATF, FATF-style regional bodies, World Bank, Organisation for Economic Co-operation and Development or the International Monetary Fund as not implementing measures to counter money laundering and terrorist financing that are consistent with the FATF recommendations.

In addition to the geographical risk factors in Regulation 33(6)(c), HMRC considers there may be an increased geographical risk where the overseas jurisdiction:

• Is not subject to anti money laundering or counter terrorist measures equivalent to the UK
• Shares a border with a FATF Call for Action country or a country known to have high levels of crime or corruption, host terrorist groups, or be involved in proliferation-related activities, as money laundering, terrorist financing or proliferation financing often involves the movement of funds across borders
• Has limited corporate registration requirements or limited beneficial ownership information requirements (for example, where there is no requirement to update ownership changes)
• Allows unrestricted bearer share usage
• Has laws aiding financial secrecy
• Has high levels of tax evasion
• Has high levels of capital flight
• Is a conflict zone

 

Examples of sources which may help you to consider the risk of an overseas jurisdiction may include:

• Guidance on the Joint Money Laundering Steering Group website, for example, Annex 4-1 of part 1, on the level of risk in other jurisdictions.
• Guidance and corruption index on the Transparency International website.
• Guidance on the Global Witness website.
• Internet searches.
• News articles and media publications.
• Basel AML index (HMRC considers that any country with a score above 6.08 should be treated as high risk but note that not all countries are included on the index).

You should take care to make sure the sources you consider are credible.

Where you consider there is a high risk in a particular case, you must apply enhanced due diligence measures before you form a business relationship.

If an overseas jurisdiction is also a black-listed country, you must apply enhanced due diligence measures before you form a business relationship.

All persons and entities linked to the UK sanctions list, irrespective of which sanctions regime, should be treated as high-risk. You must not deal with those specifically listed – see sanctions section at end.

Whilst you must make your own assessment of all jurisdictions based on the factors already mentioned, HMRC considers the countries listed within the NRA 2025 to be higher risk.

The customer is from or has links to a country subject to foreign policy sanctions Foreign policy sanctions, including financial and trade restrictions, are in place on certain sectors, entities or individuals in certain countries.  Financial sanctions are restrictions put in place to achieve a specific foreign policy or national security objective and can limit the provision of certain financial services and/or restrict access to financial markets, funds and economic resources.  Trade sanctions may target a particular sector or type of goods, for example, there are restrictions in relation to luxury goods (including art) worth over £250 to individuals connected to Russia. It is against the law to breach sanctions restrictions, including to: 

• Violate trade sanctions, such as those in place against Russia.
• Deal with frozen funds or economic resources, belonging to or owned, held or controlled by a designated person (an individual or entity on the UK Sanctions List (The UK Sanctions List) or to a person who is owned or controlled directly or indirectly by the designated person.      
• Make funds or economic resources available, directly or indirectly, to, or for the benefit of, a designated person or to a person who is owned or controlled directly or indirectly by the designated person.
• Engage in actions that, directly or indirectly, circumvent sanctions prohibitions. 

More details on UK sanctions can be found here: Starter guide to UK sanctions and detailed guidance on financial sanctions here: UK financial sanctions general guidance.

There is an increased risk of sanctions evasion or proliferation financing in any transaction or business relationship linked to a sanctioned country. Such transactions and customers should be treated as high risk.  Regimes seeking to evade sanctions take extensive steps to obscure the true nature of their transactions, including using neighbouring countries from which funds or material will be sent to the sanctioned country.  Firms should be aware of the increased risk around countries and geographical areas bordering sanctioned countries.

Art Storage, Freeports and Sanctions Evasion

The storage of works of art (outside of UK freeports) is not caught by the regulations as such, however the NCA has warned about links to sanctions evasion associated with art storage: see UK warns of criminal sanctions evasion through artwork storage facilities - National Crime Agency.  You should be careful to ensure you do not violate sanctions.  Your AML obligations in relation to risk assessment and CDD should help in this regard.

Customers from jurisdictions that offer Citizenship by Investment (CBI)

CBI is the practice of granting citizenship status principally or solely in return for financial investment, without any requirement for a significant period of prior physical residency in the issuing jurisdiction. CBI schemes are often referred to as Golden Passports or Golden Visas. Some CBI schemes feature investment directly into property within the jurisdiction.

CBI programmes usually allow applicants to acquire citizenship quicker than through other, more traditional immigration channels. Some schemes also allow for citizenship to be passed down to dependants.

Illicit actors can exploit CBI programmes to facilitate a range of illicit activity including financial crimes, such as money laundering, corruption, fraud and tax evasion. These criminals may also abuse citizenship or residency status granted to them to enable further criminal activity or to evade law enforcement authorities.

CBI offers the opportunity to acquire a travel and identification document under a different nationality or name, which can be used to represent who the holder is in a novel way, or hide the original identity, particularly to avoid sanctions.

When assessing whether there is a high risk of money laundering, AMPs must take account of the risk of CBI, in order to meet their obligations under regulation 33(6)(viii) of the regulations, in regards to enhanced due diligence measures. HMRC expects AMPs to treat any customer who has a passport from a country that offers CBI as a higher risk where the place of birth is shown as being in a different jurisdiction to that of the issued passport.

Countries that offer CBI include, but are not limited to:

• Antigua and Barbuda
• Cyprus
• Dominica
• Grenada
• Jordan
• Malta
• Montenegro
• Saint Vincent and the Grenadines
• St. Kitts and Nevis
• St. Lucia
• Turkey
• United Arab Emirates
• Vanuatu

 

Unsupervised AMPs

The range of services offered by AMPs can include higher and lower risk activities, and it is important that businesses understand and properly appraise the risks presented by activity and each customer.

AMPs trading above the threshold must be registered with HMRC for AML supervision and have appropriate controls in place, in line with their Regulatory obligations.   If you have contact with a business which you suspect is not registered or abiding by their MLR obligations, you should report them to HMRC.  You should also consider submitting a Suspicious Activity Report to the National Crime Agency.

Unregistered AMPs pose significantly increased money laundering risks because they are unlikely to be engaging with AML guidance and risk management material provided by HMRC and therefore not implementing appropriate controls.  They are also likely to be at an unfair competitive advantage compared to registered AMPs as they are unlikely to be funding the cost of meeting their legal AML obligations.

 

Unusually large transactions

Transactions that are unusually large for the customer, transaction type, purpose or your business may indicate increased risk.

Likewise, where a customer transacts at a value or frequency that is outside of their normal pattern this should be viewed as an indicator of risk. 

Appropriate risk assessment and management should be put in place in these circumstances.

Unusually complex transactions or customers

Transactions or corporate structures that are unusually complex, or that lack a clear commercial or lawful purpose, may indicate an attempt to obscure the origin, destination, or ownership of funds.

In line with the Money Laundering Regulations, AMPs should give enhanced scrutiny to transactions where complexity appears unnecessary or disproportionate to the stated purpose. This may include the use of multiple legal persons, intermediaries, third parties, jurisdictions, currencies, or transaction steps without a clear explanation.

Where transactions or corporate structures appear unusually complex, the business should assess whether the activity is consistent with the customer’s profile and expected behaviour and consider whether additional due diligence, enhanced monitoring, or escalation for suspicious activity reporting is required.

Cash Risks

Most AMPs do not deal with cash, however if your business makes or accepts cash transactions above £10,000, you must also register (at no additional cost, assuming this activity is carried out from already registered premises) for supervision as a High Value Dealer (HVD) and ensure your risk assessment and PCPs consider and manage HVD risks (see the Risk Assessment of High Value Dealers).

Cash is extremely attractive for money laundering and some of the associated cash risks are listed below. More detail on these can be found in the HVD risk guidance in the link above.

The customer operates a cash-intensive business

Cash-intensive businesses can be attractive tools for criminals to launder illicit cash through, presenting it as legitimate funds.  They also provide anonymity and make funds harder to track.

Cash may originate from a variety of sources, including legitimate trading activity, however the use of cash can obscure audit trails and increase the difficulty of tracing the origin of funds.

Criminals may try to use cash for high-value transactions through your AMP business.  You must carefully consider and manage the risks associated with such requests, including whether the source of funds for the transaction is consistent with your knowledge of the customer, the customer’s business and risk profile.

Consideration of the appearance and origin of bank notes

If your business does accept cash payments, a key risk to consider is the widespread use of cash by criminals seeking to convert criminal funds to enjoy the proceeds of crime, launder money or finance terrorism.

It is important for you to consider how cash is presented to you.  Is it all bundled up or is it just loose bank notes, does the presentation match the explanation for cash? For example, if your customer tells you that they withdrew the money from their bank account, then higher value notes may be in thousand-pound bundles contained by a bank wrapper and not likely to be rough bundles with rubber bands holding them together.

You must consider whether your customer has a cash business in Scotland or Northern Ireland that uses Scottish or Irish bank notes, or both. There have been law enforcement cases involving criminals buying drugs in England but paying in Scottish or Irish notes.

The condition and appearance of bank notes should also be considered, including whether notes appear excessively worn, mixed between different issue types, or inconsistent with normal circulation for the stated source of funds.

When cash is presented, it may appear either as loose banknotes or bundled together. If a customer says they withdrew the money from their bank account, higher amounts are often in thousand-pound bundles with a bank wrapper, and less likely to be rough bundles with rubber bands holding it all together.

If the customer claims the cash came from a casino win, it is likely to be wrapped in that casino’s slips, and you could undertake further customer due diligence checks with the casino.

It is important that you satisfy yourself that the evidence supports where the cash comes from.  If not, you must consider whether to stop the transaction and submit a Suspicious Activity Report (SAR).

Decisions to proceed, refuse, or report should be made on a risk basis, taking into account all available information, and in line with your business’s policies, procedures, and escalation processes.

Suspicious cash transactions by customer

Observe the appearance of the cash and consider if the banknotes resemble those typically issued by a bank or if they appear as loosely bundled street cash. Record how the customer presents the cash, whether in a secure bag, a carrier bag, or a fast-food paper bag.

Criminals are known to use everyday bags like rucksacks, carrier or fast-food bags to avoid drawing attention while transporting cash.

 

Use of third-party identity providers or compliance companies

There is a well-established market of third-party identity verification providers and compliance specialists that offer a range of services to support compliance with obligations under the MLRs. These services include conducting CDD and sanctions screening checks, providing wider regulatory compliance support, and developing risk assessments and controls.  The level of service, and standard of the product and service provided will depend on which third-party you use, and which level of service you pay for.

It is important to note that you, as the AMP, are responsible ensuring you comply with all of your obligations under the regulations. Any service, product or report the third-party provides must be examined by you, and you need to decide what, if any, further action you need to take to ensure you meet your obligations under the regulations.  

Care must be undertaken when using third parties, as any breach of the regulations may result in sanctions, including financial penalties or criminal charges, on you or your business, as the supervised entity: use of a third party does not absolve you of your responsibility for compliance.

Digital identity services certified under the UK Digital Identity and Attributes Trust Framework and included on the DVS Register are considered a reliable and independent source of information, provide an appropriate level of assurance against impersonation, and can be relied upon when conducting customer due diligence. Entities are able to fulfil their obligations under regulation 28 by verifying a customer who is a natural person’s identity using certified and registered digital identity services.  Digital verification services which are not certified and therefore not on the DVS register cannot reliably be deemed suitable for identity verification in compliance with the Regulations.

Risk indicators

It is vital that AMPs understand and meet their obligations under the Regulations to protect themselves, their families and their communities from the dangers of infiltration or abuse by criminals.

Any weakness in a business’ AML controls may be exploited by criminals who will seek to use, coerce or control the AMP to move or realise more of their illicit money. Such money is often earned from activities that cause significant harm to society, such as drug dealing, people smuggling or modern slavery.

As AMP, it is important that you carefully assess and documents the specific risks that your business faces or may be exposed to and establishes and keeps up-to-date policies, controls and procedures including relevant staff training, to address these. These must be effective to help prevent money laundering, terrorist financing or proliferation financing through your business.

Risks common to all AMPs

The key risks faced by all AMPs include:

• Unusual sales or purchase activity
• Anonymity
• Risks associated with your service delivery channels (e.g. face-to-face compared to remote sales).
• High-risk jurisdictions, including sanctions-related risks
• Off-record sales

The below (non-exhaustive list provides some key indicators associated with these risks.

Key risk indicator	Notes
A potential sale or purchase of art does not appear to be normal business practice, have a valid commercial reason or makes no economic sense.	This could be the art, the delivery method or payment arrangements that are not consistent with the normal practice for the type of business concerned.
Anonymity with the buying and selling of artwork	The art market has traditionally operated in a way that provides anonymity with the buying and selling of artwork often conducted in private or through third parties to remain anonymous and conceal the beneficial owner. Whilst there are legitimate reasons for operating in such a way, this trading environment is advantageous to those seeking to launder money and criminals abusing such legitimate mechanisms for anonymity to shield their involvement and their source of funds during art transactions. This could be to purchase art with illicit funds, purchase art by someone sought by law enforcement, to hide beneficial ownership to evade tax or use art as a stored value which is easy to transport and trade, when moving currency through the banking system would raise suspicion.
Payment from FATF Call for Action Country, or country with high geographical risk.	FATF Call for Action Countries, or countries with high geographical risk are more likely to be linked to money laundering and terrorist financing. You should carefully consider the purpose and nature of any transaction with a business from FATF Call for Action Countries, or countries with high geographical risk, including potential sanctions or sanctions evasion risks. Some countries are deemed higher risk than others and/or have poor or insufficient money laundering and terrorist financing measures. Risks include levels of bribery and corruption, tax evasion, capital flight, conflict zones, and organised crime activity in a jurisdiction. It is not only the country that the customer is based in that may be the risk, but it could also be neighbouring countries as money laundering, terrorist financing and proliferation financing often involves the movement of funds across borders. Your business will be expected to develop and maintain awareness around these topics and incorporate it into your written policies and procedures and risk assessment.
Geographical Risks	Key markets such as the United States and China currently lack specific AML supervision for the sector, increasing vulnerability to criminal misuse. Given how easily art can be used to transfer value across borders, firms should apply robust customer due diligence, particularly when dealing with high-risk clients or those linked to higher-risk jurisdictions.
Remote sales compared with other sales	Face-to-face contact with a customer offers some form of tangible relationship and an opportunity to interact with the customer. Transactions made online, over the phone or via an intermediary reduce this exposure to the customer, decrease effective identification, and increase vulnerability to money laundering and terrorist financing. High-end, luxury-focused AMPs are in an excellent position to carry out effective customer due diligence (CDD) where their business model includes cultivating and building relationships with their customer.
Criminals take advantage of unwitting legitimate businesses.	Talking to your customers about the reason for the purchase, sale or, in a freeport, storage of art should help to determine whether there is a legitimate reason for the business or whether anything appears unusual.
The customer asks for the art to be delivered in an unusual manner or to an address that is not their own.	There may be a genuine reason for this, but it is important to ask questions to decide if the transaction should go ahead and/or a Suspicious Activity Report (SAR) filed.
A business wants to conduct a sale or purchase of art in cash for an ‘off the record sale’.	The sale is not likely to have been recorded in that business’ records and you are likely to be facilitating crime (e.g. money laundering or tax evasion) by facilitating such a transaction. If offering payment this way, the business is also likely to be using cash for other purposes, such as paying workers cash in hand and thus avoid paying tax and National Insurance on the wages, using illegal workers, or paying below the National Minimum Wage.
A new customer with little or no trading history and no trade references.	Is this a genuine customer or a front for a business that is possibly laundering money?

 

Risks relating to the Money Laundering Regulations

The below highlights risk indicators relating to non-compliance with elements of the Money Laundering Regulations including:

• Reliance
• Linked transactions.
• Data protection
• Online verification
• Unregistered AMPs
• Online sales
• Rental of art and interior designers

Key risk indicator	Notes
Customer due diligence (CDD) and reliance	As part of your CDD measures you can rely on CDD carried out by an appropriately supervised entity in certain circumstances. We have noted some misinterpretation of the use of reliance in the art industry. Reliance is covered under Regulation 39 of the MLRs. See Part 1 - AMLG11410 for more information.
Art and linked transactions	For AMPs, a linked transaction can occur when; a transaction over £10,000 appears to be have been deliberately broken down into several smaller payments so there are multiple payments against a single invoice (this does not include payments made via a finance or credit arrangement), or when several works of art each valued below £10,000 are sold at the same time together and thus the total sale price is over the AMP threshold. For example, an art gallery is selling paintings from one artist at £6,000 per painting. The same customer buys 3 paintings costing £18,000 at the same time. The sale is therefore above the threshold and subject to MLR requirements. It would not be appropriate to issue separate invoices for each piece of artwork and claim they were separate sales.
Data protection	Under Regulation 41 personal data obtained by you for the purpose of the Regulations, e.g. for CDD purposes, may only be processed for the prevention of money laundering and terrorist financing unless use of the data is allowed by other legislation.
Dealing with an unregistered AMP	As part of your CDD measures, if you are dealing with another AMP, you should check on GOV.UK whether the business is registered with HMRC for AML supervision. If not, you should not continue dealing with that AMP and report them to HMRC. You should consider reporting this activity to the National Crime Agency (NCA) via a SAR
Online sales verification	Verifying identity for online sales is different to with face-to-face transactions as you do not have that interaction with the customer. For online and remote sales after receiving the identity documents you need to verify them. If you cannot meet the customer in person and inspect the original documents in their presence, and do not have relevant digital ID and screeningservice (see below), HMRC recommends that you conduct a video call to ensure the person you are dealing with is genuine and is the person in the identity documents. Digital identity services certified under the UK Digital Identity and Attributes Trust Framework and included on the DVS Register are considered a reliable and independent source of information, provide an appropriate level of assurance against impersonation, and can be relied upon when conducting customer due diligence. Entities are able to fulfil their obligations under regulation 28 by verifying a customer who is a natural person’s identity using certified and registered digital identity services. Digital verification services which are not certified cannot reliably be deemed suitable for identity verification in compliance with the Regulations.
Renting of art	If you are renting out art, you could still fall within the scope of an AMP. If you are renting art with no obligation on the renter to buy, then you are not an AMP. It will depend on the contract that is in place. If the rental amount is inflated to reduce the final sale amount, this could be seen by HMRC as a way to avoid the requirements under the Regulations.
Interior designers	An interior designer could be an AMP if they  are acting as an intermediary in the sale or purchase of art above the threshold. This would depend on what the interior designer’s working agreement is with their customer. If the interior designer is buying the art on behalf of their customer, they will have to declare who their customer is to the selling AMP, so they conduct the correct CDD.