There is a firm on the SRA’s register that ran without compliant AML policies, controls and procedures from 26 June 2017 until 1 June 2025. The regulator published the outcome this June. That firm had nothing in place. Its failure was easy to spot.
Three weeks later, on 30 June, the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 came into force. These amendments ‘appear’ easier, but they actually create a different, harder problem.
What actually changed
Most reporting on this has called it burden reduction: EDD gets narrower, high-risk country rules relax, proportionality wins. That’s true although I don’t believe the burden has been reduced.
One change matters more than the rest. EDD is defined in the regulations, and your policies, controls and procedures need to reflect that. Now, the wording has changed from “complex or unusually large” to “unusually complex or unusually large, in each case given the nature of the transaction’. Those final two words have changed the game.
Why this is not relief
“Complex” was an easy bar to clear. You could apply EDD widely, document it, and pass your audit.
“Unusually complex” can’t be cleared the same way. It isn’t a threshold, it’s a comparison. Something is only unusual against a baseline of what’s usual. And the new wording tells you whose baseline that is: yours. Your firm. Your clients. Your matter types.
The Treasury’s reasoning was that the old rule pushed firms to be too cautious, because most transactions can look complex which is a fair point. But the fix moves the definition out of the rulebook and onto you. The regulations used to hand you a trigger. Now you have to build one.
The same shift happens with geography. Under the new rules, only FATF call-for-action countries trigger EDD automatically. Everything else such as the whole grey list, every country under increased monitoring is no longer an automatic trigger. It’s now a risk factor you’re required to weigh yourself.
The uncomfortable question
Here’s a question a supervisor will ask you that they wouldn’t ask in May:
What is usual for your firm — who decided that, when, and based on what evidence?
Most firms can’t answer this. Not because they’re badly run, but because until 30 June, nobody needed to.
Here’s why that matters for audits. An audit checks whether your people followed your process. If your process says “apply EDD to complex transactions” and your people did that, the audit passes. It passes whether your definition of “complex” is solid, arbitrary, or now out of date. Audits test whether the process was followed. They’ve never tested whether the process was right.
That’s the gap. It isn’t about effort or honesty. It’s a gap in design — and it’s invisible to almost every control most firms run today.
What a defensible answer looks like
Not a longer policy. A shorter one, backed by evidence: your own written definition of “usual,” built from your own files, dated and signed off before the matters it governs — with the grey list dealt with explicitly, not left to chance.
Why the clock matters
The supervisor is changing too. HM Treasury confirmed in June that the FCA will become the single AML supervisor for the sector, and that it will assess firms on integrity, competence and compliance history, not just process.
But “compliance history” is the catch. The file a future supervisor reads is the one being written right now. The SRA’s annual AML data return closed in July — every firm has just told the regulator, in structured form, what work it does. Those answers sit alongside your case files. Checking whether what you declared matches what your files actually show isn’t hard to do. You don’t want to be the mismatch.
Where we come in
Halo AML tests the design, not the doing. We take your risk assessment, your policies, and your actual matters, and ask the questions a supervisor will ask about definitions, not just adherence. What we hand back is evidence: what your framework claims, what your files show, and where the two don’t line up.
Want to know if your definition of “unusual” would hold up to a supervisor? That’s a ten-minute conversation to get wrong, and a longer one to get right. We’ll have the second conversation with you, free, before we talk about anything else.