Skip to content
  • There are no suggestions because the search field is empty.

HMRC’s 2025 Risk Assessment: What UK AMPs must include in a business-wide AML risk assessment

Under the Money Laundering Regulations (MLRs), every Art Market Participant (AMP) must maintain a written, up-to-date business-wide risk assessment. This assessment must identify, document and evaluate the money laundering and terrorist financing risks specific to your business.

Following HMRC's 2025 risk assessment guidance for AMPs, your business-wide risk assessment must cover five key risk factors -

1. Customers

Assess the types of customers you deal with, including:

  • Individual collectors, corporate buyers, trusts or intermediaries
  • Ownership structures and beneficial ownership complexity
  • Geographic exposure (where your customers are based)
  • Customer behaviour patterns and transaction history

Consider whether any customer types present heightened risk due to their profile, jurisdiction or transaction patterns.

2. Countries or geographic areas

Evaluate money laundering and terrorist financing risks associated with:

  • Where your clients and counterparties are based
  • Where artworks originate from or are destined for
  • Sanctioned or high-risk jurisdictions identified by HMRC, FATF or UK sanctions lists
  • Cross-border transactions and international shipping arrangements

HMRC specifically identifies Iran, North Korea, Russia and Syria as key jurisdictions of concern for proliferation financing.

3. Products or services

Document the types of art and services you offer, including:

  • Categories of art traded or stored (paintings, sculptures, drawings, etc.)
  • High-value items that may appeal to criminals seeking to launder money
  • Sales of art, advisory or authentication services
  • Whether you facilitate private sales or operate as an intermediary

Consider how the portability, subjectivity of value and lack of transparency in certain art markets may increase risk.

4. Transactions

Analyse transaction characteristics such as:

  • Size and frequency of transactions
  • Payment methods, including cash, bank transfers, crypto-assets or intermediary arrangements
  • Unusual transaction patterns or amounts inconsistent with customer profiles
  • Transactions involving multiple jurisdictions or complex payment structures

HMRC flags crypto-asset payments as high risk due to anonymity and traceability issues.

5. Delivery channels

Assess how you conduct business and interact with customers:

  • Face-to-face sales versus remote or online transactions
  • Use of intermediaries or agents
  • Private sales versus public auctions
  • How your delivery channel affects your ability to verify customer identity and conduct due diligence

Remote and intermediary transactions may obscure beneficial ownership and present elevated risk.

Risk management and mitigation:

Your business-wide risk assessment must not only identify risks but also demonstrate how they are managed and mitigated. This should be detailed in your AML Policy and supporting documentation, covering for example:

  • Customer due diligence procedures (standard, simplified, and enhanced)
  • Sanctions screening processes
  • Suspicious Activity Report (SAR) procedures
  • Ongoing monitoring of customer relationships and transactions
  • Staff training and awareness
  • Record-keeping and documentation requirements

Review and update requirements:

HMRC requires that your risk assessment be:

  • Written and documented
  • Kept up to date
  • Reviewed whenever there are changes to your business model, customer base, transaction methods or the regulatory environment
  • Available to provide to HMRC upon request

ArtAML™ support:

ArtAML™'s business-wide risk assessments address all five risk factors required by HMRC and are accompanied by a corresponding AML Policy that includes tailored policies, controls and procedures. Our templates are regularly updated to reflect evolving regulatory requirements and emerging threats in the art market.

If you would like support in developing or updating your business-wide risk assessment, get in touch with our Compliance Team.

References: