Money laundering regulations appear twice in CeMAP®, both in CeMAP 1 (FSRE), set by Walbrook (LIBF). FRE1 AC1.4 covers the "Main types and impacts of financial crime", and FRE2 AC7.2 covers "Anti-money-laundering and proceeds of crime rules and obligations". The regime is UK-wide: the regulations and the Proceeds of Crime Act apply across England, Wales, Scotland and Northern Ireland, though some criminal procedure differs in Scotland. For the module as a whole, see the CeMAP 1 (FSRE) hub; for each unit, the FRE1 guide and the FRE2 guide.
| Law or rule | What it does for CeMAP |
|---|---|
| Money Laundering Regulations 2017 (MLR 2017) | Duties on firms: risk assessment, customer due diligence, records, training, a nominated officer |
| Proceeds of Crime Act 2002 (POCA), Part 7 | The offences: laundering, failure to disclose, tipping off |
| Terrorism Act 2000 | Parallel offences and reporting duties for terrorist financing |
| FCA SYSC 6.3 | How FCA-authorised firms organise AML systems, including the MLRO |
What are the Money Laundering Regulations?
The Money Laundering Regulations are the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, SI 2017/692. They require regulated firms, including mortgage lenders and intermediaries, to take a risk-based approach to preventing money laundering and terrorist financing.
The MLR 2017 have been amended several times, most recently by the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621), made on 9 June 2026. That amendment changes parts of the due diligence and trust register rules; check your study materials for the version Walbrook examines.
What the regulations require of a firm
- A firm-wide risk assessment of the money laundering and terrorist financing risks it faces, by customer, product, channel and country.
- Written policies, controls and procedures that match those risks.
- Customer due diligence (CDD) before establishing a business relationship, with simplified or enhanced measures where the risk is lower or higher.
- Training so staff can recognise and report suspicious activity.
- A nominated officer, usually called the money laundering reporting officer (MLRO), under regulation 21.
- Record keeping: CDD records for 5 years from the end of the business relationship; records of individual transactions within it need not be kept for more than 10 years (regulation 40).
The FCA supervises AML compliance at authorised firms, while other bodies supervise estate agents (HMRC) and solicitors (their professional bodies). The FCA's SYSC 6.3 adds that the MLRO reports to senior management at least once a year, and that a director or senior manager holds overall responsibility for AML systems. Firms also follow industry guidance from the Joint Money Laundering Steering Group (JMLSG). Data protection, the other big compliance topic in FRE2 AC7.2, is separate law; it is covered in the FRE2 guide.
Key fact: MLR records are kept for 5 years from the end of the relationship, not from the start. For a 25-year mortgage, the identity evidence is kept until 5 years after the loan is redeemed.
What are the three stages of money laundering?
The three stages of money laundering are placement, layering and integration: criminal cash enters the financial system, is moved to hide its origin, and finally returns as apparently legitimate wealth. Property and mortgages can be used at all 3 stages.
| Stage | What happens | Mortgage or property example |
|---|---|---|
| Placement | Criminal cash is put into the financial system | Cash paid into several accounts to build up a house deposit |
| Layering | Funds are moved through transactions to obscure the trail | Large lump-sum overpayments on a mortgage, followed by a further advance or a redraw |
| Integration | The money reappears as legitimate | The property is sold and the proceeds look like an ordinary house sale; or rental income from a laundered property |
Financial crime in FRE1 AC1.4 is wider than laundering. It also covers terrorist financing, fraud (including mortgage fraud), market abuse and bribery. Mortgage fraud links back to laundering: a mortgage obtained by lying about income can turn the property, or the money gained from it, into criminal property.
Exam tip: Placement is the riskiest stage for the criminal, because cash is hardest to explain. Questions about cash deposits are almost always about placement.
What are the offences under the Proceeds of Crime Act 2002?
The offences under the Proceeds of Crime Act 2002 are the principal offences in sections 327 to 329 (concealing, arranging, acquiring or using criminal property), failure to disclose in section 330, and tipping off in section 333A. The principal offences carry up to 14 years.
| Section | Offence | Maximum sentence on indictment |
|---|---|---|
| s.327 | Concealing, disguising, converting, transferring or removing criminal property | 14 years and/or a fine |
| s.328 | Entering into or becoming concerned in an arrangement that facilitates another person's laundering | 14 years and/or a fine |
| s.329 | Acquiring, using or possessing criminal property | 14 years and/or a fine |
| s.330 | Failure to disclose: a person in the regulated sector who knows or suspects, or has reasonable grounds to know or suspect, laundering and does not report it | 5 years |
| s.333A | Tipping off in the regulated sector | 2 years |
Sentences come from sections 334 and 333A of POCA 2002. Criminal property means any benefit from criminal conduct, of any size, which the person knows or suspects is such a benefit.
Section 328 is the one that catches advisers. Arranging a mortgage for a client while suspecting the deposit is criminal property can be "becoming concerned in an arrangement". The defence is an authorised disclosure: reporting the suspicion before acting, and, where needed, waiting for consent.
The failure-to-disclose test in section 330 is objective as well as subjective. An adviser who should have been suspicious, given the facts, can commit the offence even without actual suspicion.
Key fact: Under section 330, "reasonable grounds to suspect" is enough. An adviser cannot avoid the offence by not thinking about the warning signs.
What is customer due diligence, and when is it enhanced?
Customer due diligence is the MLR 2017 duty to identify each customer and verify their identity, identify any beneficial owner holding more than 25%, understand the purpose of the relationship and monitor it. Enhanced due diligence applies to higher risks, including PEPs and high-risk countries.
Standard CDD (regulations 27 and 28)
- Identify and verify the customer from reliable, independent sources: for example a passport or driving licence, plus proof of address or electronic verification.
- Beneficial owners: for a company or trust, identify the individuals who ultimately own or control it, generally anyone with more than 25%.
- Purpose and nature: understand why the customer wants the mortgage and where the money is coming from.
- Ongoing monitoring: scrutinise transactions during the relationship and keep information up to date.
CDD happens before the relationship starts. If a firm cannot complete it, it must not proceed, and it must consider whether a report is needed.
Simplified and enhanced due diligence
| Level | When | Examples of measures |
|---|---|---|
| Simplified (reg. 37) | Assessed lower risk | Reduced verification or monitoring, never none |
| Enhanced (reg. 33) | Higher risk, including complex or unusually large transactions, high-risk third countries, PEPs | Extra evidence of source of funds and wealth, senior management approval, closer monitoring |
Politically exposed persons (reg. 35)
A PEP is someone entrusted with a prominent public function, such as a minister, senior judge, ambassador or senior officer of the armed forces, plus their family members and known close associates. For a PEP, a firm must get senior management approval, establish the source of wealth and funds, and apply enhanced ongoing monitoring. Since 10 January 2024, regulation 35(3A) says a domestic (UK) PEP starts from a lower level of risk than a non-domestic PEP, if no other risk factors are present.
Exam tip: "Source of funds" is where the money for this transaction comes from; "source of wealth" is how the customer built up their total wealth. EDD for a PEP needs both.
What must an adviser do with a suspicion?
An adviser who knows or suspects money laundering must report it to the MLRO, the nominated officer under regulation 21. The MLRO decides whether to send a suspicious activity report (SAR) to the National Crime Agency (NCA). An internal report meets the section 330 duty.
The reporting sequence
- Spot the concern during fact-finding, document checks or the application.
- Report internally to the MLRO straight away, using the firm's procedure. Do not investigate further to "make sure".
- Say nothing to the client about the report.
- Follow the MLRO's instruction on whether the case can continue.
- The MLRO assesses the report and, if the suspicion stands, submits a SAR to the NCA.
- Consent where needed. If the firm wants to continue with the transaction, the MLRO asks for a defence against money laundering (DAML). The NCA has 7 working days to respond. If it refuses, a 31-day moratorium follows, which a court can extend.
- Keep records of the internal report and the MLRO's decision.
| Term | Meaning |
|---|---|
| SAR | Suspicious activity report to the NCA |
| DAML | Defence against money laundering, the NCA's consent to proceed |
| Notice period | 7 working days from the day after the disclosure |
| Moratorium | 31 days after a refusal |
The time limits come from section 335 of POCA 2002. The NCA's SAR guidance explains the system from the reporting side.
Key fact: The adviser reports to the MLRO, not to the NCA directly. The MLRO, not the adviser, decides whether a SAR goes to the NCA.
What is tipping off?
Tipping off is the section 333A POCA 2002 offence of disclosing, from information gained in regulated business, that a SAR has been made or an investigation is under way, where this is likely to prejudice it. The maximum sentence is 2 years.
The risk for a mortgage adviser is ordinary customer service. Explaining a delay with "compliance have flagged your deposit and passed it on" is tipping off. So is warning a colleague at another firm who is not in the same group.
There are limited exceptions. Disclosures within the same undertaking or group, between certain regulated firms about a shared client, to a supervisor, or to prevent an offence are allowed. In practice, an adviser asking a client for evidence of the source of a deposit is normal due diligence, not tipping off. The difference is whether the adviser reveals that a report exists.
| Allowed | Tipping off |
|---|---|
| "The lender needs bank statements showing where the deposit came from." | "We've had to report your deposit to the authorities." |
| Telling the MLRO about the concern | Telling the client's estate agent that a report has been made |
| "The application is still being processed." | "There is an investigation into your funds." |
Exam tip: Asking questions is due diligence. Revealing that a report or investigation exists is tipping off.
What are the warning signs in a mortgage application?
The warning signs in a mortgage application are facts that do not add up: an unexplained deposit, third-party funds, income that does not fit the job, or pressure to rush. One sign proves nothing, but section 330 means it must be questioned.
Worked example: a deposit that does not add up
Kieran, 29, is buying a £320,000 flat with an £80,000 deposit and a £240,000 mortgage, so the loan to value is 75%. His payslips show £34,000 a year as a warehouse supervisor. He says £30,000 is savings, but his statements show £6,000 in his account three months ago. The other £50,000 is described as a gift from "a friend" overseas. He asks the adviser to "keep it simple" and complete within four weeks.
| Fact | Why it matters |
|---|---|
| Savings jumped from £6,000 to £30,000 in three months | Unexplained source of funds |
| £50,000 gift from a non-family member abroad | Third-party funds; possible hidden interest in the property |
| Deposit of 25% on a £34,000 salary | Wealth inconsistent with income |
| Pressure for speed and simplicity | Classic attempt to cut checks short |
The adviser asks for the source of the extra savings and full details of the donor. If the answers do not resolve the concern, the adviser reports it to the MLRO and says nothing to Kieran about the report. If Kieran then withdraws the application, the report is still required.
Other signs worth knowing: cash deposits, reluctance to provide identification, a buyer using a company with unclear ownership, a price well above or below market value, and repeated large overpayments soon after completion. The conveyancer runs its own AML checks on purchase funds; our conveyancing process guide shows where they fit.
Exam tip: In a case study, list the facts that do not match. The question usually asks what the adviser should do next, and the answer is to report to the MLRO, not to the NCA and not to the client.
Your money laundering regulations study plan for FRE1 and FRE2
Your money laundering regulations study plan for FRE1 and FRE2 takes about three study sessions: learn the MLR 2017 duties and the 3 stages, memorise the POCA sections and sentences, then practise scenario questions on reporting and tipping off until you score 85% or more consistently.
- Session 1. Take the free FRE2 diagnostic. Then learn the six MLR duties and the three stages with a mortgage example for each.
- Session 2. Make a five-row card: s.327, s.328, s.329, s.330, s.333A, with the sentence for each. Add the 7-day and 31-day periods.
- Session 3. Drill AML with the FRE2 regulatory framework topic practice, which also covers complaints, the FOS and the FSCS. For the financial crime side of FRE1, use the FRE1 markets and financial crime drill.
For short sessions, use the free FRE2 quick practice, and sit the free FRE2 mock 1 when the topic is secure. AML sits next to complaints and compensation in the same criterion, so read the FSCS and FOS guide alongside this one, and the FCA and PRA guide for who supervises firms.
The sample questions below come from our FRE2 bank. Topic drills and mocks 2 to 10 are part of Pro, at £6.99 a week, £11.99 a month or £22.99 for three months, covering all five units. Our readiness rule matches the app: three mocks in a row at 85% or more, with every topic at 80% or more. It is a guide, not a pass guarantee.
10 free FRE2 practice questions with answers
Try each one, then open the answer. For a timed experience use the free mock exam.
1. If the NCA refuses consent during the notice period for a transaction, how long is the moratorium period during which the firm must not proceed, unless a court extends it?
- A. 7 working days
- B. 31 days
- C. 14 days
- D. 6 months
Show answer
B. 31 days
Section 335(6) of POCA sets a moratorium period of 31 days, starting with the day the person receives notice that consent is refused. A court can extend the moratorium under section 336A. After it ends, the firm is treated as having consent.
2. A client stepped down as a senior judge eight months ago. How should the firm treat him under the PEP rules in the MLR 2017?
- A. As a PEP only if he holds another public office
- B. As a PEP for at least 12 months after he left office
- C. As a PEP only until he receives his final salary
- D. As an ordinary customer from the day he left office
Show answer
B. As a PEP for at least 12 months after he left office
Regulation 35(9) requires the PEP measures to continue for at least 12 months after the person ceased to be entrusted with the prominent public function, or longer if the firm considers it necessary because of the risk. Eight months after leaving office, he is still treated as a PEP.
3. Under the Consumer Rights Act 2015, can a trader exclude liability for death or personal injury caused by its negligence?
- A. No, such a term or notice cannot bind the consumer
- B. Only for services provided free of charge
- C. Yes, if the term is clearly printed
- D. Yes, if the consumer signs separately
Show answer
A. No, such a term or notice cannot bind the consumer
Section 65(1) says a trader cannot, by a term of a consumer contract or a consumer notice, exclude or restrict liability for death or personal injury resulting from negligence.
4. After selling her home, Grace has £900,000 of sale proceeds in her bank account while she waits to buy her next property. What FSCS protection applies to this temporary high balance?
- A. Up to £120,000 only
- B. Up to £1 million for twelve months
- C. The full amount with no time limit
- D. Up to £1.4 million for six months
Show answer
D. Up to £1.4 million for six months
The FSCS protects qualifying temporary high balances, such as proceeds from selling a home, up to £1.4 million for six months from when the amount was first deposited. After that, the standard deposit limit applies.
5. Which senior manager conduct rule is breached if a senior manager hands responsibility for a function to an unqualified colleague and never checks on it?
- A. SC4, disclosing information to the regulators
- B. SC3, appropriate delegation and effective oversight
- C. Rule 3, openness and cooperation with regulators
- D. Rule 5, proper standards of market conduct
Show answer
B. SC3, appropriate delegation and effective oversight
Senior Manager Conduct Rule SC3 requires a senior manager to take reasonable steps to ensure that any delegation is to an appropriate person and that they oversee the delegated responsibility effectively.
6. Advice was given to Maria in October 2018. She realised it was unsuitable in January 2026 and complained to the firm in October 2026. Is her complaint within the Ombudsman's time limits?
- A. No, as more than six years have passed since the advice
- B. No, as complaints must be made within 12 months of awareness
- C. Yes, as it is within three years of when she became aware
- D. Yes, as there is no time limit for mortgage complaints
Show answer
C. Yes, as it is within three years of when she became aware
DISP 2.8.2R(2) bars complaints referred more than six years after the event or, if later, more than three years after the complainant became, or ought reasonably to have become, aware of the cause for complaint. Maria became aware in January 2026, so a complaint in October 2026 is within the three-year limit even though the six-year limit has passed.
7. An adviser's analysis finds a client is eligible for a lender's product only if she adds a £999 fee to the loan. What must the adviser consider before recommending this?
- A. Whether paying the fee up front would be better for her
- B. Whether the lender will reduce its valuation fee
- C. Whether the fee is lower than the adviser's commission
- D. Whether her employer will pay the fee
Show answer
A. Whether paying the fee up front would be better for her
MCOB 4.7A.6R lists whether the customer should pay fees up front rather than add them to the loan among the suitability factors. Adding a fee means paying interest on it over the term, so the adviser must consider whether she can and should pay it up front.
8. Two unmarried clients buying a home together ask their mortgage adviser to draft a declaration of trust setting out their shares. What should the adviser do?
- A. Ask the estate agent to prepare the declaration
- B. Refer them to a solicitor or conveyancer for legal advice
- C. Draft the declaration using a standard online template
- D. Tell them a declaration of trust is never needed
Show answer
B. Refer them to a solicitor or conveyancer for legal advice
Drafting legal documents and advising on how property is held are matters for a solicitor or conveyancer. The adviser should highlight why this matters and refer the clients for legal advice, rather than act beyond their expertise.
9. What is the FCA's stated aim for vulnerable customers in FG21/1?
- A. That firms refuse to deal with them to avoid any harm
- B. That they always receive lower prices than other customers
- C. That they experience outcomes as good as other consumers
- D. That they are always served by a specialist team only
Show answer
C. That they experience outcomes as good as other consumers
FG21/1 says the FCA wants vulnerable consumers to experience outcomes as good as those of other consumers and to receive consistently fair treatment. Firms should adapt their approach rather than exclude vulnerable customers.
10. A broker discovers that one of its directors has been using client fees to pay personal debts, which could seriously damage the firm's reputation. When must the firm tell the FCA?
- A. In its next regular regulatory return
- B. Only once its internal investigation ends
- C. Immediately it becomes aware of the matter
- D. Only if a customer complains about it
Show answer
C. Immediately it becomes aware of the matter
SUP 15.3.1R requires a firm to notify the FCA immediately it becomes aware of, or has information reasonably suggesting, a matter that could have a significant adverse impact on its reputation. Waiting for a return, an investigation or a complaint would not meet this standard. The duty reflects Principle 11, which requires openness with the regulator.
Frequently asked questions
+Who is the MLRO?
The MLRO, or money laundering reporting officer, is the nominated officer every regulated firm must appoint under regulation 21 of the MLR 2017. Staff report suspicions to the MLRO, who decides whether to send a suspicious activity report to the National Crime Agency and reports to senior management at least once a year.
+What is a politically exposed person?
A politically exposed person, or PEP, is someone entrusted with a prominent public function, such as a government minister, senior judge, ambassador or senior military officer, in the UK or abroad. Their family members and known close associates are treated in the same way. Firms must apply enhanced due diligence to them.
+Can a mortgage adviser tell a client they have made a report?
No. Telling the client, or anyone else, that a report has been made or that an investigation is under way can be the offence of tipping off under section 333A of POCA 2002, with a maximum sentence of 2 years. The adviser should say nothing about the report and leave the next step to the MLRO.
+Do I have to report a suspicion if the deal does not go ahead?
Yes. The duty under section 330 of POCA 2002 arises from knowing or suspecting money laundering, not from completing a transaction. If a client walks away after an adviser questions the source of a deposit, the suspicion still has to be reported to the MLRO.
+Why do lenders ask where my deposit came from?
Because the Money Laundering Regulations require lenders and their intermediaries to understand the source of funds behind a transaction. Evidence such as bank statements, a sale completion statement or a signed gifted deposit letter shows that the money is legitimate and that a gift does not come with a hidden loan or interest in the property.
+What is the maximum sentence for money laundering?
The principal money laundering offences in sections 327 to 329 of POCA 2002 carry a maximum of 14 years' imprisonment and an unlimited fine on indictment. Failure to disclose carries up to 5 years and tipping off up to 2 years.
Keep reading
- CeMAP FRE2: Skills, Principles and Ethical BehavioursCeMAP FRE2 mock exam guide: the 40-question format, LO6 to LO8 in official order, the Consumer Duty link, common traps and a four-week plan.
- CeMAP FRE1: Industry, Regulation and Key PartiesCeMAP FRE1 mock exam guide: the 40-question format, all five learning outcomes in order, common traps and a four-week plan, with free FRE1 questions.
- CeMAP 1: The FSRE Module and Its Two Unit Exams, FRE1 and FRE2CeMAP 1 is the FSRE module: two 40-question unit exams, FRE1 and FRE2, each 1 hour, pass 28/40. Syllabus, costs, old UKFR mapping and free mocks.
- The FSCS and the Financial Ombudsman Service for CeMAP FRE2FSCS and FOS for CeMAP FRE2: complaint handling rules, the 8-week and 6-month limits, FOS award limits, FSCS cover and what happens if a lender fails.
- The FCA, the PRA and UK Financial Regulation for CeMAP FRE1The FCA and PRA for CeMAP FRE1: the 1986–2021 timeline, statutory objectives, the Handbook, Principles for Businesses, SM&CR and enforcement powers.