Firm-wide risk assessment
About this assessment
This is the written record of the steps Carrow Hale Residential LLP has taken to identify and assess the risks of money laundering and terrorist financing to which its business is subject (reg 18(1); reg 18(4)). Sections 2 to 6 take in turn the five risk factors the Regulations name (reg 18(2)), section 7 brings them together, section 8 records the controls and the actions, and section 9 is the business’s assessment of proliferation financing risk (reg 18A(1)).
For each factor it sets out the evidence from the business’s answers, then the business’s own assessment of the risk, the rating it chose and why, and how it mitigates the risk. Where the business said something is not yet in place, this assessment says so and lists it under Actions in section 8.
HMRC’s officers are told that bought-in risk assessments and policies are often generic and may not properly assess the specific risks of the business (HMRC ECSH53175; HMRC ECSH55175); this assessment records the business’s own.
It takes into account HMRC’s risk assessments of estate agency and letting agency businesses (HMRC AMLG3200; HMRC AMLG3300) and the national risk assessment (NRA 2025, estate agency businesses (¶¶5.243–5.263); NRA 2025, letting agency businesses (¶¶5.264–5.274)).
- The business must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which it is subject (reg 18(1)).
- In doing so it must take into account the information HMRC makes available, including HMRC’s risk assessment of estate agent or letting agent businesses, and risk factors relating to its customers, the countries or geographic areas in which it operates, its products or services, its transactions and its delivery channels (reg 18(2); HMRC AMLG3200; HMRC AMLG3300).
- The steps that are appropriate depend on the size and nature of the business (reg 18(3)).
- The business must keep an up-to-date written record of the steps it has taken (reg 18(4)), and give the assessment and the information it was based on to HMRC on request (reg 18(6)).
- HMRC expects the risk assessment to be reviewed at least annually (HMRC AMLG1800), and to reflect any new service or new way of operating, with the policies updated before it starts (HMRC AMLG3200).
1. The business
| Name | Carrow Hale Residential LLP |
|---|---|
| Address | Unit 4, Imaginary Mews, London, ZZ99 9ZZ |
| Companies House number | OC0990003 |
| HMRC money laundering registration number | XGML00000910003 |
| Supervisor | HMRC |
| Sales, lettings or both | Sales only |
| How the business is set up | Partnership |
| People working in the business besides the principal | 16 to 50 |
| Offices or branches | One office |
| Trading for more than 12 months | Yes |
| Nominated officer (MLRO) | Chris Hale |
Who the Regulations cover
- An estate agent is a firm or sole practitioner who, or whose employees, carry out estate agency work, read in accordance with section 1 of the Estate Agents Act 1979 and including work on land outside the UK (reg 13(1),(2)).
The sector
The national risk assessment says property purchases remain an attractive way to launder illicit funds, because of the large amounts that can be moved and the stability of property as an asset (NRA 2025, property typology (¶¶3.86–3.98)).
The NRA 2025 rates the money laundering risk of estate agency businesses as medium, risen slightly since 2020 (NRA 2025, estate agency businesses (¶¶5.243–5.263); HMRC AMLG3200).
The national risk assessment reports that some estate agents do not carry out sufficient risk assessment and due diligence, assuming others in the chain will do the checks (NRA 2025, estate agency businesses (¶¶5.243–5.263)).
HMRC’s handbook for its officers lists the common estate agency risks as including super-prime property, special purpose vehicles, customers whose profile does not fit the property, a FATF call for action link and non-resident customers (HMRC ECSH53125); for letting agents, rent or fees paid by an unconnected third party, rent or deposits in cash or foreign currency, rent paid up front and a tenant immediately sub-letting (HMRC ECSH55125).
2. Customers
Evidence
The business’s customers are one of the risk factors it must take into account (reg 18(2)).
| Fact | The business’s answer |
|---|---|
| Sellers acted for in the past 12 months | 11 to 50 |
| Buyers with an offer accepted in the past 12 months | 11 to 50 |
| Cash buyers | 11 to 50 |
| Purchases paid for in part by someone else | 1 to 10 |
| Customers that are companies, trusts or special purpose vehicles | 1 to 10 |
| Politically exposed persons, their family or close associates | 1 to 10 |
| Any of them a PEP entrusted with public functions by a country other than the UK | Yes |
| Links to the UK sanctions list | No |
| Citizenship-by-investment passports with a place of birth elsewhere | Not recorded |
| Customers connected to a cash-intensive business | No |
For a domestic PEP the starting point is a lower level of risk than for a non-domestic PEP (reg 35(3A)); HMRC says a non-domestic PEP, one entrusted with prominent public functions by a country other than the UK (reg 35(12), (14)), must be treated as high risk (HMRC AMLG3200; HMRC AMLG3300).
The business’s assessment
Most of our buyers are families moving within west London, but in the past year a third of our buyers lived abroad and one was a senior official in another country. Buyers who live overseas and buy through advisers are the customers we know least about, and the overseas official needed the most work before we were comfortable to act.
How the business mitigates it
- The business screens customers for politically exposed persons and sanctions when it takes them on.
- The business applies enhanced due diligence to the customers this concerns.
- A director, partner or other senior person approves taking on the customers this concerns.
- The business checks at take-on whether a customer or beneficial owner is a politically exposed person.
Any buyer we have not met, or who is politically exposed, is approved by a partner before we accept an offer.
3. Countries and geographic areas
Evidence
The countries or geographic areas in which the business operates are one of the risk factors it must take into account (reg 18(2)).
| Fact | The business’s answer |
|---|---|
| Customers living or based outside the UK | 11 to 50 |
| Buyers living or based outside the UK | 11 to 50 |
| Money coming from a bank account outside the UK | Sometimes |
| Links to a FATF call for action country | No |
| Links to a country HMRC treats as higher risk, or bordering a call for action country | Yes |
The business must apply enhanced due diligence and enhanced ongoing monitoring in the cases listed in reg 33(1) (reg 33(1)), including a PEP or a PEP’s family member or known close associate (reg 33(1)(d)) and any business relationship with a person established in a FATF call for action country (reg 33(1)(b); SI 2026/621).
HMRC says services to or from overseas jurisdictions, or to customers, intermediaries and third parties based overseas, may pose an increased risk (HMRC AMLG3200).
This assessment does not copy the FATF call for action list: it is the list as it has effect at the time that counts (reg 33(3); FATF list of High-Risk Jurisdictions subject to a Call for Action (current edition)).
The business’s assessment
A large share of the deposit money we see arrives from banks outside the UK, often through a relative or a company in a third country. None of our parties has a link we know of to a call for action country, but two buyers this year had links to countries HMRC treats as higher risk.
How the business mitigates it
- The business checks the source of funds where the risk calls for it.
- The business checks where customers are established against the current FATF call for action list.
- The business obtains evidence of source of funds, and of source of wealth where enhanced due diligence applies, before the sale or letting goes ahead.
We ask for bank statements from the sending account before exchange.
4. Products and services
Evidence
The business’s products and services are one of the risk factors it must take into account (reg 18(2)).
| Fact | The business’s answer |
|---|---|
| Sales, lettings or both | Sales only |
| Super-prime sales in the past 12 months | Yes |
| Auction sales | No |
| Property sourcing, deal packaging or relocation work | Yes |
| Commercial property or land | No |
| Property outside the UK | No |
| Property management | No |
- Residential sales: HMRC says the risks for residential property are higher than for commercial property, because customer turnover is higher, the property is easier to sell on and it can be lived in using criminal funds (HMRC AMLG3200).
- Super-prime property: HMRC says any super-prime transaction, residential or commercial, should be treated as high risk (HMRC AMLG3200).
- Property sourcing and relocation: Property sourcing, deal packaging, investment brokering and relocation work for buyers are estate agency work (HMRC AMLG2200), and intermediaries can put distance between the customer and the agent (HMRC AMLG3200).
- Estate agency work has no money threshold. A property transaction always has an element of duration, so it is a business relationship, not an occasional transaction (HMRC AMLG2200), and an estate agent is treated as entering into a business relationship with a purchaser (as well as with a seller) when the purchaser’s offer is accepted by the seller (reg 4(3)).
- HMRC treats property worth £5 million or more in London and the South East, or £1 million or more elsewhere in the UK, as super-prime (HMRC AMLG3200).
The business’s assessment
We sold four homes above five million pounds this year, which HMRC calls super-prime, and we search for properties on behalf of two relocation clients. Those sales are large, the buyers often act through others, and the price makes it worth a criminal’s effort.
How the business mitigates it
- The business completes the buyer’s due diligence before an offer is accepted.
Every super-prime sale is reviewed by the nominated officer before the offer is accepted.
5. Transactions
Evidence
The business’s transactions are one of the risk factors it must take into account (reg 18(2)).
| Fact | The business’s answer |
|---|---|
| Money held for customers | No |
| Payments from someone other than the customer | No |
| Cash accepted | No |
| Cryptoassets accepted | No |
| Foreign currency accepted | No |
| The same property sold or let again within a short time | No |
The business’s assessment
The purchase money goes between the solicitors, not through us. We do not hold deposits or rent, and we have not been paid our fee by anyone but the seller.
How the business mitigates it
- The business checks that the person paying is the customer it has verified.
We check the name on every payment of our fee against the seller we verified.
6. Delivery channels
Evidence
The business’s delivery channels, the ways it takes on and deals with customers, are one of the risk factors it must take into account (reg 18(2)).
| Fact | The business’s answer |
|---|---|
| Customers taken on without meeting them | Sometimes |
| Instructions taken online only | No |
| Customers through introducers or intermediaries | Yes |
| Electronic identity check | Yes |
| Identity service on the DVS register | Not sure |
Taking on a customer without meeting them in person is a delivery-channel risk factor (reg 33(6)(b)(iii)); HMRC says it presents a risk that the customer is not who they say they are, and due diligence must reflect the additional risk (HMRC AMLG3200).
The business’s assessment
About one buyer in four first reaches us through an adviser or relocation agent, and some never view in person before they offer. We use an electronic identity check, but we are not sure whether the provider is on the government register.
How the business mitigates it
- The business uses an electronic identity check.
- The business checks that another agent acting in the transaction is registered with HMRC.
We are asking our identity provider to confirm whether it is on the register.
7. Overall assessment
Each rating compares this business’s own position on one factor. It does not change the sector view: the NRA 2025 rates the money laundering risk of estate agency businesses as medium (NRA 2025, estate agency businesses (¶¶5.243–5.263)) and of letting agency businesses as low (NRA 2025, letting agency businesses (¶¶5.264–5.274)).
The ratings are the business’s own, each set with its reason in sections 2 to 6.
| Risk factor | Rating | The business’s reason |
|---|---|---|
| Customers | High | We acted for a politically exposed buyer from outside the UK and many of our buyers are not resident here. |
| Countries and geographic areas | Medium | Money from abroad is routine for us, but no buyer had a link to a call for action country. |
| Products and services | High | Super-prime sales are the highest-risk work HMRC names, and we do them every year. |
| Transactions | Low | We hold no money for customers and have had no third-party payments. |
| Delivery channels | Medium | Introduced buyers we do not meet are common, and our identity service may not be certified. |
The overall rating is the highest of the five factor ratings. This is the pack’s own rule: the Regulations name five risk factors but do not set how they combine (reg 18(2)).
Overall rating for the business: High.
One or more risk factors may not always mean a case is high risk (reg 33(7)); this never displaces a case where the Regulations require enhanced due diligence (reg 33(1)); where the business decides a case is not high risk despite a factor, it records why (HMRC AMLG1800).
The business’s overall assessment
Our biggest risks are super-prime sales to overseas buyers who act through advisers, and politically exposed buyers. We manage them with partner approval before an offer is accepted, source of funds evidence before exchange and a nominated officer review of every super-prime sale.
Changes since the last assessment
This is the first year we have sold super-prime property, so the services section is new.
Terrorist financing
The national risk assessment rates the terrorist financing risk of estate agency and letting agency businesses as low (NRA 2025, estate agency businesses (¶¶5.243–5.263); NRA 2025, letting agency businesses (¶¶5.264–5.274)).
The ratings in the table above are the business’s assessment of terrorist financing risk as well as money laundering risk (reg 18(1)).
Reporting in the past two years
Suspicious activity reports made to the NCA in the past two years: None. Internal reports received by the nominated officer: None.
8. Controls and actions
This section records the controls the business has today. A control the business still has to introduce is listed under Actions, not described as if it were in place.
Customer due diligence as the business does it today
When it takes a customer on, the business told us it usually obtains or checks:
- Photo identification (passport or driving licence)
- Proof of address
- An electronic identity check
- Evidence of where the money comes from (source of funds)
- Evidence of how the customer came by their wealth (source of wealth)
- A PEP and sanctions screening check
The business told us it carries out due diligence on the buyer only sometimes.
The business told us it is not sure whether the identity service it uses is on the DVS register.
The business puts its customers into risk categories.
The business told us it checks where a customer’s money comes from: when the risk calls for it.
The business’s AML controls
| Control | Position today |
|---|---|
| Firm-wide risk assessment | The business has a documented firm-wide risk assessment. Last reviewed or completed: 1 June 2025. |
| AML policies, controls and procedures | The business has documented AML policies, controls and procedures. Last reviewed or completed: 1 June 2025. Review overdue since 1 June 2026. |
| Proliferation financing risk assessment | Adopted by signing this assessment in section 10. |
| MLRO report on how well the AML controls work | To be introduced (see Actions). |
| AML training for relevant employees | The business’s last recorded AML training for relevant employees was on 15 January 2025; HMRC expects training at least once a year (HMRC AMLG11030). |
| Formal process for reporting suspicion to the MLRO | The business has a written process for staff to report suspicious activity to the MLRO. Last reviewed or completed: 1 June 2025. |
| Independent audit of AML controls | To be introduced (see Actions). |
| Sanctions screening | The business checks every customer, on both sides of each sale or letting, and their beneficial owners against the UK sanctions list, and reports to OFSI when it must. Last reviewed or completed: 1 June 2025. |
| HMRC registration up to date | The business is registered with HMRC for money laundering supervision for each kind of work it does, with every premises listed, and its annual declaration and fee are up to date. Last reviewed or completed: 10 January 2026. |
| Approval of beneficial owners, officers and managers | To be introduced (see Actions). |
Actions
- AML policies, controls and procedures: action: Review and update these policies, controls and procedures now (reg 19(1)(b)), have senior management approve the reviewed version (reg 19(2)), and record the new review date (HMRC AMLG1900).
- MLRO report on how well the AML controls work: to be introduced — action: The MLRO, or the compliance officer where there is one, reviews how well the business’s policies, controls and procedures are working at each annual review of them, writes down what was found and what will change, and gives it to senior management (HMRC AMLG11000; HMRC AMLG1900). Target date: 31 January 2027.
- AML training for relevant employees: action: Train every relevant employee again and set an annual cycle for it (reg 24(1)(a); HMRC AMLG11030); keep a written record of the training (reg 24(1)(b)).
- Independent audit of AML controls: to be introduced — action: Where its size and nature make it appropriate, arrange an independent audit of the policies, controls and procedures and act on what it recommends (reg 21(1)(c)); HMRC expects this of a business with more than one premises, branches or agents, a high turnover of customers, cross-border trading or complex ways of delivering its services (HMRC AMLG1900). Target date: 31 March 2027.
- Approval of beneficial owners, officers and managers: to be introduced — action: Make sure every beneficial owner, officer or manager of the business, or the sole practitioner, is approved by HMRC (reg 26(1),(2)(c)), naming each new one to HMRC when appointed and paying the approval fee for each person tested (HMRC AMLG1600; HMRC AML supervision fees). Target date: 15 December 2026.
- Due diligence on both parties: action: Carry out customer due diligence on both sides of each sale (HMRC AMLG2200; reg 4(3)), and on both the landlord and the tenant of each letting in scope (reg 27(7B); HMRC AMLG2300).
- The NCA’s SAR portal: action: The MLRO knows how to submit a suspicious activity report to the NCA and can do so as soon as possible when one is needed (HMRC AMLG3200; POCA 2002 s.331).
Owner of these actions: Chris Hale.
9. Proliferation financing risk assessment (regulation 18A)
- The business must take appropriate steps to identify and assess the risks of proliferation financing to which it is subject (reg 18A(1)).
- It must take into account the information in the Treasury’s proliferation financing risk assessment report and the same five groups of risk factors (reg 18A(2)).
- It must keep an up-to-date written record of the steps it has taken (reg 18A(4)) and give it to HMRC on request (reg 18A(5)).
- The Treasury’s assessment does not name estate or letting agents, but HMRC says they must still understand the risk and assess it in their risk assessment, training and policies (HMRC AMLG2200; HMRC AMLG2300).
What proliferation financing is
Proliferation financing means providing funds or financial services for making, acquiring, developing, moving or shipping chemical, biological, radiological or nuclear weapons and their delivery systems (HMRC AMLG3200). For an estate or letting agency the question is whether any customer, property or payment is linked to a regime sanctioned for proliferation financing, whether a commercial property is to be used to manufacture goods that could serve that purpose, and whether a customer trades in goods that cross borders (HMRC AMLG3200; HMT PF national risk assessment (2021)).
What the Treasury’s assessment says
The Treasury’s national risk assessment of proliferation financing (September 2021) finds awareness of proliferation financing risk generally low among designated non-financial businesses and professions (HMT PF national risk assessment (2021)); HMRC notes that it does not mention estate agents specifically (HMRC AMLG2200).
Evidence
| Factor | The business’s position |
|---|---|
| Has any customer, or anyone acting for one, been linked to the UK sanctions list? | No |
| Is any customer, property or payment linked to a country under UK sanctions? | No |
| Is any customer, intermediary or the money linked to a country bordering a sanctioned country? | No |
| Does any customer trade in goods that cross borders (importing or exporting)? | No |
The business’s assessment
We sell homes to individuals and families; none of our buyers trades in goods across borders and none has a link we know of to a sanctioned country.
How the business mitigates it
- The business checks customers and their beneficial owners against the UK sanctions list.
How the business manages it
The business’s policies, controls and procedures must cover proliferation financing as well as money laundering and terrorist financing (reg 19A). They set out the sanctions checks on customers and their beneficial owners that address this risk.
Proliferation financing risk assessment: Adopted by signing this assessment in section 10.
10. Review and sign-off
Firm-wide risk assessment: This assessment is the business’s firm-wide risk assessment, dated by its signature in section 10.
This assessment is dated on the day it is signed below. The next review is due within 12 months of that date.
HMRC expects the risk assessment to be reviewed at least annually (HMRC AMLG1800), and to reflect any new service or new way of operating, with the policies updated before it starts (HMRC AMLG3200).
The business must keep this assessment up to date (reg 18(4)) and give it, and the information it was based on, to HMRC on request (reg 18(6)).
This sign-off covers sections 1 to 9, including the proliferation financing assessment in section 9.
| Signed by | To be completed when signed |
|---|---|
| Role | The principal, a director, a partner or the nominated officer |
| Signature | |
| Date |
Sources
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692), revised text in force 30 June 2026. Cited: reg 18(1); reg 18(4); reg 18(2); reg 18A(1); reg 18(3); reg 18(6); reg 13(1),(2); reg 35(3A); reg 35(12), (14); reg 33(1); reg 33(1)(d); reg 33(1)(b); reg 33(3); reg 4(3); reg 33(6)(b)(iii); reg 33(7); reg 19(1)(b); reg 19(2); reg 24(1)(a); reg 24(1)(b); reg 21(1)(c); reg 26(1),(2)(c); reg 27(7B); reg 18A(2); reg 18A(4); reg 18A(5); reg 19A.
- HMRC, Economic Crime Supervision Handbook ECSH53175 (compliance checks during an estate agency business intervention). Cited: HMRC ECSH53175.
- HMRC, Economic Crime Supervision Handbook ECSH55175 (compliance checks during a letting agent business intervention). Cited: HMRC ECSH55175.
- HMRC, AMLG3200: risk assessment of estate agent businesses (updated 18 September 2026). Cited: HMRC AMLG3200.
- HMRC, AMLG3300: risk assessment of letting agent businesses (updated 5 August 2026). Cited: HMRC AMLG3300.
- HM Treasury and Home Office, National Risk Assessment of Money Laundering and Terrorist Financing 2025. Cited: NRA 2025, estate agency businesses (¶¶5.243–5.263); NRA 2025, letting agency businesses (¶¶5.264–5.274); NRA 2025, property typology (¶¶3.86–3.98).
- HMRC, AMLG1800 (risk assessment). Cited: HMRC AMLG1800.
- HMRC, Economic Crime Supervision Handbook ECSH53125 (general risks in the estate agency business sector). Cited: HMRC ECSH53125.
- HMRC, Economic Crime Supervision Handbook ECSH55125 (general risks in the letting agent business sector). Cited: HMRC ECSH55125.
- The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621). Cited: SI 2026/621.
- FATF, High-Risk Jurisdictions subject to a Call for Action (the list as it has effect from time to time; edition held: 19 June 2026). Cited: FATF list of High-Risk Jurisdictions subject to a Call for Action (current edition).
- HMRC, AMLG2200: estate agent business guidance (updated 22 July 2026). Cited: HMRC AMLG2200.
- HMRC, AMLG11030 (training). Cited: HMRC AMLG11030.
- HMRC, AMLG1900 (policies, controls and procedures). Cited: HMRC AMLG1900.
- HMRC, AMLG11000 (nominated officer and compliance officer). Cited: HMRC AMLG11000.
- HMRC, AMLG1600 (fit and proper test and approval checks). Cited: HMRC AMLG1600.
- HMRC, Anti-money laundering supervision: fees. Cited: HMRC AML supervision fees.
- HMRC, AMLG2300: letting agent business guidance (updated 23 July 2026). Cited: HMRC AMLG2300.
- Proceeds of Crime Act 2002, Part 7 (revised text). Cited: POCA 2002 s.331.
- HM Treasury, National risk assessment of proliferation financing, September 2021. Cited: HMT PF national risk assessment (2021).