How to Prepare for an HMRC Audit?

HMRC may carry out a compliance check—either through a visit or an office-based review. The goal is to ensure you are complying with your legal responsibilities, including having appropriate AML controls and documentation in place.

During an audit, HMRC may:

• Ask more than 150 questions to test your compliance knowledge, covering areas such as your AML risk assessment, customer due diligence (CDD), policies and procedures, and staff understanding.
• Inspect physical cash on-site.
• Spend approximately 3 to 4 hours on-site, depending on the complexity of your business.

This guide explains what to expect and how to prepare, so you can stay compliant and confident.

➤ Why HMRC May Visit You

HMRC may check your business if:

• There's a perceived risk of money laundering exposure
• You're selected for a routine or random compliance check

This doesn’t necessarily mean something is wrong—but it’s important to be ready.

➤ What HMRC Will Check

HMRC officers will focus on:

• Your anti-money laundering (AML) risk assessment
• Your policies, controls, and procedures
• How these are understood, implemented, and maintained across your business
• Your systems for identifying and reporting suspicious activity
• Staff training and awareness of AML responsibilities

➤ Types of Checks

1. Office-Based Check

• Conducted via phone, email, or desk-based review
• Involves submission of documents and records remotely
• May be followed up with further checks if needed

2. On-site Visit

• Usually arranged in advance by phone and confirmed in writing
• May be unannounced in rare cases
• Takes place at your main business premises
• Officers will want access to documents, records, staff, and systems

➤ Who Should Be Present

During the check, HMRC may speak with:

• The business owner or UBO’s
• A senior manager or MLRO
• Other staff members involved in compliance

➤ Documents and Records to Prepare for HMRC Compliance Checks

To ensure a smooth HMRC audit and minimise the risk of penalties, businesses should have the following documentation and systems in place:

• AML Risk Assessment

  An updated risk assessment tailored to your business activities.

• AML Policies and Procedures

  Documented policies covering CDD, EDD, record keeping, SARs, and staff training which should align with amended regulations.

• Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD)

  Comprehensive records of customer due diligence and enhanced due diligence.

• Ongoing Monitoring Evidence

  Documentation showing a risk-based approach and evidence of ongoing monitoring.

• Staff Training Records

  Logs demonstrating AML understanding for all relevant staff

• Business and Transaction Records

  Including remittance logs and cash reconciliation (if applicable).

• Internal Audit Reports

  Reports on AML compliance and internal audits.

• Fit and Proper Tests

  Records of fit and proper tests and HMRC approvals.

• Suspicious Activity Reports (SARs)

  Copies of SARs submitted to the NCA and internal SARs.

• Personal Documentation

  Identity verification documents, and staff training logs for the responsible person or MLRO.

➤ Tips for Staying Ready

• Subscribe for a software which can manage compliance and day to day activities easily.
• Regularly review and update your AML policies.
• Keep records tidy, clear, and accessible.
• Train all staff and document that training.
• Conduct internal audits and act on findings.
• Appoint a dedicated AML compliance officer.