ECSH51075 - Factors to consider when visiting a money service business
Source: gov.uk (2025-04-15)


There are some unique factors that need to be considered when dealing with money service businesses (MSBs) that are not relevant to other sectors supervised by HMRC.

While the factors below should be considered, they should be read in conjunction with the rest of the MSB guidance within this chapter and general compliance – see ECSH32000 (https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh32000).

The MSB sector

The MSB sector differs to other HMRC supervised sectors (except high value dealers) as MSBs often deal mainly in cash, and the origins of this cash may not always be clear. Testing MSB compliance can often involve testing a significantly larger number of transactions compared to other supervised sectors as these tend to be high-volume, small transactions.

The MSB sector can be complex, especially where these businesses operate in a network with other MSBs to serve their customers, then the network can appear convoluted in structure. In particular, MSBs providing money remittance services to high street customers usually consist of complex networks of principals and agents, as well as agents with multiple principal relationships. Further information on principals and agents can be found at ECSH51250 (https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh51250).

Principals must ensure that they are complying with their obligations under The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017) in relation to both to activities conducted at their principal premises, and any by their agents. MSB principals must have sufficient oversight of their agents’ activities and show that they have assessed and managed the risks associated with their agents’ activities. HMRC directly conducts fit and proper testing on MSB principals and beneficial owners, officers or managers (BOOMs) and may test some agents. However, MSB principals have a responsibility to satisfy themselves that the agents used to provide their MSB services would pass the fit and proper test.

Where a customer account or membership number is set up to facilitate future transactions, this would indicate a business relationship.

Note: operational guidance is covered in ECSH33311 (https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh33311) (business relationships) and ECSH33312 (https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh33312) (occasional transactions) and there is a definition of business relationship in ECSH160000 (https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh160000).

Types of compliance checks at MSBs

You will be required to undertake checks on MSBs to ensure they are complying with MLR 2017. This is conducted by either carrying out a compliance check by visiting the business or conducting an office-based compliance check – referred to as a desk-based intervention (DBI). See ECSH32610 (https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh32610).

The purpose of the check is to:

Test the business for compliance with MLR 2017, with particular attention as to whether the business has:
- Met SARs reporting requirements.
- An adequate Risk Assessment in place for their specific business activities.
- Relevant policies, controls and procedures.
- Ensured that they have conducted and recorded mandatory staff training.
- Accounted for all cash on their premises.
- Remind and educate businesses of their responsibility to comply with MLR 2017.
As part of the compliance check you are required to:
- Check and test the adequacy and effectiveness of businesses’ anti money laundering (AML), counter terrorist financing (CTF) and counter proliferation financing (CPF) risk assessment, policies, controls and procedures.
- Consider the appropriate outcome of that intervention, ensuring any instances of identified non-compliance are dealt with in the most effective, dissuasive and proportionate way.
- Consider whether any penalty/sanctions proposed for any identified breaches are in line with the penalty framework when deciding action to be taken to address non-compliance.
For more information on types of intervention checks see ECSH32600 (https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh32600).

What does an MSB premises look like?

An MSB premises can vary from a small kiosk to large corporate offices. MSBs are located all over the country, but there are high concentrations in large cities, especially London. The MSB may have a small number of friends and relatives that are not necessarily officially employed by the business, but who may ‘help out’ from time to time. In this event the officer will need to establish how much responsibility such individuals hold within the business to determine whether they fall within the definition of a BOOM and, if so, whether they are listed within their registration. It is also important to check if the friend, relative or any temporary worker, who is not officially employed by the business, has received the appropriate training as required under the MLR to fulfil the role.

Targeted MSB Campaigns

When conducting compliance checks as part of a thematic MSB campaign, a specific compliance approach is developed in line with the aims and/or risks identified, then set out in the campaign project initiation document (PID). A detailed brief specific to the campaign will be produced that clearly sets out all the parameters to be followed and any other necessary information.

The risk levels differ across the three MSB sub-sectors which in turn will affect how compliance visits are conducted. See ECSH51100 (https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh51100) for more information on risks in MSB subsectors.

General Data Protection Regulations (GDPR)

An MSB may have concerns that by keeping records relating to its customers for the periods and purpose as specified in MLR 2017, or by sharing records during a compliance intervention, this may breach their GDPR obligations. In this case, the LAB should be referred to regulation 72(2) MLR 2017. Regulation 72(2) and (3) MLR 2017 provide that a businesses’ compliance in providing information pursuant to regulation 66, 69, 70, 74A or 74B does not carry with it a civil liability for breaching GDPR obligations nor does that provision of information automatically breach restrictions on the disclosure of information.

Further information on GDPR and its impact on businesses can be found at ECSH10500 (https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh10500) and record keeping obligations at ECSH33575. (https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh33575)