The Two Compliance Registrations Small Businesses Often Miss

Most compliance advice is about doing things properly. Keep good records. Verify your clients. Write a privacy notice.

That is not where most of the penalties are.

HMRC's published enforcement records show a striking pattern: a large proportion of the penalties it publishes arise because a business failed to apply for anti-money laundering registration at the required time. Registration failures appear repeatedly across estate agency, accountancy, trust and company services and other supervised sectors — not for doing the work badly, but for never having signed up.

The Information Commissioner's Office has a similar pattern. The annual data protection fee starts at £52. The fixed penalty for not paying it starts at £400.

Two obligations. Both inexpensive. Both easy to miss entirely. Both carrying a penalty specifically for the failure to register, regardless of whether anything else went wrong.

The first: the ICO data protection fee

Who has to pay

Many UK businesses that process personal information electronically need to pay the fee, unless an exemption applies.

The word that causes the confusion is "processing". Under UK data protection law it means far more than most people assume. If you hold customer names and email addresses in a spreadsheet, keep employee records on a computer, use a CRM, or operate CCTV, you are processing personal data.

You do not have to be a technology business. A plumber with a customer list on a laptop is processing personal data.

There are exemptions — for some businesses processing data only for very limited purposes such as staff administration, advertising their own goods, or keeping their own accounts. Whether an exemption applies depends on the purpose of the processing, not simply on whether personal data is held. The ICO's own self-assessment tool takes about two minutes.

One case removes any doubt: if you use CCTV for crime prevention, you need to pay the fee, regardless of anything else about your business. The ICO states that you do not even need to take the self-assessment, because the answer will always be yes.

What it costs

A £5 discount applies if you pay by direct debit.

Note the or in the first two rows. You qualify for tier 1 if you meet either the turnover test or the staff test — you do not need both. Most small businesses are tier 1, at £52 a year, or £47 by direct debit.

What happens if you do not pay

The ICO can issue a fixed penalty:

• £400 for a tier 1 organisation
• £600 for tier 2
• £4,000 for tier 3
• With a statutory maximum of £4,350 in certain circumstances

For a small business, that is a penalty roughly eight times the fee it was avoiding.

There is also a public element. The ICO publishes a register of everyone who has paid, and separately publishes a list of organisations issued with penalty notices for not paying.

The register works both ways. If you are bidding for work, a client or procurement team can look you up and see that you are registered — some tender documents ask for the reference number directly. If you have been fined, that is visible too.

Two things people get wrong

It renews annually. This is not a one-off registration. The fee is payable every year, and the obligation continues until you tell the ICO you no longer need to be registered.

Cancelling does not stop the direct debit. The ICO says this plainly, and it catches people out. If you cancel your registration but pay by direct debit, you must also cancel the instruction with your bank, or you will keep paying for a registration you no longer hold.

The second: anti-money laundering supervision

This one applies to fewer businesses, but the consequences of getting it wrong are considerably more serious.

Who needs to be supervised

Businesses carrying on activity within the Money Laundering Regulations must be supervised for anti-money laundering purposes. The main sectors:

• Accountancy service providers, including bookkeepers and tax advisers
• Estate agency and letting agency businesses
• Trust or company service providers
• High value dealers accepting large cash payments
• Money service businesses
• Art market participants

There is no small business exemption. The regulations apply regardless of size. A sole practitioner bookkeeper is within scope on the same basis as a large firm.

Who supervises you

Every business carrying on activity within the Money Laundering Regulations must have the correct AML supervisor.

But that supervisor is not always HMRC.

If your business is already supervised for AML purposes by an approved professional body, you generally do not register separately with HMRC for the same activity. This commonly applies to accountancy and legal firms supervised by bodies such as AAT, ACCA, ICAEW and other recognised professional body supervisors.

Professional membership alone, however, is not enough.

You need to confirm that the professional body actually provides AML supervision for your firm and for the activities you carry on.

HMRC supervises businesses in specified sectors that are not otherwise appropriately supervised. These include accountancy service providers without professional body supervision, estate and letting agency businesses, high value dealers, certain trust or company service providers, art market participants and some money service businesses.

Some businesses are supervised by the FCA for AML purposes, but FCA authorisation for another activity does not automatically mean that the FCA is your AML supervisor.

If you are unsure, establish the answer before you start the regulated activity. Being registered with the wrong body — or assuming a professional membership covers you when it does not — can leave the business effectively unsupervised.

There is also a future change to be aware of. The government has decided that the FCA will eventually become the AML supervisor for legal, accountancy and trust or company service providers. That transition will happen in phases and is expected to take several years. Until a business is formally moved, the requirements of its existing supervisor continue to apply.

What HMRC supervision costs

Where HMRC is your supervisor, the standard charges currently include:

• a £300 initial application fee;
• £400 for each premises included in the registration; and
• an annual £400 per-premises charge.

Additional charges can apply depending on the sector.

Money service businesses and trust or company service providers can be subject to a £500 fit-and-proper fee for each person tested.

For accountancy service providers, estate and letting agency businesses, high value dealers and art market participants, relevant beneficial owners, officers and managers may instead require an approval check, currently charged at £40 per person.

Businesses with turnover below £5,000 may qualify for HMRC's small-business reduction. The normal fees are paid first and an appropriate refund is made after HMRC accepts the reduction claim.

If a professional body supervises you instead, its own practising, supervision or membership fee structure applies.

What happens if you trade without the required registration

This is not simply an administrative oversight.

Where HMRC registration is required, carrying on regulated activity without being registered is a criminal offence and can lead to financial penalties or prosecution.

HMRC's published enforcement records repeatedly show businesses being penalised for failure to apply for registration at the required time. Registration failures appear across estate agency, accountancy services, trust and company services and other supervised sectors.

From 1 December 2025, HMRC's sanctions regime also includes a sanctions administration charge. For breaches including failure to register, customer due diligence failures and deficiencies in policies, controls, records or risk assessments, the administration charge can be up to £2,000 in addition to the underlying financial penalty. Where the penalty itself is below £2,000, the administration charge is capped at the amount of that penalty.

There is an important distinction between sectors when an application is pending.

A money service business or trust or company service provider that requires HMRC supervision must not begin the regulated activity until HMRC has confirmed its registration.

Other HMRC-supervised sectors can generally continue trading while an application is being processed.

If you discover that you should already have been registered, deal with it rather than waiting for HMRC to find you. HMRC's penalty guidance specifically allows reductions where a business makes an unprompted disclosure before HMRC begins an enquiry or intervention.

Why these two get missed

They have the same shape, and it explains a lot.

Neither is triggered by an event you would notice. You do not receive a form. Nothing arrives to be completed. There is no deadline in your calendar, because nobody put one there.

Both fall outside the normal accounting cycle. Your accountant prepares your accounts and files your returns. Unless you asked, neither of these is necessarily part of that engagement.

Both are cheap enough to seem unimportant. £52 a year does not feel like a compliance obligation. It feels like an administrative fee, and administrative fees get deprioritised.

Both renew. A business can be compliant in year one and non-compliant in year three simply by not doing anything.

Correspondence goes to the registered office. If that is a formation agent, an old accountant, or an address nobody checks, the reminders and the warnings arrive somewhere you never look.

A ten-minute check

1. Search the ICO register of fee payers for your business name. If you are there, note the renewal date and put it in a calendar. If you are not, use the ICO's self-assessment tool.
2. Ask whether any of the AML-supervised sectors describe what you actually do. Not what your company's SIC code says — what you do. "Bookkeeping services" is an accountancy service. "Company formation" is a trust or company service.
3. If a supervised sector applies, establish who supervises you. If you belong to a professional body, confirm that its supervision actually covers your firm and your activities. If it does not, check whether you need to be registered with HMRC.
4. Check where your registered office post goes, and whether anyone opens it.
5. Put both renewal dates in the same calendar as your filing deadlines. These are the obligations most likely to be missed precisely because nothing prompts them.