The supervisory architecture around professional services shifts fundamentally. The fraud economy the regulations exist to defend against continues to evolve faster than any single regulatory response can match. For compliance leaders at firms in financial services, legal, property and accountancy, 2027 is not a year of incremental tightening. It is a year in which the bar for what good compliance looks like rises materially across every sector we serve.

Our 2026 Compliance Reality Check, which surveyed 1,000 senior decision-makers across UK regulated sectors, found that 72% of UK regulated firms expect regulatory complexity to increase over the next 12 to 24 months. 74% have already increased their compliance budget for 2026. Only 27% describe themselves as very confident in meeting their current NRA sectoral obligations. Those three numbers tell the story of a sector that knows what is coming, is already investing, and is still not where it needs to be.

2027 is the year good intentions stop being enough.

The headline changes coming

Several specific regulatory and supervisory moves land through 2027 and into early 2028. Taken together, they are the largest wave of AML and financial crime change the UK sector has absorbed in a decade.

The Failure to Prevent Fraud offence under Section 199 of ECCTA 2023 came into force in September 2025 and creates direct corporate criminal liability for large organisations (over 250 employees, £36 million turnover, £18 million assets) where a connected person commits fraud for the benefit of the organisation. The first enforcement decisions are expected to land through early 2027, which is when the “reasonable fraud prevention procedures” defence standard will start being established in practical terms.

The FCA is becoming the single AML supervisor for professional services (including legal and accountancy, with tax following) by 2026, with full implementation targeted for 2029. The transition replaces the 22-supervisor model that has run professional services AML oversight for the last decade. For firms that have operated under SRA, ICAEW, CLC and other professional body supervision, the move is a step-change in supervisory standard, not just a change of regulator name.

The MLR 2026 Amendments took effect in mid-2026 and tightened the risk-based approach obligations on UK regulated firms, including specific expectations on enhanced due diligence for higher-risk transactions, beneficial ownership verification in complex structures, and the documentation of control effectiveness. The AML Reform Package 2026, approved by Parliament in parallel, extended obligations on beneficial ownership verification, source of funds verification and digital identity integration.

Companies House identity verification is live, and the ECCTA programme continues to roll out. 3.81 million personal codes obtained, 151,000 registered office addresses removed from the register, and 74 Authorised Corporate Service Providers suspended in the first phase. Further phases through 2026-27 include compulsory electronic filing, enhanced accuracy requirements and restrictions on corporate directors.

The EU AML Package applies from July 2027, and the Anti-Money Laundering Authority (AMLA) in Frankfurt begins direct supervisory responsibilities from 2028. For UK firms with EU clients, EU corporate structures or cross-border exposure, dual-compliance obligations become live through 2027. The EU AMLR’s €10,000 cash transaction ceiling tightened beneficial ownership thresholds, and specific obligations on high-value dealers all apply.

The Online Safety Act’s fraudulent advertising duties come into force in 2027. The FCA’s crypto asset regulation regime applies from October 2027. The Fraud Strategy 2026 to 2029 continues its programme of £250 million government investment through to the end of the decade.

For any one of these, UK-regulated firms would be making material adjustments. All of them landing within an eighteen-month window makes 2027 the year the sector’s compliance infrastructure is tested against a level of change it has not operated through before.

Failure to Prevent Fraud

The Failure to Prevent Fraud offence is the single piece of statutory change most likely to generate early 2027 enforcement activity with direct commercial consequences for regulated firms.

Section 199 of ECCTA 2023 creates a corporate criminal offence where a large organisation fails to prevent a specified fraud offence committed by an associated person for the benefit of the organisation or a client. Specified fraud offences include fraud by false representation, fraud by failing to disclose information, fraud by abuse of position, false accounting, false statements by company directors, cheating the public revenue and various fraud-related conspiracy and aiding and abetting offences. The only defence is that the organisation had “reasonable fraud prevention procedures” in place at the time of the offence, or that it was not reasonable in the circumstances to expect prevention procedures.

The specific commercial exposure for UK regulated firms covers Payment Diversion Fraud in conveyancing, impersonation fraud in property transactions, authorised push payment fraud in financial services, procurement fraud across the board, and any fraud committed by employees, agents or contractors for the firm’s benefit. For firms over the threshold (250 employees, £36 million turnover, £18 million assets), the offence applies directly. For firms under the threshold, exposure can still arise through subsidiary structures, parent company arrangements, or in due course through anticipated extensions of the offence to smaller organisations.

The “reasonable procedures” standard is still being established. SFO guidance published in late 2024 set out six principles (top-level commitment, risk assessment, proportionate procedures, due diligence, communication and training, monitoring and review) which should guide firms’ prevention frameworks. The early enforcement decisions will clarify how these principles translate into specific operational expectations. The firms that have scoped their reasonable procedures framework ahead of the first enforcement decisions will be well-placed. The firms waiting for enforcement to tell them what the standard is will be reacting, not preparing.

UK Finance’s Annual Fraud Report 2026 confirmed that total payment fraud losses reached £1.28 billion in 2025. Authorised Push Payment fraud losses alone reached £576.4 million, up 19%. Investment fraud rose 40% to £221.5 million. Deepfakes and synthetic identities were named as accelerating threats across every category of financial services fraud. Deloitte has projected that generative AI could contribute to fraud losses in the United States reaching $40 billion annually by 2027, compared with $12.3 billion in 2023. The threat environment the Failure to Prevent Fraud offence exists to drive prevention against is accelerating, not slowing.

The FCA supervision shift

The FCA transition to becoming the single AML supervisor for professional services is the structural change that will take longest to work through, and will carry the sharpest long-term consequences.

In 2025, FCA AML fines across its existing regulated population reached over £23 million, with Barclays (£21.1 million) absorbing the largest single penalty. That is the enforcement standard the professional services sector is now preparing to be measured against. FCA supervision is more documentation-heavy, more technology-literate, more continuous rather than periodic, and generally comfortable with materially larger penalties than professional body supervision has been.

The SRA has been intensifying its enforcement activity through 2025 and 2026, specifically because it wants to hand over a sector in good shape. The SRA AML Annual Report published in October 2025 showed enforcement activity at the highest level in several years. Over 35 fines were issued in 2025, totalling more than £565,000. The Solicitors Disciplinary Tribunal heard 14 AML-related cases with £953,000 in combined fines. 22% of firms inspected were found to be fully compliant with their AML obligations.

ICAEW’s monitoring data tells a similar story on the accountancy side. Approximately one in three accountancy firms inspected were found to be non-compliant with aspects of their AML obligations, with firm-wide risk assessments, customer due diligence on complex structures, source of funds documentation and fit and proper checks on beneficial owners, officers and managers (BOOMs) all flagged as consistent weaknesses.

Both pictures tell UK-regulated firms the same thing. The weaknesses the current supervisors have been flagging will be inherited by the FCA, which will push harder on each of them. The firms investing now in integrated technology, documented evidence trails and continuous inspection-readiness will absorb the transition. The firms treating current monitoring findings as something to address when a visit is scheduled will not.

What firms should do now?

For UK regulated firms, the practical response to the 2027 picture breaks into three distinct disciplines.

The most immediate is auditing current AML controls against the standard that will apply in 2027, not the standard that applied five years ago. For firms in financial services already under FCA supervision, this means reading the FCA’s enforcement decisions through 2025 and 2026 carefully and ensuring internal controls match the standard those decisions have set. For firms in legal, accountancy and property, this means scoping what FCA-grade compliance infrastructure will look like and planning accordingly. An internal audit against the current enforcement standard is the single most useful 2027 planning exercise compliance leaders can commission now.

Alongside that, the specific operational gaps the current supervisors have been flagging consistently need to be closed. Identity verification that runs manually (54% of UK regulated firms) needs to become integrated and automated. Beneficial ownership verification in complex structures (52% struggle with this) needs to extend into nominee arrangements and layered share classes. Source of funds and source of wealth verification needs to produce auditable evidence trails rather than forms. Ongoing monitoring across the full client base needs to run continuously rather than event-triggered. PEP and sanctions screening across OFSI, OFAC and the EU consolidated list needs to run in parallel, with automated re-screening when any list updates. BOOM checks need to be documented, refreshed and linked to an auditable risk register.

The third discipline is building reasonable procedures frameworks for Failure to Prevent Fraud exposure, and documenting them before early 2027 enforcement decisions land. The firms that have scoped their SFO-aligned prevention framework will be the firms best placed to defend against both the first enforcement wave and the broader fraud economy the offence exists to tackle.

The cost of waiting

The firms that prepare now will meet these changes from a position of strength. The rest will retrofit under enforcement pressure.

The commercial cost of retrofitting is real. Enforcement activity landing while compliance infrastructure is being rebuilt means penalties, remediation costs, reputational damage and lost commercial opportunities, all at the same time. The firms absorbing a monitoring finding into an already-robust compliance operation absorb it as a tactical adjustment. The firms absorbing a monitoring finding into a compliance operation that is behind the standard absorb it as a strategic emergency.

The 74% of firms that increased compliance budget for 2026 understood the direction of travel. That spend has been going into integrated technology, continuous monitoring, triangulated identity verification, documented beneficial ownership processes and the broader financial crime infrastructure that defends against the 2027 picture. For the 26% that did not increase budget in 2026, 2027 is the year that question comes back more sharply.

The regulatory wave is landing. The enforcement standard is sharpening. The fraud economy is accelerating. The operational perimeter of the regulated firm matters more now than at any point in the last decade. The firms that treat 2027 as the year to lift their compliance infrastructure to the standard the next supervisory environment will require are the firms best placed for what comes next. The firms that treat it as something to manage reactively will spend more on compliance to carry more risk, at precisely the moment the economic environment makes that harder to defend.

2027 is the year good intentions stop being enough. The time to move is now.

Sources

• Home Office, Fraud Strategy 2026 to 2029: Disrupting Crime, Supporting Economic Resilience and Delivering Justice, published 9 March 2026
• Home Office, National Risk Assessment of Money Laundering and Terrorist Financing 2025
• Economic Crime and Corporate Transparency Act 2023 (ECCTA), Section 199 Failure to Prevent Fraud offence
• Serious Fraud Office, Guidance on Reasonable Fraud Prevention Procedures
• UK Government, Confirmation of FCA as single AML supervisor for professional services, October 2025
• Money Laundering Regulations (MLR) 2026 Amendments
• AML Reform Package 2026 (Parliament)
• Companies House Third Progress Report on ECCTA implementation
• European Union, AML Package (AMLR, AMLD, AMLA Regulation)
• UK Finance, Annual Fraud Report 2026
• Deloitte Centre for Financial Services, Generative AI Fraud Loss Projections 2027
• FCA, AML Enforcement Decisions 2025
• SRA, AML Annual Report, October 2025
• ICAEW, AML Monitoring Reports 2025-2026
• HM Treasury, Autumn Budget 2026, delivered 28 October 2026
• SmartSearch, 2026 Compliance Reality Check, based on 1,000 senior decision-makers across UK regulated sectors