OPBAS Report Exposes Persistent AML Failures in Professional Services—Technology Is the Solution

The Office for Professional Body Anti-Money Laundering Supervision (OPBAS) has published its 2024/25 supervisory report, and the findings should concern any firm in the legal or accountancy sectors: while baseline compliance is adequate, effectiveness is inconsistent, and some poor practice persists despite years of regulatory focus.

With the FCA preparing to assume direct supervision of professional services and HMRC issuing hundreds of penalties—including fines up to £104,000—firms can no longer rely on manual processes and assisted compliance approaches. The message is clear: robust, technology-enabled AML systems are essential.

The Enforcement Reality

Between April and September 2025, HMRC issued 336 penalty notices for Money Laundering Regulations breaches:

• 303 penalties for failure to register for HMRC supervision at the required time
• 33 penalties for substantive failures: no risk assessments, missing AML controls, inadequate staff training, deficient customer due diligence
• Highest fine: £104,000
• Average fine for registration failures: £5,500
  
  

These aren't theoretical compliance risks, they're actual enforcement actions with real financial consequences.

Persistent Compliance Failures

OPBAS's assessment of 6 Professional Body Supervisors (PBSs) revealed concerning patterns:

Common breaches that continue to plague supervised firms:

• Inadequately documented policies and procedures
• Insufficient customer due diligence
• Poor or missing client risk assessments
• Absent or inadequate firm-wide risk assessments
• Inadequate record-keeping
  
  

These aren't new issues. OPBAS notes these failures "call into question the consistency and effectiveness of PBS supervision" and suggests "continued failures" despite regulatory attention.

Where Professional Services Are Falling Short

The report identifies specific weaknesses across the legal and accountancy sectors:

1. Overly member-centric supervision

OPBAS found that some PBSs "take an overly member-centric approach or assisted compliance view" that "hinders robust AML supervision."

In practice, this means PBSs provide templated documents for members to address breaches (for example, providing a risk assessment template when a firm has failed to conduct one as required). While support is appropriate, it shouldn't come "at the cost of holding members to account for material non-compliance."

2. Weak enforcement

PBSs "continue to perform poorly in their enforcement approach relative to other Sourcebook areas." OPBAS is concerned that some aren't taking "consistent, proportionate and sufficiently dissuasive disciplinary measures."

Examples of less effective practice include:

• Providing firms with multiple opportunities to address non-compliance before enforcement referral
• Excessive remediation timelines without adequate follow-up
• Over-reliance on assisted compliance rather than proportionate enforcement
  
  

3. Inadequate use of technology

While OPBAS supports AI and technology use to understand risk better, implementation varies widely. Some smaller PBSs "could have made more effective use of the tools available to them."

The report notes concerns about third-party AML software: "Different views were expressed on the quality of the third-party provided AML software and outcomes achieved. We're unclear on how assurance is obtained by the supervised population or PBSs in these circumstances."

4. Insufficient ongoing monitoring

OPBAS found that some PBSs rely too heavily on "member self-certification, without associated and risk-sensitive proportionate assurance activity."

Static checks at onboarding aren't sufficient—customer risk profiles change, beneficial owners change, and business activities evolve.

The Scope of the Problem

The scale of AML supervision in professional services is substantial:

• 22 Professional Body Supervisors overseeing the legal and accountancy sectors
• 41,400+ firms and practitioners worldwide under supervision
• £81 billion contributed to UK GDP by the accountancy sector (2022)
• £74 billion contributed by the legal sector (2023)
• £100+ billion estimated money laundering through/within the UK annually
  
  

With only 213 FTE staff dedicated to AML supervision across all PBSs (combined annual spend £15m), the coverage challenge is immense.

Why Manual Compliance Doesn't Scale

OPBAS's data shows that even with improvements, manual approaches struggle:

On-site visits and desk-based reviews:

• 2,663 desk-based reviews conducted across both sectors in 2023/24
• 1,557 onsite inspections conducted
• 10.2% population coverage achieved
  
  

While OPBAS notes this "compares favourably to other AML supervisors," it still means nearly 90% of firms receive no onsite inspection in a given year.

More concerning: onsite visits in the accountancy sector have not returned to pre-pandemic levels. The 2023/24 figure was slightly lower than 2022/23.

What the FCA Takeover Means

The report welcomes that "subject to legislation, the FCA will become the single Anti-Money Laundering/Counter Terrorist Financing (AML/CTF) supervisor for selected professional services."

This transition will bring:

• Stronger, more consistent supervision drawing on FCA's experience supervising 16,000+ financial services businesses
• Higher expectations for compliance effectiveness, not just baseline adherence
• Greater enforcement capability with the FCA's established enforcement framework
• Less tolerance for assisted compliance approaches that delay accountability

The FCA's supervisory model emphasises outcomes over box-ticking—exactly what OPBAS has been pushing for.

The Technology Solution

Manual compliance processes can't deliver what regulators now expect. Here's why technology is essential:

1. Identity verification at scale

With 41,400 firms under supervision and millions of client interactions, manual document checks don't scale. Biometric verification, document forensics, and multi-source identity triangulation catch risks visual inspection misses—in seconds, not days.

2. Beneficial ownership transparency

OPBAS highlighted that shell companies and complex ownership structures are key money laundering risks. Automated beneficial ownership identification traces through multiple corporate layers to reveal ultimate controllers—something manual searches struggle with.

3. Real-time sanctions screening

OPBAS found gaps in how firms screen against sanctions lists. Automated screening against 1,100+ global sanctions and PEP lists, updated every 24 hours (not annually), ensures firms catch newly designated entities immediately.

4. Ongoing monitoring

The report criticises reliance on static onboarding checks. Continuous monitoring throughout client relationships flags changes in risk profiles, new sanctions designations, and evolving business activities automatically.

5. Audit-ready compliance

With enforcement increasing and the FCA taking over, firms need documented proof of robust due diligence. Technology provides timestamped, cryptographically secure records for every check, evidence that manual processes rarely capture comprehensively.

6. Consistent decision-making

OPBAS noted that some PBSs would benefit from enhanced guidance for staff "to support consistency in decision-making." Automated risk assessment removes human inconsistency while flagging high-risk cases for expert review.

SmartSearch: Purpose-Built for Professional Services AML

SmartSearch provides the technology infrastructure professional services firms need to meet OPBAS's effectiveness standards:

Instant identity verification

• Biometric liveness detection (99.8% deepfake catch rate)
• Document forensics across 200+ countries
• Multi-source verification ensuring consistency
• Browser-based (no app downloads, completed in under 60 seconds)
  
  

Beneficial ownership identification

• Trace through unlimited corporate layers
• Identify ultimate beneficial owners globally
• Flag hidden relationships and complex structures
• Integrate with Companies House and international registries
  
  

Real-time AML screening

• 1,100+ sanctions and PEP lists updated every 24 hours
• Automated screening at onboarding and ongoing
• Instant alerts when clients are newly designated
• Adverse media monitoring
  
  

Ongoing monitoring

• Continuous screening throughout the client relationship
• Behavioural analytics flagging unusual patterns
• Automatic re-screening when risk profiles change
• Proactive alerts, not reactive annual reviews
  
  

Audit-ready records

• Compliance certificates for every verification
• Timestamped, immutable audit trails
• Regulator-ready reports demonstrating robust checks
• Evidence OPBAS and FCA expect

The Positive AI Angle: Productivity, Not Risk

While concerns about AI often focus on risks, OPBAS takes a balanced view: "We support PBSs in their use of technology and artificial intelligence to better understand risk."

The guidance is practical: AI must be "robustly tested" and use "relevant and accurate data sources," with systems that are "understood, documented and auditable."

This is the responsible approach, not avoiding AI, but deploying it thoughtfully with proper oversight.

AI's role in better AML compliance:

• Pattern recognition identifies risks that human reviewers miss
• Automated risk profiling processes information at scale
• Real-time analysis of transaction patterns and behaviours
• Predictive analytics flagging emerging risks before they materialise
  
  

The productivity gains enable firms to achieve OPBAS's 10.2% coverage benchmark—or exceed it—without proportionally increasing headcount.

What Firms Should Do Now

With the FCA transition approaching and enforcement increasing, professional services firms should:

1. Audit current AML processes

• Do you have documented, firm-wide risk assessments?
• Are your customer due diligence processes robust and consistent?
• Can you prove ongoing monitoring, not just onboarding checks?
• Are your records audit-ready if OPBAS or the FCA requests them?
  
  

2. Assess technology gaps

• Are you relying on manual document checks that can't catch sophisticated forgeries?
• Do you screen against sanctions lists in real-time or annually?
• Can you identify beneficial owners through complex structures?
• Do you have evidence of every compliance decision?
  
  

3. Invest in automated compliance

• Implement identity verification that works at scale
• Deploy beneficial ownership tools that trace through layers
• Adopt real-time sanctions screening with daily updates
• Establish ongoing monitoring throughout client relationships
  
  

4. Prepare for FCA supervision

• Expect higher standards than current PBS oversight
• Anticipate outcome-focused assessments, not box-ticking
• Build evidence trails demonstrating compliance effectiveness
• Move from assisted compliance to robust, independent controls

The Bottom Line

The OPBAS 2024/25 report makes clear that baseline compliance isn't enough—effectiveness matters, and persistent failures will face consequences.

With HMRC issuing fines up to £104,000, the FCA preparing to assume supervision, and technology enabling compliance that manual processes can't match, the path forward is obvious.

Firms need robust, automated AML systems that deliver:

• Consistent identity verification catches risks, while visual inspection misses
• Beneficial ownership transparency through complex structures
• Real-time sanctions screening against comprehensive global lists
• Ongoing monitoring throughout client relationships
• Audit-ready records proving compliance effectiveness
  
  

SmartSearch provides exactly this—compliance infrastructure purpose-built for the professional services sector's unique challenges.

The question isn't whether to modernise AML compliance. It's whether to do it now, while you control the timeline, or wait until the FCA takes over supervision and expectations increase further.