HMRC maintains a public register of businesses it has penalised under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.  It is sometimes referred to, informally, as the naughty list. It is anything but informal in its consequences.

The scale of enforcement

The list has grown dramatically. Between 2021/22 and 2024/25, HMRC issued 1,860 AML fines – a 177% increase in four years. Estate and lettings agencies are consistently the most penalised sector, accounting for close to half of all fines in recent years. In the six months from April to September 2025 alone, 170 penalties were issued to estate agency businesses, totalling over £835,000, with fines ranging from a few thousand pounds to over £50,000.

Most arise from what might seem like administrative oversights: failing to register, failing to renew on time, or – as in this case – failing to notify HMRC of a material change. Under Regulation 57(4)(a), supervised businesses must inform HMRC of material changes, and a change of company name qualifies. HMRC’s power to impose financial penalties for such failures sits in Regulation 83.

What it means to be named on HMRCs list

Publication on the list is not a minor inconvenience. Entries remain online for five years. They identify your business by name and address, describe the breach, and state the penalty amount. Landlords, tenants, prospective clients, conveyancers and business partners can all find them with a simple search. In a competitive letting and estate agency market, the reputational damage can far exceed the financial penalty. Agents named on the list have reported that conveyancers become reluctant to work with them, and that landlords ask questions that are difficult to answer. Once named, HMRC also tends to look more closely at the business going forward.

Almost nobody appeals

Of the hundreds of businesses on the penalty list, the overwhelming majority are marked “No Appeal.” When we reviewed the published data, the number who have challenged penalties is vanishingly small – and most of those who did appeal found HMRC’s sanctions upheld. The general view seems to be that it is not worth the effort.

We disagree.

Our client’s case

Our client is a letting agent and estate agency operating across England. Before we began acting for them, they underwent a rebrand and changed their company name. Everything else about the business remained the same. In the midst of the rebrand, they simply forgot to notify HMRC, their AML supervisor. A few weeks ago they received a £2,500 penalty notice.

We drafted a letter for our client to send to HMRC, setting out the full circumstances: the genuine and innocent nature of the oversight, the absence of any substantive non-compliance, and the disproportionality of public naming for what was, in substance, a notification failure during an otherwise unremarkable administrative process.

Last month, HMRC wrote back to advise that the penalty had been rescinded.

Outcome? Our client does not appear on the list. We checked.

The mechanics of challenging a penalty*

When HMRC issues a penalty notice under the Money Laundering Regulations, it must offer the business a review by a different officer who was not involved in the original decision. That request must be made within 30 days of the penalty notice. If the review goes against the business, there is a further right of appeal to the First-tier Tribunal, again within 30 days of the review outcome.

In our client’s case, the penalty was rescinded at the review stage and no tribunal was needed. The letter we drafted was a response to the penalty notice requesting that review, and HMRC accepted it.

The take-away lesson

HMRC has, as your accountants will tell you, an even more formidable reputation than the SRA when it comes to enforcement. That makes this outcome all the more significant. Penalties are not always the end of the story, but you do need to engage – and to engage properly – before the deadline passes*.

If you have received an AML penalty notice, or if you are concerned that your compliance arrangements may not be fully up to date – including in relation to notification obligations when changes occur – please contact us. The window to challenge is limited, and the consequences of inaction are public, lasting and, as the statistics show, increasingly likely to be searched.