The TCSP compliance checklist
Twelve checks for UK trust and company service providers — what each obligation means, the evidence a supervisor expects to see, and where it comes from. Updated for the Economic Crime and Corporate Transparency Act.
Registration & supervision
1.Registered and supervised for every TCSP activity you provide
A TCSP must be supervised for anti-money laundering purposes — by HMRC, or by the professional body it belongs to — before it provides TCSP services, and the registration must cover each type of service it offers.
Evidence to keep: Supervisor name, registration or membership reference, the services covered, and the renewal date.
Source: Money Laundering Regulations 2017 (MLR 2017), Parts 2 and 6
2.Owners, officers and managers have passed the fit-and-proper test
Beneficial owners, officers and managers of a TCSP need approval from the supervisor (HMRC runs a fit-and-proper test; professional bodies run an equivalent approval).
Evidence to keep: Approval letters or confirmations for each relevant person, and a process for new appointments.
Source: MLR 2017, regulations 26 and 58
3.A written risk assessment that covers address services
You need a written firm-wide risk assessment, and policies, controls and procedures to match it. For a TCSP it should deal specifically with the risks of providing addresses: shell companies, address misuse, and nominee arrangements.
Evidence to keep: A dated firm-wide risk assessment, reviewed at least annually, that names registered office and mail-forwarding risks.
Source: MLR 2017, regulations 18 and 19
Client due diligence
4.Customer due diligence before the service starts
Identify and verify each client company, its beneficial owners and the person instructing you before you provide the address, with enhanced due diligence where the risk is higher.
Evidence to keep: A CDD file per client company: identity verification, beneficial ownership, risk rating, and the date completed.
Source: MLR 2017, regulations 27, 28 and 33
5.Ongoing monitoring, not one-off onboarding
Due diligence has to be kept up to date, with reviews triggered by changes in the client: new officers or PSCs, a change of business, or unusual activity.
Evidence to keep: A review schedule by risk rating and a record of each periodic or trigger-based review.
Source: MLR 2017, regulations 27(8) and 28(11)
6.Every company at your address is a known client
Companies can register an address without the owner’s permission. A TCSP should regularly compare the companies registered at its address on Companies House with its client list, and act on any it does not recognise.
Evidence to keep: A dated reconciliation of Companies House records against your client list, and the action taken on each unknown company.
How ComplyPost helps: The free address lookup lists every company registered at your address. In the app, nightly Companies House monitoring alerts you when a company appears at, or leaves, your address.
Source: Companies Act 2006 (as amended by ECCTA 2023); Companies House guidance on registered office misuse
Companies House & ECCTA
7.Every registered office you provide is an "appropriate address"
Since 4 March 2024 a registered office must be an appropriate address: documents sent there should be expected to come to the attention of a person acting on behalf of the company, and delivery should be able to be recorded by acknowledgement.
Evidence to keep: A process, and a record, showing each letter was received, attributed to the right company, and passed on.
How ComplyPost helps: Every letter is matched to the client company, timestamped on upload, and logged through delivery and opening — the acknowledgement trail the rule is built around.
Source: Companies Act 2006, section 86 (as amended by the Economic Crime and Corporate Transparency Act 2023)
8.Identity verification and ACSP status are in order
Companies House identity verification for directors and people with significant control became compulsory from 18 November 2025, with existing officers moving across over a transition period. Firms that verify identities or file on behalf of clients need to be registered as an Authorised Corporate Service Provider (ACSP).
Evidence to keep: ACSP registration (if you file or verify for clients) and a tracker of which client directors and PSCs are verified.
Source: Economic Crime and Corporate Transparency Act 2023; Companies House identity verification guidance
Mail handling & records
9.A record of every letter received
You should be able to say what arrived for any client company, when, and from whom — both to evidence the appropriate-address duty and to answer a client or supervisor.
Evidence to keep: A searchable log: date received, sender, recipient company, and document type.
How ComplyPost helps: Bulk scans are split into individual letters, matched to the client company, and searchable by company, sender, category, date, or plain English.
Source: Companies Act 2006, s.86; MLR 2017, regulation 40 (record-keeping)
10.Statutory mail is identified and forwarded the same day
Letters from HMRC, Companies House, the courts, the Insolvency Service and The Pensions Regulator often carry short deadlines. Missing one can mean penalties or strike-off for the client — and a complaint against you.
Evidence to keep: A written turnaround standard for statutory mail and a record showing it was met.
How ComplyPost helps: AI identifies the sender type, priority and any deadline on each letter, so HMRC and Companies House notices are flagged before anything else.
Source: Good practice; client contract terms
11.Proof of delivery, kept for five years
Keep evidence of what you did with each item — when and how it was passed on — and keep CDD and transaction records for five years after the business relationship ends.
Evidence to keep: A delivery record per letter, and a retention policy that matches the five-year requirement.
How ComplyPost helps: The audit log records every upload, send, view and download with user and timestamp, exportable as CSV, with retention controls up to five years.
Source: MLR 2017, regulation 40; UK GDPR storage limitation
12.Red flags in the post reach your MLRO
Mail is an early-warning system: letters for companies you do not know, waves of debt-collection or court post, or mail for a dissolved company can all indicate misuse. Staff should know to escalate them to the MLRO for a possible suspicious activity report.
Evidence to keep: Staff training records covering mail red flags, and an escalation log kept by the MLRO.
Source: MLR 2017, regulations 21 and 24; Proceeds of Crime Act 2002, Part 7
This tool gives general guidance on UK rules for trust and company service providers. It is not legal advice. Confirm your position with your AML supervisor or a qualified adviser.
Keep a copy in your inbox
We'll email you the checklist and a five-part series on the mail side of TCSP compliance.
Evidence items 6, 7, 9, 10 and 11 automatically
ComplyPost logs every letter against the right company, flags statutory mail, proves delivery, and monitors your address on Companies House. Free for 100 pages a month.
Start free