A hairdresser. A corner shop. A beauty salon.
On paper, there is nothing particularly unusual about any of them. They are ordinary businesses found on high streets across the UK.
But what if the same address has been used by dozens of companies? What if the company has existed for just six months? What if several apparently unrelated businesses were incorporated at roughly the same time and then dissolved within the same period?
And what if the pattern keeps repeating?
New analysis of Companies House data has uncovered more than 3,000 short-lived UK companies registered as beauty businesses and convenience stores, raising questions about how easily corporate structures can be exploited for money laundering and other financial crime.
The research, conducted by AML technology provider SmartSearch, identified 3,097 dissolved companies between 2016 and 2026. Conservative modelling suggests that between £310 million and £464 million may have moved through these companies. The researchers suggest that applying similar patterns to other high-risk, cash-intensive sectors could put the total above £1 billion over the past decade.
The numbers are alarming. But for compliance teams, the most interesting part of the story is not the £464 million. It’s the pattern.
Are these businesses that failed? They don’t look like it
The companies identified in the analysis had average lifespans of only 170 to 194 days.
They were clustered around the same postcodes and registered addresses. Their incorporation and dissolution dates followed recurring patterns. And businesses that supposedly operated in completely different sectors displayed remarkably similar corporate behaviour.
Among the suspect convenience businesses, 92% were incorporated in the first or second quarter of the year, with more than half dissolved in the fourth quarter.
For hairdressing-related companies, 83% were incorporated during the first two quarters.
The cycle then repeated. One area of Cardiff alone contained 119 suspected companies across the two sectors.The research does not mean that every short-lived hairdresser or convenience store is a front for criminal activity. Nor does a shared address prove anything on its own.
But the combination of indicators is precisely what makes the findings so significant. These are not isolated red flags. They are patterns.
The criminal exploitation of the high street is hiding in plain sight
There is an uncomfortable simplicity to the apparent model. Set up a company. Give it a plausible business description. Provide a registered address. Create the appearance of a functioning business. Use it for a period of time. Move money through it. Close it down.
Then do it again.
The UK has made company formation deliberately straightforward because easy incorporation supports legitimate entrepreneurship. But that same simplicity can be exploited by people who have no intention of building a genuine business.
The issue is now receiving increasing attention from government and regulators. Authorities have been targeting apparently legitimate retail outlets suspected of being used to launder criminal money, while concerns about the integrity of the UK company register have intensified.
For businesses conducting AML due diligence, it’s important to note that a company being registered does not mean that the business behind it is genuine.
And that matters particularly for law firms.
Law firms: when did you last update your red flags?
Law firms spend a lot of time updating their AML policies.
They amend procedures when the SRA publishes new guidance. They update policies following changes to the Money Laundering Regulations. They refresh their firm-wide risk assessments. They review sanctions procedures. They introduce new technology.
But when did they last ask, are our actual red flags still relevant to the way criminals are exploiting the system today?
The SRA’s current guidance is clear that a firm’s risk assessment should identify the money laundering risks the firm is exposed to and inform its policies, controls and client and matter risk assessments. The SRA also says its sectoral risk assessment should be taken into account when firms produce their own firm-wide risk assessment.
And in June 2026, the SRA updated its guidance on client and matter risk assessments, specifically noting examples where firms missed specific AML risks or adopted a tick-box approach rather than genuinely considering the risks involved.
That highlights the challenge. It is possible to have a beautifully written AML policy that is completely up to date and still have outdated red flags.
Are your high-risk businesses still the right high-risk businesses?
It is worth taking a fresh look at what your firm actually considers to be a high-risk business.
Most law firms will have well-established AML procedures covering high-risk jurisdictions, enhanced due diligence triggers and categories of clients that require additional scrutiny. Their policies may contain red flags around complex ownership structures, unexplained wealth, offshore companies, politically exposed persons and unusual transactions.
All of these remain important. But where, in that risk assessment, is the high street?
What happens when the client sitting in front of you is not an obviously complex international corporate structure, but a perfectly ordinary-looking UK limited company? A convenience store. A beauty business. A car wash. A phone shop. A nail bar.
There is nothing inherently suspicious about any of these businesses. And that is the point. If criminals are using ordinary-looking high-street businesses as vehicles for moving illicit money, the risk may not be obvious from the business description alone.
The issue, then, is not whether a convenience store or beauty salon should automatically be classified as high risk. It is whether firms are looking closely enough at the combination of factors surrounding the business.
Who owns it? Where does it operate? How long has it existed? What other companies are connected to its directors or beneficial owners? What does its financial activity look like? Does the scale and nature of its transactions make sense for the business it claims to be?
The risk is not necessarily in the type of business itself. It is in the gap between what the business appears to be and what the evidence tells you it actually is.
That is why the latest findings should prompt law firms to ask, when did we last look at the high-risk businesses on our list and check whether they still reflect where financial crime is actually happening?
It is easy to spend time updating policies to reflect the latest regulatory requirements. It is much harder and potentially much more valuable, to step back and ask whether the red flags themselves are still looking in the right places.
What should law firms be looking for?
The latest findings suggest firms should consider whether their AML procedures adequately capture indicators such as:
- A company with an unusually short corporate history
- Multiple companies linked to the same registered address
- Repeated incorporation and dissolution of similar businesses
- Directors or beneficial owners associated with many recently dissolved companies
- Generic or interchangeable business descriptions
- A client’s stated business activity that’s not consistent with its financial activity
- Transaction values that seem disproportionate to the size or nature of the business
- Cash-intensive businesses with unusually complex payment flows
- Rapid changes in ownership or corporate structures without a commercial rationale
None of these should become an automatic “reject” button but they should become questions. Where is the business actually operating? How many employees does it have? Who are its customers? What does its turnover look like? Why has the company changed directors three times in a year? Why are ten apparently unrelated companies registered at the same address? Why has the beneficial owner been involved with several companies that were incorporated and dissolved within months?
And, the big one, does the whole story make commercial sense?
Companies House: more than a tick-box check
Companies House is an essential source of due diligence, but registration does not establish that a business is genuine. The value lies in what the information reveals about the client.
If a search uncovers a trail of short-lived companies, repeated addresses or connected directors, that should not simply be recorded and filed away. It should inform the firm’s assessment of the client’s risk.
Your risk assessment is only as good as its last update
Criminals do not wait for the next regulatory update before changing tactics. So firms should not limit their reviews to policies and procedures. They should also challenge the assumptions underneath them.
Are the firm’s red flags still capturing the risks that are emerging now? Would the onboarding process identify a legitimate-looking company that is actually part of a wider network? And does the firm’s definition of a high-risk business reflect what is happening on the ground?
With the SRA’s latest sectoral risk assessment published in August 2026, there is a timely opportunity to revisit those questions.
Stop looking for criminals. Start looking for patterns
The companies at the centre of this story did not necessarily look criminal. That was their advantage.
The warning for law firms is that effective risk-based AML is not about spotting the obviously suspicious client. It is about recognising when ordinary-looking facts, taken together, point to something that does not make sense.
That means keeping red flags current, looking beyond individual companies and continually testing whether the firm’s risk assessment reflects how financial crime is actually evolving.
The most dangerous AML policy may not be one that is out of date. It may be one that is perfectly up to date on paper, but still looking for yesterday’s criminals.
