UK guidance on anti-money laundering (AML) due diligence for investments starts with the Money Laundering Regulations 2017, applicable FCA rules and JMLSG guidance. For firms within scope, customer due diligence (CDD) includes checking the customer and beneficial owners and understanding the relationship. Firms must also assess risk and monitor activity. The checks must address the investment and the people involved.
This guide is for fund managers, investment firms and administrators handling investor or transaction files. It covers money coming into a fund and the separate checks that can arise when a fund buys or sells an investment. It does not assess investment returns or replace financial, tax or legal deal due diligence.
Written by AgentKYZ. Sources checked on 19 October 2026. The checklist and examples below are our operational recommendations, not an official FCA or JMLSG checklist. For help completing investor files, see AgentKYZ’s UK managed KYC services.
Which UK rules and guidance should you use?
The Money Laundering Regulations 2017, or MLRs, set legal requirements for businesses within their scope. Start by identifying the responsible entity, its activities and its supervisor. A UK manager and an overseas fund can have different obligations even when they share investor documents.
For FCA-regulated firms, check the applicable Handbook rules. The FCA Financial Crime Guide, chapter 3, explains supervisory expectations and examples of good and poor practice. It identifies JMLSG guidance as a key resource; neither guide replaces legislation or applicable rules.
Use the Joint Money Laundering Steering Group (JMLSG) current-guidance page to find the texts and any subsequent revisions. At our review date it linked to Part I, October 2026, and Part II, June 2023 updated December 2025. Read Part I’s general requirements alongside the relevant Part II sector:
- Sector 8: non-life providers of investment fund products.
- Sector 9: discretionary and advisory investment management.
- Sector 10: execution-only stockbrokers.
- Sector 13: private equity.
- Sector 20: brokerage services to funds.
Choose the guidance for the activity, not simply the firm’s trading name. Our broader UK AML compliance guide covers governance, reviews and outsourcing across financial services.
Identify who needs checking on each side of the investment
Investor onboarding examines the person or entity putting money into the fund. Transaction-side due diligence examines the relevant parties when the fund invests or exits. Commercial due diligence on a target’s revenue does not establish that the investor’s subscription money has a legitimate origin.
JMLSG Part II, sector 13 makes this distinction explicit for private equity. Paragraph 13.21 separates fundraising investors from transaction parties. Paragraphs 13.29–13.48 address portfolio companies, acquisition vehicles, sellers, co-investors and exits.
For a private equity transaction, map these parties before requesting documents:
- Fund investor: identify the subscribing entity or individual, relevant beneficial owners and anyone authorised to act for it.
- Portfolio company: consider the company receiving the investment, its ownership and control, business activity and geographic exposure.
- Seller: identify who benefits from the sale. Paragraph 13.40 recommends CDD on sellers even where an acquisition vehicle sits between them and the fund.
- Co-investor: assess the role and risk. Paragraph 13.43 highlights circumstances such as a significant ownership stake, a board role or formal reliance on the lead investor.
- Exit counterparty: consider the purchaser on a private sale, or the relevant parties for another exit structure, using paragraph 13.47.
These are private-equity-specific examples. Do not apply the same party list mechanically to every listed-security trade or investment mandate. Record why each party falls within the review and which entity owns the obligation.
An AML due diligence checklist for investment files
Use this checklist to organise the evidence and decisions. Adapt it to the applicable rules, customer type and approved policy. Completing it does not by itself establish compliance.
1. Record the relationship and risk
Describe who is investing, the amount or commitment, the expected payment route and the purpose of the relationship. Assess relevant customer, geographic, product and delivery-channel risks. Record the reasons for the risk rating, including information that contradicts an initial low-risk assessment.
2. Verify identity, ownership and authority
Regulation 28 requires customer identification and verification, applicable beneficial ownership checks, and assessment of the purpose and intended nature of the relationship. Verify the authority and identity of people acting on the customer’s behalf.
For a company, connect the ownership chart to reliable evidence and understand who controls it. Apply the beneficial ownership definition for the entity type; trusts and partnerships need different analysis from companies. Companies House information can support the review, but Regulation 28(9) prevents reliance solely on registrar information to satisfy beneficial ownership requirements. Document any applicable exception rather than assuming one.
3. Assess screening results and adverse information
Check the relevant parties for sanctions exposure and politically exposed person (PEP) status, and assess credible adverse information under your policy. Resolve potential matches using identifying details and record the reasoning. A common name match is not proof that two people are the same person.
Sanctions need a separate decision. OFSI guidance explains that restrictions can extend to entities owned or controlled by designated persons even when the entity is absent from the UK Sanctions List. A low AML risk rating does not remove sanctions obligations.
4. Support the source-of-funds explanation
Establish the origin of the investment money to the extent required by the applicable obligations and risk. Where source of wealth is required, explain how the customer or beneficial owner accumulated their wealth. Keep both the supporting evidence and the reviewer’s assessment; the next section gives examples.
5. Resolve gaps before the required approval point
Separate missing documents, unresolved risk and cases awaiting approval. Name the decision-maker and record any required senior-management approval. Under Regulation 31, inability to complete required CDD can prohibit a transaction or new relationship and require an existing relationship to end, subject to the regulation’s exceptions. It also requires consideration of a suspicious activity disclosure.
Escalate suspicion through the nominated officer or money laundering reporting officer (MLRO) process. A missing document alone does not establish suspicion, and sending a suspicious activity report does not give general permission to proceed. Observe confidentiality and tipping-off restrictions when seeking more information.
6. Keep a retrievable decision record
Retain the policy version, evidence reviewed, risk rationale, screening decisions, unresolved issues and approval record. Regulation 40 generally requires relationship CDD records for five years after the relationship ends, or records of an occasional transaction for five years after its completion. It also addresses transaction records, a ten-year limit for certain records and deletion of personal data unless an exception applies. Do not start the relationship retention clock at the last KYC review.
Source of funds and source of wealth: what evidence helps?
The FCA’s definitions in FCG 3.2.6 distinguish source of funds, the origin of money used in the relationship or transaction, from source of wealth, how the customer or beneficial owner acquired their total wealth. A bank transfer shows the payment route; it may not show the activity that generated the money.
Evidence should fit the explanation and risk. These are examples, not a mandatory document list:
- Employment income or savings: income records and account history that support the claimed accumulation and available amount.
- Sale of a business, property or investment: sale or completion documents, evidence of the customer’s entitlement and receipt of proceeds.
- Inheritance: relevant estate or distribution records and evidence of receipt.
- Company profits or dividends: financial statements, distribution records and evidence connecting the payment to the investor.
- Borrowing or a third-party payment: identify the lender or payer, explain the relationship and funding terms, and investigate the underlying origin as the risk requires.
Illustrative example: an investor says a £750,000 subscription comes from selling a business. A bank statement shows a £750,000 credit from a law firm. The amount matches, but the file still needs a supported connection between the investor, the sale and the proceeds. Depending on risk, sale and completion records may provide that connection. If the payer or amount differs from the explanation, investigate before treating the evidence as sufficient.
Standard CDD does not mean collecting every possible wealth document from every investor. Apply the relevant requirements proportionately, and record why the evidence is enough or what remains unresolved.
For banks reviewing an existing client book, our source of wealth remediation guide covers reusing adequate evidence, resolving material gaps and separating current updates from possible historical failures.
When enhanced due diligence is required
Regulation 33 requires enhanced due diligence (EDD) and enhanced ongoing monitoring in specified cases, including identified high risk. Its triggers include relevant PEP relationships, certain geographic exposure, false or stolen identification and unusual transactions. The extra measures must address the actual risk.
Two current points matter when using older investment AML checklists:
- The country trigger changed on 30 June 2026. Regulation 33(1)(b) now refers to FATF call for action countries. FATF increased-monitoring or “grey-list” status is no longer by itself that automatic trigger. It remains relevant to the wider risk assessment, which can still require EDD.
- Transaction size needs context. Regulation 33(1)(f) refers to an unusually complex or unusually large transaction given its nature, an unusual pattern, or transactions with no apparent economic or legal purpose. A large subscription that fits the customer’s profile should not be treated as suspicious solely because of its size.
For PEP relationships, Regulation 35 requires senior-management approval, adequate measures to establish source of wealth and funds, and enhanced ongoing monitoring. Domestic PEPs, their family members and known close associates have a lower-risk starting point than non-domestic PEPs; without additional enhanced risk factors, the extent of EDD must be less. Read the FCA’s FG25/3 guidance when setting the approach.
At the other end of the scale, Regulation 37 permits simplified due diligence where the conditions for low risk are met. It still requires CDD and sufficient monitoring. Being a professional investor or using a regulated bank does not automatically remove the checks.
Complete checks before commitment and monitor changes
Regulation 30 generally requires identity verification before establishing the relationship or carrying out the transaction. It contains limited exceptions, including verification during establishment where necessary not to interrupt normal business and where there is little money laundering or terrorist financing risk. A closing deadline alone is not an exception.
For private equity fundraising, JMLSG paragraph 13.28 puts identification checks and satisfaction as to source of funds before an unconditional contractual commitment to accept an investor. For new or further investments, paragraph 13.46 puts completion of checks before the fund becomes unconditionally legally obliged to complete. Build those points into subscription and deal workflows; waiting until money moves may be too late.
After onboarding, Regulation 28(11) requires ongoing monitoring and current CDD information. Review changes in ownership, unexplained third-party payments, unexpected redemptions or new adverse information. A scheduled document refresh covers only part of monitoring.
For follow-on private equity investments, paragraph 13.45 calls for an assessment of whether existing monitoring and CDD remain sufficient. It does not call for automatic re-verification in every case. Record the review trigger, what changed and why existing evidence remains adequate or needs updating.
Get help with investor files while keeping approval control
If an administrator or provider performs CDD, agree who collects evidence, resolves alerts, approves relationships and monitors activity. Regulation 39 distinguishes outsourcing from statutory reliance on eligible third parties. Both leave the regulated firm liable for failures; statutory reliance has additional information and record-access conditions.
AgentKYZ’s UK KYC service supports investor onboarding, CDD remediation and periodic reviews under your approved AML policy. Agents organise documents and perform the first pass; qualified compliance reviewers check the work. Your team receives ownership evidence, screening rationale, a proposed risk assessment and unresolved questions for decision.
Your firm retains customer acceptance, required approvals and reporting decisions. Agree transaction-side due diligence and wider AML controls separately; an investor-file engagement does not automatically cover the entire deal or compliance programme.
If your administrator already maintains the files, Shadow KYC offers a separately scoped file review against your policy. For wider fund-process checks, see our AIMA customer due diligence checklist.
Bring the investor types, case count, open issues and target date to a scoping call. AgentKYZ can confirm the deliverables and price before you share customer documents through an agreed secure transfer method.