A customer file can pass an identity check and still leave your approver unable to explain who controls the company or where its money comes from. UK AML compliance requires evidence that supports the risk assessment, with unresolved questions sent to the right decision-maker.
This guide focuses on customer due diligence (CDD) for UK financial services firms, including funds, administrators, investment firms, asset managers, banks and brokerages. The obligations depend on the legal entity and activity. For help completing the file work, see our UK KYC services and CDD remediation.
Start with the law, supervisor and activity
The Money Laundering Regulations 2017, usually called the MLRs, set preventive requirements for the businesses within their scope. The Proceeds of Crime Act 2002 and Terrorism Act 2000 provide the wider criminal offences and suspicious activity reporting framework. A CDD checklist addresses only part of these obligations.
The FCA supervises many financial services firms for AML, but it is not the supervisor for every UK business. HMRC and professional body supervisors also have roles. The FCA’s overview identifies firms normally within its MLR supervision and explains that some FCA-authorised businesses fall outside the MLRs while still needing financial crime controls.
For an FCA-supervised firm, read the applicable Handbook provisions alongside the MLRs. The FCA Financial Crime Guide gives examples of good and poor practice. JMLSG guidance helps financial services firms apply the requirements to their business; it is guidance, not a substitute for legislation or applicable FCA rules.
The firm also needs an up-to-date business risk assessment and appropriate policies, controls and procedures. The FCA’s overview covers senior responsibility, the money laundering reporting officer (MLRO), staff understanding of the procedures, and independent audit where appropriate to the size and nature of the business. Outsourcing customer files does not fulfil these wider governance duties.
Before scoping a review, record the legal entity, its activity, supervisor and approved policy. A UK manager and an offshore fund may have different obligations even when they use the same investor documents. An administrator’s involvement does not by itself settle which entity is responsible for each check.
Update checklists for the June 2026 changes
The 2026 amending Regulations made changes that largely took effect on 30 June 2026, with some provisions commencing later. Check the commencement provision before applying a change to a live case.
One change affects geographic risk. Regulation 33(1)(b) now uses FATF call for action countries for its automatic country-based enhanced due diligence (EDD) trigger. It no longer treats every country under FATF increased monitoring as falling within that particular trigger. A country’s grey-list status still informs the risk assessment, and other high-risk circumstances can require EDD under Regulation 33. Removing a country from an automatic rule is not a reason to ignore the risk of a particular relationship.
The amendments also qualify the transaction trigger as “unusually complex or unusually large”, in each case given the nature of the transaction. Firms should review the actual trigger wording and their risk assessment before changing controls.
As checked on 7 October 2026, the JMLSG current-guidance page warns that its guidance is being updated for these amendments and directs readers to subsequent revisions. Check those notices as well as the main PDFs when maintaining your policy.
Build CDD around ownership and the relationship
Regulation 28 requires identification and verification of the customer, assessment of the purpose and intended nature of the relationship, and the applicable beneficial ownership checks. It also addresses people acting on a customer’s behalf, including their identity and authority.
For corporate customers, obtain the required company information and understand the ownership and control structure. Identify beneficial owners and take reasonable measures to verify their identity. The ordinary corporate definition in Regulation 5 includes more than 25% of shares or voting rights, as well as other routes to control. A shareholder spreadsheet alone can miss the person exercising control through an agreement or appointment rights.
Regulation 28(9) expressly prevents firms satisfying beneficial ownership requirements solely through information filed with the company registrar. Companies House information can support the review, but the file still needs the checks required by the MLRs. If the conditions for using a senior managing official as the beneficial owner are met, document the steps taken and the required verification; it is not a shortcut for an unfinished ownership review.
For trusts and other legal arrangements, use the relevant definitions and CDD requirements rather than applying a corporate shareholding test. Record the roles and how control works.
Our file-work recommendation is to link each ownership conclusion to a source document and identify any gap explicitly. Where required CDD cannot be completed, assess the restrictions and reporting consideration in Regulation 31. A missing check should not quietly become an approved exception because a commercial deadline is close.
Apply EDD and domestic PEP rules proportionately
Regulation 33 requires enhanced due diligence and enhanced ongoing monitoring in specified circumstances, including identified high risk. Record why EDD applies and which additional measures address the risk. The required measures vary with the trigger; a standard request for more documents may not address the concern.
Regulation 35 and FCA guidance FG25/3 address politically exposed persons. For a domestic PEP, or their family member or known close associate, the starting point is a lower level of risk than for a non-domestic PEP. Where no additional enhanced risk factors exist, the extent of EDD must be less.
That lower-risk starting point does not remove PEP requirements. Regulation 35 still requires senior-management approval for the relationship, adequate measures to establish source of wealth and source of funds, and enhanced ongoing monitoring. Record the role or connection, other risk factors, proportionate checks and approval. A screening tool’s PEP label cannot make that assessment for the firm.
Keep source of funds and source of wealth distinct. Source of funds concerns the origin of money used in the relationship or transaction. Source of wealth concerns how the person accumulated their wealth. A transfer from a named bank account establishes a payment route; it may leave the underlying origin unexplained.
Keep customer records current between scheduled reviews
Regulation 28(11) requires ongoing monitoring, including scrutiny of transactions against the firm’s knowledge of the customer, business and risk profile. It also requires reviews of existing records and keeping CDD information up to date.
Set risk-sensitive review intervals in your policy, track overdue files and identify events that require earlier review. A change in beneficial ownership, unexplained activity, new adverse information or a newly identified PEP connection can make the existing assessment unreliable before the next scheduled date.
A periodic document refresh covers only part of ongoing monitoring. When outsourcing file reviews, state who monitors transactions, assesses unusual activity and handles urgent escalations. Our recommendation is to keep the last review date, next due date, triggering information and unresolved actions visible in the file.
Keep sanctions and suspicious activity reporting distinct
Sanctions obligations sit alongside AML requirements. A low AML risk rating does not exempt a firm from applicable financial sanctions. Consult OFSI’s current guidance for restrictions, reporting and licensing requirements; a screening result needs review against the relevant regime, including ownership and control.
For suspected money laundering or terrorist financing, follow the firm’s internal escalation procedure and the applicable statutory reporting requirements. The FCA’s overview directs firms to submit suspicious activity reports (SARs) to the National Crime Agency. The nominated officer needs enough information to assess the suspicion, any reporting duty and whether a defence or other consent is required before proposed activity proceeds.
A SAR is not general permission to continue a transaction and does not discharge a separate sanctions reporting or licensing requirement. Control access to sensitive case notes and consider tipping-off restrictions when requesting further information from the customer.
Separate KYC outsourcing from statutory reliance
Regulation 39(7) allows a firm to apply CDD through an agent or outsourcing provider, with arrangements that leave the firm liable for failures. The provider works to the agreed scope; the firm still needs oversight.
Statutory reliance under Regulation 39(1) is a different route. It has conditions on who can be relied on, which measures are covered and access to information. The relying firm must immediately obtain the required information and arrange to receive the underlying identification and verification records immediately on request. Reliance also leaves the firm liable for failures. Receiving another provider’s completed checklist does not establish that these conditions have been met.
The FCA’s outsourcing guidance explains that requirements vary by firm and function. Assess the provisions applicable to your business, including any notification requirement, before transferring work. Do not assume every KYC contract has the same regulatory classification.
For a managed KYC engagement, we recommend agreeing the approved policy, quality checks, reporting, escalation routes, record access and exit arrangements in writing. Address data protection, access permissions, data location, international transfers and retention before customer documents move. Keep customer acceptance and required approvals with the authorised team, and define the MLRO’s escalation route.
Retain evidence and give unresolved cases an owner
Regulation 40 generally requires CDD records to be kept for five years after the business relationship ends, or after completion of an occasional transaction. It also requires sufficient transaction records to reconstruct relevant transactions. The five-year clock for relationship CDD does not start when the file was last reviewed.
The regulation limits the requirement to retain certain transaction records to ten years and requires deletion of personal data after the applicable period unless an exception applies. Apply a documented retention and deletion policy that accounts for other legal obligations and relevant proceedings. Agree how your firm retrieves records during and after an outsourced engagement.
For remediation, our recommended handover contains the file population and policy version, evidence-linked findings, reviewer notes and an exception log. Give each unresolved item an owner and target date. Report missing evidence separately from cases awaiting approval so a completion figure does not hide decisions still required.
Our managed KYC services for UK financial services firms cover onboarding, CDD remediation and periodic reviews under your approved policy. Agents organise the evidence and perform the first pass; qualified compliance reviewers check the work. Bring the case count, entity type and target date to agree the scope and price before sharing customer documents.