Your responsibilities under money laundering supervision
Source: gov.uk (2025-05-23)

How to carry out checks on your business and customers, and what records you must keep to prevent money laundering.

You must meet certain day-to-day responsibilities if your business is covered by the Money Laundering Regulations (https://www.gov.uk/guidance/money-laundering-regulations-who-needs-to-register). These include carrying out ‘customer due diligence’ measures to check that your customers are who they say they are, and risk assessing your business (https://www.gov.uk/guidance/money-laundering-regulations-risk-assessments).

You must also put in place internal controls and monitoring systems. The nature of these controls will depend on the size and complexity of your business, including:
- the number of customers you have
- the number of products and services you provide
- the type of products and services you provide
Customer due diligence requirements

What customer due diligence is

Customer due diligence means taking steps to identify your customers and checking they are who they say they are. In practice this means obtaining a customer’s:
- name
- photograph on an official document which confirms their identity
- residential address and date of birth
The best way to do this is to ask for:
- a government issued document like a passport
- utility bills
- bank statements
- other official documents
Other sources of customer information include the electoral register and information held by credit reference agencies such as Experian and Equifax.

You also need to identify the ‘beneficial owner’ in certain situations. This may be because someone else is acting on behalf of another person in a particular transaction, or it may be because you need to establish the ownership structure of a company, partnership or trust.

The beneficial owner is usually the person who’s behind the customer and who owns or controls the customer, or it’s the person on whose behalf a transaction or activity is carried out.

If you have doubts about a customer’s identity, you must stop dealing with them until you’re sure.

When you need to apply customer due diligence measures

You must apply customer due diligence measures:
- when you establish a business relationship with a customer (or another party in a property sale)
- when you suspect money laundering or terrorist financing
- when you have doubts about a customer’s identification information
- when it’s necessary for existing customers — for example, if their circumstances change
- if you are not a high value dealer, when you carry out an ‘occasional transaction’ worth 15,000 euros or more
- make a payment to a supplier worth 10,000 euros or more
- carry out an ‘occasional transaction’ worth 10,000 euros or more
Customer due diligence when you’re establishing a business relationship

A business relationship is one that you enter into with a customer where both of you expect that the relationship will be ongoing. It can be a formal or an informal arrangement.

When you establish a new business relationship you need to obtain information on:
- the purpose of the relationship
- the intended nature of the relationship — for example, where funds will come from, the purpose of transactions, and so on
The type of information that you need to obtain may include:
- details of your customer’s business or employment
- the source and origin of funds that your customer will be using in the relationship
- copies of recent and current financial statements
- details of the relationships between signatories and any underlying beneficial owners
- the expected level and type of activity that will take place in your relationship
The changing circumstances of your customers

You need to keep up-to-date information on your customers so that you can:
- update your risk assessment of a particular customer if their circumstances change
- carry out further due diligence measures if necessary
Changes of circumstance may include:
- a big change in the level or type of business activity
- a change in the ownership structure of a business
When to apply customer due diligence for occasional transactions

You must carry out customer due diligence measures when your business carries out occasional transactions. These are transactions that are not carried out within an ongoing business relationship where the value is:
- 15,000 euros or more (or the equivalent in other currencies) if you’re not a high value dealer or art market participant
- 10,000 euros or more (or the equivalent in other currencies) if you’re a high value dealer or art market participant
This applies whether it’s a single transaction or linked transactions.

Linked transactions are individual transactions of less than 15,000 euros (or 10,000 euros for high value dealers or art market participants) that have been deliberately broken down into separate, smaller transactions to avoid customer due diligence checks. Your business must have systems in place to detect potentially linked transactions.

Once a potentially linked transaction has been identified, you need to decide if it has been deliberately split. Some issues to consider are when:
- a number of payments have been made by the same customer in a short period of time
- it’s possible that a number of customers have carried out transactions on behalf of the same person
- a number of customers have sent money transfers to the same person
You also have to carry out customer due diligence measures for occasional transactions that are worth less than 15,000 euros in certain circumstances. For example, when the nature of a transaction means that there’s a higher risk of money laundering.

When to carry out enhanced due diligence

In some situations you must carry out ‘enhanced due diligence’. These situations are:
- when the customer is not physically present when you carry out identification checks
- when you enter into a business relationship with a ‘politically exposed person’ — typically, a non-UK or domestic member of parliament, head of state or government, or government minister and their family members and known close associates
- when you enter into a transaction with a person from a high risk third country identified by the EU — find the list of high risk third countries on the EU’s website (https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-international-level_en)
- any other situation where there’s a higher risk of money laundering
The enhanced due diligence measures for customers who are not physically present and other higher risk situations include:
- obtaining further information to establish the customer’s identity
- applying extra measures to check documents supplied by a credit or financial institution
- making sure that the first payment is made from an account that was opened with a credit institution in the customer’s name
- finding out where funds have come from and what the purpose of the transaction is
The enhanced due diligence measures when you deal with a politically exposed person are:
- making sure that only senior management gives approval for a new business relationship
- taking adequate measures to establish where the person’s wealth and the funds involved in the business relationship come from
- carrying out stricter ongoing monitoring of the business relationship
Customer due diligence measures where your customer is another Money Service Business

You should seriously consider applying enhanced due diligence if your customer is a money transmitter or currency exchange office. This situation presents a higher risk of money laundering or terrorist financing because the money you receive will be a ‘bulk transfer’ representing a collection of underlying transactions placed with your customer. The extent of enhanced due diligence measures you apply should be based on the risk and circumstances of each case.

You must get the number of underlying transactions of each bulk transfer made to you by your customer. This information will allow you to check that the number and average value of transactions is consistent with the level of business you anticipated when you began your business relationship.

It will also give you an indication of risk, particularly where either the number of underlying transactions or the average transaction value is significantly above what you expected. In such cases you must establish and record why it’s different.

You must undertake checks if you consider there is a risk, to ensure that your customer is carrying out due diligence (and if a money transmitter is involved obtain ‘complete information on the payer’). This will include checking the relevant records for specific transactions.

You should check that any money transmission businesses that you do business with are registered with, or authorised by, the Financial Conduct Authority (FCA). Businesses carrying out money transmission that are not registered with, or authorised by, the FCA cannot lawfully provide payment services in the UK. You should decline the transaction if your customer is not properly registered.

Internal controls and ongoing monitoring of your business

You must make sure that your business has adequate internal controls and monitoring systems. These should alert you and other relevant people in your business if criminals try to use your business for money laundering. Once you’ve been made aware of a potential threat, you can take steps to prevent it and report any suspicious activity.

Your controls should include:
- appointing a ‘nominated officer’ (https://www.gov.uk/guidance/money-laundering-regulations-nominated-officers-and-employee-training) and making sure that employees know to report any suspicious activity (https://www.gov.uk/guidance/money-laundering-regulations-report-suspicious-activities) to them
- appointing a compliance officer if your business is larger or more complex
- identifying the responsibilities of senior managers and providing them with regular information on money laundering risks
- training relevant employees on their anti-money laundering responsibilities
- documenting and updating your anti-money laundering policies, controls and procedures
- introducing measures to make sure that the risk of money laundering is taken into account in the day-to-day running of your business
Complete a policy statement for your business

A policy statement is a document that includes your anti-money laundering policy and controls and the procedures your business will take to prevent money laundering. The document provides a framework for how your business will deal with the threat of money laundering.

You should name relevant individuals and set out their responsibilities. Even if your business is small, it’s a useful tool for focusing your mind and those of your employees, if you have them, to make them constantly aware of the risks.

What a policy statement should include

The exact contents of your policy statement will depend on the nature of your business. But it’s likely to include:
- details of your approach to preventing money laundering, including named individuals and their responsibilities
- details of your procedures for identifying and verifying customers, and your customer due diligence measures and monitoring checks
- a commitment to training employees so they’re aware of their responsibilities
- a summary of the monitoring controls that are in place to make sure your policies and procedures are being carried out
- recognition of the importance of staff promptly reporting any suspicious activity to the nominated officer
Record keeping requirements

You need to keep a record of all customer due diligence measures that you carry out, including:
- customer identification documents that you’ve obtained
- risk assessments
- your policies, controls and procedures
- training records
By keeping comprehensive records you’ll be able to show that your business meets the Money Laundering Regulations. This is crucial to protect your business if there’s an investigation into one of your customers.

The types of record you keep may include:
- daily records of transactions
- receipts
- cheques
- paying-in books
- customer correspondence
The formats that you can keep your records in are:
- originals
- photocopies
- microfiche
- scanned
- computerised or electronic
You must keep your records for 5 years beginning from:
- the date a business relationship ends
- the date a transaction is completed
More information on how to comply

More sector specific guidance on responsibilities under the Money Laundering Regulations can be found in guidance for:
- money service businesses (https://www.gov.uk/government/publications/anti-money-laundering-guidance-for-money-service-businesses)
- estate agency businesses (https://www.gov.uk/government/publications/money-laundering-regulations-2007-supervision-of-estate-agency-businesses)
- high value dealers (https://www.gov.uk/government/publications/anti-money-laundering-guidance-for-high-value-dealers)
- Trust or Company Service Providers (https://www.gov.uk/government/publications/anti-money-laundering-guidance-for-trust-or-company-service-providers)
- the accountancy sector (https://www.gov.uk/government/publications/anti-money-laundering-guidance-for-the-accountancy-sector)
- Art market participants guidance for money laundering supervision (https://www.gov.uk/government/publications/art-market-participants-guidance-on-anti-money-laundering-supervision)