Art market participants

Assess whether the value reaches £10,000 in one transaction or relevant linked transactions. Splitting a sale into invoices or instalments does not necessarily avoid the threshold. The AMP scope is not restricted to cash payments.

CDD also applies on a business-relationship trigger and when there is suspicion or doubt about earlier identification evidence, as relevant. Freeport operators have a specific storage-related threshold based on works held for a person or linked persons.

Identify the customer and any beneficial owner, and verify the identity and authority of a person acting on the customer's behalf. Intermediaries can obscure the ultimate buyer or seller: determine the contractual and commercial relationships rather than rely on an agent's identity alone.

Risk-based checks should consider opaque collecting companies, nominees, third-party payers and unusual settlement arrangements. Apply the relevant HMRC sector guidance to identify the parties for whom CDD is required in the particular transaction.

Portability, subjective valuation, private sales and storage arrangements can create money-laundering risks. Provenance and authenticity work can inform an assessment but do not replace customer identification or source-of-funds checks where required.

Investigate unusually complex or unusually large transactions in context, unexplained pricing, rapid resale and transactions without an apparent economic purpose. Apply proportionate enhanced measures when the statutory EDD triggers are present.

Regulation 18 requires a relevant person to identify and assess its money-laundering and terrorist-financing risks. The assessment must consider customers, countries or geographical areas, products or services, transactions and delivery channels, as well as information made available by the supervisory authority. Its extent must be appropriate to the size and nature of the business.

Keep a written record and keep the assessment up to date unless the supervisor has determined that an individual documented assessment is unnecessary for the sector. Regulation 18A separately addresses proliferation-financing risk: the risk of breaches, non-implementation or evasion of financial sanctions connected with proliferation of weapons of mass destruction.

Regulation 19 requires proportionate policies, controls and procedures to manage identified risks. These cover risk management, internal controls, customer due diligence, reporting, record keeping and monitoring compliance. Senior management must approve them; they must be reviewed and updated. Regulation 20 addresses group-wide arrangements, including relevant overseas branches and subsidiaries.

Where appropriate to the size and nature of the business, Regulation 21 requires a board or senior-management officer responsible for compliance, screening of relevant employees and an independent audit function. A nominated officer receives internal suspicion reports where required. These roles are distinct; not every firm has an FCA-designated SMF17 role. Regulation 24 requires relevant staff, and relevant agents where applicable, to receive regular training, with written records of the measures taken.

Customer due diligence (CDD) is required when establishing a business relationship, when applicable occasional-transaction thresholds are met, when money laundering or terrorist financing is suspected, or when the adequacy or accuracy of earlier identification information is in doubt. Sector-specific triggers also apply; a threshold is not permission to ignore suspicion below that amount.

Regulation 28 requires identification and verification using reliable, independent sources, identification of beneficial owners with reasonable verification measures, and assessment of the purpose and intended nature of the relationship. Understand a corporate customer's ownership and control structure and check the authority of anyone acting on its behalf. Do not rely solely on a public register to establish beneficial ownership.

Regulation 30 generally requires verification before establishing the relationship or carrying out the transaction. Its limited exceptions have conditions and are not a general entitlement to defer checks. Regulation 30A contains separate duties to report qualifying material discrepancies in relevant beneficial-ownership registers; not every typographical difference is reportable.

Ongoing monitoring includes scrutiny of transactions for consistency with the firm's knowledge of the customer, business and risk profile, including the source of funds where necessary. Keep due-diligence information current. The law requires an effective risk-based outcome, not one particular software product or a universal annual review interval.

Where a firm cannot apply the required CDD, Regulation 31 generally requires it not to establish the relationship or execute the relevant transaction, to terminate an existing relationship and to consider a disclosure. Specific exceptions exist, including for certain legal work; apply the actual provision rather than automatically blocking every instruction.

Regulation 40 generally requires CDD evidence and transaction records to be retained for five years after a business relationship ends or an occasional transaction completes. Personal data must ordinarily be deleted afterwards, subject to the statutory exceptions. AML records do not remove data-protection obligations.

Enhanced due diligence (EDD) and enhanced ongoing monitoring apply to the higher-risk circumstances specified in Regulation 33. These include identified high risk and specified country-related circumstances. The amended transaction triggers include transactions that are unusually complex or unusually large given their nature, unusual patterns of transactions, or transactions without an apparent economic or legal purpose. Examine the background and purpose and record the findings.

Regulation 35 addresses politically exposed persons (PEPs), their family members and known close associates. Required measures include senior-management approval, adequate measures to establish source of wealth and source of funds, and enhanced monitoring. A PEP is not automatically suspected of crime.

For domestic PEPs and their family members or known close associates, the statutory starting point is lower risk than for non-domestic PEPs where no additional enhanced risk factors are present. The extent of EDD must reflect that distinction. Simplified due diligence under Regulation 37 is available only on a properly evidenced low-risk assessment, not when suspicion or another mandatory EDD trigger applies.

Sections 327–329 of the Proceeds of Crime Act 2002 create the principal money-laundering offences. Section 330 contains the regulated-sector failure-to-disclose offence, including where there are reasonable grounds for knowledge or suspicion, subject to its statutory conditions and exceptions. Reports are made through the nominated officer where appropriate and to the National Crime Agency (NCA).

A suspicious activity report (SAR) is not the same as a request for a defence against money laundering (DAML). Where a proposed act could engage a principal offence, assess whether a defence is needed before proceeding and observe the applicable statutory process. A DAML is not an NCA endorsement of the customer or a general clearance for future activity.

Section 333A addresses tipping off in the regulated sector and section 342 addresses prejudicing an investigation, each with specific elements and exceptions. Terrorist-financing offences and disclosure duties arise separately under the Terrorism Act 2000. Obtain appropriately qualified advice on privilege, exceptions and any proposed disclosure.

UK sanctions obligations are separate from the MLR customer-risk framework. Relevant regulations may prohibit dealing with frozen funds or economic resources, or making funds or economic resources available to or for the benefit of designated persons, including entities owned or controlled by them. The exact restrictions and exceptions depend on the applicable sanctions regime.

A name match needs investigation, and absence from a list does not settle ownership or control. Where applicable, freeze assets, do not proceed without a lawful exception or licence, and comply with the relevant reporting obligations to the Office of Financial Sanctions Implementation (OFSI). Overseas sanctions do not automatically have the same legal scope as UK sanctions.