Banking & payments

The PSRs govern payment-services permissions and requirements such as conduct of business, information and execution of payment transactions. The EMRs govern issuance of electronic money and the related authorisation or registration framework. Exclusions and requirements differ by activity and institution type.

Safeguarding protects qualifying customer funds according to the applicable regime. It is separate from AML verification and should not be described as a tax or a refundable deposit that a customer must pay to unlock a withdrawal. The treatment of payment and e-money funds is not identical to bank deposit protection.

For the correspondent relationships specified in Regulation 34, enhanced measures supplement ordinary CDD. These include gathering sufficient information about the respondent institution, assessing its AML controls and obtaining senior-management approval before establishing the relationship.

Document each institution's responsibilities. Payable-through arrangements require additional assurance concerning customers with direct access. Regulation 16 separately prohibits relationships with shell banks and requires measures against correspondent accounts being used by them.

Where applicable, SYSC 6.3 requires adequate systems and controls to identify, assess, monitor and manage money-laundering risk. The FCA Financial Crime Guide illustrates good and poor practice in governance, monitoring, investigations and oversight.

Monitoring should reflect the actual customer population and payment flows. Unusual account activity, mule behaviour, third-party payments and unexplained cross-border transfers require investigation. Vendor defaults and alert counts alone do not demonstrate effectiveness.

Regulation 18 requires a relevant person to identify and assess its money-laundering and terrorist-financing risks. The assessment must consider customers, countries or geographical areas, products or services, transactions and delivery channels, as well as information made available by the supervisory authority. Its extent must be appropriate to the size and nature of the business.

Keep a written record and keep the assessment up to date unless the supervisor has determined that an individual documented assessment is unnecessary for the sector. Regulation 18A separately addresses proliferation-financing risk: the risk of breaches, non-implementation or evasion of financial sanctions connected with proliferation of weapons of mass destruction.

Regulation 19 requires proportionate policies, controls and procedures to manage identified risks. These cover risk management, internal controls, customer due diligence, reporting, record keeping and monitoring compliance. Senior management must approve them; they must be reviewed and updated. Regulation 20 addresses group-wide arrangements, including relevant overseas branches and subsidiaries.

Where appropriate to the size and nature of the business, Regulation 21 requires a board or senior-management officer responsible for compliance, screening of relevant employees and an independent audit function. A nominated officer receives internal suspicion reports where required. These roles are distinct; not every firm has an FCA-designated SMF17 role. Regulation 24 requires relevant staff, and relevant agents where applicable, to receive regular training, with written records of the measures taken.

Customer due diligence (CDD) is required when establishing a business relationship, when applicable occasional-transaction thresholds are met, when money laundering or terrorist financing is suspected, or when the adequacy or accuracy of earlier identification information is in doubt. Sector-specific triggers also apply; a threshold is not permission to ignore suspicion below that amount.

Regulation 28 requires identification and verification using reliable, independent sources, identification of beneficial owners with reasonable verification measures, and assessment of the purpose and intended nature of the relationship. Understand a corporate customer's ownership and control structure and check the authority of anyone acting on its behalf. Do not rely solely on a public register to establish beneficial ownership.

Regulation 30 generally requires verification before establishing the relationship or carrying out the transaction. Its limited exceptions have conditions and are not a general entitlement to defer checks. Regulation 30A contains separate duties to report qualifying material discrepancies in relevant beneficial-ownership registers; not every typographical difference is reportable.

Ongoing monitoring includes scrutiny of transactions for consistency with the firm's knowledge of the customer, business and risk profile, including the source of funds where necessary. Keep due-diligence information current. The law requires an effective risk-based outcome, not one particular software product or a universal annual review interval.

Where a firm cannot apply the required CDD, Regulation 31 generally requires it not to establish the relationship or execute the relevant transaction, to terminate an existing relationship and to consider a disclosure. Specific exceptions exist, including for certain legal work; apply the actual provision rather than automatically blocking every instruction.

Regulation 40 generally requires CDD evidence and transaction records to be retained for five years after a business relationship ends or an occasional transaction completes. Personal data must ordinarily be deleted afterwards, subject to the statutory exceptions. AML records do not remove data-protection obligations.

Enhanced due diligence (EDD) and enhanced ongoing monitoring apply to the higher-risk circumstances specified in Regulation 33. These include identified high risk and specified country-related circumstances. The amended transaction triggers include transactions that are unusually complex or unusually large given their nature, unusual patterns of transactions, or transactions without an apparent economic or legal purpose. Examine the background and purpose and record the findings.

Regulation 35 addresses politically exposed persons (PEPs), their family members and known close associates. Required measures include senior-management approval, adequate measures to establish source of wealth and source of funds, and enhanced monitoring. A PEP is not automatically suspected of crime.

For domestic PEPs and their family members or known close associates, the statutory starting point is lower risk than for non-domestic PEPs where no additional enhanced risk factors are present. The extent of EDD must reflect that distinction. Simplified due diligence under Regulation 37 is available only on a properly evidenced low-risk assessment, not when suspicion or another mandatory EDD trigger applies.

Sections 327–329 of the Proceeds of Crime Act 2002 create the principal money-laundering offences. Section 330 contains the regulated-sector failure-to-disclose offence, including where there are reasonable grounds for knowledge or suspicion, subject to its statutory conditions and exceptions. Reports are made through the nominated officer where appropriate and to the National Crime Agency (NCA).

A suspicious activity report (SAR) is not the same as a request for a defence against money laundering (DAML). Where a proposed act could engage a principal offence, assess whether a defence is needed before proceeding and observe the applicable statutory process. A DAML is not an NCA endorsement of the customer or a general clearance for future activity.

Section 333A addresses tipping off in the regulated sector and section 342 addresses prejudicing an investigation, each with specific elements and exceptions. Terrorist-financing offences and disclosure duties arise separately under the Terrorism Act 2000. Obtain appropriately qualified advice on privilege, exceptions and any proposed disclosure.

UK sanctions obligations are separate from the MLR customer-risk framework. Relevant regulations may prohibit dealing with frozen funds or economic resources, or making funds or economic resources available to or for the benefit of designated persons, including entities owned or controlled by them. The exact restrictions and exceptions depend on the applicable sanctions regime.

A name match needs investigation, and absence from a list does not settle ownership or control. Where applicable, freeze assets, do not proceed without a lawful exception or licence, and comply with the relevant reporting obligations to the Office of Financial Sanctions Implementation (OFSI). Overseas sanctions do not automatically have the same legal scope as UK sanctions.