Wealth & investment

Source of wealth explains how the customer's overall assets were accumulated; source of funds explains the money used for a particular investment or transfer. Regulation 35 requires adequate measures for both in PEP relationships, and other higher-risk cases may require them under the applicable EDD framework.

Evidence should be tailored to the explanation: for example business ownership and sale documents, income or inheritance records and supporting financial information. A bank statement can show a transfer without establishing the underlying origin of the wealth.

CDD must look beyond the immediate account holder where a company, trust or other arrangement is used. Identify beneficial owners under the relevant statutory definition and take reasonable measures to verify them, understanding ownership and control.

For trusts, assess the applicable roles and definition rather than use a company-shareholding percentage as the sole test. Reliance on introducers or custodians requires a valid arrangement under Regulation 39; outsourcing does not transfer the firm's legal responsibility.

Apply Regulation 35 proportionately, including the lower-risk starting point for domestic PEPs where no additional enhanced risk factors exist. A blanket approach to all PEPs or their relatives is not a substitute for risk assessment.

Monitor activity against the expected investment purpose and wealth profile, with refreshes when relevant circumstances change. Unexpected subscriptions, withdrawals, third-party funding and changes of control may justify investigation. AML rules do not establish a general refundable tax-deposit requirement before investment withdrawals.

Regulation 18 requires a relevant person to identify and assess its money-laundering and terrorist-financing risks. The assessment must consider customers, countries or geographical areas, products or services, transactions and delivery channels, as well as information made available by the supervisory authority. Its extent must be appropriate to the size and nature of the business.

Keep a written record and keep the assessment up to date unless the supervisor has determined that an individual documented assessment is unnecessary for the sector. Regulation 18A separately addresses proliferation-financing risk: the risk of breaches, non-implementation or evasion of financial sanctions connected with proliferation of weapons of mass destruction.

Regulation 19 requires proportionate policies, controls and procedures to manage identified risks. These cover risk management, internal controls, customer due diligence, reporting, record keeping and monitoring compliance. Senior management must approve them; they must be reviewed and updated. Regulation 20 addresses group-wide arrangements, including relevant overseas branches and subsidiaries.

Where appropriate to the size and nature of the business, Regulation 21 requires a board or senior-management officer responsible for compliance, screening of relevant employees and an independent audit function. A nominated officer receives internal suspicion reports where required. These roles are distinct; not every firm has an FCA-designated SMF17 role. Regulation 24 requires relevant staff, and relevant agents where applicable, to receive regular training, with written records of the measures taken.

Customer due diligence (CDD) is required when establishing a business relationship, when applicable occasional-transaction thresholds are met, when money laundering or terrorist financing is suspected, or when the adequacy or accuracy of earlier identification information is in doubt. Sector-specific triggers also apply; a threshold is not permission to ignore suspicion below that amount.

Regulation 28 requires identification and verification using reliable, independent sources, identification of beneficial owners with reasonable verification measures, and assessment of the purpose and intended nature of the relationship. Understand a corporate customer's ownership and control structure and check the authority of anyone acting on its behalf. Do not rely solely on a public register to establish beneficial ownership.

Regulation 30 generally requires verification before establishing the relationship or carrying out the transaction. Its limited exceptions have conditions and are not a general entitlement to defer checks. Regulation 30A contains separate duties to report qualifying material discrepancies in relevant beneficial-ownership registers; not every typographical difference is reportable.

Ongoing monitoring includes scrutiny of transactions for consistency with the firm's knowledge of the customer, business and risk profile, including the source of funds where necessary. Keep due-diligence information current. The law requires an effective risk-based outcome, not one particular software product or a universal annual review interval.

Where a firm cannot apply the required CDD, Regulation 31 generally requires it not to establish the relationship or execute the relevant transaction, to terminate an existing relationship and to consider a disclosure. Specific exceptions exist, including for certain legal work; apply the actual provision rather than automatically blocking every instruction.

Regulation 40 generally requires CDD evidence and transaction records to be retained for five years after a business relationship ends or an occasional transaction completes. Personal data must ordinarily be deleted afterwards, subject to the statutory exceptions. AML records do not remove data-protection obligations.

Enhanced due diligence (EDD) and enhanced ongoing monitoring apply to the higher-risk circumstances specified in Regulation 33. These include identified high risk and specified country-related circumstances. The amended transaction triggers include transactions that are unusually complex or unusually large given their nature, unusual patterns of transactions, or transactions without an apparent economic or legal purpose. Examine the background and purpose and record the findings.

Regulation 35 addresses politically exposed persons (PEPs), their family members and known close associates. Required measures include senior-management approval, adequate measures to establish source of wealth and source of funds, and enhanced monitoring. A PEP is not automatically suspected of crime.

For domestic PEPs and their family members or known close associates, the statutory starting point is lower risk than for non-domestic PEPs where no additional enhanced risk factors are present. The extent of EDD must reflect that distinction. Simplified due diligence under Regulation 37 is available only on a properly evidenced low-risk assessment, not when suspicion or another mandatory EDD trigger applies.

Sections 327–329 of the Proceeds of Crime Act 2002 create the principal money-laundering offences. Section 330 contains the regulated-sector failure-to-disclose offence, including where there are reasonable grounds for knowledge or suspicion, subject to its statutory conditions and exceptions. Reports are made through the nominated officer where appropriate and to the National Crime Agency (NCA).

A suspicious activity report (SAR) is not the same as a request for a defence against money laundering (DAML). Where a proposed act could engage a principal offence, assess whether a defence is needed before proceeding and observe the applicable statutory process. A DAML is not an NCA endorsement of the customer or a general clearance for future activity.

Section 333A addresses tipping off in the regulated sector and section 342 addresses prejudicing an investigation, each with specific elements and exceptions. Terrorist-financing offences and disclosure duties arise separately under the Terrorism Act 2000. Obtain appropriately qualified advice on privilege, exceptions and any proposed disclosure.

UK sanctions obligations are separate from the MLR customer-risk framework. Relevant regulations may prohibit dealing with frozen funds or economic resources, or making funds or economic resources available to or for the benefit of designated persons, including entities owned or controlled by them. The exact restrictions and exceptions depend on the applicable sanctions regime.

A name match needs investigation, and absence from a list does not settle ownership or control. Where applicable, freeze assets, do not proceed without a lawful exception or licence, and comply with the relevant reporting obligations to the Office of Financial Sanctions Implementation (OFSI). Overseas sanctions do not automatically have the same legal scope as UK sanctions.