Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017

1. Overview of the Regulations

The Regulations apply to a wide range of obliged entities, including banks, credit unions, building societies, accountinformation service providers, paymentservice providers, accountants, lawyers, estate agents and highvalue dealers. Their purpose is threefold:

• To impede the laundering of criminal proceeds.
• To prevent the financing of terrorism.
• To increase transparency around the identity of payers in electronic fund transfers.

They are enforced by the Financial Conduct Authority (FCA), HM Revenue & Customs (HMRC) and the Office of Financial Sanctions Implementation (OFSI). Noncompliance can lead to civil penalties, criminal prosecution and reputational damage.

2. Core Obligations for Covered Entities

2.1 Governance and Policies

Every obliged entity must have a documented antimoneylaundering (AML) and counterterroristfinancing (CTF) policy approved by senior management. The policy must set out the riskbased approach, internal controls, training programmes and reporting mechanisms.

2.2 Risk Assessment

A periodic, documented risk assessment is required. It must consider:

• Customer type and geography.
• Products, services and delivery channels.
• Transaction volumes and patterns.
• Emerging threats (e.g., virtual currencies).

The outcome determines the intensity of customer duediligence (CDD) and monitoring measures.

2.3 Customer Due Diligence (CDD)

CDD is the process of identifying and verifying a customers identity, understanding the nature of the business relationship and assessing the purpose of transactions. The Regulations distinguish three levels:

• Standard CDD applied to most customers.
• Enhanced CDD (ECDD) required for highrisk customers (e.g., politically exposed persons, highrisk jurisdictions).
• Simplified CDD permitted where the risk is low and the customer is a private individual using lowvalue transactions.

2.4 Ongoing Monitoring

Compliance does not stop once a client is onboarded. Entities must continuously monitor transactions, compare them to the customers risk profile, and update CDD information as needed. Automated transactionmonitoring systems are encouraged for large volumes.

3. Conducting a Risk Assessment

A robust risk assessment includes:

1. Identify Risk Factors: Product risk (e.g., cashintensive services), geographic risk (countries with weak AML regimes), customer risk (PEPs, highnetworth individuals).
2. Assess Likelihood and Impact: Use scoring matrices or qualitative analysis to rate each factor.
3. Document Findings: Produce a risk register and justify the chosen CDD level for each segment.
4. Review Regularly: Minimum annual review, or sooner when material changes occur.

Documentation of the assessment demonstrates to regulators that a proportionate, riskbased approach is in place.

4. Customer Due Diligence Practical Steps

4.1 Identification & Verification

Collect reliable, independent documents such as passports, driving licences, utility bills, or corporate registration excerpts. For legal persons, verify the identity of the beneficial owners holding at least 25% of the voting rights, or the natural person who ultimately controls the entity.

4.2 Understanding the Business Relationship

Obtain information on the source of funds, intended use of the account and expected transaction patterns. Questionnaires and riskscoring questionnaires help to capture this data.

4.3 Ongoing Updating

For higherrisk customers, review CDD information at least annually; for lowerrisk customers, a review every three years is acceptable.

4.4 Recordkeeping

All CDD information, risk assessments and transaction records must be retained for a minimum of five years after the business relationship ends or after a transaction is completed.

5. Suspicious Activity Reporting (SAR)

Whenever an entity has knowledge, suspicion, or a reasonable belief that a transaction may involve proceeds of crime or terrorist financing, it must file a SAR with HMRCs National Economic Crime Centre (NECC). Key points:

• Reports are confidential; the subject must not be informed.
• Failure to report is a criminal offence.
• Reports can be filed online via the SAR portal.
• Internal procedures must exist for staff to raise alerts.

Prompt reporting is essential there is no minimum monetary threshold.

6. Penalties and Enforcement

The FCA and HMRC have extensive enforcement powers. Penalties may include:

• Unlimited fines for corporate entities.
• Criminal prosecution leading to imprisonment for individuals.
• Public enforcement notices and bans from regulated activities.
• Compensation orders for victims of moneylaundering.

Recent case law shows that regulators penalise not only failures to detect illicit activity but also weak governance, inadequate training and poor recordkeeping.

7. Conclusion

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 create a comprehensive, riskbased framework aimed at protecting the integrity of the UK financial system. Success depends on a culture of compliance, robust policies, regular risk assessments, effective CDD, timely monitoring and swift reporting of suspicious activity. By embedding these practices, obliged entities not only meet legal obligations but also reinforce public confidence in the financial sector.