Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017

1. Scope and Covered Entities

The Regulations apply to obliged entities, which include:

• Credit and financial institutions
• Accountancy, tax and legal practitioners
• Realestate agents and property developers
• Trust and company service providers
• Highvalue dealers (e.g., jewellery, art)
• Cryptocurrency exchanges and wallet providers
• Payment service providers and electronic money institutions

Any person who carries out a regulated activity, alone or on behalf of another, must comply with the Regulations.

2. Core Obligations

2.1 Customer Due Diligence (CDD)

Obliged entities must identify and verify the identity of their customers before establishing a business relationship or conducting a transaction above the thresholds set out in the Regulations (generally 10,000). CDD includes:

• Verification of name, address and date of birth (or equivalent for legal persons)
• Obtaining information on the purpose and intended nature of the business relationship
• Identifying the ultimate beneficial owners (UBOs) of corporate customers
• Enhanced due diligence (EDD) for highrisk customers, politically exposed persons (PEPs), and highrisk jurisdictions

2.2 Ongoing Monitoring

Monitoring must be continuous, covering transaction patterns, changes in risk profile and any suspicious activity. Entities are required to keep records of all CDD information and transaction data for a minimum of five years.

2.3 Suspicious Activity Reporting (SAR)

When a transaction or pattern raises suspicion of money laundering or terrorist financing, the entity must submit a SAR to the National Crime Agency (NCA) without informing the client. Failure to report can result in criminal liability.

2.4 Risk Assessment

Each obliged entity must maintain a documented riskassessment process that evaluates:

• Customers and beneficial owners
• Products and services offered
• Delivery channels (e.g., online, branch, mobile)
• Geographical locations involved

The assessment must be reviewed regularly and updated whenever there is a material change in risk exposure.

3. Money Laundering and Terrorist Financing Explained

Money laundering is the process of disguising the origins of illegally obtained money, typically through three stages: placement, layering and integration. The aim is to make illicit proceeds appear legitimate.

Terrorist financing involves providing or collecting funds, either from legitimate or illegitimate sources, with the intention of supporting terrorist activities. Unlike money laundering, the source of the money may be lawful, but its use is criminal.

Both crimes threaten the integrity of the financial system and can undermine public confidence, national security and economic stability.

4. Key Provisions of the 2017 Regulations

4.1 Beneficial Ownership Registers

Companies and other legal persons must maintain a register of their UBOs and submit this information to Companies House. The register must be accessible to competent authorities and persons with a legitimate interest.

4.2 Politically Exposed Persons (PEPs)

Entities must apply enhanced scrutiny to PEPs, their families and close associates. The regulations require a riskbased approach and, where appropriate, the use of thirdparty data sources to verify the source of funds.

4.3 RecordKeeping

All records related to CDD, transactions and SARs must be stored in a form that permits retrieval within a reasonable time. The fiveyear retention period applies regardless of whether the business relationship has ended.

4.4 Training

Obliged entities must provide regular AML/CTF training to staff at all levels. Training must be proportionate to the employees role and risk exposure and must be documented.

4.5 Sanctions and Enforcement

Noncompliance may lead to civil penalties, criminal prosecution, unlimited fines and imprisonment. The Financial Conduct Authority (FCA) and the NCA have the power to issue enforcement notices, conduct investigations and levy fines.

5. Recent Developments and Emerging Risks

Since 2017, the regulatory landscape has evolved to address new threats:

• Cryptocurrencies: The FCA now requires virtualcurrency exchanges to register and apply AML controls akin to traditional financial institutions.
• FinTech and Open Banking: APIs expose new channels for fund transfers, demanding robust customer verification and monitoring.
• SupplyChain Finance: Complex transaction chains increase the risk of layering and require enhanced duediligence on counterparties.

Organizations must stay abreast of guidance from the FCA, the Treasury and the European Union (where applicable) to ensure ongoing compliance.

6. Practical Steps for Compliance

1. Implement a riskbased AML policy: Tailor controls to the specific products, customers and geographies you serve.
2. Adopt reliable verification technology: Use electronic identity checks, document verification and biometric tools where appropriate.
3. Maintain uptodate UBO information: Integrate Companies House data feeds to automate updates.
4. Screen against sanctions lists: Run realtime checks against HM Treasurys consolidated list and international lists (UN, OFAC).
5. Establish clear SAR procedures: Designate a compliance officer, set escalation thresholds and ensure confidentiality.
6. Conduct regular internal audits: Test the effectiveness of controls, identify gaps and remediate promptly.

7. Resources and Further Reading

• FCA AntiMoney Laundering guidance
• UK Government Money Laundering Regulations
• National Crime Agency SAR information
• HM Treasury Sanctions and terrorist financing