United Kingdom country photograph
United Kingdom flag
AML & CTF regulatory handbook

United Kingdom

Retail banking / Individual customer / Onboarding

Save in workspace
Checked requirements
9
Retained sources
32
Recorded changes
0
Evidence date
2026-10-12

Reader context

Country and scenario

More views
ToolsEvidence coverageSourcesRecent changesFull documents & provisionsSearchQuestions
Scenario overview

In summary

The payer's payment service provider must send required payer and payee information and verify the payer information before executing the transfer, subject to the precise domestic and low-value derogations.

Supporting requirements
Read more scenario context

Payee and intermediary payment service providers must detect missing or inadmissible transfer information and operate risk-based procedures to execute, reject or suspend affected transfers.

Supporting requirements

Payer and payee payment service providers must retain the required transfer-information records for five years and delete personal data afterwards unless a lawful further-retention provision applies.

Supporting requirements
Start with a task

What do you need to do?

View all requirements
Review mapped requirementsPayer and payee payment service providers must retain the required transfer-information records for five years and delete personal data afterwards unless a lawful further-retention provision applies.Supported by 1 sourceCollect customer informationThe payer's payment service provider must send required payer and payee information and verify the payer information before executing the transfer, subject to the precise domestic and low-value derogations.Supported by 1 sourceVerify identityJMLSG guidance says to obtain an individual's full name, residential address and date of birth; its standard documentary route verifies the name plus either the address or date of birth.Previous checked explanation · 3 sources · current verification pendingAssess risk and EDDApply EDD and enhanced monitoring when regulation 33 triggers are met.Previous checked explanation · 1 source · current verification pendingMonitor and reportPayee and intermediary payment service providers must detect missing or inadmissible transfer information and operate risk-based procedures to execute, reject or suspend affected transfers.Supported by 1 source
Source traceability

Legislation and requirement mapping

See how each requirement links to its authority, source type and exact supporting provision.

Open full mapping
Preview of legislation and requirement mapping for United Kingdom
RequirementSource typeAuthoritySupporting provision
Review pending

For UK business within the MLR relevant-person scope, maintain proportionate, senior-management-approved controls for money laundering, terrorist financing and proliferation financing. Keep policies under review and document changes and internal communication.

legislationHM Treasury / legislation.gov.ukMLR 2017 regulations 8(1)-(2), 10, 14A, 15, 19(1)-(4) and 19A(1)-(4)
Review pending

For a UK MLR relevant person, a business relationship, suspicion or identity doubts can trigger CDD irrespective of transaction value. Occasional-transaction thresholds depend on the activity; crypto transfers and crypto ATM transactions have specific tests rather than a universal banking threshold.

legislationHM Treasury / legislation.gov.ukMLR 2017 regulation 27(1)-(2), (7D)-(7E) and (10), read with regulations 8, 14A and 15
Review pending

Verify the customer and assess the purpose of the relationship. Where a person purports to act on the customer's behalf, separately verify authority to act, identify that person and verify their identity using a source independent of both the person and the customer.

legislationHM Treasury / legislation.gov.ukMLR 2017 regulation 28(1)-(4), (10), (12)-(15) and (18)-(19), read with regulation 30
Review pending

Normally complete verification before the relationship or transaction; restrict or end activity when required CDD cannot be completed.

legislationHM Treasury / legislation.gov.ukMLR 2017 regulations 30(1)-(5) and 31(1)-(5)
Review pending

Apply EDD and enhanced monitoring when regulation 33 triggers are met.

legislationHM Treasury / legislation.gov.ukMLR 2017 regulation 33(1)-(4), (5)-(7)
Previous checked narrative

Baseline reading under review

For an individual retail-banking customer, start with the statutory task: when CDD is triggered, identify the customer and verify identity from a reliable, independent source. The MLRs do not prescribe a universal document package. JMLSG guidance says firms should obtain full name, residential address and date of birth. Its standard documentary route is full name plus either address or date of birth, and it also allows electronic or combined evidence; a passport and utility bill are not a universal statutory checklist. Normally complete verification before the relationship or transaction. Any departure needs regulation 30's particular timing conditions and safeguards, not simply a plan to collect documents later. Supporting requirements

For business within the UK money laundering regulations, establishing a relationship triggers customer due diligence independently of occasional-transaction thresholds. The next decision is how extensive those measures must be. Simplified treatment needs an established low-risk basis and still includes monitoring; a single favourable characteristic is not enough. Enhanced diligence follows the applicable statutory triggers. For the automatic country trigger, distinguish FATF's call-for-action category from increased monitoring, while recognising that other facts can independently establish higher risk. Supporting requirements

Evidence details