Illustrative firm examples
United Kingdom country research brief
Research dated 2026-10-09 · Reviewed 2026-10-09
Version da73f1f8ff7f
da73f1f8ff7fafe95c822ad1d72cb6440ad5595c88372264f1adf92dd353aee5Scope: Illustrative firm examples. The selector is not an authorisation or legal-applicability determination. Source-check observations concern retrieval/access only and do not establish legal currentness; the research date is the content date boundary. Source health: review-required, checked 2026-10-12T05:01:08.878Z.
Legal and supervisory framework
Coverage and authorities
The Money Laundering Regulations 2017 (MLR) cover defined relevant persons and activities, with scope and exclusions. The Financial Conduct Authority (FCA), HM Revenue & Customs (HMRC) and approved professional bodies divide MLR supervision; the National Crime Agency (NCA) receives suspicious activity reports. Confirm entity, activity, permission and supervisor. POCA's regulated-sector perimeter is separately defined by Schedule 9. This brief uses the 30 June 2026 MLR and POCA editions, not an exhaustive later-amendment reconciliation. FCA Handbook rules and guidance have distinct status.
Core controls and due diligence
An in-scope relevant person assesses and documents money-laundering and terrorist-financing risk (regulation 18) and separately assesses proliferation-financing risk (18A); a supervisor may waive recording, not assessment. Regulation 19 requires proportionate controls approved by senior management and kept under review. Customer due diligence (CDD) applies at relationship entry and specified transaction, suspicion, identity-doubt and review triggers: identify and verify applicable customers, representatives and beneficial owners; understand control, assess purpose and monitor. Enhanced CDD (regulation 33) and politically exposed person (PEP) measures (35) have specified triggers. Domestic PEP status alone is not high risk. Thresholds and exceptions vary by trigger.
Reporting, retention and guidance status
Proceeds of Crime Act 2002 (POCA) section 330 requires qualifying regulated-sector disclosures as soon as practicable; section 331 separately governs nominated officers. Defences and privilege limits apply. MLR regulation 40's five-year clocks run from known or reasonably believed occasional-transaction completion or relationship end for relationship CDD and transactions. Relationship-transaction records need not be kept over ten years. Delete personal data afterwards unless a specified regulation 40(5) exception permits retention. Office of Financial Sanctions Implementation (OFSI) publications are guidance, not legislation.
Risk and external measures
FATF assessment evidence and dated national risks
HM Treasury's 2023-24 supervision report says the next Financial Action Task Force (FATF) Mutual Evaluation Review is expected in 2028 and will assess effectiveness and technical compliance. It does not state present ratings or prove the UK's current monitoring-list position; this brief gives neither. The July 2025 UK national assessment describes high national money-laundering exposure and identifies fraud, cash, company structures, professional services, payment firms and cryptoassets. It assesses electronic-money institutions' and payment service providers' terrorist-financing risk as rising from medium to high, and discusses cryptoasset risks including hacks, donation crowdfunding and privacy protocols. The first UK proliferation-financing assessment (2021) describes trade-linked procurement, sanctions/export-control evasion and financial-services vulnerabilities; no later replacement was verified. United States (U.S.) sanctions apply to U.S. persons and U.S.-territory activity, with programme-specific reach; international or U.S.-dollar payment alone does not bind every foreign person. These dated risks are context, not firm, customer or transaction scores.
Sanctions and cross-border connections
United Nations measures operate through UK legislation and regime-specific regulations. UK restrictions depend on each rule and UK territorial/person nexus; check parties, ownership/control, transaction, exceptions, licences and reporting. From 28 January 2026 the UK Sanctions List is the sole UK-government designation list; searching it does not resolve ownership/control. European Union (EU) measures have EU-person and territorial scope. No designation dataset was audited; no absence of designations is implied.
Selected firm implications
Meaning: Identify/verify customers, representatives and beneficial owners; assess control, purpose and monitor.
Conditions: For an MLR relevant person, only when regulation 27 or another rule requires CDD.
Exceptions: Specific reasonable-measures, listed-entity, trust and other branches apply.
Suggested action: Test the CDD trigger, identity/control branch, purpose and monitoring evidence.
Legislation / Binding · Regulation 28Meaning: Maintain proportionate controls approved by senior management and kept under review.
Conditions: For an MLR relevant person, reflecting its risk assessments.
Exceptions: MLR scope and exclusions control.
Suggested action: Check approval, proportionality and implementation evidence.
Legislation / Binding · Regulation 19Meaning: Disclose qualifying knowledge, suspicion or reasonable grounds that another person is laundering money.
Conditions: Regulated-sector business information; can identify the suspect or laundered property's location, or believes (or can reasonably be expected to believe) it may help either.
Exceptions: Defences include reasonable excuse, qualified privilege, no knowledge/suspicion plus no required training, overseas conduct and specified information-source cases.
Suggested action: Disclose underlying information and known identity/whereabouts to a nominated officer or NCA-authorised person as soon as practicable.
Legislation / Binding · POCA 2002, s.330Notices and limitations
- Illustrative bank, payments and crypto examples, not an assessed firm profile.
- Product/customer exposure alone is not statutory applicability. This is not a licensing guide.
- Local entity / domestic activity selected.
- 3 representative obligations from 10 editorial matches; see the full register for other duties.
- Source observations are unavailable, stale, failed or review-required. This dated brief does not confirm today's legal position.
- FATF originals returned HTTP 403 (9 October 2026); current ratings/list status unconfirmed and omitted.
- Selected register rows only; MLR edition is 30 June 2026. Later changes, commencement, devolution, sector scope and firm perimeter remain unchecked.
- Risk reports: 2025 money-laundering/terrorist-financing and 2021 proliferation-financing assessments; no newer PF or full sector review verified.
- Hashes show custody, not reproduction rights; no original text quoted.
- Profile tags choose examples; they do not determine legal applicability.
- Orientation only, not legal advice, a full inventory or compliance approval.
Evidence sources
Original source documents are not reproduced in this brief. Retained originals are private research evidence; use the official-source links.
- Legislation · HM Treasury · Official revised text as at 30 June 2026; edition used for provision bindings · Regs. 7-8, 10, 14A-15, 18-19A, 21, 27-28, 33-35, 40
- Legislation · UK Parliament · Revised view 30 June 2026; captured 9 October 2026 · Sections 330-331; Schedule 9 is a separate capture
- Legislation · UK Parliament · Revised view 16 October 2025; captured 9 October 2026; later amendments and regime rules unchecked · Part 1, sanctions regulations; no regime-by-regime audit
- National Risk Assessment · HM Treasury and Home Office · July 2025 national assessment; dated context, not firm/customer ratings · Printed pp. 20-22; paras. 5.55, 5.76, 5.107; section 6
- National Risk Assessment · HM Treasury · First UK assessment, published 23 September 2021; no later replacement verified · Sections 3-4: threats and vulnerabilities; 2021 context
- Official Supervision Report · HM Treasury · Accessible official report for the 2023-24 reporting year; captured 9 October 2026 · Section: Preparing for the Financial Action Task Force's next assessment of the UK; says the Mutual Evaluation Review will be published in 2028 and will consider effectiveness and technical compliance
- Official Sanctions Guidance · Foreign, Commonwealth and Development Office, HM Treasury and Office of Financial Sanctions Implementation · GOV.UK guidance captured 9 October 2026 · UK Sanctions List transition, 28 January 2026
- Official Sanctions Guidance · HM Treasury (OFSI) · General guidance captured 9 October 2026; updated 12 May 2026 · Sections 1-2, 4.1 and 5 (scope, ownership/control, reporting)
- Official Sanctions Guidance · European Commission · Captured 9 October 2026 · Heading: Where do EU sanctions apply?
- Official Sanctions Guidance · U.S. Treasury (OFAC) · FAQ 11 updated 21 August 2024 · FAQ 11: U.S.-person and territorial scope
- Legislation · UK Parliament · Revised view 30 June 2026; captured 9 October 2026 · Parts 1-3: activities, exclusions and supervisory authorities; read with sections 330-331
MLR 2017 (SI 2017/692)
Official revised text as at 30 June 2026; edition used for provision bindings · Regs. 7-8, 10, 14A-15, 18-19A, 21, 27-28, 33-35, 40
Source record
Retrieved 2026-10-09T21:41:05Z. SHA-256: 222afcca33e01f0c61c12d49182cbd83eeb6f0c0e80bae5b61432d2dcf7b2830
Source retrieval check
review-required · Checked 2026-10-12T05:00:45.664Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-09.
This brief relies on the identified official source edition. Open it using the official-source control.
POCA 2002 (c.29), Part 7
Revised view 30 June 2026; captured 9 October 2026 · Sections 330-331; Schedule 9 is a separate capture
Source record
Retrieved 2026-10-09T21:38:19Z. SHA-256: 63fb6b37b2a02cd2e23e1882319408a134bca0d0287120b0d5cdcc37a9f9ad7b
Source retrieval check
review-required · Checked 2026-10-12T05:00:48.106Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-09.
This brief relies on the identified official source edition. Open it using the official-source control.
SAMLA 2018 (c.13)
Revised view 16 October 2025; captured 9 October 2026; later amendments and regime rules unchecked · Part 1, sanctions regulations; no regime-by-regime audit
Source record
Retrieved 2026-10-09T21:42:01Z. SHA-256: ddef6a06c5db1c0369ad80dc4b8bb4723c96a197fe19535267040ba93008152e
Source retrieval check
review-required · Checked 2026-10-12T05:00:49.709Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-09.
This brief relies on the identified official source edition. Open it using the official-source control.
UK ML/TF risk assessment, July 2025
July 2025 national assessment; dated context, not firm/customer ratings · Printed pp. 20-22; paras. 5.55, 5.76, 5.107; section 6
Source record
Retrieved 2026-10-09T21:36:54Z. SHA-256: f4d9c87d545ee46754f8e41a053fdf48ebe3d45b167794543eba11eadf1e0766
Source retrieval check
observed · Checked 2026-10-12T05:00:51.167Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-09.
This brief relies on the identified official source edition. Open it using the official-source control.
UK PF risk assessment, September 2021
First UK assessment, published 23 September 2021; no later replacement verified · Sections 3-4: threats and vulnerabilities; 2021 context
Source record
Retrieved 2026-10-09T21:36:58Z. SHA-256: 8a580f9f9c69c98dfd5bbf9dc6626013bc0e3aa5449749b1fc2423e677bb4f3d
Source retrieval check
observed · Checked 2026-10-12T05:00:51.691Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-09.
This brief relies on the identified official source edition. Open it using the official-source control.
HMT AML/CTF supervision 2023-24
Accessible official report for the 2023-24 reporting year; captured 9 October 2026 · Section: Preparing for the Financial Action Task Force's next assessment of the UK; says the Mutual Evaluation Review will be published in 2028 and will consider effectiveness and technical compliance
Source record
Retrieved 2026-10-09T21:50:38Z. SHA-256: 0ae7ef7293f72f0b2b623433d5db4d56edb859995ad18c44fc87795312edfd8c
Source retrieval check
review-required · Checked 2026-10-12T05:00:52.254Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-09.
This brief relies on the identified official source edition. Open it using the official-source control.
UK Sanctions List transition, January 2026
GOV.UK guidance captured 9 October 2026 · UK Sanctions List transition, 28 January 2026
Source record
Retrieved 2026-10-09T21:41:56Z. SHA-256: 607474673490608579e0ec257284cede2e92854880b4b0ca58ccc027141912a3
Source retrieval check
review-required · Checked 2026-10-12T05:00:53.640Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-09.
This brief relies on the identified official source edition. Open it using the official-source control.
UK OFSI guidance, May 2026
General guidance captured 9 October 2026; updated 12 May 2026 · Sections 1-2, 4.1 and 5 (scope, ownership/control, reporting)
Source record
Retrieved 2026-10-09T19:54:40Z. SHA-256: 254c2891db0f511d40d8bf862d92954c08469ae8c7f720dbd9b613b551e9c230
Source retrieval check
review-required · Checked 2026-10-12T05:00:54.545Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-09.
This brief relies on the identified official source edition. Open it using the official-source control.
EC sanctions overview, October 2026 capture
Captured 9 October 2026 · Heading: Where do EU sanctions apply?
Source record
Retrieved 2026-10-09T19:54:30Z. SHA-256: 84d90e3b6d3d7ca27c33d98783660ea6e86c7f837a8006418763b4e96dab98c4
Source retrieval check
observed · Checked 2026-10-12T05:00:55.751Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-09.
This brief relies on the identified official source edition. Open it using the official-source control.
OFAC FAQ 11, August 2024
FAQ 11 updated 21 August 2024 · FAQ 11: U.S.-person and territorial scope
Source record
Retrieved 2026-10-09T19:54:40Z. SHA-256: 92cfe8932dd817a5c2371d265ae1ecbaf62970f798c0d5c6ab77fd96897e0e99
Source retrieval check
review-required · Checked 2026-10-12T05:00:56.732Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-09.
This brief relies on the identified official source edition. Open it using the official-source control.
POCA 2002 (c.29), Schedule 9
Revised view 30 June 2026; captured 9 October 2026 · Parts 1-3: activities, exclusions and supervisory authorities; read with sections 330-331
Source record
Retrieved 2026-10-09T22:14:00.656Z. SHA-256: fba74fddb60f8453a8f026df1707639fe23a65e7d41f25fd911a263d7aa0d6c2
Source retrieval check
review-required · Checked 2026-10-12T05:01:08.878Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-09.
This brief relies on the identified official source edition. Open it using the official-source control.
Retail bank
Meaning
Identify/verify customers, representatives and beneficial owners; assess control, purpose and monitor.
Full public provision explanation
When CDD is required, a relevant person must identify the customer and verify its identity (unless already done), and assess and where appropriate obtain information on the purpose and intended nature of the relationship or transaction. For a body corporate it must obtain and verify the name, registration number and registered office and principal place of business, and take reasonable measures to determine and verify its governing law, constitution, directors and senior managers. For legal persons, trusts and similar arrangements it must take reasonable measures to understand the ownership and control structure. It must identify any beneficial owner and take reasonable measures to verify their identity (listed companies excepted), without relying solely on Companies House or overseas entity register information; if all means are exhausted it may treat the senior managing official as beneficial owner, keeping written records of its efforts. It must verify that anyone acting for the customer is authorised and identify and verify them. It must conduct ongoing monitoring of the business relationship, scrutinising transactions (including source of funds where necessary) for consistency with its knowledge of the customer and keeping CDD information up to date. The extent of measures must reflect its risk assessment and the risk in the case, and it must be able to demonstrate to its supervisor that they are appropriate. CDD need not continue where a SAR has been made and continuing would amount to tipping off.
Suggested action
Test the CDD trigger, identity/control branch, purpose and monitoring evidence.
Conditions
For an MLR relevant person, only when regulation 27 or another rule requires CDD.
Exceptions
Specific reasonable-measures, listed-entity, trust and other branches apply.
Payments and e-money
Meaning
Maintain proportionate controls approved by senior management and kept under review.
Full public provision explanation
A relevant person must establish and maintain policies, controls and procedures to mitigate and manage the money laundering and terrorist financing risks identified in its regulation 18 risk assessment, regularly review and update them, and keep a written record of them, of changes made and of how they were communicated within the business. They must be proportionate to the size and nature of the business and approved by senior management, and must cover risk management, internal controls, customer due diligence, reliance and record keeping, and monitoring of compliance. They must also provide for scrutiny of unusually complex or unusually large transactions, unusual patterns and transactions with no apparent economic or legal purpose; additional measures for products and transactions that might favour anonymity; risk assessment before adopting new products, practices or technology; staff who know or suspect ML/TF to comply with the POCA Part 7 and Terrorism Act Part 3 reporting regimes; and, for money service businesses using agents, assessment of agents' fitness and ML/TF risk. Where relevant they must be communicated to branches and subsidiaries outside the UK.
Suggested action
Check approval, proportionality and implementation evidence.
Conditions
For an MLR relevant person, reflecting its risk assessments.
Exceptions
MLR scope and exclusions control.
Crypto and digital assets
Meaning
Disclose qualifying knowledge, suspicion or reasonable grounds that another person is laundering money.
Full public provision explanation
A person in the regulated sector commits an offence if they know, suspect, or have reasonable grounds to know or suspect, from information that came to them in the course of regulated-sector business, that another person is engaged in money laundering, can identify that person or the laundered property (or believe the information will/may help do so), and fail to disclose this as soon as practicable to a nominated officer or an NCA-authorised person. Defences: reasonable excuse for not disclosing; legal professional privilege for professional legal advisers and relevant professional advisers (and their support staff) where the information came in privileged circumstances (not where communicated to further a criminal purpose); not knowing or suspecting and not having received the required training; the overseas-conduct defence; and two information-source carve-outs (information obtained only from an Immigration Act 2014 status/immigration check, or only from complying with a Social Security Administration Act 1992 Schedule 3B eligibility verification notice) where that information alone would not give reasonable grounds. A court must consider whether approved, Treasury-approved, published guidance was followed. Schedule 9 defines the regulated sector and supervisory authorities for this purpose.
Suggested action
Disclose underlying information and known identity/whereabouts to a nominated officer or NCA-authorised person as soon as practicable.
Conditions
Regulated-sector business information; can identify the suspect or laundered property's location, or believes (or can reasonably be expected to believe) it may help either.
- The relevant person is carrying on business in the regulated sector (defined by Schedule 9) and the knowledge/suspicion/reasonable-grounds arose from information received in the course of that business.
Exceptions
Defences include reasonable excuse, qualified privilege, no knowledge/suspicion plus no required training, overseas conduct and specified information-source cases.
- Reasonable excuse; legal professional privilege (legal advisers/relevant professional advisers and support staff, information not given to further a criminal purpose); no knowledge/suspicion plus no AML training provided by employer; overseas-conduct defence; information derived only from an immigration status/eligibility check under the specified provisions, where that alone would not found reasonable grounds.