A Guide to UK AML Regulations and KYC Requirements

Money laundering is the process of disguising criminal proceeds as legitimate funds. The UK attacks it from two directions at once: criminal law that punishes the laundering itself, and regulatory duties that force businesses to detect and report it before it succeeds. In the calendar year of 2025, the UK’s Financial Conduct Authority (FCA) has imposed more than £124 million in fines, and the majority of the fines were associated with Anti-Money Laundering (AML) and failures in financial crime control.

This illustrates how the banking systems and financial institutions have failed to conduct KYC and AML screening. This failure demanded that the UK government enhance their AML regulations and that the banking systems use modern verification systems to detect deepfakes, PEPs, fraudulent transactions, and UBO’s as well.

Which businesses must follow UK AML requirements?

The Money Laundering Regulations apply to defined business activities. These include banking and certain financial services, accountancy and tax services, specified legal services, trust and company services, property agency activities, high-value dealing, art-market activities, casinos and specified cryptoasset services. 

Every business carrying out one of these activities must run KYC checks, but the depth of these checks depends on the risk. The lower-risk customers may qualify for the simplified due diligence, standard cases need full customer due diligence, and higher-risk cases such as politically exposed persons or the customers that are linked to the higher-risk countries which require enhanced due diligence (EDD). 

Which laws make up the UK AML framework?

The framework combines legislation on criminal offences, preventive business obligations, sanctions legislation, as well as corporate-transparency requirements. The core guidance revolves around implementing controls like identifying PEPs, sanctioned entities, beneficial owners, monitoring transactions and unusual customer behaviour, and reporting any suspicious activity to a supervisory authority and financial intelligence unit.

These laws and regulations include: 

1. Proceeds of Crime Act 2002 (POCA): POCA explains how money laundering is a criminal offense. It also includes what type of penalties exist for hiding, moving or helping someone to use criminal funds. It also requires businesses to identify and report suspicious activity through Suspicious Activity Reports (SARs). 
2. Terrorism Act 2000: It is for preventing and investigating terrorism and terrorist financing. This act covers the financing side that POCA cannot, because terrorist funds are often clean in origin. It criminalizes fundraising, possession and laundering of terrorist property, again with 14-year maximums, and the regulated sector carries a parallel duty to report suspicion.
3. Money Laundering Regulations 2017 (MLRs): It is the operational rulebook for businesses on how they can prevent money laundering. It encompasses complete KYC that includes Customer Due Diligence (CDD), Enhanced Due Diligence (EDD), transaction monitoring, and beneficial ownership information. 
4. Sanctions and Anti-Money Laundering Act 2018 (SAMLA): This law gives UK the power to create and enforce sanctions after leaving the EU. It also strengthens the AML framework to prevent money laundering and terrorist financing. It allows the government to implement financial sanctions, trade and economic restrictions, AML rules, and penalties. 
5. Office of Financial Sanctions Implementations (OFSI): OFSI is part of the HM Treasury and implements and enforces the UK’s financial sanctions. These sanctions apply to all the persons in the territory and territorial sea of the UK and to all the UK persons, wherever they are in the world. Relevant firms must inform OFSI as soon as practicable if they know or reasonably suspect that a person is a designated person, or has breached a prohibition or failed to comply with an obligation under UK sanctions regulations, where the information has been received in the course of carrying on their business. 
6. Criminal Finances Act 2017: This law is established to strengthen the rules against money laundering, terrorist financing, and the use of criminal money. It introduced Unexplained Wealth Orders (UWOs), which include how one paid for an asset, account freezing orders for suspect bank balances, and corporate offences of failing to prevent the facilitation of tax evasion.
7. Economic Crime (Transparency and Enforcement) Act 2022: This act was passed after Russia invaded Ukraine in 2022. It was introduced to strengthen the fight against money laundering, corruption, and the use of UK markets to hide criminal wealth. The government created the Register of Overseas Entities, so foreign companies that hold UK property must be publicly named as their beneficial owners at Companies House, reaching back to purchases from 1999 in England and Wales. 
8. Economic Crime and Corporate Transparency Act 2023 (ECCTA): It builds on earlier reforms such as the ECTEA 2022  but focuses more on corporate transparency, company accountability, and preventing businesses from being used for criminal activity. It introduced mandatory identity verification for directors and people with significant control, gave the registrar power to query and reject filings, and created a failure-to-prevent-fraud offence for large organisations, in force since 1 September 2025.

 

 

What changed in UK AML requirements in 2026?

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 made several targeted changes to the MLRs 2017, and most provisions took effect on 30 June 2026. The proposed reforms aim to make compliance more effective, reduce unnecessary burdens, and prepare for the UK’s next Financial Action Task Force (FATF) mutual evaluation. The changes that matter most in practice are:

• Country-related EDD narrowed. Automatic EDD now applies only to countries on the FATF call-for-action list, not the wider grey list. For grey-listed jurisdictions, you apply your own risk-based judgement instead of a blanket requirement.
• Thresholds converted from euros to sterling. Trigger values across the regulations now read in pounds, for example, the £10,000 cash threshold for high-value dealers to apply CDD and £12,000 for general occasional transactions, removing exchange-rate ambiguity from compliance procedures.
• Pooled client accounts clarified. Under Regulation 29, credit and financial institutions holding pooled client accounts received clearer, risk-based due diligence duties instead of the previous uncertainty about how far checks must reach.
• A 30-day notification duty. Authorised persons who are under FCA supervision before acting as money service business or a trust or company service provider must inform the FCA about their intention to conduct such activity or within 28 days if already begun operations. A material change or inaccuracy discovered in information supplied under Regulation 23 must also be reported within 30 days of such change occurring or from the time the inaccuracy was discovered & corrected.
• Cryptoasset provisions regarding correspondent relationships. Several crypto-facing measures like enhanced due diligence for correspondent relationships in third countries in regulation 34A take effect from 1 Feb 2027, giving that sector a staggered timeline.

One structural change sits alongside the amendment. The FCA is set to become the single AML supervisor for the professional services sector, consolidating oversight that currently sits with multiple professional bodies.

What do UK KYC requirements involve?

Know Your Customer duties in the UK come from Part 3 of the Money Laundering Regulations 2017, as amended. These requirements follow a risk-based approach, which means that the extent of customer checks varies according to the risk involved. The regulations specify when the checks are required, what businesses should establish about their customers, and when additional scrutiny is necessary.

When Customer Due Diligence (CDD) is essential: Regulation 27  requires customer due diligence before establishing a business relationship, when carrying out an occasional transaction above the threshold requirement, when money laundering is suspected, and when doubts arise about previously obtained documents. Identity verification must generally be completed before establishing a business relationship. However, Regulation 30 allows verification during its establishment where necessary to avoid interrupting normal business and where there is little risk of money laundering or terrorist financing, provided verification is completed as soon as practicable after the first contract. 

What CDD includes: The standard CDD means identifying the customer and verifying that identity from reliable, independent sources, identifying the beneficial owners, including, for an unlisted body corporate, individuals who ultimately own or control, directly or indirectly, more than 25% of its shares or voting rights, exercise the ultimate control over its management, or otherwise control within the meaning of the Regulation 5(2), and understanding the purpose and intended nature of the relationship. Firms also need to conduct ongoing monitoring under Regulation 28 (11) and to retain the records for five years under Regulation 40. 

When Enhanced Due Diligence (EDD) applies: Under Regulations 33-35 of MLR 2017, firms need to implement EDD when there is a higher-risk situation that includes PEPs, high-risk third countries, and transactions that are unusually enormous, lack credibility, or lack apparent economic purpose. This includes obtaining additional information on source of wealth and source of funds, and ongoing transaction monitoring.

How Suspicious Activity is Reported: Under section 330 of the Proceeds of Crime Act 2002 (POCA), a person in the regulated sector commits an offence if they know or suspect or have reasonable grounds for knowing or suspecting that another person is engaged in money laundering, based on information received in the course of the business in the regulated sector. The offence is applicable where they do not disclose this, as soon as practicable, to a nominated officer or to a person authorized by the Director General of the NCA and the other conditions in section 330 are met. A person does not commit an offence if they have a reasonable excuse for not making the disclosure. Under section 331, a nominated officer receiving such disclosure must, in turn, disclose it to a person authorised by the Director General of the NCA as soon as practicable. The SARs are submitted through the SAR Portal to the UK Financial Intelligence Unit (UKFIU) at the NCA. A valid SAR fulfils the firm’s reporting obligations under the POCA or Terrorism Act 2000 and can also provide a defence to the principal money laundering or the terrorist financing offence. 

Who is responsible for AML enforcement in the UK? 

There are different AML enforcement bodies in the UK that supervise different aspects, depending on what type of crime it is. 

• The Financial Conduct Authority (FCA) supervises the banks, e-money institutions, consumer credit firms, and crypto asset businesses that are registered under the Money Laundering Regulations. The FCA imposes breaches and penalties through its enforcement division. 
• His Majesty’s Revenue and Customs (HMRC) is responsible for income tax, custom duty, tax credits, AML, trade statistics, and many other regulations. It supervises the Money Service Businesses (MSBs), high-value dealers, and estate agents, letting agents, art-market participants, and company service providers.
• The Gambling Commission provides licenses and regulates the individuals and businesses that provide gambling services within Great Britain. It supervises casinos and betting operators and has issued AML penalties, including the £19.2 million action against the William Hill Group for social responsibility and AML failures in 2023, which is the largest in history. 
• Office for Professional Body Anti-Money Laundering Supervision (OPBAS) is a supervisory body that exists within the FCA that oversees the UK professional body supervisors (PBSs), covering lawyers and accountants. It was established in 2018 to improve consistency across a fragmented supervisory landscape by ensuring professional bodies apply effective, risk-based AML supervision. 
• The National Crime Agency (NCA) operates on the UK’s SARs intelligence, through the UK Financial Intelligence Unit (UKFIU). It receives and analyses hundreds of thousands of suspicious activity reports each year, distributes intelligence to enforcement partners, and manages Defence Against Money Laundering requests that allow firms to seek protection before handling suspected criminal funds.

How Global Standards influence UK compliance?

UK AML rules are built on global standards created by the Financial Action Task Force, the main international body that sets expectations for preventing money laundering and terrorist financing. FATF’s 40 Recommendations outline what an effective AML screening system should include, such as criminalising money laundering, applying customer checks, monitoring suspicious activity, and enabling cooperation between countries. FATF also reviews countries through mutual evaluations, which assess how well their AML frameworks meet global standards. The UK’s next evaluation cycle begins in 2026, which has contributed to ongoing reviews of its AML regime. 

The UK’s AML laws also reflect international agreements it has signed, including the Vienna Convention (1988), Palermo Convention (2000), and Merida Convention (2003). These agreements required countries to criminalise money laundering, tackle organised crime, and strengthen cooperation against corruption. International cooperation supports the UK system as well. The UK Financial Intelligence Unit (UKFIU), operated by the National Crime Agency (NCA), shares financial intelligence with more than 170 countries through the Egmont Group. Banking standards from groups such as the Basel Committee and the Wolfsberg Group also influence expectations for financial crime controls. Although EU AML rules no longer apply directly after Brexit, the Money Laundering Regulations 2017 (MLRs) were originally based on EU AML directives, so parts of the UK’s current framework still reflect that approach. 

What do compliance teams learn from recent UK AML fines? 

The following is a selected list of major fines FCA imposed for AML failures since the year 2022, and the pattern among them has been very consistent. These firms were not punished for laundering money but for running controls that couldn’t have caught money laundering. 

 

There are three noticeable patterns that can be seen across these UK enforcement cases: 

Risk Assessments go stale quietly: 

Nationwide’s fine announced by the FCA was based on the weaknesses that existed in its financial crime controls rather than evidence that money laundering had occurred. The FCA fined the building society because customer due diligence and risk assessments had not been kept current between 2016 and 2021, so higher-risk customers sat unidentified. A control that was adequate at design becomes a breach through neglect alone. 

Controls must scale with customer base: 

Monzo’s customer numbers grew from around 250,000 in 2017 to over 12 million in 2025, and its financial crime controls did not grow with them. The £21.1 million fine that followed in July 2025 is the clearest statement yet that growth-stage firms are held to the same standard as incumbents.

Automation needs auditing: 

Metro Bank’s monitoring system carried an error that excluded roughly 60 million transactions between June 2016 and December 2020. A data-feed error excluded certain transactions from its automated monitoring system. Junior staff raised concerns in 2017 and 2018, but these did not lead to the problem being identified and fixed. Although a fix was implemented in July 2019, consistent checks that all the relevant transactions reached the system were not established until December 2020. Automated controls reduce workload, and they also concentrate risk into whatever nobody is checking.

What should firms review now?

Compliance in 2026 means re-baselining against the amended regulations rather than maintaining what worked last year. The practical review should produce identifiable evidence instead of a policy alone: 

• Confirm which activity is regulated and who supervises it. It should produce an activity-to-obligation mapping with an assigned owner for accountability.
• Re-run the firm-wide risk assessment against the post-June 2026 text, since the EDD country triggers and several thresholds it references have changed. It should result in an updated documented risk assessment document
• Remap EDD rules so automatic EDD fires on the FATF call-for-action list, with documented risk-based decisions for grey-list exposure. Configure, test and document change in country rules and thresholds.
• Check Companies House obligations and plan for verification and code submission for the applicable director and PSC in the group before the relevant deadline. Directors, PSCs and existing PSCs, have their own timelines and routes for verification and code submission.
• Review monitoring and screening controls and document data coverage, alert handling process, escalation process, and test automation runs as intended
• Document every judgement, since the recent fines show regulators punishing the absence of evidence as readily as the absence of controls.

How Shufti Helps Businesses in Meeting End-to-End Compliance with UK AML Regulations?

Most of the fines in the table above share a root cause. Checks that ran once at onboarding, then never kept up with the customer, the sanctions list, or the risk. That rebuild is exactly the work that broke at Nationwide, Monzo and Metro.

Shufti addresses the screening half of that problem. Its AML screening checks a customer against global sanctions, PEP, and adverse media, watchlists at onboarding, then keeps monitoring the same customer afterwards, so a person who is clean on day one and designated on day 400 is flagged when the change happens rather than discovered by a regulator years later. Screening outcomes are logged as they run, which gives your MLRO the evidence trail the MLRs require, and the FCA expects to see.

Request a demo, see how shufti can support your UK AML Compliance Processes.