AMLR Solutions 
AMLR Consultation
EUDI Wallet
Onboarding
Ongoing Monitoring
FRAML
KYC
KYB
KYI
Age Assurance
Workforce IAM
Candidate Verification
Account Takeover
Bonus/ Promotion Abuse
Chargeback Fraud
Deepfake
Document Fraud
Fraud Networks
Impersonation Fraud
Money Mule Activity
Multi-Accounting
Party Fraud
Regulatory & Compliance Risks
Synthetic Identity Fraud
Adult Content
Banking
Crypto
Fintech
Forex
Compliance
Fraud prevention
Trust & safety
Global expansion
Compliance Officers
Developers
Fraud Analysts
Product Managers
Journey Builder 
Global Trust Platform
Customer Profiles
Vendor Comparison
IDV Case Management
AML Case Management
Regulatory Reporting
Agentic Rule Builder 
AI Compliance Co-Pilot 
Fraud Analytics
Fraud Hub 
OCR
Shufti AI
Bank Account Verification 
Biometric Duplication
Database Checks
Document Intelligence
Government ID
Mobile Driver's License
NFC
Selfie Liveness
Brand Personalisation
Deployment Options
Identity Methods
IDV Modes
Multi-tenancy
On-Premise IDV
Secure Capture
Shufti MCP
- Algeria
- Argentina
- Armenia
- Australia
- Austria
- Bahrain
- Bangladesh
- Belarus
- Belgium
- Brazil
- Bulgaria
- Cambodia
- Cameroon
- Canada
- Chile
- China
- Colombia
- Costa Rica
- Croatia
- Cyprus
- Czech Republic
- Denmark
- Dominican Republic
- Ecuador
- Egypt
- Estonia
- Eswatini
- Ethiopia
- Finland
- France
- Germany
- Greece
- Haiti
- Hong Kong
- Hungary
- India
- Iraq
- Ireland
- Indonesia
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Lithuania
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Mongolia
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Poland
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Saudi Arabia
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- UAE
- Uganda
- Ukraine
- UK
- USA
- Vietnam
Scale Identity Verification and KYC Operations in the United Kingdom
Verify residents through ePassport NFC, driving licences and eIDV, and non-residents through 10,000+ foreign ID document types, run KYB on Companies House firms and their PSCs, and monitor transactions and sanctions lists. One platform runs compliance and fraud prevention across the full customer lifecycle for FCA-, HMRC- and Gambling Commission-supervised firms.
Operational Performance for UK KYC
Our Numbers Speak Volumes
94.85%
Pass
rates
100%
NFC Verification
Coverage
95%
eIDV Pass
Rate
United Kingdom IDV/KYC Challenges
No National ID Card Means Every Journey Needs Several Routes
The UK has had no national identity card since the Identity Documents Act 2010, so KYC in the UK rests on passports, driving licences, electronic data checks and eVisas. Shufti runs all four routes in one flow, matched to what each customer holds.
Keeping Customer Risk Current Requires Continuous Monitoring
Regulation 28(11) of the Money Laundering Regulations 2017 (MLRs) requires ongoing monitoring of every business relationship. Shufti checks transactions against each customer's profile, rescreens customers whenever watchlists change and flags Companies House director and PSC changes as they happen.
PSC Register Data Cannot Stand Alone in Ownership Checks
Regulation 28(9) of the MLRs bars firms from relying solely on the PSC register, while directors and PSCs verify their identity with Companies House through a transition ending in November 2026. Shufti maps ownership independently and flags register discrepancies for reporting under regulation 30A.
Thin Case Files Weaken SAR Portal Reports
Suspicious activity reports and defence against money laundering (DAML) requests sent to the National Crime Agency (NCA) need the identity evidence, transactions and reasoning behind a suspicion. Shufti's case management keeps that evidence in one file, so every report starts complete.
Documents and Languages
Individual Documents Shufti Verifies in the United Kingdom
Shufti verifies UK identity documents plus passports and ID cards from other countries. The cards below cover the core documents UK onboarding relies on, with the full list on the supported documents page.
View All Supported DocumentsUK Passport and ePassport
HM Passport Office has issued biometric passports since 2006, so every valid UK passport carries a chip. Shufti reads it by NFC and runs nine forensic detection layers, from MRZ checksum validation to hologram analysis, so a cloned or altered passport fails before onboarding.
DVLA and DVA Photocard Driving Licences
DVLA issues photocard licences in Great Britain and the DVA in Northern Ireland, each with a photo renewed every ten years. Shufti checks authenticity, expiry and facial match, and confirms driving entitlement through a DVLA check code for ride-hailing, delivery and vehicle-rental platforms.
eVisas and Immigration Status Documents
Every biometric residence permit has now expired and been replaced by a Home Office eVisa. Shufti checks the immigration status behind a customer's eVisa share code, matches it to the passport and face in the same session, and reads older visa vignettes too.
Proof of Age, Armed Forces and Veteran ID Cards
Proof of age cards such as CitizenCard and PASS cards, plus Armed Forces and veteran ID cards, give customers without a passport or licence a photo ID. Shufti checks each card's security features and matches its photo to a live selfie.
Foreign Passports and National ID Cards
Shufti actively processes 10,000+ ID document types from 240+ countries and territories, and its zero-shot AI learns new document formats in minutes. International students, overseas workers and non-resident customers onboard with these documents, with NFC chip reads on most biometric passports.
Proof of Address
Council tax bills, utility bills and bank statements are verified in the same step as the ID, with the extracted address matched against the driving licence or the electronic identity check.
Entity Identity
Certificate of Incorporation and Companies House Register Data
Shufti checks the company number against live Companies House data at every check, confirming status, registered office, officers, filing history and charges, and flags any certificate that does not match the register.
Confirmation Statement and Filing History
The latest confirmation statement is read for shareholders and SIC codes, and overdue accounts or a pending strike-off are flagged as risk indicators before onboarding.
Articles of Association
AI-OCR reads ownership, share classes and signing authority, and flags GAN-generated or edited pages.
Overseas Entity Registrations
Overseas entities that hold UK land register with Companies House under the Economic Crime (Transparency and Enforcement) Act 2022. Shufti checks the registration and the beneficial owners it names.
Business Address Proof
Utility bills, business rates bills and lease agreements are cross-checked against the registered office held at Companies House.
Tax Identity
VAT Registration Number
Shufti validates the VAT number against HMRC records and matches the registered business name and address to Companies House.
Unique Taxpayer Reference (UTR)
The 10-digit Corporation Tax or Self Assessment UTR is captured where sector policy requires it and reconciled with the entity's other records.
Foreign Tax Registrations and FATCA/CRS Self-Certification
Foreign-owned entities and overseas parents are verified with their home-country tax registrations, and FATCA and CRS self-certifications are captured in the same flow.
Ownership and Control
People with Significant Control (PSC) Register
Part 21A of the Companies Act 2006 requires companies to record anyone holding more than 25% of shares or voting rights, or otherwise controlling the company. Shufti extracts every PSC at that threshold, identity-verifies and screens each one, and flags gaps against the register.
Trust Registration Service Excerpts
Regulation 30A of the MLRs requires proof of registration or an excerpt from HMRC's Trust Registration Service before a relationship with a registrable trust starts. Shufti reads the excerpt, maps settlors, trustees and beneficiaries, and screens each one.
Shareholder Register and Ownership Chart
Shufti maps ownership through intermediate holding companies and screens every person and entity in the chain against the UK Sanctions List, UN Security Council lists and global watchlists.
Directors and Authorised Signatories
Each director and signatory is identity-verified and screened, and Shufti alerts the case owner when Companies House records a change of officers.
Languages We Cover
Latin Script, English and Expat Document Parsing
UK documents use Latin script, while the international customers UK firms onboard bring passports in Arabic, Devanagari, Ge'ez, CJK and many other scripts. Shufti's OCR reads 150+ languages and scripts at 99.7% accuracy and averages 93% against Google Vision's 78.4% across its published benchmark. Zero-shot document intelligence reads passport layouts it has never seen on first sight, without waiting for a template.
UK Name Matching
Apostrophes, hyphens and accents in names such as O'Connor, Anne-Marie and García are normalised against MRZ formats, and native phonetic models for 80+ languages match transliterated names in sanctions and PEP screening.
Cross-Document Consistency Checks
Names, dates of birth and addresses are reconciled across the passport, driving licence, eVisa, electronic identity check and Companies House officer records, so a spelling variant gets resolved instead of rejected.
Independent Validation
Shufti's Recognition Across Independent Evaluations
Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Top Vendor for Product Execution in the Liminal Index for KYC 2026
View Report
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader in G2 Fall 2026 reports
Read More
Regulatory Update
Every Verification Route UK Firms Rely On, in One Platform
Regulation 28(19) of the MLRs accepts electronic identification that is secure from fraud and misuse, and HM Treasury guidance of February 2026 confirms certified digital verification services can be used for due diligence. Shufti supports the chip, data, document and video routes UK firms use, plus eVisa checks for non-UK nationals.
Docless Database (eIDV)
LiveShufti matches a customer's name, date of birth and address against credit reference, electoral register and other authoritative UK data sources and returns a decision in seconds with no document upload, using the kind of independent source regulation 28(18) describes.
eVisa Status Check
LiveFor non-UK nationals, Shufti checks the immigration status behind a Home Office eVisa share code and matches the result to the passport and selfie captured in the same session, storing both in the case file.
Document and Face Biometric
LiveDocument checks paired with iBeta Level 3 liveness and face matching cover driving licences, proof of age cards and foreign IDs, the route most customers take when they have no NFC-enabled passport to hand.
Fraud Prevention Across the UK Customer Journey
Reduce fraud losses and protect customer trust across onboarding, account access, and payments. Shufti connects identity, behavioral, device, network, and transaction intelligence to help UK businesses act on risk while keeping legitimate customers moving.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer Avoidable Re-submissions
Capture guidance for passports, photocard licences and proof of address catches glare, cropping and expired documents before submission, so customers rarely repeat a step.
Cleaner Audit Trails
Shufti's case management records sources, results, timestamps, evidence, analyst notes and decision history, packaged as report-ready bundles for SAR Portal submission.
One Workflow, One Back Office
Unify KYC, KYB, AML screening and transaction monitoring in one case file. Perpetual KYC/KYB tracks ownership, director and transaction changes across the compliance lifecycle.
Passport and eIDV-First Flow Design
UK residents verify through passport NFC or docless eIDV first, while non-UK nationals move to passport, eVisa and biometric checks in the same flow.
Shufti's IDV/KYC Solutions for the United Kingdom
KYC Solutions
UK onboarding serves residents with a passport or licence, residents with neither, and non-UK nationals on eVisas. One Shufti flow routes each by risk, so nobody faces checks they don't need.
Explore More
Face Verification
Remote onboarding in the UK depends on a selfie matched to a passport or licence photo. Shufti's face matching delivers a 99.5% first-try pass rate, and DHS RIVR 2025 testing measured a false match rate below 0.001.
.
Age Verification
Ofcom expects highly effective age assurance under the Online Safety Act 2023, and gambling operators must verify age before any deposit. Shufti estimates age from a selfie in under 5 seconds, blocks 99.8% of underage attempts and falls back to a document check when needed.
.
Bank Account Verification
Payouts fail and fraud slips through when a sort code, account number or holder name is wrong. Shufti validates UK account details and IBANs and matches the account holder's name in real time, so funds reach the verified customer.
.
Address Verification
Council tax bills, utility bills and bank statements vary by supplier and layout. Shufti's layout-aware extraction and fuzzy matching verify them against the ID address at a 99.3% pass rate, with docless checks in under 3 seconds.
.
Document Verification
UK onboarding draws on passports, GB and Northern Ireland licences, proof of age cards, eVisas and foreign IDs. Shufti verifies each within seconds, catching edits, template fraud and synthetic documents before they reach a reviewer.
.
Identity Verification
Separate tools for documents, selfies, data checks and addresses split one customer across several records. Shufti runs document, biometric, NFC, address and eIDV checks in one API session, so each customer has one verified identity and one audit trail.
.KYB Solutions
UK corporate onboarding means reconciling Companies House records, VAT registrations and ownership that often runs through several holding companies, measured against the more-than-25% beneficial owner test in regulation 5 of the MLRs.
Explore More
Business Verification
Onboarding a UK company means confirming its company number, VAT registration, signatories and everyone who owns or controls more than 25%. Shufti's live registry call pulls that picture together in one check, putting corporate onboarding under two minutes.
.
Enhanced Due Diligence
Layered ownership, PEP links, high-risk sectors and exposure to FATF call for action countries trigger enhanced due diligence under regulation 33. Shufti's branching questionnaires, configurable risk scoring and UBO verification links gather the evidence, and every answer lands in the case file.
.AML Screening
A customer who is clean at onboarding can land on a list next week. Shufti's perpetual KYC rescreens every customer against 4,000+ watchlists, including the UK Sanctions List and UN Security Council lists, refreshed every 15 minutes, with every hit kept in one case file.
Explore More
Business AML Screening
A company's risk often sits with its owners and directors. Shufti screens entities, PSCs and directors against the UK Sanctions List, PEP lists and 50,000+ adverse media sources in 80+ languages, and perpetual KYB rescreens the portfolio when any of them change.
.
Transaction Monitoring
Faster Payments move funds in seconds, leaving little time to catch layering before the money is gone. Shufti's library of 500+ pre-built rules covers structuring, smurfing and mule activity with 60% fewer false positives, and alerts flow into case management ready for SAR Portal reporting.
.
Travel Rule
Part 7A of the MLRs has required originator and beneficiary information to travel with cryptoasset transfers since 1 September 2023. Shufti's single integration connects to major Travel Rule networks, exchanges IVMS101 data and confirms unhosted wallet ownership.
.
AI Compliance Co-Pilot
One common name can return 140+ screening hits. Shufti's AI Compliance Co-Pilot reviews every hit and gives a confidence score with a written reason, while the MLRO keeps the final call and every override is logged.
.Built To Fit the United Kingdom's Compliance Landscape
The MLRs, the Proceeds of Crime Act 2002 and UK sanctions law apply to every regulated business, while the FCA, HMRC, the Gambling Commission and 22 professional bodies supervise their own sectors. Shufti maps its KYC, KYB, AML screening and transaction monitoring controls to every regime below, so one platform covers each licence your group holds.
Money Laundering Regulations 2017 (MLRs)
The MLRs set customer due diligence in regulation 28, define beneficial owners as those holding more than 25% in regulation 5 and require five-year record keeping under regulation 40. Amendments in force since 30 June 2026 converted thresholds to sterling and tied mandatory EDD to FATF call for action countries.
Proceeds of Crime Act 2002
Part 7 creates the principal money laundering offences, and section 330 makes failing to disclose knowledge or suspicion an offence in the regulated sector. Section 335 sets the consent process the NCA handles as a DAML request, and section 21A of the Terrorism Act 2000 mirrors the disclosure duty.
National Crime Agency (UK Financial Intelligence Unit)
The NCA's UK Financial Intelligence Unit receives suspicious activity reports and DAML requests through the SAR Portal, which replaced SAR Online in 2024. Regulation 104A of the MLRs designates the NCA as the UK's financial intelligence unit, and its guidance explains how to frame DAML and terrorist financing consent requests.
Financial Conduct Authority (FCA)
The FCA supervises banks, payment and e-money firms, investment firms and cryptoasset businesses under the MLRs. SYSC 6.3 of its Handbook requires systems and controls against financial crime and a nominated MLRO, and its Financial Crime Guide explains the FCA's KYC and wider financial crime expectations.
FCA Cryptoasset Regime
Cryptoasset exchange providers and custodian wallet providers must register with the FCA under regulation 56 of the MLRs. The Travel Rule in Part 7A has applied since 1 September 2023, and authorisation under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 applies from 25 October 2027.
HM Revenue and Customs (HMRC)
HMRC supervises money service businesses, trust or company service providers, estate and letting agents, high value dealers, art market participants and accountancy service providers outside a professional body. Since 30 June 2026 the MLRs have set the cash, monthly rent and art sale thresholds for these sectors at £10,000.
Gambling Commission
The Gambling Commission licenses operators serving Great Britain. LCCP condition 17.1.1 requires a customer's name, address and date of birth to be verified before they gamble, social responsibility code 3.2.11 requires age verification before any deposit, and condition 12.1.1 sets AML duties, with casinos also bound by the MLRs.
Office of Financial Sanctions Implementation (OFSI)
OFSI, part of HM Treasury, enforces UK financial sanctions made under the Sanctions and Anti-Money Laundering Act 2018 and can impose civil penalties on a strict liability basis. Since 28 January 2026, the Foreign, Commonwealth and Development Office's UK Sanctions List has been the only source of UK designations.
Companies House
Companies House holds the register of companies, the PSC register and the Register of Overseas Entities, each recording owners above 25%. Regulation 30A of the MLRs requires firms to collect register evidence before a relationship starts and to report material discrepancies they find, including discrepancies found during ongoing monitoring.
Economic Crime and Corporate Transparency Act 2023
Identity verification for directors and PSCs became a legal requirement at Companies House on 18 November 2025, with a 12-month transition for existing appointments. The Act's failure to prevent fraud offence, in force since 1 September 2025, makes large organisations liable when an associated person commits fraud to benefit them.
Digital Verification Services Register
Part 2 of the Data (Use and Access) Act 2025, in force since 1 December 2025, created a statutory register of digital verification services certified against the UK trust framework. HM Treasury guidance of 26 February 2026 confirms registered services can support identity verification under regulation 28 of the MLRs.
Home Office (HM Passport Office and UK Visas and Immigration)
HM Passport Office issues UK passports, all biometric since 2006, and UK Visas and Immigration has replaced biometric residence permits with eVisas. Non-UK nationals prove their status with a 90-day share code, the route employers and landlords use for right to work and right to rent checks.
Payment Systems Regulator (PSR)
Since 7 October 2024, the PSR's Specific Directions 20 and 21 have required payment firms to reimburse authorised push payment fraud victims up to £85,000 per claim, with the cost split equally between sending and receiving firms. Specific Direction 17 sets the Confirmation of Payee requirement for directed firms.
Ofcom (Online Safety Act 2023)
Pornography publishers have needed highly effective age assurance since January 2025, and user-to-user services that allow content harmful to children since 25 July 2025. Ofcom lists facial age estimation, photo-ID matching, open banking, credit card, digital identity, mobile network and email-based checks as methods capable of meeting that standard.
National Risk Assessment 2025
HM Treasury published the National Risk Assessment of Money Laundering and Terrorist Financing 2025 on 17 July 2025 under regulation 16 of the MLRs. Supervisors must take it into account under regulation 17, and firms must weigh their supervisor's risk information in their own assessments under regulation 18.
UK Data Residency and Deployment
As a KYC provider with a London office, Shufti runs in UK cloud regions, including AWS Europe (London), Azure UK South and UK West, Google Cloud London, IBM Cloud London and Oracle's UK Sovereign Cloud, or on-premises. Hosting locations and transfer arrangements are set in the agreement.
UK GDPR and the Data Protection Act 2018
UK GDPR treats biometric data used to identify a person as special category data under Article 9 and requires breach notification within 72 hours under Article 33. Shufti protects identity and biometric data with encryption, role-based access controls and configurable retention.
FCA and PRA Outsourcing Rules
SYSC 8 of the FCA Handbook keeps firms responsible for the functions they outsource, and the PRA's SS2/21 sets outsourcing and third-party risk expectations for banks and insurers. Shufti's agreements set out data location, audit and access rights, and support for your exit planning.
Retention Controls
Regulation 40 of the MLRs keeps due diligence and transaction records for five years after a relationship ends, then requires personal data to be deleted. Shufti configures retention by client and licence, deletes on schedule and applies legal holds when an enactment or court proceedings require it.
Encryption and Security
Data is encrypted in transit and at rest, with role-based access and audit logging throughout. ISO 27001:2022 and SOC 2 Type 2 reports support your vendor due diligence and the operational resilience assessments that SYSC 15A expects of FCA-regulated firms.
Automated Decisions and Biometric Data
Articles 22A to 22D of UK GDPR, in force since 5 February 2026, require safeguards for significant decisions taken without meaningful human involvement. Shufti returns verification results and supporting details through the API and back office, so support teams can explain outcomes and escalate disputed results.
Scope of Our Role
Shufti processes personal data as a processor on the firm's instructions under UK GDPR. The firm remains the controller, answerable to the Information Commission, which took over from the Information Commissioner on 30 September 2026, and Shufti's privacy notice identifies any independent-controller activity.
Data Residency and Privacy Controls in the United Kingdom
UK AML Sources That Strengthen Decisions
Financial Conduct Authority (FCA)
HM Revenue and Customs (HMRC)
National Crime Agency (NCA)
Office of Financial Sanctions Implementation (OFSI)
HM Treasury
Companies House
Prudential Regulation Authority (PRA)
Gambling Commission
Office for Professional Body Anti-Money Laundering Supervision (OPBAS)
Serious Fraud Office (SFO)
Financial Action Task Force (FATF)
UN Security Council Consolidated List
Egmont Group of Financial Intelligence Units
Wolfsberg Group
Basel Committee on Banking Supervision
Turn UK Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.
INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.
Certified to Global Standards
PROVEN WORKFLOWS
Identity Verification Built Around Your Industry in the United Kingdom
Onboard And Monitor Customers Under FCA Supervision
Banks apply the MLRs under FCA supervision and carry their share of authorised push payment fraud reimbursement as sending or receiving firms. Shufti verifies customers through passport NFC or eIDV, runs KYB on business accounts against Companies House, monitors Faster Payments for scam and mule patterns and rescreens customers continuously.
Frequently Asked Questions
How does Shufti handle identity verification in the UK when there is no national ID card?
Shufti verifies UK residents through passport NFC or a docless eIDV check against credit reference and electoral register data. Customers without a passport move to driving licence or proof of age card checks with liveness, and non-UK nationals add an eVisa status check.
Is a photo of a UK passport enough, or should verification read its chip?
A photo shows only what is printed, which can be edited. Shufti reads the passport chip by NFC, validates its digital signature and compares the chip data and photo with the printed page and the customer's selfie, so a cloned or altered passport fails.
Can Shufti verify foreign documents or identity formats it has not encountered before?
Yes. Shufti actively processes 10,000+ ID document types from 240+ countries and territories, and its zero-shot AI learns new formats in minutes. International students, overseas workers and non-resident customers can onboard with their own passports or national IDs, with NFC chip reads where available.
How does Shufti OCR compare with Google OCR for the non-Latin documents UK firms receive?
UK documents use Latin script, but international customers bring passports in many non-Latin scripts. Across the languages in its published benchmark, Shufti's OCR averages 93% accuracy against Google Vision's 78.4%, and it transliterates each name to Latin script so sanctions and watchlist matching works across languages.
How does Shufti verify ownership when a UK company has several corporate layers?
Shufti pulls Companies House records for each company in the chain, maps shareholdings through every holding entity and identifies everyone owning or controlling more than 25%. Each owner is identity-verified and screened, and the chart is reconciled with the PSC register and stored with sources.
Does Shufti's ongoing monitoring cover more than sanctions screening?
Yes. Regulation 28(11) of the MLRs requires scrutiny of transactions and up-to-date due diligence records throughout a relationship. Shufti monitors transactions against each customer's profile, tracks Companies House officer and PSC changes, and triggers a review when risk, ownership or documents change.
How does Shufti keep screening current now that the OFSI sanctions list has closed?
OFSI's Consolidated List closed on 28 January 2026, and the UK Sanctions List is now the only source of UK designations. Shufti screens against it alongside UN and global lists, with phonetic matching for hyphenated, apostrophised and transliterated names that keeps false hits down.
Can we choose UK hosting or run verification inside our own infrastructure?
Yes. Shufti runs in UK cloud regions in London, Cardiff and Newport, or on-premises inside your own infrastructure, including air-gapped deployments. Hosting locations are written into the agreement, which supports the data location and access terms that FCA and PRA outsourcing rules expect.
What controls help us protect identity and biometric data?
Shufti encrypts data in transit and at rest, applies role-based access controls and logs every access. Biometric data is handled as special category data under UK GDPR, retention is configurable, and ISO 27001:2022 and SOC 2 Type 2 reports support your vendor due diligence.
Can we configure different retention periods for different UK licences?
Yes. Retention is set per client, licence and record type, so each entity applies the retention its own rules require, starting from the five-year period in regulation 40 of the MLRs. Legal holds extend retention when an enactment or court proceedings require it.
What does Shufti provide when our compliance team needs to file through the SAR Portal?
Shufti's case file holds the customer's verified identity, screening results, transaction history, alerts and analyst notes in one place. Your MLRO can export that evidence for a SAR or DAML request without rebuilding it by hand, with every source and timestamp intact.
Can we add verification checks without rebuilding our onboarding journey?
Yes. The AI Journey Builder adds or reorders checks such as eIDV, passport NFC, eVisa status or address verification without code changes. Routing rules apply them by product, risk tier or customer type, so existing journeys keep running while new steps go live.
How does Shufti make verification queries easier for our customer support team?
Every decision is shown in the back office with the reason, the failed check and the captured evidence. Support teams can tell a customer exactly what to resubmit, such as a glare-free licence image, and escalate disputed results to a reviewer.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
5 January, 2026
eIDV Global Capability Matrix
Shufti's eIDV coverage across 87 jurisdictions, showing which passive, active and biometric database checks, plus address and age checks, are available in each.
Coverage Sheet
