How AML and KYC obligations affect banks and their business customers

Anti-money laundering (AML) legislation and procedures seek to prevent criminals and terrorists from using financial products or services to store and move their money around.

Banks and other financial institutions in the UK are required to comply with AML laws. They must also meet Know Your Customer (KYC) requirements within their obligations under AML laws and compliance with regulators’ guidance.

These laws mean banks are required to ask for and periodically re-verify information about you and your business. It’s a legal requirement for banks to do this, and it helps to reduce criminal activity and protect you from potential fraud too.

The main AML laws in the UK are the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. They apply across a range of sectors and institutions. Banks must also comply with the Financial Services and Markets Act 2023 (FSMA) and requirements set by their regulators (Prudential Regulation Authority, a division of the Bank of England, Financial Conduct Authority, and the Bank of England itself).

Gathering KYC information, verifying it, and keeping it up to date also helps banks adhere to AML legislation worldwide and to the strict financial sanction regimes in place across the globe.

The regulations require banks to perform ‘Customer Due Diligence’ (CDD) measures including:

• identifying and verifying a customer’s identity on the basis of documents, data or information obtained from a reliable and independent source;
• identifying, where applicable, any beneficial owners and verifying their identities on a risk sensitive basis;
• obtaining information on the purpose and intended nature of the business relationship as well things like source/origin of funds;
• there are also additional enhanced due diligence requirements for Politically Exposed Persons (PEPs), specifically around sources of wealth.

Regulations also require banks to understand the purpose and intended nature of the business relationship; this includes understanding where their customers’ funds and wealth come from.

Following a risk-based approach, banks must obtain sufficient information to develop a comprehensive profile of the customer and (where applicable) any beneficial owners, and to understand the risks associated with the business to ensure it is within appetite.

Banks must perform KYC checks when an account is first opened and are required to regularly re-verify their KYC information. This is usually done at least annually for high-risk customers and every two to four years for medium and lower risk customers.

Sometimes it may feel onerous to respond to your bank’s request to verify information it holds about you and your business. But it is doing so to detect and prevent criminal activity – and because it must, under law, follow these AML and KYC procedures. This also helps banks to protect customers from fraud.

Importantly, AML laws don’t only apply to banks, financial institutions and credit providers.

Businesses (and some individuals) in various other industries must register with a supervisory body for money laundering regulations. These include:

• accountants, tax advisers, auditors and insolvency practitioners,
• independent legal professionals,
• trust and company service providers,
• estate agents and letting agents,
• casinos,
• high value dealers (handling cash payments of €10,000 or more in exchange for goods),
• art market participants (buying, selling or storing art worth €10,000 or more).

Read more about registration and supervisory bodies for different industries on the GOV.UK website.