KYC in the UK is governed by the Money Laundering Regulations 2017 (the MLRs), supervised for financial firms by the FCA, and shaped in practice by JMLSG guidance. The rules require regulated businesses to verify customer identity, screen against sanctions, identify beneficial owners of companies, and apply enhanced checks to higher-risk customers. The framework is risk-based: the law tells you what outcomes to achieve and expects you to calibrate the depth.
Here is what that means in operational terms if you are launching or scaling a regulated business serving UK customers.
Who the rules apply to
The MLRs cover banks, payment and e-money institutions, lenders, investment firms, crypto-asset businesses (registered with the FCA for AML purposes), estate agents, high-value dealers, accountants, and legal professionals. Gambling operators fall under the Gambling Commission's parallel licence conditions, which impose their own identity and affordability checks.
If you are a fintech passporting into the UK or a foreign platform onboarding UK users into regulated activity, the obligations attach to the activity, not your headquarters.
What identity verification must establish
The MLRs require verifying identity on the basis of documents or information from a reliable, independent source. In practice UK firms use three routes, usually combined.
▹Documents plus biometrics: a passport, UK driving licence, or BRP verified for authenticity, with a face match and liveness check tying the applicant to the document. This is the workhorse of digital onboarding, and a full identity verification flow covers document, biometric, and screening steps in one pass.
▹Electronic verification: matching the applicant against independent data sources such as credit files and the electoral roll. The MLRs explicitly permit electronic verification where the source is reliable and independent, and JMLSG guidance describes when a two-source electronic match suffices.
Certified copies remain acceptable for non-digital channels, though they are now the exception.
▹Timing matters: verification must complete before establishing the business relationship, with a narrow allowance to verify during account setup where risk is managed and no transactions occur first.
Sanctions: stricter than the AML rules
UK sanctions screening runs under a separate regime with no risk-based softening. Every firm, regulated or not, is prohibited from dealing with persons on the UK Sanctions List, and screening against the OFSI list at onboarding and continuously afterward is the operational standard. OFSI enforces on a strict liability basis for many breaches: not knowing is not a defence. PEP screening is also mandatory, with the nuance that UK domestic PEPs are, by FCA guidance, generally treated as lower risk than foreign PEPs unless other factors apply.
Business customers: PSCs, not just UBOs
For companies, UK KYB centers on the People with Significant Control register. Firms must identify beneficial owners, generally the over-25% threshold, and verify them as individuals. Companies House data is a starting point, not proof: the register is declarative, and reforms under the Economic Crime and Corporate Transparency Act are tightening identity verification for directors precisely because filings were unreliable. Verifying UK companies and their PSCs therefore combines registry data with document verification and individual checks on each controller.
When enhanced due diligence is mandatory
The MLRs name the triggers: foreign PEPs and their associates, high-risk third countries on the UK list, complex or unusually large transactions with no apparent purpose, and correspondent relationships. EDD in UK practice means senior management approval, source of funds evidence, and enhanced ongoing monitoring, all documented. The FCA's enforcement record is consistent on the failure mode: firms are fined less for individual misses than for being unable to evidence a functioning, risk-based system.Records and the five-year rule
Records and the five-year rule
Firms must keep identity evidence and transaction records for five years after the relationship ends, retrievable on request. Digital audit trails with timestamps, document images, and screening results are the practical standard; a verification you cannot produce is a verification that did not happen, as far as a supervisor is concerned.
FAQ
🔹Is electronic ID verification accepted in the UK?
Yes. The MLRs treat electronic data from reliable, independent sources as valid verification, and JMLSG guidance sets expectations for source quality and match depth. Most UK digital onboarding combines electronic checks with document and biometric verification.
🔹Do UK rules require verifying address as well as identity?
The MLRs require identity verification; address forms part of identity in JMLSG guidance and most firms' risk frameworks, evidenced by documents or electronic sources such as the electoral roll.
🔹Are domestic PEPs treated the same as foreign PEPs?
No. UK guidance directs firms to treat domestic PEPs as lower risk by default, applying EDD proportionately, while foreign PEPs trigger mandatory enhanced due diligence.
🔹How long must KYC records be kept in the UK?
Five years from the end of the customer relationship or the completion of the transaction, under the MLRs.