AML and identity checks in a practice: what repeats and what does not

What the regulations actually ask for #

HMRC's guidance on your responsibilities under the Money Laundering Regulations sets out a small number of obligations that generate a large amount of recurring work. It describes the first of them, customer due diligence, in a sentence.

• Customer due diligence

  Covering name, photographic identity documents, residential address and date of birth.

• Enhanced due diligence

  In higher risk situations, including customers who are not physically present and politically exposed persons.

• Risk assessment

  Updated when a customer’s circumstances change significantly, for example a major change in transaction activity or ownership.

• Written policies and controls

  And a nominated officer to receive internal reports.

• Record keeping

  For five years, beginning from the date a business relationship ends or a transaction is completed.

• Training

  For relevant employees, and evidence that it happened.

Why the work recurs instead of ending #

Practices often think of AML as an onboarding task. It is not. Four things make it recurring:

Documents expire

A passport that satisfied a check three years ago may not satisfy it now. Expiry is a date calculation over a set of documents, which is the most rule-shaped thing in the entire compliance calendar, and in many practices it is done by somebody remembering.

Circumstances change

HMRC guidance explicitly ties risk assessment updates to significant changes in a customer's circumstances. Noticing a change is judgement. Knowing when the assessment was last done is a date.

The register has to stay accurate

Your own supervision registration, its premises list and its annual renewal are a small recurring obligation of exactly the kind that gets missed, because it happens once a year and belongs to nobody in particular.

The evidence has to survive the relationship

Five year retention from the end of the relationship means the filing decision you make today has to make sense to somebody reviewing it long after the client has gone. A practice where the evidence lives in individual inboxes is not in a position to demonstrate anything.

Identity verification at Companies House changed the shape of this #

Separately from the Money Laundering Regulations, identity verification at Companies House became a legal requirement on 18 November 2025, having been available voluntarily from 8 April 2025. It applies to directors and their equivalents, people with significant control and authorised corporate service providers, and Companies House guidance says the requirement will later extend to people who file at Companies House, limited partnerships, corporate directors and officers of corporate PSCs.

For a practice this creates a second identity status per company client, on a separate register, with its own consequences for failure. It does not replace anything.

What runs on rules, and what absolutely does not #

Everything in the judgement half is the reason the regime exists. Everything in the rules half is what stops the judgement half getting the attention it needs, because a person who spends their week chasing expiry dates is not a person who is thinking hard about risk.

The line this page will not cross #

No page, and no supplier, can tell you that a given arrangement is compliant. The obligation sits with the practice, your supervisor will test it against your own risk assessment, and a tool that produces a tidy audit trail is not a defence if the underlying decisions were poor. Anything handling identity documents also engages UK GDPR, and that assessment is yours as well.

What can be said plainly is that the administrative half of AML is a dated list, and dated lists are the most mechanical work in any business. If you want to know how much of your week it takes, start with where onboarding hours go and the cost of admin time calculator, then have the audit count it properly.