UK AML/CFT Framework

United Kingdom AML/CFT obligations overlay universal AML processes through sector scope, supervisor expectations, professional guidance and current consolidated legislation.

Jurisdiction boundary: UK legal duties, SAR procedures, supervisory expectations and sanctions rules must not be applied as universal FATF requirements. The workflow must identify the legal person, regulated activity, supervisor, current source and accountable nominated officer or MLRO.

Core instruments and authorities#

Instrument or authorityFunctionOperational relevance
Money Laundering Regulations 2017 (MLRs)Preventive AML/CFT and proliferation-financing controls for relevant personsBusiness risk assessment, CDD, EDD, policies and controls, training, recordkeeping, reliance and supervision
Proceeds of Crime Act 2002, Part 7Money-laundering offences and disclosure frameworkSuspicion, internal disclosure, nominated-officer review, SAR/DAML context and tipping-off controls
Terrorism Act 2000, Part IIITerrorist-property offences and disclosure dutiesCounter-terrorist-financing escalation and regulated-sector reporting context
UKFIU / National Crime AgencyReceives and processes UK Suspicious Activity ReportsCurrent SAR guidance, portal practice, quality expectations and law-enforcement intelligence
FCA, HMRC and professional-body supervisorsSector-specific AML supervisionRegistration or authorisation, control expectations, examination, remediation and enforcement
JMLSG and sector guidanceRisk-based implementation guidance for financial servicesInterpretation and practical control design within the stated sector and approval status
OFSI and the UK sanctions frameworkImplementation of UK financial sanctionsScreening, ownership/control, asset freezes, reporting, licensing and enforcement

Scope and supervisory perimeter#

The UK framework covers multiple regulated sectors and does not have one supervisor for every relevant person. A workflow must determine whether the activity is within the MLRs, which supervisor applies and whether separate FCA, HMRC or professional-body requirements are relevant.

Before applying a UK control, record:

  • the regulated activity and legal entity;
  • the applicable MLR provision and current amendment status;
  • the supervisor and sector guidance;
  • the nominated officer / MLRO decision path;
  • the separate POCA, Terrorism Act and sanctions layers.

Process mapping#

Universal AML processUK overlay questions
Business and customer risk assessmentIs the person within the MLRs, what sector risks apply and which supervisor's expectations must be mapped?
CDD / KYCWhich identification, verification, purpose, intended-nature and ongoing-monitoring requirements apply?
Beneficial ownershipWhich ownership/control test, verification approach and Companies House or other registry evidence is relevant?
PEP / EDDWhich enhanced measures, senior-management approval, source-of-wealth/funds and monitoring requirements apply?
Internal disclosure and SARWho is the nominated officer, what facts support knowledge or suspicion, and which UKFIU procedure applies?
Tipping-off and confidentialityWhat information may be communicated without prejudicing an investigation or breaching statutory restrictions?
Recordkeeping and data protectionWhich retention, access, deletion, legal-basis and information-sharing rules apply?
SanctionsWhich UK regulation, designation, ownership/control rule, asset-freeze, licence and reporting duty applies?

MLRO, nominated officer and escalation#

UK terminology is role- and sector-sensitive. The nominated officer receives internal disclosures and performs the legally accountable reporting assessment; firms often use the title MLRO, but governance documents should record the actual statutory and regulatory responsibilities rather than relying on a title alone.

Suspicious activity reporting#

UK SARs are submitted to the UKFIU. A defensible process separates:

  • the employee's internal disclosure;
  • the nominated officer's review and rationale;
  • the external SAR decision;
  • any Defence Against Money Laundering process;
  • post-report confidentiality and customer-handling controls.

Current UKFIU guidance and portal instructions must be used. This encyclopedia does not hard-code filing fields, thresholds or operational portal steps.

Guidance versus binding requirements#

The MLRs, POCA and the Terrorism Act are legal sources. FCA and other supervisor materials explain expectations within their remit. JMLSG guidance is influential for financial services and can have relevant approval status, but it is not a substitute for the legal text and should not be applied unthinkingly as a checklist.

OFSI is a separate sanctions layer#

Financial sanctions are connected to AML operations but are a distinct legal regime. Screening results must be assessed against the current UK Sanctions List, the applicable sanctions regulations, ownership/control rules, licences and OFSI reporting requirements.

Evidence requirements for a UK overlay#

  • regulated activity, legal entity and supervisor;
  • current consolidated legislation and relevant provision;
  • applicable FCA, HMRC, professional-body or JMLSG guidance and version;
  • internal disclosure, nominated-officer review and external-reporting rationale;
  • UKFIU guidance version and submission record where applicable;
  • sanctions regulation, designation source, ownership/control analysis and licence status;
  • internal-policy mapping and accountable approver.

Relationship to FATF#

The UK framework implements AML/CFT and proliferation-financing controls within a national legal and supervisory system. FATF remains the global baseline, while UK legislation and current supervisor/FIU guidance control the local implementation.

Source basis#

Boundary#

Boundary: relevant-person status, supervisory scope, suspicion, SAR/DAML, sanctions action and legal conclusions require current UK sources and accountable review.