For UK financial advisers within the Money Laundering Regulations, client due diligence means identifying and verifying the client, checking beneficial ownership and authority to act where relevant, understanding the relationship and monitoring it over time. The depth of the checks depends on risk. Higher-risk cases need enhanced measures, and the file must support the firm’s decisions.
The legislation calls this customer due diligence (CDD). Advisers also use “client due diligence” and “know your customer” (KYC). This guide covers the UK AML checks behind those terms, rather than research into investments or whether a recommendation is suitable. Other countries have different rules; see our US AML requirements guide if your firm operates there.
Need help with incomplete client files? AgentKYZ’s UK managed KYC service supports onboarding, remediation and periodic reviews under your approved AML policy. Your firm keeps the approval decision.
Which financial advisers must carry out CDD?
Start with the legal entity and the activities it performs. The FCA’s AML overview includes financial advisers among the firms normally within its Money Laundering Regulations supervision. It also explains that mortgage brokers, general insurers and general insurance brokers are outside these MLR obligations for those activities, although financial-crime controls and other legal duties still apply. A firm offering several services must assess each activity.
JMLSG Part II, Sector 6 addresses financial advisers and financial planners. It covers advisers who only give advice as well as those acting for clients with product providers. You can face money-laundering risk without handling client money: advice can help someone place criminal proceeds into an apparently legitimate investment.
Read Sector 6 alongside Part I and any relevant product-sector guidance. JMLSG guidance helps firms apply the rules; it does not replace the legislation. The current-guidance page links the October 2026 Part I edition and flags subsequent revisions. The sources here were checked on 19 October 2026. For wider governance obligations, see our UK AML compliance guide.
When must client checks be completed?
Regulation 27 requires CDD when establishing a business relationship, when money laundering or terrorist financing is suspected, and when previous identity evidence is doubtful. It also covers qualifying occasional transactions and reviews of existing clients. A small investment is not an exemption from CDD when you establish a business relationship.
Under Regulation 30, identity verification normally happens before the relationship or transaction. A limited exception permits completion during establishment where necessary to avoid interrupting normal business and there is little money-laundering or terrorist-financing risk. Verification must then finish as soon as practicable after first contact. Do not treat a client’s investment deadline as permission to defer checks.
If required CDD cannot be completed, Regulation 31 generally prohibits proceeding, requires termination of an existing relationship and requires consideration of a suspicious activity disclosure. Escalate through your firm’s procedure. A missing document does not automatically mean a suspicious activity report is required; the circumstances need assessment.
A client due diligence checklist for financial advisers
Use this as a file-review starting point, adapted to your policy and the client. The legal basis for the core checks is Regulation 28; the suggested file records below are practical ways to document the work.
- Identify the client and verify identity. Record who is receiving the service. For an individual, collect the relevant personal details and verify identity using reliable, independent evidence. Keep the documents or electronic verification evidence and explain discrepancies, such as different names or addresses.
- Check anyone acting for the client. An attorney, trustee or company signatory may give instructions. Identify and verify the person and confirm their authority. A copy of their passport does not establish their authority to invest someone else’s money.
- Identify beneficial owners and understand control. For a company or trust, identify the relevant beneficial owners and take reasonable measures to verify them. Keep evidence of the ownership or control structure. Companies House information alone does not satisfy the beneficial ownership requirement in Regulation 28(4).
- Understand the relationship. Record why the client wants advice, the intended service, expected investment amounts and expected activity. Use the fact-find where relevant, but resolve inconsistencies between it and the CDD evidence.
- Assess AML risk and apply the required checks. Consider the client, product, geography and delivery channel. Determine PEP status, address applicable sanctions restrictions and assess relevant adverse information. Record why a potential screening match was cleared or escalated, rather than saving an unexplained “pass”.
- Address source of funds and wealth. Record the explanation and obtain supporting evidence where the applicable requirements and risk call for it. Keep the origin of the investment money distinct from how the client built their overall wealth.
- Record the decision and follow-up. Keep the risk assessment, outstanding questions, required approvals and review arrangements together. Give unresolved items an owner. Do not label a file complete while required evidence or approval is still missing.
An investment suitability fact-find can supply useful information, but the two assessments answer different questions. A client’s preference for low-risk investments does not establish low AML risk.
What documents and source-of-funds evidence are needed?
There is no universal rule that a passport and one utility bill complete CDD. Identity verification can use documents or qualifying electronic processes. Regulation 28(19) requires electronic identification to be secure from fraud and misuse and provide the assurance needed to manage the risk. Check what your chosen service verifies and how you can retrieve its evidence.
JMLSG Sector 6 also recognises clients who cannot reasonably provide standard documents, such as someone in a care home without a passport or utility bills. Follow the guidance on alternative evidence and your policy rather than treating the absence of those documents as automatic rejection.
For a corporate client, Regulation 28 requires information including its name, registration number and registered office, plus further checks subject to the applicable exceptions. A trust needs checks appropriate to its roles and control structure, not a company shareholding checklist.
Source of funds explains where the money for the relationship or transaction comes from. Source of wealth explains how the client accumulated their wealth. A bank statement may show the transfer route without explaining the underlying origin.
For example, if a client says an investment comes from selling a business, your risk assessment may call for a sale agreement or completion statement and evidence connecting the proceeds to the investing client. This is an illustrative evidence request, not a mandatory document list for every case. JMLSG Sector 6.23 connects understanding wealth and the purpose of activity with the normal advice process; the amount of corroboration still needs to fit the risk and applicable requirements.
When are simplified or enhanced checks appropriate?
Regulation 37 allows simplified due diligence where the relationship or transaction has an assessed low degree of risk. The firm must still meet the relevant CDD requirements and carry out sufficient monitoring. Familiarity with the client, or a low-risk product on its own, does not settle the assessment.
Regulation 33 requires enhanced due diligence (EDD) and enhanced ongoing monitoring in specified cases. These include identified high risk, certain unusual transactions and PEP relationships. Record the trigger and the additional work needed to address it.
Following the June 2026 amendments, Regulation 33(1)(b) uses FATF call for action countries for its automatic country-based EDD trigger. A country on FATF’s increased-monitoring list still informs risk assessment but does not fall within that trigger merely because it is grey-listed. Use the current regulation and lists rather than an old country checklist.
For PEP relationships, Regulation 35 requires senior-management approval, adequate measures to establish source of wealth and funds, and enhanced ongoing monitoring. UK domestic PEPs, their family members and known close associates have a lower-risk starting point than non-domestic PEPs. Without additional enhanced risk factors, the extent of EDD must be less. Apply the FCA’s FG25/3 guidance; a PEP match is not itself evidence of wrongdoing.
Sanctions obligations are separate from the AML risk rating. A low-risk classification does not allow a prohibited transaction. Investigate potential matches and follow the applicable restrictions and reporting requirements.
Can you use a platform’s or provider’s checks?
An adviser and a product provider can both have obligations for the same client. JMLSG Sector 6.20 says advisers must not confirm that verification has been completed if appropriate CDD has not actually been done. The provider’s acceptance of an application does not fill gaps in the adviser’s file.
Statutory reliance under Regulation 39 requires an eligible third party and specific information and record-access arrangements. Obtain the required CDD information immediately and arrange for copies of identification and verification records to be available immediately on request. The relying firm remains liable for failures. Reliance on specified CDD measures does not transfer ongoing monitoring under Regulation 28(11).
Outsourcing under Regulation 39(7) is a separate arrangement: a provider performs work for your firm, which remains liable. Agree who obtains missing evidence, reviews findings, handles alerts and retains records. Assess applicable outsourcing and data-protection requirements before transferring client documents.
Keep reviews and records current
Regulations 27 and 28 require risk-based attention to existing clients and ongoing monitoring. Set review intervals in your policy and act on relevant changes before the next scheduled review. Examples include a new beneficial owner, an unexplained investment increase or instructions to send proceeds to an unrelated third party.
Where your firm has an ongoing relationship, monitor activity against what you know about the client. Agree responsibilities with the platform or provider; a periodic document refresh alone does not fulfil the whole monitoring duty. JMLSG Sector 6.23 notes that an adviser need not handle a transaction personally to have a reporting obligation.
Regulation 40 generally requires CDD records for five years after the business relationship ends, or after an occasional transaction is complete. It also covers supporting transaction records and limits the requirement to retain certain transaction records to ten years. Apply the personal-data deletion rules and exceptions alongside other applicable retention duties. The last KYC review date does not start the relationship-end retention period.
Keep records retrievable when a product provider or supervisor requests them. If you change software or outsource file work, agree access during the engagement and after it ends.
Use AgentKYZ for the file work
AgentKYZ’s KYC software reads case documents, maps ownership, screens sanctions, PEPs and adverse media, and prepares an assessment for your reviewers. Your team checks the findings against its AML policy and records the decision.
If you need additional review capacity, our UK managed KYC service covers agreed onboarding, remediation and periodic-review work. Qualified compliance reviewers check the files and return the evidence, findings and open questions your team needs to assess each relationship. Your firm retains compliance responsibility, customer acceptance, required approvals and suspicious activity reporting decisions.
Bring the client types, case count, review scope and target date to a scoping call. Agree responsibilities, record access and data-handling terms before sharing identity documents.