Money Laundering Regulations
Criminals may try to use financial services to hide or move illegal money.
Therefore, the UK has rules designed to reduce this risk.
One of the main sets of rules is the:
Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017
These are usually called the:
Money Laundering Regulations
or:
MLRs
The Regulations set important requirements for businesses within the regulated sector. (Legislation.gov.uk)
In simple terms:
The Money Laundering Regulations require relevant businesses to understand financial-crime risks, check customers and take suitable steps to reduce those risks.
Why Do We Need the Money Laundering Regulations?
Financial services can move large amounts of money very quickly.
Therefore, criminals may try to use:
- banks
- financial firms
- property transactions
- businesses
- professional services
to move or hide criminal funds.
As a result, relevant businesses need systems that make financial crime harder.
The Regulations help create those systems.
What Is Money Laundering?
Money laundering involves dealing with money or other property linked to crime so that its criminal origin is hidden or disguised.
For example, criminals may try to make illegal money appear to come from a normal source.
Therefore:
Crime creates proceeds
↓
Money is moved or disguised
↓
Its origin becomes harder to see
↓
Funds appear more legitimate
We will look at money laundering itself in more detail on Page 28.
For now, the important point is that the MLRs are designed to help prevent and detect this type of activity. (FCA Handbook)
The Money Laundering Regulations 2017
The current framework is mainly based on the:
Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
However, the Regulations have been changed several times since 2017.
Therefore, firms should always work from the current rules rather than relying on an old textbook or website. (Legislation.gov.uk)
Who Must Follow the Regulations?
The Money Laundering Regulations apply to defined types of relevant person and business.
These include parts of sectors such as:
- banking
- financial services
- accountancy
- legal services
- estate agency
- trust and company services
- certain other regulated businesses
However, not every financial firm has exactly the same duties.
Therefore, the firm’s activities matter.
Mortgage Brokers Have a Particular Position
This point is especially important for CeMAP.
Ordinary mortgage brokers generally have more limited direct AML responsibilities than firms such as banks that are fully within the Money Laundering Regulations regime.
However, this does not mean mortgage brokers can ignore money laundering.
They still need suitable systems and controls to reduce the risk of being used to handle criminal proceeds.
In addition, they remain subject to wider criminal law, including the Proceeds of Crime Act 2002. (FCA)
Therefore:
Limited MLR duties do not mean no financial-crime duties.
Why Does This Matter to Mortgage Advisers?
Mortgage advisers often receive detailed information about:
- income
- savings
- deposits
- bank accounts
- property
- employment
- identity
Therefore, they may notice information that does not make sense.
For example:
Customer says deposit came from savings
However:
Bank statement shows a large unexplained payment from an unknown third party
This does not prove a crime.
Nevertheless, it may need further consideration.
Therefore, advisers should follow their firm’s procedures.
The Risk-Based Approach
A key idea within anti-money-laundering controls is the risk-based approach.
This means businesses should consider the level of financial-crime risk rather than treating every situation as identical.
For example, risk may be affected by:
- the customer
- the transaction
- the country involved
- the source of funds
- the ownership structure
- the type of business
Therefore:
Lower risk
may require normal checks.
Meanwhile:
Higher risk
may require more detailed checks.
The Regulations require relevant firms to take risk into account when applying due-diligence measures. (Legislation.gov.uk)
Business Risk Assessments
Relevant businesses need to understand the money-laundering and terrorist-financing risks they face.
Therefore, they may need a business-wide risk assessment.
This looks at risks across the organisation.
For example:
- what customers does the firm deal with?
- what services does it offer?
- where are customers located?
- how are transactions carried out?
- which areas create greater risk?
As a result, the firm can design controls that match its actual risks.
Customer Due Diligence
One of the most important MLR concepts is:
Customer Due Diligence
usually shortened to:
CDD
In simple terms, CDD means checking and understanding the customer.
For relevant businesses, this can include:
- identifying the customer
- verifying their identity
- understanding certain ownership arrangements
- understanding the purpose of the relationship
- applying ongoing monitoring where required
The detailed CDD duties are set out in Regulation 28 of the MLRs. (Legislation.gov.uk)
A Simple CDD Example
Imagine a customer wants to use a financial service.
The firm may need to establish:
Who are you?
↓
Can we verify that identity?
↓
Why are you using this service?
↓
Does the activity make sense for what we know about you?
Therefore, CDD is about more than seeing a passport.
It also involves understanding the relationship.
Identity and Verification
Two words are important:
Identify
Find out who the customer says they are.
Meanwhile:
Verify
Check that information using suitable evidence.
Therefore:
Identify → Who are you?
Verify → Can we confirm it?
This difference is important.
We will look at KYC and identity checks more closely on Page 27.
When Is CDD Required?
For businesses covered by the Regulations, CDD may be required when:
- starting certain business relationships
- carrying out certain transactions
- money-laundering or terrorist-financing suspicion arises
- there are doubts about earlier customer information
The exact rules depend on the circumstances. (Legislation.gov.uk)
Therefore, due diligence is not simply a one-off box ticked at the beginning.
Ongoing Monitoring
Customer checks may continue after the relationship begins.
This is known as ongoing monitoring.
For example, a relevant firm may need to consider whether transactions remain consistent with what it knows about:
- the customer
- their business
- their risk profile
- where necessary, the source of funds
In addition, customer information may need to be kept up to date. (GOV.UK)
Therefore:
Know the customer at the start and remain alert during the relationship.
A Simple Monitoring Example
Imagine a customer normally makes small, routine transactions.
Suddenly, very large international payments begin passing through the account.
That change does not automatically mean criminal activity.
However, it may not fit the expected pattern.
Therefore, the firm may need to understand what has changed.
Enhanced Due Diligence
Sometimes normal CDD is not enough.
Where there is a higher risk of money laundering or terrorist financing, relevant businesses may need to apply:
Enhanced Due Diligence
or:
EDD
In simple terms:
Higher risk → More detailed checks
EDD sits on top of normal customer due diligence. (Legislation.gov.uk)
What Might Enhanced Due Diligence Involve?
Depending on the risk, EDD can involve additional steps.
For example:
- more information about the customer
- stronger identity checks
- more information about source of funds
- closer monitoring
- additional management approval
Therefore, EDD is not one fixed checklist.
Instead, the level of additional work should respond to the risk. (GOV.UK)
A Higher-Risk Example
Imagine a transaction involves:
- a complex company structure
- money coming from several countries
- an unclear source of funds
Each point may create questions.
Together, they could create a higher-risk situation.
Therefore, a relevant firm may need to carry out more detailed checks before continuing.
High-Risk Third Countries
Some countries may be identified as presenting a higher money-laundering or terrorist-financing risk.
Where the relevant MLR conditions apply, enhanced due diligence is required for relationships or transactions involving high-risk third countries. (GOV.UK)
However, country lists can change.
Therefore:
Always check the current position rather than memorising an old list.
Politically Exposed Persons
The Regulations also contain enhanced due-diligence requirements relating to Politically Exposed Persons, or PEPs.
Broadly, a PEP is someone entrusted with a prominent public function.
Certain family members and close associates can also fall within the relevant framework. (Legislation.gov.uk)
However:
Being a PEP does not mean someone is dishonest.
Instead, the position can create a higher risk of bribery or corruption.
Therefore, additional measures may be needed.
A Simple PEP Example
Imagine a customer is a senior government minister.
That does not mean the customer is involved in crime.
However, their position may create greater exposure to:
- bribery
- corruption
- misuse of public money
Therefore, relevant firms may need additional checks.
The approach should remain risk-based and fair.
Source of Funds
A firm may need to understand the source of funds.
This means:
Where did this particular money come from?
For example, a house deposit could come from:
- savings
- inheritance
- sale of another property
- family gift
- sale of investments
Therefore, source of funds focuses on the money being used in the transaction.
A Deposit Example
Imagine a customer has a:
£60,000 deposit
The adviser asks where it came from.
The customer explains:
£40,000 savings
£20,000 gift from parents
That gives a basic explanation.
However, the lender or another relevant firm may need evidence depending on its rules and financial-crime requirements.
Source of Wealth
Source of wealth is different.
It asks:
How did the customer build their wider wealth?
For example:
Source of funds
£100,000 from sale of investments.
Meanwhile:
Source of wealth
Twenty years of owning and running a successful business.
Therefore:
Source of funds → This money
Source of wealth → Overall wealth
This distinction is useful.
Record Keeping
Relevant firms must keep certain records relating to their anti-money-laundering work.
For example, this can include records connected with:
- customer due diligence
- transactions
- supporting evidence
The Regulations set retention requirements for relevant records. (Legislation.gov.uk)
Therefore, good record keeping is an important part of AML compliance.
Why Do Records Matter?
Imagine a regulator asks:
Why did you accept this customer’s source of funds?
The firm should be able to show what information it considered.
Therefore, records can help explain:
What was checked
↓
What was found
↓
How risk was assessed
↓
What action was taken
As a result:
Good AML decisions need a clear record.
Policies and Controls
Relevant firms need suitable policies, controls and procedures to manage money-laundering and terrorist-financing risk.
Depending on the business, these can cover areas such as:
- risk assessment
- customer checks
- ongoing monitoring
- internal reporting
- record keeping
- staff training
Therefore, AML compliance needs to be built into the business.
It should not depend only on one alert employee.
Staff Training
Employees need enough training to understand the financial-crime risks connected with their role.
For example, they may need to know:
- what warning signs look like
- what the firm’s procedures are
- when to raise a concern
- what information should be recorded
Therefore:
Staff do not need to investigate crime themselves, but they do need to know what to do when something looks wrong.
Suspicion
A firm may discover information that creates a suspicion of money laundering.
For example:
Customer explanation changes repeatedly
Documents do not match
Source of money remains unclear
This still does not prove a crime.
However, it may create a concern that needs to be handled under the firm’s procedures.
Therefore:
Suspicion should be escalated, not ignored.
Suspicious Activity Reports
Where the legal reporting requirements apply, knowledge or suspicion of money laundering may lead to a:
Suspicious Activity Report
or:
SAR
SARs are received by the UK Financial Intelligence Unit within the National Crime Agency. (FCA)
However, employees should follow their firm’s reporting procedure.
They should not simply decide on their own how to handle a serious suspicion.
Do Not Tip Off the Customer
Once a money-laundering concern exists, staff also need to be careful about what they tell the customer.
In certain circumstances, telling someone about a report or investigation could itself cause legal problems.
This is commonly described as tipping off.
Therefore, an adviser should not simply say:
We have reported you for money laundering.
Instead, follow the firm’s procedure.
Advisers Should Not Investigate Crime
Mortgage advisers are not police officers.
Therefore, they should not attempt to carry out their own criminal investigation.
A safer approach is:
Notice concern
↓
Follow firm procedure
↓
Escalate appropriately
↓
Allow trained staff or authorities to decide what happens next
This helps protect both the adviser and the wider process.
Mortgage Adviser Versus Mortgage Lender
The regulatory responsibilities of an adviser and lender may be different.
For example, a bank providing the mortgage may be fully subject to the MLR customer-due-diligence requirements.
Meanwhile, an ordinary mortgage broker may have more limited direct MLR obligations. (FCA)
Therefore, advisers should not assume:
If the lender checks it, I have no responsibilities.
Likewise, they should not assume:
I personally have exactly the same AML duties as the bank.
Instead, they should understand and follow their firm’s own regulatory position and procedures.
A Practical Mortgage Example
Imagine Priya wants to buy a home.
Her deposit is:
£80,000
Initially, she says:
I saved it from my salary.
However, the documents show that £70,000 arrived from an overseas company two days ago.
Priya then gives several different explanations.
This does not automatically prove money laundering.
Nevertheless, there is a clear mismatch.
Therefore, the adviser should not simply ignore it to keep the mortgage application moving.
Instead:
Notice inconsistency
↓
Follow firm procedure
↓
Escalate if required
This is the correct professional approach.
The Regulations Do Not Mean Every Customer Is Suspicious
AML rules are designed to manage risk.
They are not designed to treat every customer like a criminal.
Therefore, firms should use a fair and risk-based approach.
For example, a large deposit may have a completely normal explanation.
It could come from:
- property sale
- inheritance
- long-term savings
- family gift
Therefore:
Ask sensible questions without making unfair assumptions.
Do Not Ignore Risk Either
On the other hand, firms should not ignore obvious warning signs.
For example:
Fake documents
Changing explanations
Unexplained funds
may require action.
Therefore, a useful principle is:
Be fair, but stay alert.
MLRs and KYC
The Money Laundering Regulations are closely linked with:
Know Your Customer
or:
KYC
In simple terms, KYC is about understanding who the customer is.
However, KYC deserves its own page.
Therefore, we will explore:
- identity
- verification
- beneficial ownership
- customer information
- practical checks
on Page 27.
MLRs and Financial Crime
Likewise, the Regulations sit within a much wider financial-crime framework.
Other laws can also apply.
For example, mortgage brokers remain subject to the Proceeds of Crime Act 2002, even where they have more limited direct duties under the MLRs. (FCA)
Therefore:
The Money Laundering Regulations are important, but they are not the whole financial-crime system.
We will explore that wider picture on Page 28.
What Should a Mortgage Adviser Remember?
A useful working approach is:
Know Your Firm’s Duties
Understand the regulatory framework that applies.
↓
Know the Customer
Gather appropriate information.
↓
Notice Inconsistencies
Do not ignore information that does not make sense.
↓
Follow Procedure
Use the firm’s financial-crime process.
↓
Escalate Concerns
Raise suspicious activity where required.
↓
Keep Records
Make sure important decisions can be understood later.
This keeps the process simple.
What Should an Adviser Avoid?
Avoid:
- knowingly using false information
- ignoring unusual activity
- making assumptions about customers
- trying to investigate crime personally
- telling customers about confidential reports
- working outside firm procedures
Therefore:
Stay alert without becoming an investigator.
A Simple Memory Aid
Remember:
Risk
↓
Check
↓
Understand
↓
Monitor
↓
Escalate
↓
Record
This captures the main AML approach.
Key Terms to Remember
MLRs
Money Laundering Regulations.
AML
Anti-Money Laundering.
CDD
Customer Due Diligence.
EDD
Enhanced Due Diligence.
Risk-Based Approach
Applying controls according to the level of financial-crime risk.
Ongoing Monitoring
Continuing to review relevant customer activity and information.
Source of Funds
Where the money being used in a transaction came from.
Source of Wealth
How a person’s wider wealth was built.
PEP
Politically Exposed Person.
SAR
Suspicious Activity Report.
Tipping Off
Improperly revealing information about certain money-laundering reports or investigations.
Quick Knowledge Check
1. What does MLR stand for?
Money Laundering Regulations.
2. What is the main purpose of the Regulations?
To help relevant businesses prevent and detect money laundering and terrorist financing.
3. What does CDD stand for?
Customer Due Diligence.
4. What is the difference between identifying and verifying a customer?
Identifying means finding out who they say they are. Verifying means checking that identity using suitable evidence.
5. What does EDD stand for?
Enhanced Due Diligence.
6. When is EDD particularly relevant?
Where a higher risk of money laundering or terrorist financing is present.
7. What is the difference between source of funds and source of wealth?
Source of funds explains where particular money came from. Source of wealth explains how the person’s wider wealth was built.
8. Does being a PEP automatically mean a person is involved in crime?
No. PEP status reflects a higher potential risk and can require additional checks.
9. Should mortgage advisers investigate suspected crime themselves?
No. They should follow firm procedures and escalate concerns appropriately.
10. Are ordinary mortgage brokers always subject to exactly the same MLR duties as banks?
No. Their direct AML responsibilities can be more limited, although they still need appropriate financial-crime controls and remain subject to wider criminal law.
Quick Summary
The Money Laundering Regulations help protect the financial system from criminal use.
For businesses covered by the Regulations, important areas include:
Risk assessment
↓
Customer Due Diligence
↓
Enhanced Due Diligence where required
↓
Ongoing monitoring
↓
Record keeping
↓
Reporting and controls
However, firms do not all have exactly the same AML responsibilities.
In particular, ordinary mortgage brokers generally have more limited direct duties under the MLR framework than banks and other fully supervised firms. (FCA)
Nevertheless, mortgage advisers should still remain alert.
Therefore:
Do not ignore information that does not make sense.
Instead:
Notice → Follow procedure → Escalate → Record
Most importantly, AML controls should remain fair and risk-based.
The aim is not to treat every customer as suspicious.
Instead, it is to make it harder for criminals to misuse the financial system.
Next Page
Know Your Customer (KYC)