Checks for regulatedfinancial firms.
Check each client before you take them on, watch them every morning after, and keep the record the FCA asks to see.
- High
- Risk for payment and e-money firms, up from medium (NRA 2025)
- FCA
- Your money laundering supervisor if you are authorised
- 30 Nov
- Yearly deadline to report frozen assets to OFSI
What the rules ask, and what we do.
From the Money Laundering Regulations 2017 and the JMLSG guidance for the financial sector.
- 01Regs 27, 28, 30
Check each client first
Identify and verify your customer before the business relationship starts, and understand its purpose and intended nature.
People checked against the sanctions and PEP lists; companies filled in from Companies House and checked with their owners and directors. Their ID with a live selfie, by link, through Vouchsafe (on the GOV.UK register of certified services). Soon Proof of address on their phone.
- 02Regs 28(4), 30A
Find the beneficial owners
Identify who owns or controls a company client, and report a material discrepancy with the Companies House register.
Owners traced to people from Companies House. A difference your client tells you about comes with how to report it.
- 03Regs 33, 35 · sanctions rules
Screen for sanctions and PEPs
Enhanced checks for politically exposed persons. Tell OFSI as soon as practicable about a designated person or a breach, and report frozen assets each year.
UK, UN, EU and US lists and PEPs for each client and the people behind it. A company is also checked on the FCA register and its Warning List.
- 04Reg 33
Enhanced checks where the risk is high
More checks for any higher-risk situation, a politically exposed person, or someone established in a FATF “call for action” country.
Each client’s risk set by your firm with its reasons, and every finding decided and recorded.
- 05Reg 28(11)
Keep watching
Monitor every business relationship as it goes on, and keep due diligence up to date.
Each checked client re-screened every morning, company changes picked up from Companies House, and a yearly re-check reminder.
- 06Regs 18, 19, 40
Your risk assessment and records
A written firm-wide risk assessment with policies that follow from it, and due diligence records kept for five years.
Every check, decision and document kept, with an audit trail and an inspection bundle. Soon A risk assessment and policies written for financial firms.
What we check for financial services.
Every check in every plan. Yours are lit; pick another industry to compare.
Where the risk is.
The 2025 National Risk Assessment rates money laundering risk as high for wealth management and, up from medium, for payment and e-money firms. It names these weak points.
- Onboarding with no physical presence
- Agents who do the checks for you
- Outsourced checks you stay responsible for
- Fast growth and cross-border flows
- High net worth clients with complex structures
- PEPs and a global client base
- Execution-only trading at volume
- Firms owned or controlled by criminals
Source: HM Treasury, National Risk Assessment 2025, paragraphs 5.50 to 5.70
Asked by financial firms.
Are we in scope of the Money Laundering Regulations?
Banks and lenders, payment and e-money firms, investment and wealth managers, and life insurers and their intermediaries are credit or financial institutions (regulation 10 and Schedule 2). Arranging mortgages or general insurance alone is not on that list.
Who supervises us?
The FCA, if you are authorised (regulation 7). HMRC supervises money service businesses and some payment firms the FCA does not. The JMLSG guidance, approved by ministers, sets out how to meet the rules.
We use an outside provider for checks. Who is responsible?
You are. The 2025 National Risk Assessment repeats that a firm stays responsible for its controls when it outsources them (paragraph 5.68). Stratum runs the checks and keeps the record; your firm decides each finding and each client’s risk.
When do we need enhanced due diligence?
In any higher-risk situation, for a politically exposed person, and for someone established in a country on FATF’s “call for action” list (regulation 33, as amended on 30 June 2026). FATF’s increased-monitoring list is now a risk factor to weigh, not an automatic trigger.
What do we report to OFSI?
As soon as practicable, anyone you know or suspect is designated, or a breach, with what you hold for them. And each year, any frozen funds or assets you hold on 30 September, by 30 November.
Can we rely on another firm’s checks?
On certain regulated firms’ due diligence, yes (regulation 39), but you stay liable for it and must be able to get copies of their identity documents immediately when asked.
Does Stratum check firms on the FCA register?
Yes. A company client is checked on the FCA register under its name, with any FCA Warning List entry, as part of its company check.
Start with your client book.
Import your clients and run their checks: each is then watched every morning, with a reminder to check them again each year.