KYC and AML Compliance for UK Private Companies: The Practitioner's Guide

Compliance with Anti-Money Laundering (AML) and Know Your Customer (KYC) protocols is a strict statutory duty for the UK's professional services sector. Under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, 'relevant persons'-including solicitors, accountants, insolvency practitioners, and corporate finance advisers-must execute rigorous checks before establishing a business relationship.

The regulatory burden has intensified with the Economic Crime and Corporate Transparency Act 2023 (ECCTA). This legislation shifts Companies House from a passive repository of corporate information to an active gatekeeper. With mandatory identity verification for directors and People with Significant Control (PSCs) being phased in, professionals relying on unchecked historical data face severe risks. For firms dealing with UK private companies, failing to meet these obligations can result in criminal prosecution, civil penalties from regulatory bodies, and the immediate withdrawal of banking facilities.

The Legal Framework: ECCTA 2023 and the 2017 Regulations

The 2017 Regulations mandate that regulated firms take a risk-based approach to client onboarding. This requires an objective assessment of the client's geographic location, delivery channels, and corporate structure. However, the introduction of ECCTA 2023 alters the practical reality of this assessment.

Historically, professionals could point to a Companies House filing as prima facie evidence of corporate structure. ECCTA 2023 acknowledges that the register has been historically abused by bad actors using fictitious directors or opaque ownership chains. As a result, the standard of proof required by a Money Laundering Reporting Officer (MLRO) has risen. Firms must independently verify the data they extract from public registers, cross-referencing it against secondary documentation and screening tools.

Distinguishing KYC from AML in Corporate Transactions

While frequently conflated, KYC and AML represent distinct, sequential phases of the risk management cycle.

KYC is the initial identification and verification phase. For a UK private limited company, KYC requires gathering documentary evidence that the entity is legally incorporated, that its registered address is genuine, and that the individuals instructing your firm have the legal authority to do so.

AML is the broader, continuous framework of procedures designed to prevent the integration of illicit funds into the legitimate economy. AML involves a deeper assessment of the company's commercial rationale. It asks: do the company's funds derive from legal sources? Is the entity being used to circumvent sanctions, facilitate tax evasion, or obscure the proceeds of crime through complex layering?

The Three Tiers of Customer Due Diligence (CDD)

Standard KYC procedures for corporate entities are categorised into three levels of diligence, dictated by the risk profile of the proposed business relationship.

1. Simplified Due Diligence (SDD)

SDD applies only when the risk of money laundering is exceptionally low. This typically involves public authorities, entities listed on regulated markets, or financial institutions already subject to equivalent AML supervision. For the vast majority of UK private companies, SDD is legally insufficient to meet statutory requirements.

2. Standard Customer Due Diligence (CDD)

This is the baseline requirement for most corporate interactions. It involves identifying the customer and verifying their identity using independent, reliable source data. This process routinely begins with a search of the Companies House register to confirm the company number, registered office address, date of incorporation, and active status. It also requires identifying the natural persons who exercise control over the entity.

3. Enhanced Due Diligence (EDD)

Under Regulation 33 of the 2017 Regulations, EDD is a mandatory legal requirement in high-risk scenarios. Triggers for EDD include transactions involving Politically Exposed Persons (PEPs), entities based in high-risk third countries, or situations where the client is not physically present for identification. If a UK private company possesses a complex, multi-jurisdictional ownership structure involving offshore holding companies or trusts, firms must apply EDD. This requires investigating the source of wealth and the specific source of funds for the transaction.

Identifying Ultimate Beneficial Owners (UBOs) and PSCs

A core component of AML compliance is identifying the natural person who ultimately owns or controls the entity. In the UK, this is managed through the Register of People with Significant Control (PSC).

A PSC is defined under s.790C of the Companies Act 2006 as an individual who meets one or more of the following criteria:

Regulators require firms to look past corporate layers. If Company A is owned by Company B, the investigator must trace the chain until a natural person is identified. A failure to identify a UBO is a critical red flag.

Worked Example: Unpicking a Layered Corporate Structure

Consider a scenario where a UK corporate finance firm is engaged by 'Apex Logistics Ltd', a UK private company, to facilitate a £5m commercial property acquisition.

The firm's MLRO begins standard CDD. The Companies House register shows Apex Logistics Ltd has two UK-resident directors. However, the PSC register indicates that 100% of the shares are held by 'Apex Holdings Ltd', an entity registered in the British Virgin Islands (BVI).

Standard CDD is no longer sufficient; the offshore element triggers Enhanced Due Diligence. The MLRO requests the corporate registry documents for the BVI entity. These documents reveal that Apex Holdings Ltd is owned by a discretionary trust based in Jersey.

The MLRO must now identify the settlor, the trustees, and the beneficiaries of the Jersey trust. The client provides a trust deed showing the settlor is a high-net-worth individual resident in a jurisdiction with weak AML controls, and the individual is a known associate of a Politically Exposed Person (PEP).

At this point, the risk profile of the transaction has escalated from standard commercial property acquisition to high-risk. The firm must now obtain senior management approval to proceed, conduct rigorous source of wealth checks on the settlor, and ensure the £5m is not the proceeds of corruption. If the client refuses to provide the trust deed or obscures the settlor's identity, the firm must decline the instruction and consider submitting a Suspicious Activity Report (SAR) to the National Crime Agency (NCA).

Essential Documentation and Verification Standards

UK private companies should maintain a compliance pack to expedite KYC requests from banks and professional advisers. Firms conducting the diligence must ensure they obtain the correct documentation and apply the appropriate verification standard.

| Document Type | Statutory Purpose | Verification Standard |

| :--- | :--- | :--- |

| Certificate of Incorporation | Confirms legal existence under the Companies Act 2006 | Cross-reference with Companies House extract |

| Articles of Association | Details internal governance and director powers | Review for restrictions on borrowing or asset disposal |

| Proof of Registered Office | Confirms the trading or registered address | Utility bill or bank statement (less than 3 months old) |

| Director Identification | Verifies the identity of the controlling minds | Certified copy of passport and proof of residential address |

| Shareholder Register | Verifies ownership structure and identifies UBOs | Trace all holdings over 25% to a natural person |

Corporate CDD Checklist

Professionals can use the following framework to ensure a defensible approach to corporate client onboarding:

1. Verify Corporate Existence: Obtain the company name, registered number, and registered office address. Confirm active status on Companies House.

2. Identify the Controlling Minds: Obtain the names of all current directors. Verify the identity of at least two directors (or the sole director) using certified photo ID and proof of address.

3. Map the Ownership Structure: Obtain the company's share register. Identify all individuals or corporate entities holding more than 25% of the shares or voting rights.

4. Unwind Corporate Shareholders: If a shareholder is another company, repeat step 3 until a natural person (the UBO) is identified.

5. Screen against Sanctions: Screen the company, all directors, and all UBOs against the UK Office of Financial Sanctions Implementation (OFSI) consolidated list.

6. Assess Commercial Rationale: Document the purpose and intended nature of the business relationship. Does the proposed transaction make commercial sense for this entity?

7. Determine CDD Level: Based on the findings, apply Standard CDD or escalate to Enhanced Due Diligence (EDD) if high-risk factors (offshore entities, PEPs, complex structures) are present.

Financial Health and AML Risk Indicators

AML checks evaluate corporate behaviour as much as identity. Entities with no physical presence, no employees, and generic websites that suddenly move large volumes of capital are frequently flagged as potential shell companies used in the 'layering' phase of money laundering.

Compliance officers must examine a company's debt profile to identify anomalies. This includes conducting a company charge check to review secured loans, mortgages, or debentures registered against the company's assets.

A sudden increase in high-value charges from opaque, non-bank lenders can indicate a 'loan-back' scheme. In this typology, illicit funds are 'loaned' to a clean UK company by an offshore entity controlled by the same criminal network. The loan is secured via a debenture (registered using form MR01). The clean company then repays the loan with interest, providing a legitimate justification for the outward flow of funds. Professionals must regularly review company charges on Companies House to ensure the security interests align with the company's stated business activities and that the lenders are regulated entities.

Furthermore, financial distress can make a company vulnerable to infiltration by organised crime. If a company is facing aggressive creditor action, its directors may be coerced into facilitating illicit transactions. Creditors or compliance teams should routinely perform a winding up petition search to ensure the entity is not on the verge of compulsory liquidation.

Traditional Manual Checks vs Corp Intel

Traditionally, a solicitor or accountant conducting corporate KYC must navigate a fragmented landscape. They pull the incorporation certificate and MR01 charge documents from WebCHeck, cross-reference director names against the OFSI sanctions list in a separate browser tab, manually check the Financial Conduct Authority (FCA) register for regulated status, and search The Gazette for pending insolvency notices. This manual aggregation is slow, prone to human error, and creates a static snapshot that is out of date the moment it is saved to the client file.

Corp Intel replaces this fragmented process. By aggregating Companies House filings, global sanctions lists, PEP databases, and real-time court cause lists into a single platform, professionals can instantly map complex ownership structures and identify UBOs. Instead of spending hours pulling disparate PDFs, compliance teams receive a comprehensive, defensible risk profile that highlights offshore ownership links, anomalous financial charges, and pending winding up petitions in one unified view.

Ongoing Monitoring and the Risk Refresh Cycle

KYC is not a one-off event conducted solely at the point of onboarding. The Insolvency Service and the FCA stress that monitoring must be continuous throughout the lifecycle of the business relationship.

A company with a clean record in January may appoint a newly sanctioned director in April, or face severe financial distress by July. Relying on KYC documentation older than 12 months is considered a significant compliance failure by regulators.

Effective risk management requires a systematic approach to ongoing due diligence. Firms must implement free company monitoring to alert stakeholders to critical filing changes, new fixed or floating charges, or sudden changes in directorships. If a client company appears in The Gazette regarding a winding up petition or administration order, the MLRO must be notified immediately to freeze transactions, adjust risk ratings, and protect the firm from facilitating preferential payments or dissipating assets.

Common Compliance Pitfalls and Enforcement Risks

Failing to adhere to the 2017 Regulations exposes firms to severe regulatory action. Common failures include:

| Compliance Failure | Regulatory Risk | Mitigation Strategy |

| :--- | :--- | :--- |

| Reliance on Self-Certification | Breach of Regulation 28 (Independent Verification) | Never accept a client's word regarding their UBO. Always demand independent registry extracts or trust deeds. |

| Ignoring Dormant Companies | Facilitation of Layering Schemes | Treat dormant companies with equal scrutiny. Dormant status does not exempt an entity from AML checks. |

| Outdated Sanctions Screening | Strict Liability Fines from OFSI | Implement automated daily screening of all active clients against the consolidated sanctions list. |

| Stale KYC Data | Regulatory censure for inadequate ongoing monitoring | Implement automated alerts to monitor a UK company free and trigger a manual review when material changes occur. |

FAQ: Corporate KYC and AML

What is the difference between a PSC and a UBO?

A Person with Significant Control (PSC) is a specific statutory definition under the UK Companies Act 2006, recorded on the public register. An Ultimate Beneficial Owner (UBO) is a broader AML concept referring to the natural person who ultimately profits from or controls the entity. While a PSC is often the UBO, complex offshore structures may obscure the true UBO from the public PSC register.

How long must CDD records be retained under UK law?

Under the 2017 Regulations, firms must retain copies of all Customer Due Diligence documents and records of transactions for a minimum of five years after the business relationship has ended or the occasional transaction is completed.

Does a dormant UK company require AML checks?

Yes. Dormant companies are frequently used as holding vehicles or in the layering phase of money laundering. The lack of trading activity does not remove the statutory obligation to verify the directors, identify the UBOs, and understand the rationale for the company's existence.

What triggers Enhanced Due Diligence (EDD) for a UK entity?

EDD is triggered when the risk of money laundering is high. Common triggers include the involvement of a Politically Exposed Person (PEP), a complex corporate structure with no obvious commercial rationale, ownership linked to high-risk third countries, or if the client has not been physically present for identification purposes.

Can we rely entirely on the Companies House PSC register for KYC?

No. The 2017 Regulations explicitly state that firms cannot rely solely on the central PSC register to fulfil their obligation to identify beneficial owners. Firms must take a risk-based approach and gather additional evidence, especially following the introduction of ECCTA 2023, which highlights historical inaccuracies in the register.

***

Defend your firm against regulatory risk and corporate fraud. Relying on static, manual checks exposes your practice to outdated information and hidden ownership structures. Use Corp Intel to automate your CDD, map complex UBO structures, and receive real-time alerts on client risk profiles. Search the Corp Intel platform today to verify your corporate clients with absolute confidence.