New CCAB AML Guidance

Most of AMLGAS remains the same as in the previous edition – even the paragraph numbers – but there have been some important changes. If you read the AMLGAS cover to cover, all 147 pages, your eyes might glaze over. So I have tried to pick the key changes out for you, but you will need to do some reading!

Key changes

Customer due diligence 

Have a careful look at the new expanded wording of paras 5.1.4 and 5 dealing with the required components of customer due diligence (CDD) (and bear in mind that generally for convenience where AMLGAS says ‘money laundering’ it means ‘money laundering, terrorist financing and proliferation financing’, as explained in para 2.1.4). Comparing this with the previous version suggests a significant firming up of verification requirements.

Para 5.1.4 of the 2023 edition, listing the required components of CDD, referred to identifying the client and beneficial owners and “on a risk-sensitive basis, taking reasonable measures to verify the identity of the beneficial owners”. There was no mention of directors. The 2026 edition, in addition to identifying the full names of the board of directors and the senior persons responsible for operations, also requires performing identity verification on the client, beneficial owners, and directors.

The guidance goes on, at para 5.1.5, to say that when determining the degree of CDD to apply, the firm must adopt a risk-based approach and that most clients of most firms will be ‘normal risk’. (Many of the firms I speak to classify the majority of their clients as ‘low risk’, so the experience of the authors of the guidance differs from mine.)

The appendices, at para B2.8, indicate that for a normal-risk client firms should verify the identity of the director who is the key client contact, and verification of additional directors should be considered for high-risk clients, which is similar to the wording in the 2023 edition – but there is no hint of this in the body of the guidance.

So, to understand what is required, one needs to read the body of the guidance as modified by the interpretation in the appendix. It boils down to – obtain the full names of all directors and verify the identity of at least one of them, but obtain and verify the identity of the client and all beneficial owners.

ID verification

Then turn to 5.5.3 to 5.5.13 on evidence of identity, including copies of documents and electronic ID verification. This guidance is much more detailed and specific than before. It is made clear that, on a risk-based approach, electronic ID verification on its own may be sufficient. There is, however, a requirement that, where electronic ID verification is relied upon, the provider must be on the GOV.UK register of services certified against the UK digital verification services trust framework.

In terms of physical ID documents, there is now a hierarchy of preferred documents at paras B1.8 and 10 – with a valid passport and a valid photo card driving licence being the gold standard (and apparently preferred to electronic verification).

Source of funds checks

In relation to source of funds checks, there are new paras 5.2.9 and 10 which expand on the meaning of ‘where necessary’ in terms of source of funds checks. The essence is that where a transaction appears to be inconsistent with the firm’s knowledge of the client, the client’s business and risk profile, work needs to be done on the client’s source of funds for the transaction (even when the client is not otherwise subject to enhanced due diligence). The guidance gives a non-prescriptive and non-exhaustive list of such transactions.

MLR 2017 and regulations

The new edition is based on the Money Laundering Regulations 2017 (MLR 2017) as at 1 July 2026, and so incorporates the changes which came into effect on 30 June 2026 such as the replacement of the Financial Action Task Force (FATF) grey and black list countries with just the black list (currently Iran, North Korea and Myanmar) – the list of geographical high-risk factors in Appendix D is amended accordingly – and the replacement of amounts in euros with sterling figures.

Appendix D has a new opening paragraph at para 9.5 explaining that the risk factors listed in Regs 33(6), dealing with high risk, and 37(3), dealing with low risk, are neither mandatory nor exhaustive.

The new guidance also takes on board the clarification of unusually complex or unusually large in Reg 33(1)(f).

So what needs to be done?

Your firm’s AML policies, controls and procedures document may need updating for these changes (and the changes made to MLR 2017 from 30 June) – and the idea is that in practice your firm actually does comply with its own policies, controls and procedures document, so some procedures may need revisiting now.

You can combine this with your review of your firm’s compliance and the written report referred to in para 3.4.10 of the guidance.

Are there any problems with this new guidance?

In various places the guidance emphasises that specific paragraphs are neither prescriptive nor exhaustive. The intention is to leave firms some scope to decide where they apply simplified due diligence and enhanced due diligence.

The flip side of this coin is that firms cannot be certain whether these decisions of theirs will be criticised by their supervisory body on inspection. I know some firms would rather the CCAB AMLGAS was more nailed down so that they knew whether they needed to do X, and that if they had done X then they had definitely done what was required.

This inherent flexibility also means that you may be insisting on some procedures which a competitor firm may not.

The new guidance does seem to require a forensic examination of the detail of its wording in order to arrive at an understanding of what exactly is meant. Whether this is the result of a committee trying to arrive at a compromise to which every supervisory body can subscribe, I can only guess.

We do, of course, know that the existing plethora of supervisory bodies will remain in operation for some years to come, pending the Financial Conduct Authority (FCA) takeover, and so there may continue to be different interpretations of the guidance, or emphases on different paragraphs, by different supervisory bodies. When I am approached for help, my first question is always “Who is your supervisory body?” and that won’t change.

But perhaps we should be grateful for the added clarity in some areas, even where that creates more work!