Anti-money laundering guidance for supervised businesses

AMLG11400 - Guidance for all sectors: Identifying and verifying your customers

14. Identifying and verifying your customers

 

14.1 What details must you obtain to identity an individual?

If your customer is an individual, you must identify them as part of your CDD. As a minimum, you should obtain all of the following details for a private individual:

• Full name.
• Date of birth; and,
• Residential address.

You must then verify this information by obtaining ID evidence or using electronic verification (see 14.5 below) .

Important note: If you cannot verify the customer’s identity you must not proceed with the occasional transaction or establish a business relationship with them.

14.2 Verifying an individual’s identity

Unless you are using electronic verification (see 14.5 below), you should verify the customers identify by obtaining ID from your  customer that has been issued by a recognised body e.g. a government department, that has robust identity proofing measures, and includes security features that prevent tampering, counterfeiting and forgery with the customer’s full name and photo, together with their date of birth or residential address such as:   

• A valid passport    
• A valid photo card driving licence (full or provisional)    
• A national identity card
• A firearm certificate
• An identity card issued by the Electoral Office for Northern Ireland

Please note - The customer’s full name, photograph, date of birth and residential address must be verified by ID evidence. This may require you to obtain more than one form of ID evidence. At least one form of ID evidence should include a photograph of the customer.

Where the customers ID cannot be fully verified using one or more of the documents listed above, you should ask for the following:  

• A valid and genuine identity document from an authoritative source (without a photo) which includes the customer’s full name and evidence of the customer’s address, for example an old-style driving licence or recent evidence of entitlement to state or local authority funded benefit such as housing benefit, council tax benefit, pension, tax credit, and;   
• A further document as evidence of the customer’s address, that can be verified as true by an authoritative source, for example a utility bill, bank, building society or credit union statement or a most recent mortgage statement.      

The documents must be from a reliable source not connected to the customer – e.g. a bank, building society, utility company, local authority or credit union.  

You should do more than simply obtain the ID documents. You should ensure that every ID document provided is checked to satisfy yourself of the customer’s identity and that the document is genuine. This may include, but is not limited to checking:  

• Spellings.    
• Validity e.g. checking the expiry date.  
• The photo on the ID is that of the customer.    
• Whether the addresses match on each form of ID.
• Whether the customer’s date of birth as shown on the document is in a range which appears to realistically match the customer.  
• Whether there are anomalies in the documents that suggest they are forgeries or fakes e.g. text out of alignment or unreadable, missing watermarks, pictures that would not meet the criteria for official ID documents.

More information on official documents and how to spot counterfeits and forgeries is published by the Home Office here. The Nominated Officer, or other responsible person, should be aware of the issues within this and cascade relevant parts to staff as part of their training programme.   

If a member of staff has visited an individual at their home address, a record of the visit may corroborate the individual's residential address, although your risk assessment should include an assessment of whether you are satisfied that the property is the individual’s genuine home address.

 

14.3 Customers that do not have standard ID documents

Some persons such as elderly persons or those that cannot manage their own affairs may not be able to produce current standard documents because they have been incapacitated or have not driven or travelled for some time and have allowed licenses and passports to lapse.   Before accepting non-standard documents, you should exhaust the standard documents listed above first and should record the reasons why standard documents cannot be provided.   

The types of documents that you could accept should be from a reliable and independent source that has knowledge of the person, for example documents from:   

• A medical professional. 
• A legal professional.
• The head of a care home with relevant professional qualifications.    
• A pension provider stating that the person is in receipt of a pension.   

If non-standard documentation is used to confirm the client's identity, measures should be taken to establish whether the documentation is genuine - for example, the use of document references or organisation stamps.   

The JMLSG Guidance for the UK financial sector Part I, at the section “Customers who cannot provide the standard evidence” (from 5.3.108) gives more detail on situations where non-standard documents may be acceptable. This can be found here. 

 

14.4 Must ID documents be certified?

Original ID documents should be produced to verify ID wherever possible. If the original ID documents are not produced for verification, or cannot be validated with the issuing source, you can accept documents that have been certified as true copies of the original by a professional person, such as a solicitor, as part of your CDD measures. You must ensure that the person certifying the copy exists and is an appropriate person to certify the document. Guidance on certifying documents and professional persons can be found here. 

To be correctly certified, the person certifying the document must: 

• Write “Certified to be a true copy of the original seen by me” on the document.
• Sign and date the document and print their name.    
• Add their occupation, address and telephone number.   

Certifying a copy of a document does not by itself constitute EDD.   

 

14.5 Electronic Verification

It is possible to verify a customer or beneficial owner’s identity using digital verification services. The UK digital verification services trust framework sets  rules and standards that show what a good digital identity looks like. The trust framework and good practice guide produced by HM Treasury can be found here: UK digital verification services trust framework - GOV.UK.

Digital identity services which are certified against the trust framework and on the DVS register are a reliable and independent source of information, with an appropriate level of anti-impersonation assurance, and can be used to verify a customer or beneficial owner by  as part of their customer due diligence processes.

Any digital verification service provider which is not on the DVS register cannot reliably be deemed suitable for identity verification in compliance with the Regulations.

 

14.6 Verifying the identity of individuals not resident in the UK

You should obtain the same types of identity documents for non-UK residents as for UK residents.  If you have any concerns that an identity document might not be genuine, contact the relevant embassy or consulate or use the link to the Public Register of Authentic travel and identity Documents Online (PRADO) here. 

• If documents are in a foreign language, appropriate steps must be taken to be satisfied that the documents in fact verify the customer’s identity. HMRC expects that if you, or your relevant employees do not understand the language the document is in, a certified translation should be obtained. HMRC can require, under regulation 66 of the Regulations, certified translations when inspecting your CDD records.  
•  It may be difficult to verify legitimacy of non-UK identity documents and supporting evidence depending on the country in question. You should use all available resources to verify non-UK resident’s supporting documents. You may be able to use publicly accessible registers or open-source data to verify non-UK supporting documentsbut there will be times you may not be able to. 

• You must record and document each step you take to verify identity and supporting documents for a non-UK resident.
• For a non-UK based company, you must obtain an excerpt of the register kept under the law to which that business is subject as proof of the customers registration. This requirement only relates to business relationships.

 

14.7 Identifying a customer who is not an individual

If your customer is not an individual (for example, they are a company, partnership, trust or other legal arrangement), you must obtain and verify identity information that is relevant to that entity.

All non-individual customers

For all customers that are not individuals, you must:

• Identify the customer and verify their identity so you are satisfied that you know who the customer is (for example, company, trust, partnership);
• Take reasonable measures to understand the ownership and control structure of the customer, where relevant;
• Identify the beneficial owner of the customer where the customer is beneficially owned by another person and;
• Take reasonable measures to verify the identity of the beneficial owner/s so that you are satisfied that you know who the beneficial owner is.

Beneficial owners are generally individuals who ultimately own or control the entity or on whose behalf a transaction is being conducted, but one entity can also be beneficially owned by another.

The following are examples of legal entities that will have one or more beneficial owner:

• Limited companies.
• Limited liability partnerships.
• Public companies listed on the stock exchange that aren’t listed on the EEA regulated market.
• Trusts.
• Industrial & provident societies.
• Certain charities and foundations.

For a detailed definition of a beneficial owner in relation to each of the above entities please see the Glossary section of this guidance.

 

Important notes: An example of a beneficial owner may include a person that is using another person to shield them from meeting you. The beneficial owner of a corporate structure may be different from the legal owner – for example, where the registered shareholder is holding the shares on trust or as a nominee for the ultimate beneficial owner.

Body corporates (e.g. a limited company, limited liability partnership or subsidiary of a body corporate)

Identifying beneficial owners - If your customer is a body corporate you must identify the beneficial owner/s of the body corporate. The ways in which you can do this include the following:   

• Requesting the information from the company.   
• Searching for Persons of Significant Control (PSC) at the Companies House register. 
• Company website searches.
• Public records in the UK and overseas.   

Where a customer is a corporate body, and you have exhausted all possible ways of identifying the beneficial owner, you may, in exceptional circumstances, treat the senior person responsible for the operations of the body corporate as the beneficial owner. This applies where either:

• You have been unsuccessful in identifying the beneficial owner, or
• You are not satisfied that the individual identified is in fact the beneficial owner.

You must keep written records that clearly show all the steps you have taken to identify the beneficial owners, the progress made and why they have been unsuccessful. You should consider whether they should be treated as a higher risk or even suspicious due to the number of entity layers.   

In such cases, you must:

• Keep written records of all actions taken to identify the beneficial owner. This should include the reasons why you have been unsuccessful, and
• Take reasonable measures to verify the identity of the senior person you are treating as the beneficial owner, and keep written records of:
  • all actions taken in doing so, and
  • any difficulties encountered.

Verifying the identity of beneficial owners - You must take reasonable measures to verify the identity of beneficial owners through reliable, independent sources that are relevant to that type of entity. For example:    

• Searching a relevant company registry.   
• Checking the customer is registered to make/receive relevant cash payments.   
• Obtaining a copy of the company's register of members.   

Important note:  You do not satisfy your obligation to take reasonable steps to verify the identity of beneficial owners by relying only on information contained in a PSC register.

Please note – See 14.8 below if you find any discrepancy between information given by the customer and any official register.

If your customer is a body corporate, you must also obtain and verify:

• the full name of the body corporate;
• the company or registration number;
• the registered office address;
• the principal place of business (if different).

You must also take reasonable measures to:

• determine and verify the law to which the body corporate is subject, and its constitution (whether set out in its articles of association or other governing documents);
• determine and verify the full names of the board of directors (or if there is no board, the members of the equivalent management body) and the senior persons responsible for the operations of the body corporate.

(unless the company is listed on a regulated market — see below)

Exemption for Companies listed on a regulated market

If the customer is a company listed on a regulated market:

• You must still identify and verify the company itself;

but you do not need to:

• Verify the ownership and control structure;
• Identify or verify beneficial owners;
• Verify directors or senior management.

This reflects the higher level of transparency and disclosure requirements for listed companies.

Persons purporting to act on behalf of the customer

Where a person purports to act on behalf of the customer you must:

• Identify and verify the individual’s identity;
• Obtain evidence that they have authority to act.

Evidence of authority may include:

• Direct confirmation from the customer e.g. through a call to the customer with a confirmation email by return.
• Company records showing a connection (for example, directors listed at Companies House).
• Legal or contractual documentation.

 

14.8 Identifying a business in a business relationship

If the customer is a business, you must obtain documents that prove the business’s registration or an excerpt of the register on which the business is included before a business relationship is established. For UK businesses this should show the business:  

• Is a company subject to the requirements of Companies Act 2006, Part 21A, or
• Is subject to the requirements of Limited Liability Partnerships, or (Register of People with Significant Control) Regulations 2016, or  
• Is subject to the requirements of the Scottish Partnerships (Register of People with Significant Control) Regulations 2017, or
• On or after 10 March 2020, is a UK corporate body or trust subject to registration under Part 5 of the Regulations, or
• An overseas entity which is subject to registration under Part 1 of the Economic Crime (Transparency and Enforcement) Act 2022.

Please note - If you find any discrepancy between information given by the customer relating to the beneficial ownership of the business customer and that held by any official register you must report this to Companies House and HMRC. 

 

14.9 Obligation of customers to provide information

Corporate bodies in the UK, who are not listed on a regulated market, have obligations to keep a register of people with significant control (a PSC register) and must provide this information when requested.  

Guidance on the requirements to maintain PSC registers is available here. 

This information will assist in identifying beneficial owners, but it will not provide you with all the information you need to verify their identity, for example, the address or date of birth of the individual.  

Trustees have similar obligations to tell you that they are acting as a trustee, to identify all the beneficial owners of the trust and any other person that may benefit.  

The customer must notify you of any changes to the information supplied within 14 days of the change.