Enhanced due diligence (EDD) checklist for UK firms: when it applies and what to collect

When EDD is mandatory: the reg 33(1) triggers

EDD and enhanced ongoing monitoring are mandatory in seven cases listed in reg 33(1). Your client risk assessment should screen every new client against each of them and record the answer. If none applies, your own risk assessment can still lead you to EDD.

“Established in” a country means, for an individual, being resident there, “but not merely having been born in that country”. For a company, it means incorporated there or having its principal place of business there (reg 33(3)(c)).

What changed on 30 June 2026, and what happened to Schedule 3ZA

SI 2026/621 reg 19 made two changes to reg 33(1) from 30 June 2026. The country trigger now applies only to FATF call for action countries. The transaction trigger now reads “unusually complex or unusually large in each case given the nature of the transaction”. The PEP and other triggers did not change.

How the country trigger has moved:

On the FATF list published on 19 June 2026, as reproduced by HM Treasury on 22 June 2026, the call for action countries are North Korea, Iran and Myanmar. The grey list has 22 jurisdictions, including the British Virgin Islands and Monaco. FATF updates both lists after each plenary in February, June and October. As at 24 October 2026, the October 2026 update had not been published, so check the HM Treasury advisory notice again after it.

Grey-list links still matter. HM Treasury says firms must take FATF evaluations into account as a geographical risk factor under reg 33(6)(c) and apply EDD where they identify a high risk. Two warnings: the opening section of HM Treasury’s notice still uses the pre-2026 definition, and LSAG 2025 §6.19.1 predates the change. The law as amended is what counts. Our MLR 2026 changes guide covers the wider amendments.

What to collect for each trigger

The law sets the minimum measures; guidance suggests the evidence. Choose the evidence in proportion to the risk, and record why it satisfied you. “It is not enough to know the money came from a UK bank account,” as HMRC puts it in AMLG11630. Reg 33(5) lists optional measures you can add in any case.

HMRC’s AMLG11600 adds practical measures: certified copies, validating documents against an authoritative source, checking for known fraud and requiring payment from an account in the client’s name. Our guide to source of funds vs source of wealth lists acceptable documents.

FATF call for action countries: the reg 33(3A) measures

Where a client or a party to a relevant transaction is established in a call for action country, reg 33(3A) is not optional. You must apply all six measures, including source of funds and source of wealth for both the client and the beneficial owner. A branch or majority-owned subsidiary of a group under equivalent supervision may be exempt (reg 33(2)).

1. Additional information on the client and the beneficial owner.
2. Additional information on the intended nature of the business relationship.
3. Information on the source of funds and source of wealth of the client and the beneficial owner.
4. The reasons for the transactions.
5. Senior management approval to establish or continue the relationship.
6. Enhanced monitoring: more controls, applied more often, with selected transaction patterns examined.

HMRC’s AMLG11640 expects source of funds to be “supported by evidence”. Its bullet on source of funds does not mention source of wealth, but the regulation requires both, so collect both. All three countries on the June 2026 list are also under UK financial sanctions, according to HM Treasury, so check the UK Sanctions List as well.

PEPs: EDD in proportion (FCA FG25/3)

Every PEP, family member and known close associate needs EDD, but not the same EDD. Reg 35(3A) says a domestic PEP starts as lower risk than a non-domestic PEP. FCA guidance FG25/3 (July 2025, replacing FG17/6) says domestic PEPs should be treated as lower risk unless other factors point higher.

• Identify PEPs among clients and beneficial owners. Reg 35(1) requires systems for both. HMRC suggests asking the client, public sources or a commercial provider, and understanding how that provider’s database is populated.
• Know who is not a PEP. HMRC says UK local councillors are not PEPs, and UK civil servants below Permanent or Deputy Permanent Secretary are not normally PEPs. FG25/3 adds non-executive board members of UK civil service departments.
• Scale the sign-off. FG25/3 says senior management approval for a lower-risk PEP may come from a lower level of seniority.
• Former PEPs stay in scope for at least 12 months after leaving office (reg 35(9)).
• Do not refuse a client just for being a PEP. CCAB guidance discourages it.

Late identification is costly: the SRA’s 2025-26 report describes a former licensed body fined £172,934 after it identified the beneficial owner of a client company as a non-domestic PEP only two months after the purchase completed. More in our guide to PEPs, sanctions and adverse media.

Complex or unusual transactions

Since 30 June 2026 the test is whether a transaction is “unusually complex or unusually large in each case given the nature of the transaction”. A large house purchase is not unusual for an estate agent; a large cash deposit with no clear source may be. Measure against what is normal for that kind of work and that client.

Reg 33(4) then requires you to examine the background and purpose as far as reasonably possible and to increase monitoring to see whether the transaction appears suspicious. Ask the client, corroborate the answer and write a file note. If something still does not add up, pass it to your nominated officer to decide on a SAR.

Sector notes

The triggers are the same for every regulated firm, but each sector’s guidance highlights different cases. These points from HMRC, LSAG and CCAB guidance are the ones most likely to lead a small firm to EDD.

• Estate agents. HMRC says both buyer and seller are customers and that for a PEP or call for action customer you must verify source of wealth and source of funds. Treat super-prime transactions as high risk (£5m or more in London and the South East, £1m or more elsewhere) and take extra care with cash buyers. See the estate agents hub.
• Letting agents. In scope at £10,000 a month or more. HMRC flags high-net-worth clients, PEPs, complex structures and rent paid to offshore accounts without knowing the beneficial owner. See the letting agents hub.
• Accountants. CCAB guidance says firms must refer to the call for action list for mandatory EDD and should also use the grey list, Transparency International and FATF evaluations. See the accountants hub.
• Solicitors. LSAG says you need not account for every asset when establishing source of wealth, but you should build a rationale; if you cannot establish it in a higher-risk case, consider ceasing to act and reporting. Remember that LSAG’s country section predates 30 June 2026. See the solicitors hub.
• Financial advisers. Use FCA FG25/3 for PEPs. See the financial advisers hub.

Not sure who supervises you? Use our AML supervisor finder.

When you cannot complete EDD

If you cannot complete the due diligence you need, reg 31 says you must not carry out the transaction or start the relationship, must end an existing one and must consider making a SAR. If you decide not to report, HMRC expects you to record why.

EDD checklist

1. Screen the client, beneficial owners and other parties against each reg 33(1) trigger and record yes or no.
2. Check the FATF call for action list currently in force, and record the date of the version you used.
3. Run PEP, sanctions and adverse media screening, and keep the results.
4. For a PEP, record the type (domestic or non-domestic, family, close associate) and your risk view under reg 35(3A).
5. Collect source of funds evidence, and source of wealth evidence where required (PEPs, call for action cases) or where the risk calls for it.
6. For unusual transactions, get the client’s explanation, corroborate it and write a file note.
7. Get senior management approval where reg 33(3A) or reg 35(5) requires it, and record who approved and when.
8. Set enhanced ongoing monitoring: what you will check, how often and who is responsible.
9. If you cannot complete EDD, stop, and refer the case to your nominated officer.
10. Keep everything for 5 years from the end of the relationship (reg 40).

AML Buddy can help with step 3: your client verifies their identity through one secure link, and you get sanctions, PEP and adverse media screening in a timestamped report for the file, at £5.40 a check inc. VAT. The EDD decisions and evidence beyond that stay with your firm.

Download our free CDD checklist and client risk assessment form, and take the 2-minute AML health check to see where your firm stands. For the standard checks that come first, read our guide to customer due diligence.

This guide is general information, not legal advice. Your supervisor’s guidance and your own risk assessment decide what is right for your firm.