Last reviewed: 27 October 2026. An AML check is the identity and risk check a regulated UK firm must carry out before it acts for you. The firm confirms who you are, screens you against sanctions and politically exposed person (PEP) lists and, where the risk calls for it, asks where your money comes from. The Money Laundering Regulations 2017 require it.
This guide is for people being checked, such as home buyers and sellers or clients of an accountant or solicitor, and for small firms that need to explain the check to their clients.
AML checks in five points
- It is a legal duty on the firm. Estate agents, accountants, bookkeepers, solicitors, financial advisers, letting agents on high-rent lets and other firms covered by the Money Laundering Regulations 2017 (MLRs) must check their clients before acting.
- It covers identity and risk. Expect an ID document, a selfie or other proof that the ID is yours, an address check and screening against sanctions, PEP and adverse media sources.
- Some checks go further. If the risk is higher, for example a large purchase or a PEP match, the firm may ask about your source of funds.
- It is not a credit check. The firm is not deciding whether you can borrow money.
- You cannot opt out. If the check cannot be completed, the firm must not go ahead.
Why firms have to run AML checks
The MLRs list the businesses they apply to in regulation 8. Those businesses must carry out customer due diligence (CDD), the legal name for an AML check, when they start a business relationship with you or carry out certain one-off transactions (regulation 27). They must also check again if they suspect money laundering or doubt information they were given earlier.
As a rule, the firm must verify your identity before it starts working for you or carries out the transaction (regulation 30). That is why the check usually comes at the very start.
Every client is checked. Being asked is not a judgement about you.
Which firms must check you
| You are dealing with | When you are checked | Who supervises the firm |
|---|---|---|
| An estate agent (selling) | Before the agent acts for you, usually when you sign the agency agreement | HMRC |
| An estate agent (buying) | Once the seller accepts your offer, the agent is treated as having a business relationship with you too (regulation 4) | HMRC |
| A letting agent | Only on lets with a monthly rent of £10,000 or more (regulation 13, since 30 June 2026) | HMRC |
| An accountant, bookkeeper or tax adviser | Before the firm takes you on as a client | HMRC or a professional body |
| A solicitor or conveyancer | Before acting on property, company and other financial work covered by the MLRs | A professional body |
| A financial adviser | Before acting for you | The FCA |
HMRC’s registration guidance explains which businesses register with HMRC and which are supervised by the FCA or a professional body instead. For a plain-English overview of the rules, see our glossary entry on the Money Laundering Regulations.
What an AML check covers
Regulation 28 sets out the core of every AML check: identify the client, verify that identity using a reliable source that is independent of the client, understand the purpose of the relationship and, for a company or trust, identify the people who own or control it. Regulation 28(19) confirms that a secure electronic identification process can count as that independent source, so a face-to-face meeting is not required.
| Part of the check | What it means | Always? |
|---|---|---|
| Identity | Your name and date of birth, confirmed with a photo ID document. Many firms also ask for a selfie so your face can be matched to the photo. | Yes |
| Address | Your home address, checked against your documents or independent records | Yes |
| Sanctions screening | Your name checked against the UK Sanctions List | Yes |
| PEP screening | Whether you are a politically exposed person, a family member of one or a known close associate (regulation 35) | Yes |
| Adverse media | Whether news reports link you to financial crime | Many firms include it |
| Beneficial owners | For a company or trust, the people who own or control it | When relevant |
| Source of funds | Where the money for this transaction comes from | When the risk calls for it |
| Ongoing monitoring | Keeping your information up to date and watching for changes during the relationship | Yes, for ongoing clients |
Read more about the screening part in our guide to PEPs, sanctions and adverse media, and about the legal steps in customer due diligence.
When the firm asks for more
Some situations require enhanced due diligence (EDD) under regulation 33. These include clients who are PEPs, clients or other parties based in a country on the FATF call-for-action list, and transactions that are unusually large or complex or have no obvious purpose.
For a PEP, regulation 35 requires the firm to establish your source of wealth and source of funds and to get senior management approval before acting. The firm may ask for bank statements, a mortgage offer, a gift letter or a sale completion statement. Our guide to source of funds vs source of wealth explains the difference and the evidence firms usually accept. See also enhanced due diligence.
The check does not end on day one
Regulation 28(11) requires ongoing monitoring: the firm keeps your information up to date and checks that what you do fits what it knows about you. It must look at you again when your circumstances change (regulation 27(8)). See ongoing monitoring.
What you will be asked for
Many AML checks now happen on a phone. The firm sends you a link, you photograph your ID and take a selfie, and you confirm your address.
| What | Typical examples |
|---|---|
| Photo ID | Passport or photocard driving licence. If you are not sure which documents the firm accepts, ask before you start. |
| Selfie | A photo of your face, matched to the photo on your ID |
| Address | Your current address. Some firms ask for a recent bank statement or utility bill. |
| Follow-up questions | Short questions if your name is similar to someone on a sanctions or PEP list |
| Source of funds evidence (if asked) | Bank statements showing savings building up, a mortgage offer, a gift letter, a sale completion statement |
| Company or trust details (if relevant) | Who owns and controls it, and identity checks on those people |
A genuine AML check never asks you to share passwords, PINs or banking logins.
How long an AML check takes
The identity part usually takes a few minutes if you have your ID to hand and good light for the photos. The firm then reviews the result.
It takes longer when:
- your name or address on your documents does not match what you gave the firm;
- you moved recently or changed your name;
- your name is similar to an entry on a sanctions or PEP list and the firm needs to rule out the match;
- the firm needs source of funds evidence and you have to gather statements or letters.
A mismatch or a possible match does not mean you have done anything wrong. Many people share a name with someone on a list. Send what the firm asks for and it can usually complete the check.
Is an AML check a credit check?
No. An AML check confirms who you are and screens you for financial crime risk. The firm is not assessing whether you can borrow money or afford something.
There is one overlap. Some identity check providers match your name, address and date of birth against credit reference agency data, which the ICO notes is also used to verify identity and combat money laundering. The agencies record each search as a “footprint”. Their joint information notice says some footprints are visible only to the agency and to you, while others can also be seen by other organisations.
If this matters to you, ask the firm whether its check uses credit reference agency data and what kind of search it records, or look at your credit report.
Who pays for an AML check
The legal duty, and the cost of meeting it, sits with the regulated firm. The MLRs do not say who pays. Some firms absorb the cost; others charge clients an admin or compliance fee, which should be made clear before you commit.
For property buyers and sellers, our guide to who pays for AML checks when buying a house covers typical fees and what to do if a charge was not disclosed.
What happens if you refuse or the check fails
If a firm cannot complete its checks, regulation 31 says it must not establish a business relationship or carry out the transaction, and it must end any existing relationship. In practice, the firm cannot act for you, and a sale cannot go ahead through that agent, until the check is done.
When a firm cannot complete its checks, it must also consider whether to make a suspicious activity report. Firms are not allowed to tell you whether they have made one (see tipping off). Many failed checks are resolved by sending a clearer photo or a matching document.
How your data is kept
| Rule | What it means for you | Source |
|---|---|---|
| Purpose limit | Personal data collected for AML checks may only be used to prevent money laundering, terrorist financing or proliferation financing, unless another law allows other use or you agree | Regulation 41(1) and (3) |
| You are told | Before taking you on, the firm must tell you that your data will be used only for these purposes | Regulation 41(6) |
| Five years | The firm keeps its records for five years after the relationship ends or the transaction completes | Regulation 40(3) |
| Then deleted | After that, the firm must delete the personal data unless another law requires it, you agree, or it is needed for legal proceedings | Regulation 40(5) |
You can ask the firm for a copy of the information it holds about you.
How to tell a genuine AML request from a scam
Fraudsters know that people expect ID requests when buying a home or taking on an adviser. Before you open a link or send documents:
- Check you were expecting it. A genuine request comes from a firm you already deal with, usually soon after you instruct it or have an offer accepted.
- Contact the firm using details you already have, such as the number on its website or your paperwork, not the link or number in the message. Take Five to Stop Fraud gives the same advice.
- Stop if you are asked for passcodes or to move money. An AML check never asks you to share passwords, PINs or one-time passcodes, or to move money to a new or “safe” account. If the firm charges a fee for the check, it should have told you before you instructed it.
- Never change payment details on the strength of an email. Call the firm on a known number first. See how to check a bank account before paying.
How an AML check works with AML Buddy
If a firm has asked you to verify through AML Buddy, read what to expect when you are asked to verify. In short:
- The firm sends you one secure link. It works for 7 days.
- You photograph your ID document and take a selfie.
- Your address is checked.
- Your name is screened against sanctions, PEP and adverse media sources. If a match is unclear, you may be asked a few short questions, and your answers are recorded so the firm can see why the match was cleared or escalated.
- The firm receives a timestamped PDF report for its records.
AML Buddy charges the firm, not you. Your verification information is stored in the UK.
For firms: AML Buddy costs £5.40 per check inc. VAT (£4.50 + VAT), with 5 free checks on sign-up and no subscription, contract or monthly minimum. Your firm stays responsible for its own risk assessment and decisions. See pricing or read the sector guides for estate agents, letting agents, accountants, solicitors and financial advisers.
Frequently asked questions
What is an AML check?
An AML (anti-money laundering) check is the identity and risk check a regulated UK firm must carry out before it acts for you. The firm confirms who you are, screens you against sanctions and politically exposed person (PEP) lists and, where the risk calls for it, asks where your money comes from. It is required by the Money Laundering Regulations 2017.
Does an AML check affect my credit score?
The check is not an assessment of your creditworthiness. Where a provider uses credit reference agency data, the agency keeps a record of the search. The agencies say some search records are visible only to them and to you, while others can also be seen by other organisations. Ask the firm or its provider which kind its check uses, and check your credit report if you want to see what has been recorded.
Why do I have to do an AML check again for the same purchase?
Each regulated firm is responsible for its own checks. Your estate agent and your conveyancer are both covered by the Money Laundering Regulations, so each must be satisfied about who you are, even for the same transaction.
What happens if I refuse an AML check?
If a firm cannot complete its checks, regulation 31 of the Money Laundering Regulations says it must not start the business relationship or carry out the transaction, and it must end any existing relationship. In practice the firm cannot act for you until the check is done.
How long do firms keep my AML check information?
Regulation 40 requires the firm to keep its records for five years after the business relationship ends or the transaction completes. After that it must delete the personal data, unless another law requires it to keep it, you have agreed, or it is needed for legal proceedings.
Sources
- Money Laundering Regulations 2017 (SI 2017/692), regulation 4 (estate agents and purchasers)
- Money Laundering Regulations 2017, regulation 8 (businesses the regulations apply to)
- Money Laundering Regulations 2017, regulation 13 (letting agency threshold, £10,000 a month since 30 June 2026)
- Money Laundering Regulations 2017, regulation 27 (when customer due diligence is required)
- Money Laundering Regulations 2017, regulation 28 (customer due diligence measures)
- Money Laundering Regulations 2017, regulation 30 (timing of verification)
- Money Laundering Regulations 2017, regulation 31 (when customer due diligence cannot be applied)
- Money Laundering Regulations 2017, regulation 33 (enhanced due diligence)
- Money Laundering Regulations 2017, regulation 35 (politically exposed persons)
- Money Laundering Regulations 2017, regulation 40 (record-keeping)
- Money Laundering Regulations 2017, regulation 41 (data protection)
- HMRC: Money Laundering Regulations, who needs to register
- HMRC: Money Laundering Regulations, your responsibilities
- ICO: Credit (how credit reference agency information is used)
- Credit Reference Agency Information Notice (CRAIN), Experian
- Take Five to Stop Fraud: general advice
Cite this page
Free to quote with a link. Please cite the original source too where we name one.
AML Buddy (2026) What is an AML check? What's checked and why. Updated 27 October 2026. Available at: https://www.amlbuddy.com/resources/what-is-an-aml-check
