Cash in a holdall, a new wife and a subject access request

Decline the cash, and refresh CDD before doing anything else.

• Cash is not prohibited for adviser charges, but this is high risk. £18,750 in a holdall has no audit trail, no link to the client's bank account and no evidence of source. The firm's AML policy should either prohibit cash or require senior sign-off; either way this payment should be refused.
• CDD is mandatory here. MLR 2017 requires CDD before establishing a business relationship, for occasional transactions of €15,000 or more, and whenever there is suspicion or doubt about previously obtained information. £18,750 exceeds that threshold, and a nine-year-old file (last refreshed 2016) is stale.
• Risk profile. A self-employed property developer is a higher-risk customer type: cash-intensive, frequently structured through companies, and here with a Cyprus connection. Full CDD means verifying identity, establishing source of funds for the fee and source of wealth for the property business, and identifying the beneficial owners of his company.
• How to handle it in the room. Ask for payment by bank transfer from an account in his own name, and verify that account. Frame it as the firm's standard process - do not say 'because of money laundering rules' or hint that he is suspected of anything. Tipping off is a criminal offence (s333A POCA).
• Escalation. If Kemi's concerns go beyond routine, she must report internally to the MLRO immediately. The MLRO decides whether to submit a suspicious activity report to the NCA, and whether the firm needs a defence against money laundering before it acts on his instructions. She must not discuss that report with Gareth.

She is a separate customer, and her PEP status requires enhanced due diligence.

• Separate CDD. A joint account holder is a customer in her own right. The firm must identify and verify Marta before she is added and cannot simply rely on Gareth's file. Reliance on a third party is tightly restricted and not available here.
• PEP status. The MLR 2017 definition of a PEP expressly includes family members and known close associates of a prominent public function. A close associate of a Cypriot government minister is a PEP. That mandates enhanced due diligence:
  • senior management approval before the relationship is established or continued;
  • adequate measures to establish source of funds and source of wealth;
  • enhanced ongoing monitoring of the relationship.
• 'No paperwork' is not an answer. Identity must be verified from independent, reliable sources. Until that is done the firm must not proceed.
• Aggravating factors to weigh and record: a four-month acquaintance, a very recent marriage, immediate appointment as a director of the client's company, a PEP connection in a jurisdiction with elevated corruption risk, and an unexplained urgency about moving money. The firm should ask whether the marriage or the directorship is being used to obscure beneficial ownership or to distance Gareth from the funds.
• If EDD cannot be completed: do not establish the joint relationship; consider whether the existing relationship with Gareth can continue; consider a suspicious activity report (through the MLRO, without tipping off); and document the decision and the reasoning on file. The critical error to avoid is treating the joint account as an administrative add-on to Gareth's file.

Answer the access request in full; the erasure request is limited by law.

Subject access request (Article 15 UK GDPR)

• Respond within one month of receipt (or of receiving ID or clarification), extendable by up to two further months for complex requests, with notice inside the first month.
• Free of charge in ordinary circumstances.
• Provide a copy of his personal data plus the purposes of processing, recipients, retention periods, his rights, and his right to complain to the ICO.
• Redact third-party data - colleagues' names, other clients, references to other accounts - and withhold material covered by legal privilege or confidential references where an exemption applies.

Erasure (Article 17)

• Erasure is not an absolute right, and the firm cannot delete records it is legally required to keep:
  • MLR 2017 regulation 40 - CDD and transaction records for five years after the business relationship ends;
  • FCA record-keeping - suitability reports and advice records for at least five years under SYSC/COBS;
  • records reasonably needed to defend legal claims.
• Destroying the file to satisfy him would itself be an AML and regulatory breach.
• The correct response: explain the retention obligations, stop all marketing immediately (PECR), restrict processing where appropriate (Article 18), and give him what he actually needs - a clean handover pack for the new adviser.

Governance. Verify the requester's identity, log the request and the response date, and remember the exposure: ICO fines can reach £17.5 million or 4% of global annual turnover. Telling a client 'we must keep your AML records for five years' is not tipping off - it is ordinary transparency.