Financial crime, money laundering and data protection
Money laundering and financial crime
The core offences are in the Proceeds of Crime Act 2002 and the Terrorism Act 2000, supported by the Money Laundering Regulations 2017. Money laundering has three classic stages: placement, layering and integration. Firms must take a risk-based approach, appoint a Money Laundering Reporting Officer (MLRO), carry out customer due diligence (CDD), keep records and train staff. CDD means identifying the customer and verifying identity, identifying beneficial owners, and understanding the purpose and intended nature of the relationship. Enhanced due diligence is required for higher-risk cases such as politically exposed persons (PEPs), complex offshore structures and high-risk jurisdictions. Simplified due diligence may be used for lower-risk cases, but never where there is suspicion.
Suspicion must be reported internally to the MLRO, who decides whether to submit a suspicious activity report (SAR) to the National Crime Agency (NCA). A firm may need NCA consent before proceeding with a suspicious transaction. Tipping off the customer is a criminal offence. Sanctions screening and anti-bribery controls under the Bribery Act 2010 are separate but related controls.
Data protection
UK GDPR and the Data Protection Act 2018 require lawful, fair and transparent processing; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. There are six lawful bases, including consent, contract, legal obligation and legitimate interests. Consent is not always required. Personal data breaches that pose a risk must be reported to the Information Commissioner's Office within 72 hours.
Traps
CDD is more than copying a passport. 'Source of funds' is not 'source of wealth'. SARs go to the NCA, not the FCA. Data protection consent is only one lawful basis.
Rule of thumb
Unexplained large cash plus reluctance to explain = escalate, consider a SAR, and do not tip off.