Anti-money laundering, financial crime and data protection
Domain 5 - Anti-money laundering, financial crime and data protection
This domain tests the controls around the client rather than the mortgage: identifying and verifying the client and the money, spotting and reporting suspicion, and handling personal data lawfully.
AML framework
The Money Laundering Regulations 2017 (as amended) apply to mortgage firms, supervised by the FCA. Take a risk-based approach: customer due diligence (identify and verify the client and any beneficial owner); simplified due diligence only where risk is genuinely low; enhanced due diligence for politically exposed persons, high-risk jurisdictions and unusual structures. Establish source of funds (where the deposit came from) and source of wealth (how the client accumulated their assets). Monitor the relationship on an ongoing basis and keep records for five years after the relationship ends.
Reporting and financial crime
If you know or suspect money laundering or terrorist financing, submit a suspicious activity report to the National Crime Agency via the firm's MLRO and do not tip off the client. Mortgage fraud includes inflated income, undisclosed debt, back-to-back or cashback sale schemes and identity fraud; bribery offences under the Bribery Act 2010 and sanctions screening (OFSI) apply alongside. Firms must train staff and appoint an MLRO and nominated officer.
Data protection
UK GDPR and the Data Protection Act 2018 require a lawful basis, a privacy notice, data minimisation, accuracy, retention limits and appropriate security. A subject access request must be answered within one month, extendable for complex requests. A personal data breach that risks rights and freedoms must be reported to the ICO within 72 hours. Sharing data with lenders, valuers and insurers is usually within the client's reasonable expectations; passing it to an unconnected third party is not.
Worked example
A first-time buyer's deposit includes £40,000 from an overseas relative. Verify the relative's identity, obtain the transfer evidence, check sanctions and PEP status, record source of wealth, and consider enhanced due diligence. If the explanation is inconsistent with the evidence, do not complete the case; escalate to the MLRO and consider a SAR.
Traps
Relying on the conveyancer's checks; treating a passport copy as the whole of CDD; tipping off a client that a report has been made; retaining files indefinitely; and assuming consent is always the lawful basis.