Entities Required to Comply with KYC (UK, US & EU)

Who Is Required to Perform KYC

AML law names a roster of obliged entities. These are organisations and professionals that have to run KYC and meet prevention duties.

UK duties flow from the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (as amended). The FCA, HMRC, and sector-specific bodies supervise them. US coverage sits in the Bank Secrecy Act (BSA) and FinCEN's Customer Due Diligence Rule. At EU level the AML Directives set the floor; member states write that baseline into national law.

Obliged Entities

Financial Institutions

These parties have sat under the rules longest, and they face the tightest duties:

• Banks and building societies — Must confirm who every customer is when accounts open, credit is granted, or transfers are processed. See banking solution.
• Payment institutions and e-money issuers — Neobanks and payment gateways sit in this group. See fintech solution.
• Investment firms — Fund managers, broker-dealers, crowdfunding platforms.
• Insurance companies — Life cover and savings products draw the closest look. See insurtech solution.

Crypto-Asset Service Providers

AMLD5 transposition plus MiCA in Europe pulled crypto exchanges, custodians, and virtual wallet providers fully inside KYC. The FCA registers UK crypto firms and oversees them under the Money Laundering Regulations. FinCEN classifies US crypto exchanges as money services businesses (MSBs).

See crypto and Web3 solution.

Real Estate

Estate agents, letting agents, and property developers become obliged entities once they help complete property deals. UK coverage reaches transactions of any value. In the US, the Corporate Transparency Act and FinCEN's evolving rules are stretching real estate KYC.

See real estate solution.

High-Value Goods Dealers

Anyone who trades in goods and takes cash of EUR 10,000 or more (or the equivalent) is an obliged entity. The UK cutoff is GBP 10,000. The net includes:

• Jewellers and watchmakers
• Art galleries and auction houses
• Luxury vehicle dealers
• Dealers in precious stones and metals

See luxury solution.

Gambling Operators

Physical and online casinos, betting operators, and gaming companies must confirm identity and age for every participant. The UK Gambling Commission and US state regulators apply tight KYC rules.

See gaming solution.

Professional Service Providers

Several professions carry KYC duties:

• Solicitors and barristers — Once they take part in financial, property, or corporate work.
• Accountants and auditors — While carrying out their professional work.
• Tax advisers — When they advise on tax planning or corporate structures.
• Trust or company service providers (TCSPs) — When they form companies or trusts, or serve as a registered agent.

Hospitality and Accommodation

Hotels and lodging businesses must register guests and confirm identity. That duty is sharpest where local law requires guest data to be sent to authorities.

See hotel solution.

Due Diligence Levels

The rules split diligence into three tiers:

Simplified Due Diligence (SDD)

Used where risk is low:

• Known customers with a clean track record
• Low-value transactions
• Low-risk financial products

Standard Due Diligence (CDD)

The usual setting for most business relationships:

• Formal identification of the customer
• Document verification
• Recording the purpose of the business relationship

Enhanced Due Diligence (EDD)

Required once risk is high:

• Politically Exposed Persons (PEPs)
• Customers from high-risk countries (FATF grey or black list)
• Unusually complex or high-value transactions
• Correspondent banking relationships with third-country institutions

Core Obligations of Regulated Entities

Each obliged entity must:

1. Identify the customer before a business relationship starts.
2. Verify the identity with reliable, independent documents or data.
3. Identify the beneficial owner if the customer acts for a third party.
4. Understand the purpose of the business relationship.
5. Monitor transactions on an ongoing basis.
6. Report suspicious activity to the competent authority (NCA in the UK, FinCEN in the US).
7. Retain records for at least 5 years (UK/EU) or 5 years (US).
8. Train employees in AML prevention.
9. Appoint a nominated officer (MLRO in the UK) who owns compliance.

Penalties for Non-Compliance

Severity	Potential Penalty
Minor	Up to GBP 50,000 / USD 100,000
Serious	Up to GBP 5,000,000 / USD 10,000,000
Severe	Unlimited fines, or 10% of annual turnover (EU)

Serious breaches can also bring:

• Public censure and naming
• Licence revocation
• Criminal prosecution of directors and senior managers
• Deferred prosecution agreements (US)

Frequently Asked Questions

Are startups and SMEs also obliged to comply?

Yes, if the activity sits inside AML rules. Size does not create an exemption. KYC solutions designed for SMEs exist so firms can meet the rules without large upfront spend.

Are marketplaces required to do KYC?

It depends. Yes, if the marketplace intermediates payments or trades in high-value goods. In practice, a growing share of marketplaces run KYC anyway, to cut fraud and earn trust.

What about cryptocurrency transactions?

From 2020, every crypto-asset service provider sits fully under AML rules. MiCA in Europe and the FCA registration regime in the UK have aligned the duties, and FinCEN applies BSA requirements to crypto firms that operate in the US.

How often must I refresh customer KYC?

Periodic review is required. Cadence follows risk: yearly for high-risk customers, every 3 to 5 years for standard-risk relationships. Trigger events (unusual activity, sanctions list updates) can force an earlier refresh.

---

Not sure whether your business is an obliged entity? Speak with the team at Joinble to map your duties and put the right solution in place.