KYC, AML and record‑keeping: what platforms must do when onboarding investors

The UK Money Laundering Regulations set a risk‑based framework requiring regulated firms to identify and verify customers, carry out enhanced due diligence where risk is higher, and maintain records. Platforms offering investment services must consider customer identity verification (individuals and corporates), beneficial ownership checks, source‑of‑fund enquiries for higher‑risk cases, and sanctions screening against HM Government lists.

Operationally, KYC involves electronic identity verification, document collection, and processes for ongoing monitoring of transactions and changes in customer risk profile. Firms must have suspicious activity reporting channels to the UK authorities and retain records for prescribed periods to support audits and potential investigations. For corporate investors, supplementary checks on directors, shareholders and any trusts are common practice.

Data protection and secure storage are integral: AML records contain personal and financial information, so platforms must apply appropriate data security controls and clear retention policies. Firms should also document their risk assessment, customer acceptance policy and staff training programmes to demonstrate compliance.

For retail savers, KYC and AML processes are a protection layer: they make platforms harder to misuse for illicit flows and provide traceability. Investors should expect identity checks and verification steps when joining fractional schemes and should see clear explanations from platforms about what is required, why it matters, and how data will be handled.