aml-compliance-program

name	aml-compliance-program
language	en
description	Drafts board-ready Anti-Money Laundering compliance programs for UK financial institutions under POCA 2002, MLR 2017, and FCA requirements. Covers CDD, EDD, SAR/DAML reporting, OFSI sanctions screening, risk assessment, training, independent testing, and governance structures. Use when creating or updating AML policies or BSA-equivalent compliance programs for UK-regulated firms. Trigger keywords: AML, POCA, SAR, DAML, MLR 2017, FCA, OFSI, CDD, KYC, compliance program, money laundering regulations. [Atticus UK/Scots refined]
tags	["SCOTS, drafting, memo, regulatory, research, UK, Scotland, legal, atticus, source-verification, evidence-matrix, hostile-review"]
atticus_refined	true
jurisdiction_focus	Scotland / UK, unless expressly classified otherwise
requires_live_source_verification	true
external_action_mode	prepare-only unless operator explicitly authorises filing/service/sending

AML Compliance Program (UK/Scotland Adaptation)

Atticus UK/Scots Legal Excellence Overlay

Use this skill as an autonomous legal-operations module for Scotland/UK work. Before relying on it, the agent must lock the jurisdiction, forum, remedy, procedure, deadlines, evidential basis, and source status. Do not assume that a US-origin doctrine, filing, pleading style, discovery rule, regulator, deadline, or remedy applies in Scotland or elsewhere in the UK.

Mandatory operating rules

1. Jurisdiction lock. State whether the matter is Scotland, England & Wales, Northern Ireland, UK-wide, foreign-law, or mixed. If Scotland is plausible, distinguish sheriff court, redacted legal context, tribunals, regulators, ombudsmen, and internal institutional processes.
2. Official-source hierarchy. Prefer legislation.gov.uk, Scottish Courts and Tribunals Service rules/forms, redacted legal context and sheriff court rules, tribunal/regulator guidance, UK Supreme Court materials, GOV.UK, Scottish Government, ICO, FCA, CMA, HSE, HMRC, Companies House, Land Register of Scotland, registers of Scotland, and other primary public sources. Treat secondary commentary as orientation only.
3. Live verification. Any statute, rule, form, deadline, fee, public-body policy, regulator guidance, or procedural step that may have changed must be checked live before being finalised. Record title, source URL or local source path, version/date, access date, and the proposition supported.
4. Evidence discipline. Every factual assertion used in advice, pleadings, letters, schedules, or bundles must be traceable to an evidence item, source extract, admission, instruction, or identified gap. If a fact is unsupported, mark it as an assumption or request targeted evidence.
5. Element-by-element reasoning. Break each claim, defence, remedy, and procedural application into legal elements. Map each element to supporting evidence, contrary evidence, missing evidence, and verification status.
6. Autonomous depth. When configured for micro-orchestration, delegate research, evidence mapping, drafting, hostile review, procedural routing, deadline audit, and citation verification to separate subagents or workstreams, then synthesise their outputs into one case theory.
7. External-action boundary. Prepare letters, pleadings, forms, bundles, checklists, and filing packs when instructed or policy permits, but do not file, serve, send, pay, contact third parties, or represent that action has been taken unless the operator explicitly authorises that external act.
8. Uncertainty handling. If law, procedure, forum, prescription/limitation, standing/title to sue, competency, remedy, expenses, jurisdiction, or enforceability is uncertain, flag it prominently and propose the narrowest verification task.

Expected work product

Where proportionate, produce a chronology, issue map, source log, evidence matrix, merits/risk table, remedy/damages table, procedural route note, draft document, bundle index, service/filing checklist, and operator handoff note. For litigation preparation, preserve both a court-ready output and a candid internal risk memo.

Produces a comprehensive, board-ready AML compliance program tailored to a UK financial institution's risk profile, satisfying POCA 2002, MLR 2017, FCA Handbook, and OFSI requirements.

Checkpoint A: Pre-Draft Intake (Mandatory)

Before drafting, collect from the user:

1. Existing policies - current AML program, risk assessments, FCA/PRA exam reports, regulatory correspondence
2. Institutional profile - org chart, business lines, products, customer demographics, geographic footprint
3. Risk data - prior assessments, audit findings, enforcement actions, FCA notices, consent orders
4. Applicable regulations - confirm institution type (bank, MSB, broker-dealer, crypto-asset firm, payment institution) to determine which FCA Handbook sections and HMRC registration requirements apply

Do not proceed until items 1-2 are addressed. Items 3-4 may be developed during drafting if unavailable.

Quick Start

Draft a numbered policy document covering all sections below. Calibrate depth to the institution's size, complexity, and risk profile.

---

Step 1: Program Foundation

Element	Requirement
Board endorsement	Explicit board/senior management approval and oversight
Scope	All business lines, customer relationships, geographies, transaction types
Risk-based approach	Controls calibrated to risk assessment findings
Resource commitment	Adequate personnel, technology, budget
MLRO appointment	Named Money Laundering Reporting Officer (MLRO) - statutory requirement under MLR 2017 reg. 21

Step 2: MLRO / Compliance Officer

Element	Requirement
Qualifications	CAMS, ICA Diploma, or equivalent; demonstrated AML expertise
Reporting line	Direct to senior management; regular board access
Independence	Evaluation tied to compliance effectiveness, not production
Authority	Unrestricted access to all records, systems, personnel
Location	UK-based (usually); must be approved by FCA for regulated firms

Core duties: Regulatory contact (FCA, NCA, OFSI, law enforcement) · SAR/DAML oversight · risk assessment coordination · training management · independent testing oversight · program design and updates.

The MLRO is the named point of contact for receipt of internal SARs and decision on external reporting to NCA. Under POCA s.331, the MLRO has a personal criminal liability for failing to disclose suspicious activity, a key difference from US law where no equivalent personal liability exists for the compliance officer.

Step 3: Customer Due Diligence (CDD)

Per MLR 2017 regs. 27-40:

Data Point	Individual	Legal Entity
Full legal name	Required	Required
Date of birth	Required	N/A
Address	Residential address	Registered office / principal place of business
ID number	Passport / photo driving licence	Company registration number / EIN equivalent

Verification: Documentary (passport, driving licence) · Electronic (credit reference agencies, identity verification services) · Non-face-to-face (video ID, digital identity solutions) · [SCOTS: Note, enhanced measures for remote verification per FCA guidance]

Simplified Due Diligence: Permitted for low-risk customers (e.g., UK public authorities, listed companies) per MLR 2017 reg. 16.

Timing: CDD must be completed before establishing business relationship or carrying out occasional transaction over €15,000 (or equivalent). Retention: 5 years after business relationship ends (MLR 2017 reg. 40).

Step 4: Beneficial Ownership / PSC

Per MLR 2017 reg. 6, Sch. 2 and Companies Act 2006 Part 21A:

• Identify beneficial owners: each individual ≥25% shares or voting rights, or exercising significant control, UK companies already hold PSC Register at Companies House, cross-reference against it, Collect and verify via: company search, PSC register, trust documents, certification, For trusts: register on HMRC Trust Registration Service (TRS) if taxable, Update on risk-based schedule and upon known changes, Document relationship purpose, business activities, anticipated transaction profile, source of funds

Overseas entities owning UK land: Register on Register of Overseas Entities (ROE) under Economic Crime (Transparency and Enforcement) Act 2022.

Step 5: Enhanced Due Diligence (EDD)

Mandatory EDD triggers per MLR 2017 reg. 33:

Category	Examples
PEPs (Politically Exposed Persons)	Per MLR 2017 reg. 35 - includes domestic PEPs (UK PEPs are in scope, unlike some EU regimes)
High-risk third countries	FATF high-risk/jurisdictions under sanction
Complex ownership	Opaque structures, offshore trusts, shell companies
High-risk businesses	Crypto-asset exchanges, money service businesses (MSBs), cash-intensive, high-value dealers
Unusual transactions	No clear economic or lawful purpose
Cross-border correspondent relationships	Enhanced measures per MLR 2017 reg. 34
Elevated risk rating	Multiple risk factors per internal methodology

Requirements: Senior management approval before establishing relationship · source of wealth/funds verification · enhanced ongoing monitoring (more frequent reviews, lower thresholds) · documented risk rating methodology (customer × geography × product × activity).

Step 6: Suspicious Activity Reporting (SAR)

Per POCA 2002 ss.330-332 (principal offences) and ss.337-338 (defences):

• Threshold: Any knowledge or suspicion (no monetary threshold, lower than US SAR $5,000)
• Internal SAR: Employee reports suspicion to MLRO (protected disclosure under POCA s.337)
• External SAR: MLRO reports to NCA if suspicion is confirmed
• Consent (DAML): Defence Against Money Laundering request, must obtain NCA consent before proceeding with suspicious transaction (POCA s.335)
• Timing: As soon as practicable after suspicion formed
• Consent moratorium: Initial 31 working days; can be extended by court up to 186 calendar days (Criminal Finances Act 2017)

Key indicators: Structuring · activity inconsistent with profile · large cash transactions · wire transfers lacking rationale · high-risk jurisdiction involvement · recordkeeping avoidance · complex corporate structures · transactions with no economic purpose

Tipping-off: Strict prohibition under POCA s.342 - criminal offence to disclose that a SAR has been made. Penalties: up to 5 years imprisonment and/or fine.

Confidentiality: Need-to-know access only; separate SAR register; strict internal controls. SARs must not be filed on company-wide systems accessible to all employees.

Step 7: Large Cash Transactions (No UK CTR Equivalent)

[SCOTS: Note, UK does not have a Currency Transaction Report (CTR) system equivalent to FinCEN CTRs]

Element	UK Position
Threshold	No mandatory cash reporting threshold
Internal logs	Keep internal records of large cash transactions > €10,000 (MLR 2017 reg. 31 - high-value dealers)
Reporting	Suspicion-based only via SAR mechanism
Retail cash payments	Kept for anti-fraud / audit purposes only
Cross-border cash	Cash controls (EU Exit) Regs 2019: declare cash > €10,000 entering/leaving UK

High-value dealers (HVD): Registered with HMRC; must maintain cash transaction records; may have additional HMRC inspection obligations.

Step 8: OFSI Sanctions Compliance

UK sanctions regime under Sanctions and Anti-Money Laundering Act 2018 (SAMLA):

Trigger	Timing
Account opening	Before relationship established
Existing customers	Minimum annually; risk-based frequency
Transactions (wires, faster payments)	Real-time or near real-time

Lists: OFSI Consolidated List (UK regimes), HM Treasury Sanctions List, UN sanctions, autonomous UK sanctions (Russia, Belarus, Iran, etc.)

Actions:

• Asset freeze - mandatory for designated persons; report to OFSI within 10 working days
• Rejection - prohibited transactions not requiring freezing; notify originator; document decision
• OFSI licence - permission to carry out prohibited activity (e.g., payment of legal fees, basic needs)

Retention: All screening records ≥ 5 years (longer for asset-freeze cases).

Strict liability: UK sanctions offences are strict liability, the fact that a firm did not know it was transacting with a sanctioned person is no defence.

Step 9: Risk Assessment

Per MLR 2017 reg. 18:

Dimension	Factors
Products/services	Velocity, geographic reach, anonymity, abuse susceptibility
Customers	Type, occupation, geography, relationship characteristics
Entities	Ownership structure, business purpose, formation jurisdiction
Geography	Physical presence, customer concentrations, FATF/UK government flag lists

Assess inherent (pre-controls) and residual (post-controls) risk. Conduct annually minimum or upon significant changes. Findings drive CDD intensity, monitoring sensitivity, and resource allocation.

UK-specific risk factors: Threat assessment from National Risk Assessment (HMT/Home Office, updated periodically), NCA Strategic Assessment, FCA Financial Crime thematic reviews.

Step 10: Training

Audience	Timing
All employees/officers/directors	Annual minimum
New hires	Within 30 days or before customer-facing duties
High-risk positions	Role-specific schedule with specialised content

Core curriculum: Institution AML policies · POCA 2002 (ss.327-332) · MLR 2017 · SAMLA 2018 · FCA Handbook (SYSC 6.3 / FCG) · ML/TF typologies (FCA / NCA bulletins) · red flags · CDD/EDD procedures · SAR/DAML reporting obligations · OFSI screening · tipping-off prohibition

Documentation: Attendance records, completion certificates, comprehension assessments (including for Scottish-remote/online teams).

Step 11: Independent Testing

Element	Standard
Independence	Personnel independent of AML function
Frequency	12-18 months; higher-risk more frequent
Reporting	Findings to MLRO, management, board

Scope: Regulatory compliance (MLR 2017, POCA, SAMLA) · policy adequacy · risk assessment methodology · transaction monitoring effectiveness · training adequacy · SAR timeliness · CDD/EDD compliance · OFSI procedures · data protection (ICO compliance).

Remediation: Management action plan required with timelines; follow-up verification.

Step 12: Governance

Board duties: Approve program and updates · review risk assessment · receive quarterly compliance reports · review testing results · allocate resources.

Quarterly metrics: SAR/DAML activity · OFSI screening alerts · CDD/EDD backlogs · training completion · testing findings · regulatory developments · FCA/PRA thematic review feedback.

Change management: Document rationale → compliance + legal review → management/board approval → communicate to personnel → maintain version history.

Step 13: Recordkeeping

Record Type	Retention
SARs + supporting docs	5 years from filing
DAML consents + supporting docs	5 years from closure
CDD / beneficial ownership	5 years after business relationship ends
OFSI screening / asset freeze reports	5 years minimum (longer for frozen assets)
Risk assessments, testing, training	5 years minimum
Internal SAR register	5 years (retain in separate confidential location)

Organised for prompt retrieval upon FCA/HMRC/OFSI regulatory request. Security controls and audit trails for SAR-related records. SARs must be stored separately from general customer records (to prevent accidental disclosure in Subject Access Requests under UK GDPR).

---

Checkpoint B: Post-Draft Review (Mandatory)

After delivering the draft, ask the user:

1. Does the program scope match your institution's FCA permissions and risk profile?
2. Are the CDD/EDD thresholds appropriate for your customer demographics?
3. Do the governance and reporting structures align with your board/committee framework?
4. Any FCA enforcement history, Section 166 Skilled Person reviews, or PRA regulatory actions that require specific program provisions?

Quality Checks

• All 13 sections addressed with institution-specific detail
• POCA/MLR 2017 citations verified, uncertain citations marked [VERIFY]
• Risk-based approach: controls scaled to institution size and complexity
• SAR confidentiality / tipping-off protections embedded in relevant sections
• OFSI strict-liability posture reflected throughout
• Retention periods consistent across sections (note: UK GDPR retention may differ from MLR retention, use longer period)
• Disclaimer included: framework requires qualified legal counsel review and institution-specific tailoring

Guidelines

• Mark uncertain regulatory citations with [VERIFY] - regulations change; confirm at drafting date, OFSI obligations are strict liability, UK sanctions are distinct from US OFAC and operate independently, Tipping-off (POCA s.342) carries severe penalties (imprisonment) - embed protections in every procedure and training module, MLRO personal criminal liability (POCA s.331) is uniquely UK, ensure MLRO role is clearly defined and resourced, Program must be reviewed regularly for regulatory changes (FCA Handbook updates, new sanctions regimes, NCA guidance)
• Consult legal counsel (Scottish solicitors for Scotland-based firms) for interpretation questions
• [SCOTS: Note, Scottish criminal law applies for ML offences prosecuted in Scotland (COPFS); civil/criminal fines apply UK-wide]

Scotland/UK Adaptation

Adapted for: Scotland and UK law Changes made:

• Replaced BSA/FinCEN with POCA 2002, MLR 2017, and FCA Handbook as primary AML framework, Replaced OFAC with OFSI (Office of Financial Sanctions Implementation) under SAMLA 2018
• Replaced CTR (Currency Transaction Report) - no UK equivalent; replaced with internal large cash records, Replaced SAR to FinCEN ($5,000 threshold) with SAR to NCA (any suspicion, no monetary threshold)
• Added DAML consent process (Defence Against Money Laundering, UK-specific, no US equivalent)
• Replaced 31 CFR § 1020.220 (CIP) with MLR 2017 reg. 27-40 (CDD requirements)
• Replaced PATRIOT Act with UK anti-terrorism framework (Terrorism Act 2000, Anti-Terrorism Crime and Security Act 2001)
• Replaced beneficial ownership (FinCEN BOI) with PSC Register (Companies House, operational since 2016)
• Replaced FinCEN GTOs with NCA / OFSI guidance and FCA thematic reviews, Replaced EDD triggers: PEPs include domestic UK PEPs (broader than some EU regimes)
• Added MLRO personal criminal liability under POCA s.331 (no US equivalent)
• Added tipping-off under POCA s.342 (imprisonment, more severe than US)
• Added Trust Registration Service (TRS) for registerable trusts, Added Register of Overseas Entities (ROE) for non-UK entities owning UK land, Replaced IRS with HMRC for registration/enforcement of non-FCA entities, Added Joint Money Laundering Steering Group (JMLSG) guidance as UK industry standard, Replaced OFAC SDN List with OFSI Consolidated List (UK autonomous sanctions) and HMT Sanctions List

Key Scottish/UK considerations:

• UK has no CTR system; no equivalent to FinCEN's $10,000 threshold reporting, UK's DAML consent regime requires NCA approval before proceeding with suspicious transactions (unique)
• POCA s.331: MLRO has personal criminal liability for failure to disclose, critical difference from US, Tipping-off (POCA s.342) is a criminal offence with potential imprisonment, UK sanctions (OFSI) operate independently of US/EU sanctions, dual-listing common but not automatic, Scottish criminal prosecutions: COPFS (Crown Office and Procurator Fiscal Service) handles ML offences in Scotland, FCA regulates most financial firms; HMRC registers MSBs, HVDs, crypto-asset firms, trust/company service providers, MLR 2017 is the core regulatory instrument (updated periodically); National Risk Assessment (NRA) informs risk appetite, JMLSG guidance: de facto standard for regulated firms, supplemented by FCA FCG (Financial Crime Guide)
• PSC Register at Companies House is publicly accessible, different from US beneficial ownership approach

Foreign-Law / US-Origin Guardrail

This skill may contain inherited US terminology. For Scotland/UK use, translate rather than copy. Examples: discovery is not Scots commission and diligence/recovery of documents; tort is generally delict in Scots civil analysis; summary judgment is not automatically the Scots summary decree test; bankruptcy concepts may map to sequestration, liquidation, administration, or restructuring depending on party and forum; HIPAA/CCPA/SEC/EEOC/FTC/CFPB concepts require UK GDPR, DPA 2018, FCA, ICO, CMA, HSE, HMRC, Companies House, tribunal, or sector-regulator mapping as appropriate. If the matter is genuinely US or foreign-law, quarantine the foreign-law analysis and warn that local counsel/source verification is required.

Final Quality Gate (Mandatory)

Before marking the task complete, confirm:

• Jurisdiction/forum/procedure have been identified and are not imported from the wrong legal system.
• Current law, rules, forms, fees, deadlines, and public-body guidance have been verified from official sources where necessary.
• Every material factual assertion is tied to evidence, a source, an admission, an instruction, or a clearly labelled assumption.
• Prescription, limitation, time bar, appeal periods, service rules, competency, standing/title to sue, expenses/costs exposure, and enforcement have been considered where relevant.
• The output separates client-facing conclusions from internal risk analysis.
• Drafts include placeholders only where evidence or instructions are genuinely missing; no fabricated citations, authorities, quotes, dates, forms, or procedural steps are allowed.
• A hostile reviewer could reconstruct the reasoning from the evidence matrix and source log.