What is customer due diligence (CDD)? It is the set of checks the Money Laundering Regulations 2017 require regulated businesses to carry out on their customers — and it is much more than an ID check. Under regulation 28 you must identify the customer and verify their identity, identify any beneficial owner, assess the purpose and intended nature of the relationship, and keep monitoring it for as long as it lasts. For estate agents there is a further catch many miss: the law treats the buyer as your customer too, once their offer is accepted — even though the seller pays your fee. And since 30 June 2026, the CDD thresholds are set in pounds, not euros.
At a glance: Nexis CPD’s £9 Anti Money Laundering (AML) Awareness course covers what money laundering is, the legislation and offences, the obligations of regulated businesses (including customer due diligence) and how to recognise the warning signs. It is CPD accredited and 100% online with a verifiable e-certificate, and any three courses cost £18. It is awareness training for staff — it is not a regulated qualification, and it does not replace your firm’s own policies or advice from your supervisor.
What is customer due diligence?
HMRC’s guidance for supervised businesses describes CDD, “sometimes referred to as ‘know your customer’ (KYC)”, as “the collective term for the checks businesses must do on their customers and, where applicable, beneficial owners.” The legal requirements are in regulation 28 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs). When CDD is required, the business must:
- identify the customer unless their identity is already known to and verified by the business
- verify the customer’s identity on the basis of documents or information from a reliable source independent of the customer
- assess, and where appropriate obtain information on, the purpose and intended nature of the business relationship or transaction
- identify any beneficial owner and take reasonable measures to verify who they are, and understand the ownership and control structure of a company, trust or similar arrangement
- verify anyone acting on the customer’s behalf — check they are authorised, identify them and verify their identity
- conduct ongoing monitoring of the relationship, including scrutinising transactions (and, where necessary, the source of funds) and keeping CDD information up to date.
The extent of the checks must reflect your own business-wide risk assessment and the risk in each case, and may differ from case to case. But regulation 28(16) adds the part that catches firms out at inspection: you “must be able to demonstrate” to your supervisor that the measures you took were appropriate to the risks. A photocopied passport in a file, with nothing recorded about who the customer is, why they are buying and where their money comes from, is unlikely to meet that test.
This guide focuses on property businesses, but the core rules apply across the regulated sector. For the bigger picture, see what anti-money laundering is.
Who has to carry out customer due diligence?
CDD applies to “relevant persons” under the MLRs — the regulated sector. That includes banks and financial firms, accountants, auditors, tax advisers and bookkeepers, lawyers doing certain work, trust or company service providers, estate agency businesses, letting agency businesses above the rent threshold, high value dealers, art market participants, casinos and cryptoasset businesses.
For property, HMRC is the anti-money laundering supervisor for estate and letting agency businesses that are not supervised by a professional body. HMRC’s estate agent business guidance also covers property sourcing businesses, deal finders, deal packagers, investment brokers and relocation agents, which matters to anyone who finds deals for property investors. A private landlord or investor buying and letting property for themselves is a customer of the regulated sector rather than part of it — but will be asked for CDD by the agents, lenders and solicitors they use.
When must you carry out customer due diligence?
Regulation 27 sets the triggers. A relevant person must apply CDD when it:
- establishes a business relationship
- carries out an occasional transaction that is a transfer of funds exceeding £800
- suspects money laundering or terrorist financing
- doubts the veracity or adequacy of documents or information previously obtained for identification.
Most businesses must also apply CDD to an occasional transaction of £12,000 or more, including several linked transactions. Different thresholds apply to high value dealers (cash transactions of £10,000 or more), casinos, art market participants and letting agents (see below).
CDD is not a one-off. Regulation 27(8) and (9) require it again for existing customers at appropriate times on a risk-based approach, and when their circumstances change — for example a change of beneficial owner, or transactions that do not fit what you know about them.
For estate agents, HMRC says a property transaction “will always be a business relationship rather than an occasional transaction.”
What changed in the Money Laundering Regulations in June 2026?
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621) changed several CDD rules, with the regulation 27 changes in force from 30 June 2026. According to the explanatory note, the amendments:
- replace euro amounts with sterling, generally on a 1:1 basis (so €10,000 became £10,000), except where that would fail to meet Financial Action Task Force (FATF) standards — which is why the general occasional transaction threshold is now £12,000 and the transfer-of-funds trigger is £800
- align the CDD triggers for letting agents and art market participants with those for high value dealers
- replace “high-risk third country” with a new definition, “FATF call for action country” — a country on FATF’s list of high-risk jurisdictions subject to a call for action
- narrow the “unusually large” trigger for enhanced due diligence to transactions that are “unusually complex or unusually large in each case given the nature of the transaction”.
Be aware that not every official page has caught up. At the time of writing, HMRC’s letting agency registration page (last updated April 2023) still describes the rent threshold as 10,000 euros, while the regulations on legislation.gov.uk now say £10,000. Always check the current text of the regulations.
What ID do you need for customer due diligence?
Neither the MLRs nor HMRC set a single fixed list of documents, but HMRC’s guidance on identifying and verifying customers is detailed. For a private individual you should obtain, as a minimum, their full name, date of birth and residential address, and then verify them using ID evidence or electronic verification.
HMRC’s examples of suitable ID include a valid passport, a valid photocard driving licence (full or provisional), a national identity card, a firearm certificate, or an identity card issued by the Electoral Office for Northern Ireland. Name, photograph, date of birth and address must all be verified, which may need more than one document. HMRC’s fallback is a non-photo document from an authoritative source plus a separate proof of address, such as a utility bill or bank statement.
Crucially, HMRC says “you should do more than simply obtain the ID documents.” Staff should check spellings, expiry dates, that the photo is of the customer, that addresses match across documents, that the date of birth looks realistic, and whether there are signs of forgery.
Can you use electronic ID verification?
Yes. Regulation 28(19) allows information from a secure electronic identification process to count as a reliable, independent source. HMRC’s guidance says digital identity services certified against the UK digital verification services trust framework and on the DVS register can be used, and that a provider not on the register “cannot reliably be deemed suitable”. If you use an electronic ID or credit-reference check, confirm your provider’s status and keep the results.
What if the customer does not have standard ID?
HMRC recognises that some people, such as elderly people, may have let passports and licences lapse. Exhaust standard documents first and record why they cannot be provided; non-standard documents should come from a reliable source that knows the person, such as a medical or legal professional or a pension provider.
Do copies of ID need to be certified?
HMRC says original documents should be produced wherever possible. If they are not, you can accept copies certified as true copies by an appropriate professional person, who must write “Certified to be a true copy of the original seen by me”, sign, date and print their name, and add their occupation, address and phone number. HMRC adds that certifying a copy “does not by itself constitute EDD” (enhanced due diligence).
What CDD is needed for companies, trusts and beneficial owners?
When the customer is a company, regulation 28(3) requires you to obtain and verify its name, company number and registered office address (and principal place of business if different). You must take reasonable measures to determine and verify the law it is subject to, its constitution, and the names of its directors and senior persons, and to understand its ownership and control structure.
You must also identify the beneficial owner — broadly the individuals who ultimately own or control the customer — and take reasonable measures to verify their identity. Two rules are frequently overlooked:
- The PSC register is not enough on its own. Regulation 28(9) says you do not satisfy the beneficial ownership requirement “by relying solely” on information filed at Companies House. HMRC repeats this.
- The “senior manager” fallback is a last resort. Only if you have exhausted all possible means of identifying the beneficial owner can you treat the senior person managing the company as its beneficial owner — and you must keep written records of every step taken and every difficulty met.
If the beneficial ownership information a company gives you does not match an official register, HMRC says you must report the discrepancy to Companies House and HMRC. Property bought through companies, trusts and overseas entities deserves particular care: HMRC’s guidance notes that a beneficial owner “may include a person that is using another person to shield them from meeting you.”
When does an estate agent have to carry out CDD on the buyer?
Since the 2017 Regulations were made, regulation 4(3) has said that “an estate agent is to be treated as entering into a business relationship with a purchaser (as well as with a seller), at the point when the purchaser’s offer is accepted by the seller.” The buyer is therefore your customer for CDD purposes, even though you act for the seller.
HMRC’s estate agency guidance sets out the timing:
- Seller: the relationship starts when the agreement is made or contract signed, before the property is marketed. CDD should be done as soon as possible after first contact, and at the latest by then.
- Buyer: HMRC recommends completing all CDD as soon as possible after first contact, and before an offer is accepted. It must be completed before a binding contract is entered into — normally exchange of contracts. HMRC suggests the signing of the memorandum of sale (or heads of terms in commercial sales) as a helpful trigger to start.
- Auctions: CDD on buyers must be completed before a binding contract — HMRC suggests pre-registering bidders, or making the contract conditional on CDD.
HMRC also says you must identify all the relevant customers (a Land Registry check shows all current owners) and complete CDD “even if you knew them before they became your customers”, unless already verified. In a joint sole agency, each agent is responsible for CDD on the seller, and the agents are expected to carry out CDD on each other. If a tenant decides to buy the property they rent, HMRC says updated CDD must be completed even if it was done before. For the wider training and CPD picture, see our guide to CPD requirements for estate agents.
Do letting agents have to carry out customer due diligence?
Only for higher-value lettings. Under regulation 27(7A), as amended in 2026, a letting agent must apply CDD to an occasional transaction consisting of the conclusion of an agreement to let land for a term of a month or more, at a rent which during at least part of the term is, or is equivalent to, a monthly rent of £10,000 or more. Regulation 27(7B) says CDD must then be applied to both the landlord and the tenant.
Most residential lettings fall well below that figure. HMRC says a letting agent carrying out only lettings work below the threshold does not need to register for anti-money laundering supervision. Agencies that do handle lettings at or above the threshold must register with HMRC before carrying on that activity. Any sales work is caught in full regardless. Letting agents in Scotland and Wales also have separate registration or licensing rules — see our guide to landlord training requirements.
What is enhanced due diligence?
Enhanced due diligence (EDD) means extra checks and closer monitoring on top of standard CDD. Regulation 33 requires it in situations including:
- any case your own risk assessment, or your supervisor’s information, identifies as high risk
- a business relationship with a person established in a FATF call for action country, or a transaction where either party is established in one
- where the customer or a beneficial owner is a politically exposed person (PEP), or a family member or known close associate of one
- where a customer has provided false or stolen ID and you propose to continue dealing with them
- where a transaction is unusually complex or unusually large given its nature, there is an unusual pattern of transactions, or transactions have no apparent economic or legal purpose.
Regulation 33(6) lists risk factors such as cash-intensive businesses, unusually complex corporate structures, nominee shareholders and payments from unknown third parties — though regulation 33(7) notes that risk factors “may not always” mean the risk is high.
What extra checks apply to politically exposed persons?
Under regulation 35, you need systems to find out whether a customer or beneficial owner is a PEP or a family member or known close associate of one. If you go ahead, you must get senior management approval, take adequate measures to establish the source of wealth and source of funds, and conduct enhanced ongoing monitoring. Since 10 January 2024, for a domestic PEP — someone entrusted with prominent public functions by the UK — the starting point is that they present a lower risk than a non-domestic PEP. The measures continue for at least 12 months after a person leaves the role.
What is simplified due diligence?
Simplified due diligence is not an exemption from CDD. Regulation 37 lets a business apply it only where it has determined that a relationship or transaction presents a low risk, taking into account its risk assessment and listed risk factors. Even then, it “must continue to comply” with regulation 28, but may adjust the extent, timing or type of the measures, and must still monitor enough to detect unusual or suspicious transactions. HMRC says it may be suitable for CDD on another registered estate agency business involved in the transaction, depending on your own risk assessment and policies.
What happens if you cannot complete customer due diligence?
You must stop. Regulation 31 says that where you cannot apply CDD as required, you must not carry out a transaction through a bank account with or for the customer, must not establish a business relationship or carry out a transaction with them, must terminate any existing relationship, and must consider whether you need to make a suspicious activity report to the National Crime Agency. Regulation 30 generally requires identity verification before the relationship is established, with only a narrow exception where it is necessary not to interrupt normal business and there is little risk.
If you have made a report and continuing CDD would “tip off” the customer, regulation 28(14) and (15) mean you need not continue those measures; your nominated officer should decide how to handle it.
How long must CDD records be kept?
Regulation 40 requires you to keep a copy of the documents and information obtained for CDD, and enough supporting records to reconstruct each transaction, for five years from when the transaction completes or the business relationship ends. Records of transactions within a relationship need not be kept for more than 10 years.
After that you must delete personal data obtained for the MLRs, unless another law requires it, it is needed for legal proceedings, or the person has consented. CDD files are personal data, so they also need to be held securely under UK GDPR — see our guide to what GDPR is.
What are the penalties for getting CDD wrong?
Failing to carry out CDD is a breach of a “relevant requirement” of the MLRs. Under regulation 76, a supervisor such as HMRC can impose a penalty “of such amount as it considers appropriate” and publish a statement censuring the business, and can also fine an officer who was knowingly concerned in the breach. Regulation 86 makes contravening a relevant requirement a criminal offence, punishable on indictment by up to two years’ imprisonment, a fine or both.
Both share a defence: that the person “took all reasonable steps and exercised all due diligence” to comply, and both consider whether approved guidance was followed. That is why written procedures, trained staff and complete records matter as much as the checks themselves. Training is itself a requirement under the MLRs — our guide to AML training requirements explains who needs it and what it must cover.
Which training helps staff carry out CDD correctly?
These three £9 courses work well together for estate and letting agency teams, property businesses and accountancy practices, each with a verifiable certificate:
- Anti Money Laundering (AML) Awareness — money laundering, the law and offences, the obligations of regulated businesses and the warning signs.
- Data Protection and GDPR Awareness — handling and retaining the personal data CDD generates.
- Anti-Bribery Awareness — the Bribery Act and related financial crime risks.
Any three courses cost £18 with the pay-for-2-get-3 offer — add them to the cart and the discount applies automatically. These are awareness courses: they help staff understand their duties and can form part of your training records, but they are not regulated qualifications and they do not replace your firm’s own policies, controls and procedures or guidance from your supervisor.
Frequently asked questions
What is customer due diligence in AML?
Customer due diligence is the set of checks the Money Laundering Regulations 2017 require regulated businesses to carry out: identifying and verifying the customer, identifying beneficial owners, assessing the purpose and intended nature of the relationship, and monitoring it on an ongoing basis. HMRC says it is sometimes called know your customer (KYC).
What documents are needed for CDD?
HMRC says you should obtain at least the full name, date of birth and residential address of an individual and verify them, for example with a valid passport or photocard driving licence plus proof of address, or through a certified digital verification service. You should also check the documents are genuine.
Do estate agents have to do AML checks on buyers?
Yes. Regulation 4(3) treats an estate agent as entering a business relationship with the buyer when their offer is accepted, so CDD is required on the buyer as well as the seller. HMRC says it must be completed before a binding contract, normally exchange of contracts.
What is the difference between CDD and EDD?
CDD is the standard set of checks. Enhanced due diligence adds extra measures and closer monitoring in higher-risk cases, such as politically exposed persons, customers established in FATF call for action countries, and unusually complex or unusually large transactions.
How long do you keep customer due diligence records?
Five years from the end of the business relationship or the completion of an occasional transaction. After that, personal data obtained for the Money Laundering Regulations must be deleted unless another law, legal proceedings or consent allows it to be kept.
What is the AML threshold for letting agents?
Since 30 June 2026, letting agents must apply CDD to lettings of a month or more at a monthly rent of £10,000 or more, on both landlord and tenant. The threshold was previously 10,000 euros, and some older guidance pages still show the euro figure.
Make sure your team knows its CDD duties
£9 per course. CPD accredited, 100% online, verifiable e-certificate. Pay for 2, get 3 — any 3 courses for £18.
This article is general information, not legal advice. It summarises the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 as amended, including by SI 2026/621, and HMRC guidance for supervised businesses at the time of writing; always check the current regulations and your own supervisor’s guidance, and take professional advice on specific cases. Businesses supervised by the FCA or a professional body should follow that supervisor’s guidance. A Nexis CPD awareness course is CPD accredited but is not a regulated qualification.