UK Financial Services, regulations and ethics

In this section, we establish the main regulations relating to the fight against money laundering.

It is often hard for criminals to use funds gained from criminal activities openly, especially if they are carrying out monetary transactions where they can be questioned as to where the money came from. To enable them to use the proceeds of illegal activities without their original source being detected, they will resort to money laundering. The process will also attempt to make the funds appear perfectly “clean”, with an apparently legitimate reason for their existence.

One definition of money laundering is “the process by which criminals convert the proceeds of illegal activities into legitimate funds”.

Examples of crimes heavily associated with money laundering include drug trafficking and terrorism; however, the illegal proceeds could be from virtually any other activity.

There are several forms of money laundering and it is an international problem, which can affect all industries. Nobody can accurately identify the financial scale of the problem of money laundering in the UK economy, but estimates suggest it could run into billions.

Key stages of money laundering process

Large scale, organised money laundering is usually a three-stage process:

1. Placement

Illegal funds are paid into legitimate financial arrangements with reputable institutions such as life assurance policies, collective investments or bank / building society accounts.

2. Layering

This involves making several transactions to hide the original source of the criminal funds. The number of transactions is unlimited depending upon how far the criminal wants to go in hiding the source of funds. Often large sums of money from criminal activities are broken up into smaller denominations before the laundering process takes place.

3. Integration

This is the process by which the criminal funds finally look clean in that they appear to be fully integrated into the economy, having gone through several transactions to hide their origins.

Financial services organisations are most frequently involved at the placement and layering stages. For example, a bank account is opened in a false name, the proceeds are then withdrawn and placed into a life assurance bond, the bond is surrendered early and the “clean” proceeds transferred to an individual’s account overseas.

The UK and EU Member States are members of the Financial Action Task Force (FATF), which is committed to legislation to combat money laundering.

Proceeds of Crime Act (POCA) 2002

The Proceeds of Crime Act 2002 (POCA) is the principal UK statute in the fight against money laundering and has been amended numerous times, most recently by the Criminal Finances Act 2017. Under this legislation, criminal offences include:

Concealing, disguising, converting or transferring criminal property

Assisting so...

Shortened demo course. See details at foot of page.

..., photocopies or in computerised or electronic form. This can ease the burden of retaining records for five years. Each company tends to have its own procedures for record-keeping. Regardless of the recommended retention period for records, all records of any customer, where a suspicious transaction has been reported, or where they are known to be under investigation, must be kept until the case is closed.

Investigation

Any customer under suspicion of money laundering will be investigated. The investigators will require the records to enable them to follow an audit trail.

The things the investigators might need to find out include:

The potential beneficiaries of the client account

The volume of funds/transactions flowing through the account

The original source of the funds

How funds were paid in or withdrawn, for example, by cash or cheque

The identity of the person making the transaction

The destination of the funds

How the instruction and authority were given, and in what form

A person who reports their suspicions is covered by their firm’s whistleblowing procedures. The NCA must know who they are in order to obtain further information from them as part of their investigations, but their names are concealed, and they will not be called upon to give evidence.

Training

The Money Laundering Regulations stipulate that staff are aware of relevant legislation; they must have been trained on procedures in respect of customer due diligence and how to recognise and deal with suspicious transactions. Retraining must be carried out at regular intervals.

Financial sanctions

Financial sanctions are measures imposed by either the United Nations or the UK government to help achieve particular foreign policy goals or protect national security. Such sanctions may restrict the provision of certain financial services, and/or limit access to financial markets, funds, and other economic assets

HM Treasury publishes and updates the list of individuals and entities subject to these sanctions.

It is a criminal offence to make or facilitate payments to anyone listed under these sanctions, whether dealing with them directly or indirectly through third parties like legal or accountancy professionals. All regulated businesses—not only banks—are required to have effective systems in place to check payment instructions and ensure that funds are not sent to sanctioned individuals or organisations, or to those acting on their behalf.

Other forms of financial crime

In addition to money laundering there are other forms of financial crime including: fraud, cybercrime, terrorist financing, bribery and corruption, market abuse and insider dealing, and information security.

The Bribery Act 2010 aims to reduce the effects of bribery with penalties applying to both individuals and firms. Regulated firms have to have procedures to prevent bribery and fully implement them.

In this section we consider the rules relating to complaints procedures and compensation.

The FCA requires every authorised firm to have a written complaints procedure and to publicise it. The FSMA established the Financial Ombudsman Service (FOS) as an independent arbiter in respect of complaints against authorised persons about regulated activities and matters previously dealt with by the range of Ombudsman schemes it replaced. Membership of the FOS is compulsory for all authorised firms, and there is a voluntary jurisdiction for firms that do not currently need authorisation, e.g. National Savings and Investments (NS&I).

Procedures

A person who wants to make a complaint about a regulated financial service should firstly refer their complaint to the firm that provided the product or service, giving them a chance to investigate and rectify the matter. If the matter is not resolved to the complainant’s satisfaction, they can then take the case to the FOS. Complaints about the sale of contracts arranged by an intermediary should be made to the relevant intermediary rather than the product provider. Complaints about a sale made by an employee or representative of a provider should be made to the provider.

A complaint is defined as any oral or written expression of dissatisfaction, whether justified or not, from or on behalf of a person about the provision of, or failure to provide, a financial service, which alleges that the complainant has suffered (or may suffer) financial loss, material distress or material inconvenience, and which relates to an activity under the jurisdiction of the Financi...

Shortened demo course. See details at foot of page.

...ood industry practice but not strictly bound by law or precedent.

Notify its decision to the complainant and the respondent in writing and give reasons for the decision. The claimant must then accept or reject the FOS’s decision within the time limit that the FOS specifies

Redress can be awarded in two ways:

A money award of:

-£445,000 for complaints referred on or after 1 April 2026 for acts or omissions after 1 April 2019

- £200,005 for complaints referred on or after 1 April 2026 about actions or omissions that occurred before 1 April 2019

A directions award telling a firm what action(s) it must take to put things right for the customer. This can include paying a claim, calculating redress using FCA formulas, or issuing an apology.

If the claimant accepts the FOS decision, it is binding on the respondent. If the claimant rejects the FOS decision, the respondent is no longer bound by it. The claimant is then free to pursue the matter through the courts. If the claimant does not respond, this is treated as a rejection.

The FOS can award compensation for any loss and/or order the respondent to take remedial action. The respondent must comply with the award.

The FOS can recommend to firms that they pay higher amounts, but such a recommendation would not be binding on the respondent. The Ombudsman also has the power to order firms to take steps such as transfer a pension, offer life cover, etc.

The FOS cannot award the respondent costs against the complainant. Firms must not seek to charge their customers for the cost of bringing a complaint to themselves or the FOS.

The FSCS was created to compensate claimants where a loss was incurred through an organisation being unable to meet its commitments to its clients e.g. a deposit holding organisation going out of business.

The claim must be for a protected deposit with a UK bank or building society, a pro...

Shortened demo course. See details at foot of page.

...ances in deposit accounts due to certain life events such as house sales or divorce settlements are protected up to £1.4 million for six months from the date in which the money is placed into the account or the date in which the depositor becomes entitled to it, whichever is the later.

In this section we discuss the main provisions of the Access to Medical Reports Act 1988.

Access to Medical Reports Act 1988

The purpose of this Act is to give applicants the right to view medical reports relating to them.

The Act applies to medical reports provided by medical practitioner...

Shortened demo course. See details at foot of page.

...>Where a report is supplied at the request, or with the consent, of the individual, the medical practitioner may charge a reasonable fee for supplying it. Any medical report that is supplied for employment or insurances purposes must be retained for at least six months from the date it was supplied.

The Data Protection Act 2018 (DPA 2018) came into effect in May 2018 to coincide with the implementation of the EU General Data Protection Regulations (GDPR). Both govern the processing of personal data in the UK. As part of the arrangements for the UK leaving the EU the provisions of GDPR have been written into UK law as UK GDPR. The DPA 2018 implements GDPR into UK law, but makes some modifications, for example, parts of the DPA 2018 do not apply to law enforcement agencies.

Changes under the Data Use and Access Act (DUAA) 2025 are being phased in over a 12 month period from June 2025. Under the DUAA 2025, online services that are likely to be used by children have an explicit duty to take their needs into account when deciding how to use their personal information.  

The legislation applies to all persons or organisations who process personal data other than for domestic purposes.

Data protection legislation applies to data controllers and data processors established in the UK who process personal data, other than for purely personal or household reasons. It also applies to controllers and processors outside of the UK where they offer goods or services in the UK or monitor the behaviour of individuals in the UK. . Data subjects are afforded certain rights and data processors and controllers are subject to various obligations. All businesses processing personal data must register with the Public Register of Data Controllers, stating the type and purpose of data they process and who has access to it.

Firms need to appoint a Data Protection Compliance Officer with sufficient authority to ensure that the Act is adhered to. The Government body overseeing the enforcement of the Act is the Information Commissioner.

Data Protection...

Shortened demo course. See details at foot of page.

...ort certain types of data breach to the relevant supervisory authority, the Information Commissioner’s Office (ICO) in the UK and the individuals affected. The DUAA requires that data controllers have procedures in place that facilitate complaints from data subjects who suspect an infringement of their rights.

The transfer of data to a country outside of the UK and to international organisations is restricted, to ensure that individuals are not having their levels of protection decreased. Under the DUAA the relevant test is that the third country or international organisation must have a standard of data protection which is ‘not materially lower’ than the UK standard.

Data security

Firms should consider the following points when reviewing their security:

What is client data?

This is any personal data held in any format.

What are the main risks?

This is not purely an IT issue; for example:

Are visitors to the premises supervised?

Are administration staff vetted at recruitment?

What are the risks from third party suppliers?

Are third party suppliers – for example, contract cleaners - vetted?

Is confidential information left on desks?

Breach notification

Under the legislation, organisations must report personal data breaches to the Information Commissioner’s Office where there is likely to be a risk to individuals. If the risk is high, individuals must also be informed.

Penalties

The legislation defines maximum penalties that can be imposed for breaches. A number of significant fines have been imposed on organisations that have been the subject of a data breach. There have also been out of court settlements in respect of damages claims from affected data subjects.

In this section we discuss the main objectives and activities of the Competition and Markets Authority.

Competition and consumer protection is the respo...

Shortened demo course. See details at foot of page.

...otect consumers from unfair trading practices

Encourage the Government and other regulators to use competition effectively on the behalf of consumers

The FCA authorises and regulates firms who undertake credit related activities.

The Consumer Credit Act 2006 (amending the CCA 1974) protects consumer’s rights and sets out the law regarding most retail lending in the UK. It affects companies and individuals who provide credit or advice on obtaining or repaying debt, including debt restructuring services. The act covers credit cards, hire ...

Shortened demo course. See details at foot of page.

...s, insurers will need to ensure that the significant terms in insurance contracts meet the rules on transparency and are communicated prominently. Contracts deemed unfair will not be binding. These rules cover not only the contract itself but also renewal invitations and customer promotions.

The FCA is responsible for assessing the fairness of terms in contracts for regulated financial services.

In this section we discuss the main objectives and activities of the Pensions Regulator.

The Pensions Regulator regulates work-based pension schemes in the UK and seeks to be a strong, visible regulator that helps to build confidence in pension savings. It ensures that schemes are adequately funded, run in the interests of retirement savers, and that employers meet their obligations to automatically enrol employees and make contributions

The responsibilities of the Pensions Regulator are:

To make sure employers enrol employees in a pension scheme and make contributions

To protect people’s savings in workplace pensions

To improve the way that workplace pensions schemes are run

Th reduce the risk of pension schemes ending up in the Pensio...

Shortened demo course. See details at foot of page.

... range of fund managers and maintaining oversight of the funds under management. The PPF is also responsible for the Fraud Compensation Fund which provides compensation to occupational pension schemes that suffer a loss attributable to dishonesty.

The Money and Pensions Service (MaPS)

The Money and Pensions Service was established in 2019 to bring together the work of the Money Advice Service, Pension Wise and the Pensions Advisory Service. From June 2021, a new brand and website – MoneyHelper – was rolled out.

It aims to give UK individuals access to information to allow them to make effective financial decisions and has these five core functions:

Pensions guidance

Debt advice

Money guidance

Consumer protection

Strategy

In this section we discuss the main provisions of these regulations.

This Act replaces all the previous anti-discrimination laws and aims to protect people from discrimination in the...

Shortened demo course. See details at foot of page.

...ce between the scheme member and their spouse. Since October 2011, employees can also no longer be forced to retire at a certain age unless there is an objective justification for this.