Skip to content
Looking for the latest updates for AML in the art world instead? Visit the ArtAML™ blog
  • There are no suggestions because the search field is empty.

How to conduct KYC on an Ultimate Beneficial Owner (UBO) if a large organisation won’t supply normal documents

Large or institutional customers sometimes refuse to share identity documents directly, often over concerns about identity theft. Regulation 39 offers an alternative: relying on CDD already completed by a regulated third party, so no identity document needs to reach the AMP at all. This article explains when reliance applies and what it doesn't cover.

Art Market Participants (AMPs) sometimes deal with large or institutional customers who are unwilling to share identity documents directly — often for security reasons — to reduce the risk of identity theft. In these cases, Regulation 39 of the Money Laundering Regulations 2017 offers an alternative: relying on CDD that a regulated third party has already carried out.

What reliance means

Under Regulation 39, an AMP may rely on customer due diligence already conducted by a regulated third party — typically a solicitor or accountant acting for the customer — rather than obtaining identity documents themselves. No identity document, certified or otherwise, needs to pass to the AMP. The third party retains the underlying records; the AMP receives written confirmation that adequate CDD has been carried out.

When to consider reliance

Reliance is worth considering where:

  • the customer or UBO is unwilling to directly share ID documents for security or confidentiality reasons; or
  • a regulated professional acting for the customer has already completed CDD to the required standard.

This is intended for exceptional circumstances rather than routine use. Legal advice may be appropriate where the position is unclear.

What you need from the third party

A letter from the customer's professional adviser confirming they:

  • are regulated under the MLRs (or an equivalent regime);
  • have verified the UBO's identity to the required standard — full CDD or EDD, not simplified due diligence;
  • consent to the AMP relying on that verification; and
  • will make the underlying records available on request — for example, if the AMP faces a regulatory audit and must produce CDD data.

Sanctions and PEP screening still apply

Reliance under Regulation 39 covers only the standard CDD measures in Regulation 28(2)–(6) and (10), and the register-discrepancy duty under Regulation 30A. It does not extend to enhanced due diligence for politically exposed persons under Regulation 35, or to sanctions screening, which falls under separate legislation (the Sanctions and Anti-Money Laundering Act 2018) enforced by OFSI on a strict-liability basis. The AMP must carry out PEP and sanctions screening on the customer and UBO names itself, regardless of the reliance arrangement.

Liability is not transferred

Relying on a third party's CDD does not transfer the AMP's liability. The AMP remains responsible for ensuring the third party's verification is adequate, and for satisfying itself that the reliance letter meets the requirements above before proceeding.

Legislation:

  • Regulation 39 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017: reliance on third-party CDD.
  • Regulation 28(3)(b): listed company exemption.