AML checks: what they cover and how long they take
What an anti-money-laundering check actually involves under MLR 2017, realistic timings for each stage, the five reasons checks stall, and the record a firm needs at the end of it.
By Mehmood Rajoka · Last updated 2026-08-12
TL;DR: Quick Summary
- •An AML check is the set of steps a regulated firm takes to identify a client, verify that identity, screen them against sanctions and PEP lists, and assess the money-laundering risk of acting for them.
- •It is not a single lookup. Identity verification is one part of customer due diligence under MLR 2017 Regulation 28, alongside beneficial ownership, purpose of the relationship, and ongoing monitoring.
- •A straightforward electronic check returns in minutes. The elapsed time for a client is usually days, and the delay is almost always missing documents rather than processing.
- •Enhanced due diligence, a PEP match, or an unclear source of funds turns minutes into weeks, because those require human review and more evidence.
- •The output that matters is the record: what was checked, when, against what, the result, and the decision that followed.
Answer-first summary
What is an AML check?
An AML check is the set of steps a regulated firm takes to identify a client, verify that identity from a reliable and independent source, screen them against sanctions and politically exposed person data, understand the purpose of the relationship, assess the money-laundering risk of acting for them, and monitor the relationship over time. In the UK these obligations sit in the Money Laundering Regulations 2017, principally Regulation 28. Identity verification is one component of an AML check, not the whole of it.
- Governed by MLR 2017, principally Regulation 28
- Identity verification is one part, not the whole
- Includes screening, risk assessment and monitoring
- The retained record is what an inspector reviews
What an AML check actually covers
Four components. The third is the one most often skipped and the one inspectors ask about most:
Identify and verify
Establish who the client is and verify it from a reliable, independent source. For an individual that is usually a document and likeness check; for a company it means the incorporation record and the people behind it.
Screen
Check the client, and where relevant their beneficial owners, against sanctions lists, politically exposed person data, and adverse media. A match is not a conclusion; it starts a review.
Understand and assess
Record the purpose and intended nature of the relationship, identify beneficial owners for corporate clients, and assess the risk. This is the part most often skipped, and the part inspectors most often ask about.
Monitor
Keep the picture current. Sanctions lists change, clients change, and a check that was adequate at onboarding does not stay adequate on its own.
How long do AML checks take?
The honest answer depends on which part of the check you mean, and on how quickly the client responds:
Electronic verification: minutes
Where a client provides a valid document and the data matches, an electronic identity check typically returns within minutes. This is the step people usually mean when they ask how long an AML check takes.
A standard client, end to end: one to three working days
The elapsed time is dominated by waiting for the client, not by processing. Requesting the full document set in one message at the outset is the single biggest saving available.
Source of funds involved: several days to a fortnight
Evidencing where money came from means bank statements, completion statements, probate documents, or gift letters, often from more than one party. Each round trip with the client adds days.
Enhanced due diligence or a PEP match: one to several weeks
EDD requires additional evidence and a documented decision, and a possible PEP or sanctions match requires human review to confirm or discount. Neither can be safely rushed, and both are the points at which a firm's own process is tested.
Why AML checks stall
Five causes account for most of the delay, and four of them are fixable by asking better at the start:
Partial bank statements. A statement missing pages, or showing a balance without the transactions that built it, will not evidence source of funds.
A gift with no donor evidence. The donor's own source of funds is part of the answer, and clients rarely expect to be asked for it.
Documents that do not match. A name on a passport that differs from the name on a utility bill needs explaining, not ignoring.
Expired identity documents. Whether an expired document is acceptable depends on the check and the scheme, so it is worth confirming before the client sends one.
Silence after the request. Most delay is the gap between asking and receiving, which is a process problem rather than a compliance one.
FAQ
Answer-first summary
What is an AML check?
An AML check is the set of steps a regulated firm takes before and during a client relationship to satisfy its anti-money-laundering obligations. It covers identifying the client and verifying that identity from a reliable independent source, identifying beneficial owners for corporate clients, screening against sanctions and politically exposed person data, understanding the purpose of the relationship, assessing risk, and monitoring the relationship over time. In the UK the requirements sit in the Money Laundering Regulations 2017, principally Regulation 28.
Answer-first summary
How long do AML checks take?
An electronic identity check usually returns within minutes. A standard client, end to end, typically takes one to three working days, and the time is dominated by waiting for documents rather than by processing. Where source of funds must be evidenced, expect several days to a fortnight. Enhanced due diligence or a possible PEP or sanctions match can take one to several weeks, because both require human review and additional evidence.
Answer-first summary
Why is my AML check taking so long?
In most cases the file is waiting on the client rather than on the firm. The common causes are partial bank statements, a gift with no evidence from the donor, names that differ across documents, or an expired identity document. If a possible sanctions or PEP match has surfaced, the file will be with a human reviewer, and that review is deliberately not rushed.
Answer-first summary
What is the difference between an AML check and an ID check?
An ID check verifies that a person is who they say they are. An AML check includes that, and adds screening, beneficial ownership for corporate clients, the purpose of the relationship, a risk assessment, and ongoing monitoring. Treating identity verification as the whole of an AML check is the most common compliance gap, and it is one HMRC and professional-body inspectors look for directly.
Answer-first summary
What is an online AML check?
An online or electronic AML check uses data sources and document-validation technology instead of manual document inspection. MLR 2017 does not mandate or prohibit any particular method: Regulation 28 asks for verification from a reliable, independent source. Electronic checking qualifies where the firm can explain why the source is reliable and retains the evidence, which means understanding what the tool actually checks.
Answer-first summary
What are adverse media checks?
An adverse media check searches news and public sources for negative information about a client, such as reporting on fraud, corruption, or criminal proceedings. It is not separately mandated by name in MLR 2017, but it is a normal component of enhanced due diligence and of PEP risk assessment, because it surfaces risk that list-based screening alone will not.
Answer-first summary
Who has to carry out AML checks in the UK?
Firms in scope of MLR 2017 Regulation 8, which includes accountants, auditors, tax advisers, bookkeepers, legal professionals, estate and letting agents above thresholds, trust or company service providers, high-value dealers, art-market participants, cryptoasset firms, and financial institutions. Each has a designated supervisor: HMRC, the FCA, a professional body, or the Gambling Commission.
Answer-first summary
What records should be kept from an AML check?
Keep what was checked, when, against which source, the result, and the reasoning behind any decision, including decisions to proceed despite a flag. MLR 2017 Regulation 40 requires customer due diligence records to be kept for five years from the end of the relationship or the completion of the transaction. Records of a check carried out for Companies House purposes as an Authorised Corporate Service Provider are kept for seven years.
Read this from the role you hold in the AML process
AML content is only useful if it helps the right person make the next decision: sign off, escalate, collect evidence, train the team, or change the workflow.
Partner / director
Use this guide to understand ownership, supervision exposure, and what must be signed off at firm level.
ContinueMLRO / MLCO
Use it to check evidence, escalation, review cadence, and whether the file would stand up in an inspection.
ContinueClient-facing team
Use it to explain the requirement to clients and capture clean notes before the work becomes harder to evidence.
ContinueQuality standard for this guide
- Maps the topic to the UK AML framework rather than treating it as a generic compliance concept.
- Separates what the regulation requires from what a practical firm workflow should evidence.
- Links the topic to adjacent decisions, so readers can move from learning into implementation.
Related guides
ID documents accepted for AML checks
Which documents work, expired documents, biometric passports, and proof of address.
Customer Due Diligence: UK guide
MLR 2017 Reg 28 in depth.
Enhanced due diligence
What triggers EDD and what it adds to a standard check.
IDVT checks explained
The technology behind electronic identity verification, and its limits.
Source of funds
What to ask for, how far back, and what to do when a client cannot evidence it.
AML record keeping
What to retain from a check and for how long.