AML + CARF in one check. No documents.

Regulation 28: the substantive basis for identity verification

Regulation 28 of the Money Laundering Regulations 2017 requires customer identity to be verified from a reliable and independent source. This is the substantive legal foundation on which WhyAML's verification methodology stands.

The standard it sets is technology-neutral: FATF Recommendation 10, which Regulation 28 implements, permits verification from information or data rather than documents alone. It is met by cumulative evidence to a standard of reasonable certainty - the approach the JMLSG Guidance describes (Part I, Chapter 5), under which a single check is normally insufficient on its own, and the basis on which WhyAML's layered evidence is assessed.

A regulated financial institution that has performed customer identity checks under its own regulatory obligations is such a source. At present these are FCA-registered crypto-asset firms, supervised for anti-money-laundering purposes under the Regulations; a later phase extends this to FCA/PRA-authorised banks, accessed through read-only Open Banking. WhyAML does not adopt or rely on that institution's due diligence - Regulation 39 (reliance on third parties) is not engaged - it independently witnesses the individual's authenticated, ongoing control of the relationship. Regulation 39 governs reliance on another regulated firm's completed due diligence under a written arrangement; here the institution is unaware of the check and supplies nothing, so the arrangement that would make it reliance never arises - consistent with HMRC's position that electronic verification of this kind is the firm's own due diligence, not a reliance arrangement (Economic Crime Supervision Handbook, ECSH33357).

What the method produces is a verification anchored in a real, regulated relationship with genuine economic activity: a fraud-traceable record at an accountable institution, rather than a static document that can be forged. This is what the anti-money-laundering regime exists to enable.

Regulation 28 is the rule that makes the method lawful. It is distinct from Regulation 19(4)(c), which is the procedural rule under which a firm records its decision to adopt the technology.