Regulatory Compliance
How WhyAML meets UK AML regulations through data ownership and institutional verification.
Money Laundering Regulations 2017
The MLR 2017 requires obliged entities to verify client identity from a reliable and independent source. WhyAML satisfies these requirements by verifying the user's existing status at regulated financial institutions.
Key Regulations
Your client's verified status at an FCA-supervised institution is a reliable, independent source. The institution already verified them. WhyAML's Witness Model proves your client controls that verified account. Regulation 28 is technology-neutral - it prescribes no single method - so WhyAML is not a Digital Verification Service (DVS) and does not need to be: the regulated institution is the reliable source.
The MLR allows businesses to adopt new verification technologies provided they document their risk assessment. WhyAML provides a complete Technological Due Diligence (TDD) pack for your Practice-Wide Risk Assessment.
WhyAML does not rely on the institution's due diligence under Regulation 39. The firm performs its own CDD, using WhyAML to independently witness the client's authenticated relationship - so no written reliance agreement is required or claimed.
Two gateways bring a cryptoasset business within the Regulations, and WhyAML passes through neither. It is not a custodian wallet provider under Regulation 14B(2): it holds no keys, safeguards nothing and administers nothing - the customer signs from a wallet they alone control. It is not a cryptoasset exchange provider under Regulation 14A(1): settlement is same-chain, so nothing is exchanged for anything, and any conversion between money and cryptoassets happens earlier, at the customer's own FCA-registered venue. With no exchange occurring in the flow, the arranging limb has nothing to attach to.
The law requires 5-year retention. WhyAML's on-chain Compliance Token is immutable and permanent - exceeding the regulatory requirement automatically.
Need this provision by provision? See the full regulatory mapping or read the legal questions in the FAQ
Data Ownership
WhyAML's approach is built on a fundamental principle: your client's verified status belongs to them, not to the institution that recorded it.
Collect, store, hope nothing happens
- You collect passport copies
- You store sensitive documents
- You bear the breach liability
- Your client's data proliferates
- Each firm becomes a honeypot
Prove what they already own
- No documents collected
- Your client proves what they already own
- Compliance Token belongs to them
- You receive a certificate - not their passport
- Nothing for hackers to steal
We don't ask the institution for permission. We help your client assert a fact.
New to the idea? See the whole approach in one place
GDPR & DUAA 2025
WhyAML is designed with privacy-first principles. Under UK GDPR and the Data (Use and Access) Act 2025, by not collecting identity documents we don't just minimise your data-protection burden - we remove the data that creates the greatest breach risk.
Data Minimisation in Practice
- Name
- Address
- Wallet address
- Passport images
- Utility bills
- Bank statements
- Selfies / biometrics
Concerned about client data specifically? Read what we do and do not hold
HMRC Supervision
HMRC supervises estate agents, accountants, and other MLR-obliged entities. WhyAML provides audit-ready documentation that demonstrates you've taken reasonable steps to verify client identity.
What HMRC Inspectors Look For
- Evidence of CDD procedures being followed
- Risk-based approach documented
- Records of identity verification
- Ongoing monitoring processes
- Compliance Certificate for every client
- TDD documentation for your PWRA
- Timestamped, immutable audit trail
- Perpetual monitoring records
Want to see why this stands up to scrutiny? Read the architectural brief
FCA Guidance
The FCA provides guidance on AML compliance. WhyAML aligns with FCA expectations for proportionate, risk-based verification.
FCA Principles We Follow
- Proportionate measures based on risk
- Verification from regulated institutional sources
- Clear audit trail and documentation
- Ongoing monitoring and review
Want the detail behind the confidence levels? See how the verification works
CARF (live since 2026)
The Crypto-Asset Reporting Framework requires a tax-residency determination for crypto-active clients. WhyAML supplies economic-residency evidence from authenticated activity to support that determination.
CARF Requirements
- Tax Identification Number (TIN) collection
- Tax residency determination
- Due diligence records
- Annual reporting to HMRC (first reports May 2027)
The Compliance Token
Every WhyAML verification produces a Compliance Token - an on-chain, immutable record of verification. It belongs to your client, not to you and not to us.
Compliance Certificate
A clear, downloadable PDF confirming verification was completed, the confidence level achieved, and when it took place. This is your evidence of compliance.
You store it. You own it. This is what you show HMRC.
Compliance Token
A secure digital record stored in their own wallet. It belongs to them. They control it. They can choose to use it again.
This is data ownership in practice - ahead of where the rules are heading.
Traditional verification records are stored by businesses who may lose them, get hacked, or go out of business. The Compliance Token is permanent, independently verifiable, and cannot be lost, altered, or deleted.
It exceeds the 5-year retention requirement automatically.
Satisfied it stands up? See pricing or compare it side by side
When a client won't send a passport
The no-document position in practice - how Reg 28 is satisfied without collecting anything.
No selfie, no app
Why removing biometrics and document capture lowers your data-protection burden, not your compliance.
Clients with no UK address
Verifying expats and overseas clients through a regulated account they already hold.
Ready to simplify compliance?
WhyAML handles the regulations. You handle your business.