Regulatory compliance mapping
How WhyAML's verification methodology maps against each applicable provision of the UK AML regulatory framework.
Each regulation is assessed with the specific WhyAML mechanism that addresses it. The standard applied is adversarial - each entry is written to withstand challenge.
The full Regulatory Compliance Mapping document - with complete evidence tables, known limitations analysis, and gap assessment - is available in your client portal after onboarding.
Money Laundering Regulations 2017
Customer Due Diligence - Identity Verification
Requirement: Verify identity from a reliable source independent of the person.
How WhyAML satisfies: Identity is verified by a provider certified under the UK Digital Verification Services Trust Framework and listed on the OfDIA register, from bank-held data reached through the individual's own online banking. The HMT/DSIT joint guidance of 26 February 2026 recognises a certified and registered service as a reliable and independent source for Regulation 28. The minimum identity profile accepted is GPG45 M1C, and the profile achieved, together with the concordance of the firm's entered particulars against the verified attribute set, is recorded on the Certificate. The Witness Model then binds that verified person to authenticated control of the regulated institution account and the wallet from which value moves. Each stage is structurally independent of the individual's self-report.
Digital Verification Services - Certified Provider
Requirement: Approved guidance recognises certified DVS as a reliable source and cautions that non-certified DVS are unsuitable for MLR identity verification.
How WhyAML satisfies: The identification stage is performed by a certified and registered DVS, which is the route the guidance expressly recognises. WhyAML itself is not the DVS and does not create a digital identity; it routes the individual to the certified provider, receives only the verified attribute set and the identity profile achieved, and transmits no personal data to the provider. The provider's name, OfDIA register entry and certified role are set out in Schedule 1 Part A of the firm's own Technological Due Diligence document, so the firm can verify the register entry from its own file. Attribution through the Witness Model is additional evidence, not a substitute for the certified identification.
Custodian Wallet Provider - Not In Scope
The test: Safeguarding, or safeguarding and administering, cryptoassets or private cryptographic keys on behalf of customers.
Our position: WhyAML holds no keys, safeguards nothing and administers nothing. The customer signs from a wallet they alone control; no private key, seed phrase, or signing authority passes to WhyAML or to the merchant at any point in the flow.
Cryptoasset Exchange Provider - Not In Scope
The test: Exchanging, or arranging to exchange, cryptoassets for money or another cryptoasset.
Our position: Settlement is same-chain - the customer sends a stablecoin and the merchant receives the same stablecoin on the same network. Nothing is exchanged for anything. Any conversion between money and cryptoassets happens before WhyAML is involved, at the customer's own FCA-registered venue. With no exchange occurring in the flow, the arranging limb has nothing to attach to.
Risk Assessment - New Technologies
Requirement: Assess risks of new technologies adopted for AML prevention.
How WhyAML satisfies: The TDD document constitutes that assessment. It sets out the method stage by stage, records the particulars of the certified verification service relied upon, and identifies the risks of adoption with the mitigation for each. G-RADE™'s tiered proof architecture operationalises proportionate scrutiny at the attribution stage - higher-risk individuals go through more proof elements.
Timing of Verification
Requirement: Verification must be completed before the business relationship is established.
How WhyAML satisfies: Compliance Token and Compliance Certification issued only on full completion. Near-Approved Status is a commercial communication only - firms must not treat it as completed verification.
Enhanced Customer Due Diligence
Requirement: Apply enhanced measures to higher-risk clients.
How WhyAML satisfies: G-RADE™'s low-confidence path maps directly to Regulation 33. Individuals whose score indicates elevated risk are automatically routed through additional proof elements.
Reliance on Third Parties
Requirement: Formal written agreement required for third-party reliance.
How WhyAML satisfies: Regulation 39 is not engaged by either stage. The firm is performing its own CDD using WhyAML as a technology tool, not delegating CDD to a third party. The source institution witnessed at the attribution stage is unaware of the check and supplies nothing, so the written arrangement that would make it reliance never arises - consistent with HMRC's position that electronic verification of this kind is the firm's own due diligence (ECSH33357). No written reliance agreement is required or claimed.
Record Keeping
Requirement: Retain CDD evidence for 5 years.
How WhyAML satisfies: Satisfied automatically and permanently by the on-chain Compliance Token. The blockchain record is independently verifiable by any regulator without depending on the firm's record-keeping.
Ongoing Monitoring
Requirement: Keep verification information up to date throughout the business relationship.
How WhyAML satisfies: Where the client transacts, verification is performed in full at each movement of value: screening is re-run, control is re-established, and a determination is produced for that movement alone. No prior determination is cached. Where the method is used in verification-only mode and no movement occurs, the verification is point-in-time and the Regulation 28(11) obligation remains the firm's own; it is not represented as discharged by the platform.
Data (Use and Access) Act 2025
Data Minimisation Mandate
Requirement: Collect only the minimum data necessary.
How WhyAML satisfies: WhyAML holds name, date of birth, address, country of residence and email address - the attribute set returned by the certified verification service - together with the wallet address used for the payment. No identity documents, no biometrics, no financial account details. No personal data is transmitted to the verification service; the individual authenticates with their own bank directly. Structurally aligned with data minimisation.
Individual Rights - Subject Access and Erasure
Requirement: Individuals can access and request deletion of their data.
How WhyAML satisfies: SARs directed to Go 2 Glory Ltd as data controller. The firm holds no personal data to disclose. Compliance Token on-chain is not personal data.
Crypto-Asset Framework & GDPR
Crypto-Asset Reporting Framework
Requirement: Report crypto-linked tax residency.
How WhyAML satisfies: The certified identity verification returns a verified country of residence. WhyAML's behavioural geolocation and institutional connection verification supply the supporting evidence of real economic activity that CARF expects. The determination remains the firm's.
Originator and Beneficiary Information
Requirement: Identify originator/beneficiary for crypto transfers.
How WhyAML satisfies: The attribution stage produces a verified natural person bound to a specific self-hosted address, with the binding established by the customer's own signature over the transfer before value moves. This is the evidence a crypto-asset service provider needs to verify ownership or control of a self-hosted address. It is a statement of capability: WhyAML is not a crypto-asset service provider and the obligation attaches to the providers upstream and downstream of the transfer, not to the firm.
Automated Decision-Making
Requirement: Individuals have rights regarding automated decisions.
How WhyAML satisfies: G-RADE™ determines the proof path, never the outcome. No individual is rejected - more evidence is required for lower-confidence profiles. Pre-emptively addresses automated decision-making concerns.
Full compliance mapping in your portal
The complete document - with full evidence tables, known limitations, gap analysis, and document control - is available to clients in the WhyAML portal.