Blogs
Client due diligence tools are software that verifies who a client is, establishes who owns and controls it, and screens those people for sanctions, politically exposed person (PEP) and adverse media risk, with every step recorded for audit. For insurers, MGAs and brokers the client is often another business, so the work centres on ultimate beneficial owners (UBOs), directors and officers rather than one individual’s identity. A good tool collects declarations from the client, checks them against independent sources and keeps watching after onboarding. This post sets out what the UK Money Laundering Regulations 2017 expect, what a tool needs to do, how to choose one and how to keep records current.
Customer due diligence (CDD) is the process of identifying a client, verifying that identity and understanding the relationship before and during trading. Regulation 28 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 sets out the measures, and regulation 27 sets out when they must be applied: when a business relationship is established, when money laundering or terrorist financing is suspected, and when the firm doubts documents it has already obtained.
Many insurance firms apply the same standard to business counterparties regardless, because the FCA expects firms to control financial crime risk and because sanctions obligations apply to everyone. The tests in regulation 28 are also a sensible benchmark. When your client is a company, the regulation requires you to obtain and verify the company’s name, registration number and registered office, and to take reasonable measures to determine the names of its directors and senior managers. You must also understand its ownership and control structure and identify and verify its beneficial owners.
That is where insurance gets harder than retail. The “client” may be a broker, a coverholder, an MGA or an intermediary in a long distribution chain. Looking through the company to the people behind it is the core of the job, and it is slow to do by hand across hundreds of relationships.
Under regulation 28, CDD on a body corporate has several parts. You identify and verify the client. You assess the purpose and intended nature of the relationship. You verify that anyone acting on the client’s behalf is authorised and identify them too. You establish who the beneficial owners are and take reasonable measures to verify them.
For a company, regulation 5 defines a beneficial owner as an individual who ultimately owns or controls, directly or indirectly, more than 25% of the shares or voting rights, who exercises ultimate control over management, or who otherwise controls the company. Companies House applies a similar test to people with significant control (PSCs), including the power to appoint or remove a majority of directors.
The depth of checking is risk-based. Regulation 28 requires the extent of CDD to reflect your risk assessment and the risk in each case, and you must be able to show your supervisor that the measures are appropriate. In practice that means simplified, standard and enhanced due diligence, applied according to the client’s risk profile.
A client due diligence tool earns its place if it replaces the manual steps below with a single, recorded workflow. These are the capabilities to look for, in the order a case normally moves.
The tool should retrieve the company’s registered details and officer and PSC information automatically, then flag anything that does not match what the client has told you. Typing registry data into a spreadsheet is where most errors enter the file.
Good tools also work beyond the UK register. Insurance chains cross borders, and a coverholder or reinsurance intermediary may sit under a foreign parent with a very different disclosure regime.
Registry data tells you what has been filed. A declaration tells you what the client says today, signed by a named person. A tool should send structured requests to the client, capture declarations on UBOs, directors and officers, and store them against the client record with a timestamp.
REG Network handles this through its UBO, director and officer declarations feature, which sits inside the platform rather than in a separate form tool.
Every beneficial owner, director and officer identified in steps one and two should be screened, not just the client entity. A company can be clean while the person who controls it is on a sanctions list or is a PEP. Screening should run at onboarding and again whenever the underlying data changes.
The tool should apply your risk appetite consistently, score each client and send higher-risk cases to a reviewer with the evidence attached. Consistent scoring matters because regulation 28 expects you to justify the extent of your checks to your supervisor.
Every request, response, check and decision should be logged with who did what and when. When the regulator or a capacity provider asks how you reached a decision on a client two years ago, the answer should be one click away rather than an email search.
Public registers help, but they are not enough on their own. Since 18 November 2025, regulation 28(9) states that firms do not meet their beneficial ownership requirements by relying solely on information delivered to the registrar. You need to take your own reasonable measures to verify who the beneficial owner is.
The reasons are practical. Registers differ by country, and some overseas jurisdictions publish little or nothing. Ownership is often layered, with one company owned by another, so you must follow the chain until you reach individuals. Where the beneficial owner is itself a company or trust, regulation 28 requires reasonable measures to understand that structure too.
Data also goes stale. Companies House guidance says a company must tell it about changes to PSC information within 14 days of confirming the change, but that only helps you if you are watching for the update. And some clients simply do not disclose. Companies House guidance treats refusal to provide PSC information as a criminal offence, and a person who does not respond to a notice within one calendar month, or gives false information, can face up to two years in prison, a fine or both.
The workable answer combines self-declaration with independent verification. The client declares who owns and controls it, and the tool tests that declaration against registry data, screening results and previous declarations. Where you have exhausted all possible means of identifying the beneficial owner, regulation 28 allows you to treat the senior person managing the company as its beneficial owner, but only if you keep written records of every action you took. A tool that logs those attempts automatically makes that fallback defensible.
Start with the work your team repeats most, and test each tool against it. These criteria separate tools that save time from tools that move the problem.
Ask whether the tool supports a proactive or reactive approach. A reactive tool reports what was true on the day you checked. A proactive tool tells you when something changes, which is the difference between finding out at renewal and finding out the same week. Also check whether it is built for insurance. A generic tool will not understand a coverholder, a delegated authority relationship or a distribution chain.
REG’s research found that 51% of general insurance firms still rely on spreadsheets. If spreadsheets are your current process, the comparison to make is not tool against tool. It is tool against the manual workload it replaces.
Regulation 28(11) requires ongoing monitoring of a business relationship, including reviewing existing records and keeping CDD documents and information up to date. Regulation 27 goes further and requires CDD to be applied again at other appropriate times to existing customers on a risk basis, and when you become aware that a customer’s circumstances relevant to its risk assessment have changed. It lists examples to consider, including any indication that the identity of the customer or its beneficial owner has changed.
That makes trigger events the heart of ongoing CDD. Typical triggers are a change of director or PSC, a new sanctions designation, a change in a client’s regulatory status and a change in the nature of the relationship. A periodic refresh still has a place for lower-risk clients, but a calendar alone will miss a change that happens the week after the review.
This is the job of continuous monitoring. REG Network monitors counterparties for changes and sends alerts, so a team reviews exceptions rather than re-running every check. Combined with declarations, it keeps the record of who owns and controls each client current without a manual re-papering exercise. For the wider picture of verifying businesses and the people behind them, see our guide to KYC and KYB checks for insurers.
Client due diligence is a legal and commercial discipline, and for business clients it is a beneficial ownership discipline. The Money Laundering Regulations 2017 expect you to identify and verify the people behind a company, understand how it is controlled and keep that information current. Public registers are not a substitute for your own verification. The right tool collects declarations from directors, officers and UBOs, checks them against independent data, screens every individual and records each step. Firms that move from periodic, manual checks to continuous, audit-ready oversight spend less time on paperwork and find problems sooner.
Client due diligence is the process of identifying a client, verifying that identity and understanding the purpose of the relationship before you trade, then monitoring it afterwards. For a company it also means identifying its beneficial owners, directors and senior managers and understanding how it is owned and controlled. The level of checking depends on the client’s risk.
Client due diligence tools combine company registry data, declaration collection, sanctions, PEP and adverse media screening, risk scoring and an audit trail. Some run only at onboarding. Others, such as REG Network, also monitor clients continuously and alert you when directors, owners or screening results change.
Ask the client to declare its beneficial owners, then test the declaration against independent sources such as registry data and screening results. Follow ownership through any intermediate companies until you reach individuals. Do not rely only on the public register. Regulation 28 requires reasonable measures to verify identity, and you should keep records of what you did.
Monitor registry and screening data continuously and set alerts for changes of director, owner or sanctions status. Then re-run checks when an alert fires. Comparing each new declaration with the last one also shows what changed. This is more reliable than a fixed annual review, which can miss changes between dates.
Enhanced due diligence is the deeper version of client due diligence that applies to higher-risk clients, such as those linked to higher-risk countries or involving a PEP. It typically means more evidence on ownership, more scrutiny of the relationship and senior sign-off. Standard due diligence applies where risk is ordinary.
Head of Product
Sandra Simões is Head of Product at REG Technologies, sharing insights on delegated authority, PEPs, UBOs, onboarding journeys, and compliance technology solutions.
In the UK, one of the biggest challenges facing insurance firms is to obtain UBO information as part of AML due diligence. If you do not get your UBO screening and reporting right, it can result in significant increases in risks of financial crime and ultimately, penalties and fines...
Regardless of their role in an insurance deal, brokers must verify that their potential clients and trading partners aren't barred from entering insurance transactions. However, carrying out these checks can be a challenging task. What is the impact of the task and responsibilities brokers have and how can they manage risks?
The insurance industry and the regulatory requirements around counterparty risk is always evolving, and so the obligations to minimise the risk and safeguard customers is becoming much more challenging for insurance companies. In the wake of COVID-19, financial crime continues to increase and whilst not all of these can be stopped, it is crucial they are recognised.
In today's rapidly evolving business landscape, regulatory compliance has become a significant challenge for financial institutions and other regulated industries. The ever-changing and complex regulatory requirements place a heavy burden on organisations, leading to increased costs, resource allocation, and operational inefficiencies. However, a silver lining appears through the rise of compliance software, which serves as an innovative solution to manage the abundance of regulatory requirements...
The FCA and US Authorities are committed to enforcing anti-corruption and anti-money laundering laws and regulations to protect the integrity of the financial system and to prevent financial crime. In this article we look at the risks and the controls financial services firms should consider...
Choose a time to suit you and meet one of our experts
Book a solutions call with usOur monthly round up of news and views in the insurance and financial services world!
"*" indicates required fields
By signing up for newsletter updates you agree to our privacy policy.
