The UK will add 500 new officers to its AML enforcement team as part of a crackdown on “dirty money networks.” The strategy also includes investments in intelligence capabilities and advanced technologies. But a glaring problem with determining
Regulatory guidance on how businesses should complete digital identity verification to stay compliant with AML regulations is inconsistent. HM Treasury’s guidance direct financial service providers to Digital Verification Service (DVS) providers certified in the UK. The Financial Conduct Authority (FCA)
The government says it will invest 500 million pounds (roughly US$667 million) under its new “Anti-money laundering and asset recovery strategy 2026-2029.”
Money laundering through the UK and its corporate structures surpasses £100 billion ($133 billion) a year, according to National Crime Agency (NCA) figures.
BioCatch Director of Global Advisory for EMEA says “the real test will be whether it helps stop illicit funds entering and moving through the financial system in the first place.” Once dirty money enters the system, it moves fast, making enforcement a concern secondary in his eyes to spotting suspicious behaviour as it happens.
“And yet, banks, insurers, fintechs and others seem strangely disinterested in using DVS for digital onboarding and to combat fraud,” digital identity law expert Richard Oliphant says in a LinkedIn post.
“Reforms to anti-money laundering supervision provide a golden opportunity to strengthen the supervision of professional services, ensure more consistent oversight and help us identify and disrupt crime,” says FCA Executive Director of Enforcement and Market Oversight Steve Smart in the new strategy announcement.
HM Treasury and the Office for Digital Identities and Attributes (OfDIA) released guidance in February on how those services can meet the Money Laundering Regulations 2017. That guidance raised questions which have only become more pressing with the launch of the new AML crackdown.
Certification conflict creates compliance confusion
Customer Due Diligence (CDD) obligations under Regulation 28 through a certified DVS provider, according to HM Treasury and OfDIA’s guidance. That means firms relying on a digital verification service to satisfy Regulation 28 cannot assume an uncertified provider meets the government’s standard for compliant identity verification.
But OfDIA recently surveyed 39 DVS providers for international operability and found only 14 were certified against what was then called the DIATF.
Worse, this directly conflicts with Regulation 28, which states Qualified Trust Service Providers (QTSPs) under the EU’s eIDAS are considered reliable.
Further, Good Practice Guide (GPG) 45 defines “Levels of Confidence” for digital onboarding, but the government’s AML guidance does not specify which one applies.
The government’s new strategy is explained over 100 pages. The DVS Trust Framework merits only a single mention, in a two-paragraph section on digital ID. One of the 50 actions included in the strategy is to streamline compliance with technologies like digital ID and AI.
On this matter, the government assures stakeholders, “Sector guidance bodies are developing more technical guidance,” naming HM Treasury and the Department for Business, Innovation, Science and Trade (BIST, which took over responsibilities from DSIT when it closed) responsible for the digital ID side.
Oliphant points out that in contrast the FCA, though responsible for policing the financial services sector’s AML compliance, “makes no mention of DVS on its website, in its Handbook, in policy statements or in any AML guidance.”
OfDIA has reported that the UK’s digital identity sector made £2 billion ($2.7 billion) in the latest fiscal year, but the majority of the firms it counted are not DVSTF-certified.
Oliphant tells Biometric Update in an email the numbers reveal that a lot of revenue is going to uncertified identity providers, and that the uptake of DVS in financial services is less than expected.
Article Topics
AML | BioCatch | digital verification service (DVS) | financial crime | identity verification | onboarding | Richard Oliphant | UK digital ID
Leave a comment