Private client onboarding is the procedure through which a bank, broker, fund or trust company establishes who the client is, who ultimately owns the money, where it came from and how the account will be used. For a wealthy individual with assets in several countries it is repeated with every provider and again at every file review. It works in much the same way almost everywhere because a single standard drives it; what varies is the depth, the documents and the timing.
Related narrower topics — PEPs, source of funds, sanctions screening, FATCA/CRS self-certification and corporate KYC — have their own articles and are summarised here only as far as the onboarding path requires.
Concept
AML/KYC stands for anti-money laundering and know your customer rules. The global benchmark is set by the FATF: around forty direct members and nine regional bodies through which its 40 Recommendations reach more than two hundred countries. The FATF was created at the G7 summit in Paris in 1989, published its first set of recommendations in 1990, had its mandate extended to terrorist financing after 11 September 2001, and has had an open-ended mandate since 2019.
The core of onboarding is Recommendation 10 on customer due diligence (CDD). It requires four things: identifying the customer and verifying their identity "using reliable, independent source documents, data or information"; identifying the beneficial owner and taking reasonable measures to verify their identity; understanding the purpose and intended nature of the relationship; and conducting ongoing due diligence on the relationship and its transactions. Verification takes place before or during the establishment of the relationship; it may be completed later only where the risks are effectively managed and this is essential not to interrupt the normal conduct of business. Where CDD cannot be completed, the institution does not open the account or terminates the relationship, and considers filing a suspicious transaction report.
A risk-based approach sits on top. Higher risk triggers enhanced due diligence (EDD): additional information on the customer, source of funds and source of wealth, senior management approval and enhanced monitoring — all listed by the FATF in the interpretive note to the same Recommendation. Lower risk allows simplified measures. Existing customers are reviewed "on the basis of materiality and risk" and at appropriate times, so onboarding never really ends.
The key point for the client follows: questionnaire items are not arbitrary. Each one maps to one of the four CDD elements or to a risk factor, and how predictable onboarding is depends on how far in advance the answers to all four are prepared.
The onboarding path, step by step
The order shifts between providers and some steps run in parallel, but the set is the same.
- Pre-screening. Before a formal application the provider checks whether the client fits its risk appetite: citizenships and residences, country of origin of the wealth, industry, expected amounts, links to PEPs and sanctions. At a private bank this is a conversation with the relationship manager; at a neobank it is automated filtering in the app. Many private banks set a minimum asset threshold, and some providers keep closed lists of countries whose residents they do not serve. A refusal at this stage may come without explanation.
- Identification and verification. Passport or ID card, address, date and place of birth, nationality; the document is checked in person, through a certified copy or remotely — video, chip reading, digital identity. Under the FATF standard verification happens before or during the establishment of the relationship; the US customer identification rule allows it to be completed within a reasonable time after the account is opened.
- Tax residence. FATCA and CRS self-certification listing every country of tax residence and TIN; it is cross-checked against the rest of the file.
- Purpose of the relationship and expected activity. Which products, what amounts, where payments will come from and go to, which countries and counterparties. These answers become the benchmark for later monitoring.
- Source of wealth and source of funds. How the overall wealth was built and where the money for the first and subsequent deposits comes from; documents and an explanation of plausibility.
- Screening. The client, beneficial owners and connected persons are checked against sanctions lists, PEP databases and adverse media.
- Risk rating. An overall score across customer, country, product and channel factors; it drives the extent of EDD, the approval level and the review frequency.
- EDD and approval. For high risk, additional documents and a decision by senior management or a committee; for a foreign PEP senior management approval is mandatory.
- Ongoing monitoring and refresh. Transactions are compared with the profile from step 4, and the file is refreshed periodically.
- Re-KYC triggers. A change of residence, nationality, PEP status or ownership structure, an unusual transaction or an adverse media hit — any of these starts an unscheduled review.
Identification and verification
Documents and address
The core data set for an individual is almost identical everywhere: full name, date and place of birth, nationality, residential address and, for tax purposes, TIN. The verifying document is a passport or national ID card with a photograph; address is evidenced by a utility bill, bank statement, tenancy agreement, registration certificate or tax document. The list of acceptable documents is set by each provider in its own policy.
Regulators take different views on address. As early as 11 October 2017 the HKMA clarified that for AML/CFT purposes institutions need only collect address information for customers and beneficial owners, without documentary evidence; where a bank still asks for it under group or overseas rules, it should explain why. In the United States the customer identification rule at 31 CFR 1020.220 requires name, date of birth, address and an identification number before the account is opened. For a non-US person, instead of a TIN, a passport number with country of issuance, an alien identification card number or the number of another government-issued photo document evidencing nationality or residence will do. Where there is no street address, the address of next of kin or another contact individual is permitted.
Digital identification
Remote onboarding in the EU is governed by the EBA Guidelines EBA/GL/2022/15, which apply from 2 October 2023. They distinguish attended verification, where the customer interacts with an employee by video, from unattended verification, where liveness detection is required. Strong and reliable algorithms check that the photograph or video matches the picture in the document. Where the document carries a chip readable by the device (NFC), the institution should consider using that data to check consistency with other sources. If the evidence is of insufficient quality, the process is interrupted and restarted or redirected to face-to-face verification.
The next step is state-issued digital identity. The eIDAS 2.0 Regulation (EU) 2024/1183 requires Member States to provide European Digital Identity Wallets to citizens by the end of 2026. Private relying parties required by law or contract to use strong user authentication, banks and financial services included, must accept the wallet at the user's request no later than 36 months after the implementing acts enter into force (Article 5f(2) of Regulation 910/2014 as amended by eIDAS 2.0). In Switzerland FINMA ran a consultation from 16 December 2025 to 27 February 2026 on revising Circular 2016/7 on video and online identification to accommodate the state E-ID.
In the United Kingdom the government confirmed in guidance of 26 February 2026 that verification through a provider certified under the UK Digital Identity and Attributes Trust Framework and entered on the OfDIA register (on a statutory footing under the Data (Use and Access) Act 2025) satisfies regulation 28 of the MLRs. Using such services is voluntary; responsibility for CDD remains with the firm.
Certified copies, apostille, translations
Where a document cannot be presented in person, the provider accepts a certified true copy. Who may certify is set by each bank, and the lists are specific. The HSBC Hong Kong checklist for overseas companies lists certifiers including regulated lawyers, notaries and auditors/CPAs, and requires an English translation of documents not in English or Chinese. DBS Singapore accepts independent certification for offshore companies by listed professionals in FATF member countries; persons connected with the client may not certify.
A foreign official document — a registry extract, a birth or marriage certificate, a probate or inheritance ruling — often needs an apostille in the provider's country. According to the status table of the 1961 Hague Convention, it has applied to Russia since 1992, to China since 7 November 2023, to Singapore since 2021, to Canada since January 2024 and to Vietnam since 11 September 2026. The UAE is not a party, so its documents still require consular legalisation. The required form of translation — sworn, notarised or certified — is stated in each provider's requirements.
Document "freshness" is set by providers' internal policies; neither the FATF nor the EU fixes a single period. HSBC Hong Kong accepts an incumbency certificate or company search no older than six months, DBS an incumbency certificate up to one year old. Validity, issuer, certifier, language and the need for an apostille are therefore agreed with the specific bank before documents are ordered.
Non-standard cases
The UK regulator expressly treats the ability to serve customers who lack standard documents as good practice and treats applying the same CDD to customers of differing risk as a failing. In practice this means three typical situations.
A digital nomad without a permanent address is best served by relying on the address in the country of tax residence or the country that issued the residence permit, and describing the living pattern in the questionnaire. A mismatch between address, residence and passport is the main reason for follow-up questions, so the explanation is prepared in advance and matches the CRS self-certification.
For a student without independent income, the source of funds is family support, evidenced by transfer records and the parents' income documents; documents from the educational institution help with address. A client who has recently moved benefits from any official document from the new country — residence permit, registration, tax number, employment contract.
Tax residence and self-certification
FATCA and CRS self-certification is a separate form in the onboarding pack: every country of tax residence, a TIN for each, Form W-9 for US persons and Form W-8BEN or the bank's equivalent for everyone else. Entities add their classification and details of controlling persons. For US citizens and tax residents, Form W-9 means FATCA reporting to the IRS via an intergovernmental agreement, and some foreign providers limit service to US persons as a result — see banking for US citizens abroad.
The form is subject to a reasonableness test: the provider may not rely on a self-certification it knows or has reason to know is unreliable, and cross-checks it against KYC documents. Since 1 January 2026 the amended CRS has applied in the EU through DAC8, and whether a valid self-certification was obtained has become a reporting field in its own right. An open self-certification is no longer an internal bank note; it goes into international exchange.
Purpose of the relationship, source of wealth and source of funds
Answers on account purpose and expected activity become the profile against which every transaction is later compared. Understated expectations are worse than overstated ones: the first large transfer falls outside the profile and immediately triggers a request.
Source of wealth and source of funds are distinct: the first explains how the overall wealth was built (sale of a business, dividends, inheritance, years of earnings), the second the origin of the specific money in a specific deposit. The FCA treats it as a failing when a firm does not distinguish between them, relies entirely on a single source of information or waives source-of-funds checks without good reason. The Wolfsberg Group expects the review to cover, at a minimum, "the primary, significant contributors to the total or majority of wealth": corroboration from a source independent of the customer is needed in specific cases under local regulation and the institution's policy, and significant gaps or material inconsistencies in the history may lead to further questions, additional documents or independent enquiries. Where corroboration is difficult or impossible — generational wealth, an inheritance received decades ago — the plausibility of the explanation is assessed and key milestones of the wealth history are corroborated.
The evidence follows the type of source. A business sale is supported by the sale and purchase agreement, completion documents and the credit to the account; dividends by company accounts, distribution resolutions and tax returns; an inheritance by the will or grant of probate and the estate distribution documents; earnings by employment contracts and several years of tax returns; a property sale by the contract and a statement showing receipt of the proceeds. The FCA expects firms to establish the legitimacy of, and document, source of wealth and source of funds in high-risk relationships.
In Singapore, MAS on 4 July 2025 imposed penalties of S$27.45 million on nine financial institutions for AML-related breaches; all nine had failed to detect or adequately follow up on red flags that should have cast doubt on some customers' purported source of wealth. The regulator then recalibrated: its Circular AMLD 05/2026 of 25 May 2026 asks firms to corroborate the material or higher-risk sources of wealth rather than every single piece of information, and to avoid repeated rounds of requests that delay onboarding without a clear risk-based justification.
Crypto-assets as a source of wealth
Wealth made in crypto-assets is reviewed under the same rules with a different evidential base: exchange trade histories, statements and tax computations, and wallet addresses from which the provider can trace funds on-chain. The CARF rules — the tax counterpart of CRS for crypto-assets — have applied since 1 January 2026, in the EU through DAC8. Data on a client's crypto-assets therefore increasingly reaches tax authorities automatically, and any gap between the questionnaire and provider reporting becomes visible. Structuring is covered in the article on crypto wealth.
Screening: PEPs, sanctions, adverse media
For foreign PEPs, FATF Recommendation 12 requires senior management approval, reasonable measures to establish source of wealth and source of funds, and enhanced ongoing monitoring; the same applies to family members and close associates. In the EU, after a person leaves office the risk continues to be taken into account for at least 12 months (Article 22 of Directive (EU) 2015/849). For domestic PEPs the UK's FCA FG25/3 of 7 July 2025, following regulation 35(3A) of the MLRs, starts from lower risk: enhanced due diligence still applies, but to a lesser extent than for a foreign PEP. Source of wealth is still asked about, yet in a lower-risk case the firm may rely on information it already holds and make no further enquiries unless anomalies arise. More intrusive checks apply where there is an additional risk factor, and the firm must document its reasoning.
Sanctions screening runs against UN, EU, UK and OFAC lists; in the UK the only source of designations since 28 January 2026 is the UK Sanctions List. Under OFAC's 50% rule, an entity owned 50% or more, directly or indirectly and in aggregate, by blocked persons is itself blocked even if not listed. The rule concerns ownership: an entity controlled by a sanctioned person without such a stake is not automatically blocked, but the bank still reviews control.
Adverse media screening searches for negative coverage of the client and connected persons. A name match is not an identity match; false positives are cleared with date of birth, nationality, transliteration variants and biography.
Risk rating, EDD and approval
The risk rating combines customer factors (PEP status, occupation, ownership structure), geography (countries of nationality, residence, origin of funds and counterparties), and products and channels (remote onboarding, cash, crypto). For a private client geography weighs most, and here the bank consults three different lists.
| List | Composition at date | Consequence |
|---|---|---|
| FATF "call for action" | 19 June 2026: Iran, DPRK, Myanmar | Countermeasures for Iran and the DPRK; risk-proportionate EDD for Myanmar |
| FATF "increased monitoring" | 19 June 2026: 22 jurisdictions, including Monaco and the BVI | The FATF expressly does not call for EDD; applying it is bank policy |
| EU list of high-risk third countries | From 29 January 2026: 26 jurisdictions, including Russia and the BVI | EDD mandatory for all EU obliged entities |
Russia was added to the EU list by Delegated Regulation (EU) 2026/46 on a new ground — suspended FATF membership; Bolivia and the BVI were added by Regulation (EU) 2026/83. The EU list of non-cooperative jurisdictions for tax purposes (Annex I has held ten countries since 17 February 2026, including Russia and Panama) creates no AML obligations of its own but affects DAC6 and defensive tax measures. The lists are covered in detail in the article on the FATF.
In practice EDD means additional source-of-wealth documents, an explanation of the structure, an interview, sometimes an external reputational report and a committee decision. Senior management approval is mandatory for a foreign PEP under Recommendation 12; for other high-risk clients it is required by national rules and institutional policy. This step lengthens onboarding noticeably: the decision is taken at a level that meets on its own schedule.
After opening: monitoring, refresh and re-KYC
Ongoing due diligence is the fourth mandatory CDD element. The bank compares transactions with the questionnaire profile and asks about discrepancies; the FCA treats using any customer contact to update the file, and reassessing risk on material change, as good practice.
The EU's AMLR, applicable from 10 July 2027, sets maximum update intervals for the first time: at least once a year for customers subject to enhanced due diligence and at least once every five years for everyone else (Article 26(2)). Until then, frequency is set by national law and bank policy.
Unscheduled re-KYC is triggered by events: a change of residence or nationality, new PEP status for the client or a relative, a change of ownership structure, a large or unusual transaction, adverse media, or a country being added to a high-risk list. That is exactly how, from 29 January 2026, files of clients with links to Russia and the BVI at EU banks moved into mandatory EDD without any action on their part.
The licensee's view: the file, reliance and supervision
For a financial institution onboarding is above all evidence. FATF Recommendation 11 requires CDD records, account files, business correspondence and the results of analysis of complex transactions to be kept for at least five years after the relationship ends. Supervisors use this trail to test why a client received its risk rating, who approved the relationship and how discrepancies were resolved.
Reliance on third parties under Recommendation 17 is permitted, but ultimate responsibility for CDD stays with the relying institution: it must immediately obtain the necessary information and be satisfied that copies of documents will be provided without delay. That is why a fund receiving a client through a distributor, or a bank receiving one from an external asset manager, often asks again for documents already given to the intermediary.
The FCA lists typical failings in its Financial Crime Guide: the same CDD for different risks, lighter checks on clients referred by senior executives, explanations of unusual transactions accepted at face value, and language difficulties or customer objections getting in the way of proper questioning. The Singapore penalties of 2025 show what AML failings cost. A correspondent bank in turn assesses the institution's programme through the Wolfsberg questionnaires, and the programme itself is described in the article on the compliance stack.
Depth of review by provider type
The standard is the same, but emphasis differs markedly between providers. The table shows typical emphasis, not a universal document list.
| Provider | Depth | What is asked in particular |
|---|---|---|
| Private bank | Maximum, almost always EDD | Full source-of-wealth history, structure, expected assets and flows; in the US, for accounts of $1 million or more for non-US persons — all nominal and beneficial owners, source of funds and account purpose (31 CFR 1010.620) |
| Retail bank | Standard, EDD on triggers | Address and residence, employment and income, first deposit |
| EMI and neobank | Automated, with hard filters | Remote verification, liveness, geolocation; as turnover grows — source of funds and blocking until answered |
| Broker | Standard plus investment profile | Knowledge and experience for appropriateness (MiFID), source of funds for top-ups, tax form |
| Crypto exchange | Standard plus on-chain analysis | Origin of crypto-assets, wallet addresses, transfer data under the Travel Rule |
| Fund and administrator | By investor risk, often relying on the distributor | Subscription pack, qualified investor status, source of funds for the commitment (investor onboarding) |
| Trust company | Maximum across all roles | Settlor and settlor's source of wealth, protector, beneficiaries or their class, letter of wishes, purpose of the structure |
Beyond financial institutions, other obliged entities carry out checks too: notaries, lawyers and auditors in certain transactions, company and trust service providers, estate agents. With the AMLR applying in the EU from 10 July 2027, the perimeter extends to crypto-asset service providers licensed under MiCA, crowdfunding platforms, traders in high-value goods (jewellery and watches over €10,000, cars over €250,000, vessels and aircraft over €7.5 million), operators of investment migration schemes and, from 10 July 2029, professional football clubs and agents. The disclosure pack is the same for all — identity, ownership structure, source of funds — so a file assembled once is reused with every subsequent provider.
For structures between the individual and the asset — a holding company, a trust, a private foundation — the provider unwinds the chain to natural persons. In a trust, the AML beneficial owners are the settlor, the trustee, the protector, the beneficiaries or their class, and anyone else exercising effective control. The trust deed, registers, bank questionnaires and CRS self-certifications must name the same set of roles: since 2026 the amended CRS reports each controlling person's role as a separate field. The corporate pack — constitution, incumbency, board resolution, ownership chart — is covered in the article on corporate KYC; a Companies House certificate with a summary statement (formerly the good standing statement) confirms a company's continuous existence but does not show shareholders or PSCs.
Jurisdictional specifics
United Kingdom. The Money Laundering Regulations 2017, the JMLSG sector guidance (Part I as updated in August 2025, now being revised for the MLR amendments that took effect on 30 June 2026) and the FCA Financial Crime Guide. Distinctive features: a lower starting point for domestic PEPs, recognised digital identity and access to the Financial Ombudsman Service.
EU. Until 10 July 2027 national laws implementing AMLD4 and AMLD5 apply; after that, the single AMLR: beneficial ownership from 25% with holdings multiplied along the chain, a ban on relying solely on the beneficial ownership register, a €10,000 cash ceiling for traders, a €10,000 CDD threshold for occasional transactions and €1,000 for crypto-asset service providers. A non-EU structure discloses its beneficial owner to an EU central register when acquiring EU real estate, vehicles from €250,000, or vessels and aircraft from €7.5 million, and when entering a business relationship with an EU obliged entity that the EU or national risk assessment rates as medium-high or high risk (Article 67 AMLR). Supervision of the largest groups moves to AMLA in Frankfurt. Following the Court of Justice ruling of 22 November 2022, beneficial ownership registers are closed to the public but open to banks, authorities and persons with a legitimate interest. Details are in the article on the EU package.
Switzerland. The Anti-Money Laundering Act and FINMA practice on video and online identification. A foreign PEP is always higher risk, a domestic PEP only with additional factors. From 1 October 2026 the cash payment threshold for checks by dealers in precious metals and stones falls to CHF 15,000, and for real estate dealers checks extend to any cash payment.
Hong Kong. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the HKMA guideline for banks. The distinctive feature is collecting address information without mandatory documentary evidence since 2017.
Singapore. MAS Notice 626 for banks. MAS set out its source-of-wealth expectations in Circular AMLD 08/2024 of 26 July 2024 and a risk-proportionate approach in its Circular AMLD 05/2026 of 25 May 2026. The same day the MAS Managing Director said that these steps are expected to bring the median time to open a private banking account to within a month, from about six weeks or longer for complex cases.
UAE. Federal Decree-Law No. 10 of 2025 on anti-money laundering has been in force since 14 October 2025, with executive regulations in Cabinet Resolution No. 134 of 2025; banks are supervised by the CBUAE. Documents from and for the UAE go through consular legalisation.
United States. The customer identification rule, the CDD Rule at 31 CFR 1010.230 (beneficial owners are each person owning 25% or more plus one individual with significant responsibility for control) and the private banking rules for non-US persons. There is no separate domestic PEP category. After FinCEN's August 2026 rule, the BOI register covers only foreign companies registered to do business in the US.
| Regime | Beneficial owner | PEPs | Cash |
|---|---|---|---|
| EU — AMLR from 10 July 2027 | 25%, indirect holdings multiplied | EDD for foreign PEPs; domestic PEPs without a lower starting point | €10,000 ceiling for traders (Art. 80) |
| UK — MLR 2017 | More than 25% | EDD for all PEPs; for domestic PEPs a lower starting point and lighter measures since 10 January 2024 (reg. 35) | No ceiling; dealers accepting €10,000 or more register |
| Switzerland | At least 25% of capital or votes | Foreign PEPs always higher risk; domestic by factors | Dealer checks above thresholds; CHF 15,000 for precious metals and stones from 1 October 2026 |
| United States | 25% plus one control person | Enhanced scrutiny of private banking accounts of senior foreign political figures; no domestic category | No ceiling; cash over $10,000 is reported |
Refusals without explanation
A refusal without explanation is lawful in some cases: the FATF prohibits disclosing that a suspicious transaction report has been filed and allows an institution not to pursue CDD where the checks themselves could tip off the client. Country and sanctions exposure can also lead banks to exit whole client categories — de-risking; the sanctions framework is mapped in the sanctions cluster map.
What reads as a red flag and how to evidence it
Some features are read as higher risk almost automatically, and for almost every one there is a document that brings the discussion back to facts.
| Feature | Why it reads that way | How to evidence it |
|---|---|---|
| Tax residence inconsistent with address | CRS reasonableness test: the self-certification is checked against KYC documents | Residence certificate, lease or title deed, utility bills, day-count records; a written explanation of the mismatch |
| Self-certification not completed | Whether a valid self-certification was obtained is a reporting field under the amended CRS | Complete the forms for all accounts before the end of the reporting year and keep a register of those issued |
| Trustee or shareholder acting on someone else's instructions | The AMLR recognises control "by other means" and prohibits verification against a register alone | Declaration of trust dated before the period in question, minutes of decisions, identical beneficial owner entries in all questionnaires |
| Jurisdiction with no link to the business | Inclusion on one of three lists with different consequences | Business rationale: counterparties, licence, staff, office; if the country was listed later — the chronology |
| Splitting amounts below thresholds | AMLR thresholds apply to a single transaction or linked transactions | A single payment; where splitting is objective — a contract with a payment schedule |
| Citizenship by investment as the only link to a country | The amended CRS requires regard to OECD guidance on high-risk CBI and RBI schemes | Actual residence in the self-certification, days of presence, housing, family, economic interests |
Timing, requests and complaints
There are almost no regulatory benchmarks for onboarding time. A retail account with a clean profile opens in days; a private bank with EDD takes weeks.
A request for information (RFI) is a normal part of the process, both during onboarding and afterwards. The answer is given in writing and on time, with documents and a note linking the documents to the question. Where a request looks excessive, it is appropriate to ask for its scope and basis to be clarified; for UK domestic PEPs the regulator itself has written a lower-risk starting point into FG25/3, and it makes sense to cite it.
In the UK a complaint goes to the bank first: it has 8 weeks to issue a final response (15 days for payment services), after which the client has 6 months to refer the dispute to the Financial Ombudsman Service. On account closures the ombudsman considers compliance with the law and the contract terms and how the bank justified its decision. For accounts opened before 28 April 2026, at least two months' notice applies and the bank need not explain its reasons; for accounts opened later, the 2025 amendments to the Payment Services Regulations require 90 days' notice and a detailed, specific explanation, subject to narrow exceptions.
Q/A
The money is legitimate, but after twenty years there is nothing to prove where it came from?
Build an explainable chain from what survives: tax returns, statements, contracts, press coverage of the deal, registry records of a company sale. The Wolfsberg Group points banks to the main sources of wealth and allows plausibility to be assessed where documentary corroboration is impossible.
I have no permanent address — can I open an account?
Yes, but an explanation will be needed. The FCA treats serving customers who lack standard documents as good practice, the HKMA has not required documentary proof of address for AML purposes since 2017, and the US rule allows the address of a relative or contact person. The address in the questionnaire must match the declared tax residence.
Does every document need an apostille?
No. A passport is usually checked in the original or remotely; an apostille is needed on official documents the provider accepts as evidence: certificates, registry extracts, court rulings. For countries outside the Hague Convention, including the UAE, consular legalisation is required. Translation and validity requirements are set by the bank itself.
The bank requires EDD because a counterparty is on the FATF grey list — is that mandatory?
Under the FATF standard, no: every increased-monitoring statement says the FATF does not call for enhanced due diligence on these jurisdictions. EDD is made mandatory by the EU list of high-risk third countries, which since 29 January 2026 includes Russia and the BVI. When a bank relies on the grey list alone, that is its own risk policy.
I have left public office — does PEP status fall away immediately?
No. In the EU an obliged entity takes the continuing risk into account for at least 12 months, until it considers that the PEP-specific risk no longer applies. For UK domestic PEPs, FG25/3 starts from lower risk: without additional risk factors the enhanced measures are lighter than for a foreign PEP, but they do not fall away.
The bank refused and will not explain why — what can be done?
Ask for the decision in writing and whether additional documents could resolve the issue. A bank may withhold the reason if it relates to a suspicious transaction report. In the UK, after the bank's final response the client has 6 months to go to the Financial Ombudsman Service; for accounts opened from 28 April 2026 the bank must give a specific explanation on closure, subject to narrow exceptions.
The assets are in a trust and the trustee opens the account — is the trustee's information enough?
No. For AML purposes the settlor, trustee, protector, beneficiaries or their class and anyone with effective control are identified. The trust deed, questionnaires and CRS self-certifications must name the same roles, and since 2026 each controlling person's role goes into exchange as a separate field.