Client Due Diligence (CDD) for Property, Step by Step

What does client due diligence actually involve for a property business, and what will you be asked for as an investor? In short: a supervised firm must identify and verify who it is dealing with, understand where the money comes from, and keep checking on a risk-sensitive basis — and you should expect to provide identity, address and, where relevant, evidence of your funds. Under the Money Laundering Regulations 2017, CDD is not a one-off form at onboarding; it is a running discipline that protects the investor, the seller and the firm alike. This guide walks through it step by step — verification, beneficial ownership, source of funds versus source of wealth, simplified and enhanced checks, PEPs and sanctions, monitoring and record-keeping — and explains what investors should expect to hand over and why.

This is general information, not financial, legal or tax advice — seek independent professional advice.

What client due diligence means under MLR 2017

The word "client" in the headline is the everyday term; the regulations themselves talk about the "customer." In a property context that customer might be an investor buying through the firm, a seller disposing of a property, or a company — in which case the real people behind it matter as much as the entity on the contract. The purpose is straightforward even if the mechanics are detailed: a business that knows exactly who it is dealing with, and why, is far harder to use as a vehicle for laundering the proceeds of crime.

Two timing points are worth fixing in your mind. First, CDD is generally done before the relationship starts or the transaction completes — not after the deal is agreed. Second, it does not stop at onboarding; the regulations require ongoing monitoring, so the picture has to stay current. A firm that verified someone two years ago and never looked again has not finished the job.

Step one: identifying and verifying investors and sellers

The first stage is to establish, and then independently confirm, who someone is. Identifying is taking the details; verifying is checking them against something reliable. The two are distinct, and a firm that only takes details on trust has not met the standard.

For an individual

• Identity: full name and date of birth, confirmed against a reliable document such as a passport or driving licence, or robust electronic verification.
• Address: current residential address, evidenced by an independent source such as a recent utility bill, bank statement or an electoral or credit-reference check.
• Consistency: the details given should reconcile with the evidence — discrepancies are not necessarily sinister, but they need explaining.

For a company or other entity

Where the investor or seller is a company, the firm must look behind it: confirm the entity exists and is properly constituted, understand its ownership and control structure, and — critically — identify the beneficial owners, the real human beings who ultimately own or control it. A corporate wrapper is exactly the kind of structure that can be used to obscure who is really behind a transaction, which is why the regulations insist on seeing through it.

Step two: beneficial ownership

Identifying beneficial ownership can be simple — a single director-shareholder — or layered, where companies own companies and control is several steps removed. The firm's job is to follow the chain until it reaches the individuals at the top, and to verify them, applying more scrutiny where the structure is complex or opaque. An entity that cannot or will not explain who ultimately controls it is, in itself, a risk signal worth taking seriously.

Step three: source of funds vs source of wealth

This is the distinction that most people new to compliance find genuinely useful, because the two terms are often confused — yet they answer different questions.

In plain terms: source of funds tells the firm what is paying for the deal in front of it; source of wealth explains how the person came to have money in the first place. In a low-risk, well-documented case a clear source of funds may be enough. As risk rises — a large sum, an unusual structure, a politically exposed person — the firm is expected to go further and evidence the wider source of wealth too. The depth of evidence should always be proportionate to the assessed risk, not a blanket demand applied identically to everyone.

Step four: simplified vs enhanced due diligence

CDD is not one fixed setting. The regulations build in a sliding scale, and the firm's documented risk assessment decides where on that scale a given relationship sits.

Step five: PEPs and sanctions screening

Politically exposed persons

A politically exposed person (PEP) is an individual entrusted with a prominent public function — together with their family members and known close associates. The position can carry a heightened risk of bribery or corruption, so the regulations require enhanced due diligence and senior management approval before establishing or continuing a relationship with one. It is important to be fair about this: being a PEP is not an allegation of any wrongdoing. It is simply a status that triggers a higher standard of checking and ongoing scrutiny, applied proportionately.

Sanctions

Sanctions screening sits alongside CDD but is a separate legal regime that applies to everyone, not only supervised firms. It is an offence to deal with, or make funds or economic resources available to, a designated person on the UK sanctions list. Firms therefore screen investors, sellers and beneficial owners against the consolidated list at onboarding and keep watching over time, because designations change. Because sanctions are a standalone duty, a firm cannot treat passing a general identity check as a substitute for a proper sanctions check.

Step six: ongoing monitoring and record-keeping

The final two pillars are what turn a one-off check into a durable control. Ongoing monitoring means keeping the picture current — watching that transactions remain consistent with what the firm knows about the customer, refreshing information as relationships evolve, and re-checking when something changes or a trigger occurs. A relationship that looked low risk at the start can change, and the monitoring obligation is how that gets caught.

Record-keeping is the evidence layer. Under MLR 2017, CDD records and supporting documents are generally kept for five years from the end of the relationship or the date of an occasional transaction, subject to data-protection rules. This is not bureaucratic box-ticking: in any inspection, a supervisor's first request is to see the records of the checks that were carried out. A firm that did the work but cannot evidence it is in a far weaker position than one that can produce a clean, dated file on request.

What investors should expect to provide — and why

From the investor's side, good CDD should feel thorough rather than intrusive. Typically you will be asked for photographic identity, proof of your current address, and — where a company is involved — details of who ultimately owns and controls it. Depending on the firm's risk assessment, you may also be asked to evidence the source of the funds you are using, and in higher-risk cases your wider source of wealth.

It is worth understanding why a firm declining to cut corners here is a good sign, not a red flag. The same checks that slow your onboarding are what stop the firm being used to launder someone else's money — money that could ultimately taint the very transaction you are part of. CDD protects everyone in the chain at once: the investor, the seller, and the firm's own standing. Requirements can reasonably vary between firms, because each builds its process on its own documented risk assessment, and every supervised firm should follow its supervisor's current guidance on exactly how to apply the rules.

Who's behind L&M

Verifiable sources cited in this guide

Frequently asked questions about CDD for property