Regulation 28 is not a photocopying exercise

Across every independent file review we have run, one finding appears more than any other — and it hides in the one document every fee-earner is certain is fine. Here is what regulation 28 actually asks for, the four records we look for, and the twelve-minute fix for the backlog you are afraid to count.

The bundle is tidy. There is a passport copy in the file, scanned at adequate resolution, initialled by the person who collected it. On the CDD form, the box marked "identity verified" is ticked, dated, attributed. Everything a careless reviewer would check has been checked, which is precisely the problem — because none of it answers the question regulation 28 asks.¹

Regulation 28 does not ask whether you collected an ID document. It asks whether you verified the client's identity "using documents, data or information obtained from a source you have reasonable grounds to believe is independent" of the client.² A photocopy is an artefact of the client's possession. The verification is the evidence that you tested it against something independent — and that evidence is a separate record. In most files we open, it simply does not exist. Not forgotten: never created.

A photograph of a passport proves someone held a passport. The verification record proves someone checked it was real, current and theirs. Only one of those is a compliance artefact. — the finding we write most often

§ 01What lands in the file — and what should

When we review a sample of twenty files against AML-IDV-04, we are not hunting drama. We are checking four things, and a file can survive having two of them missing but not the right one:

• The source. Which independent source was used — a certified digital identity check, a face-to-face sighting against the document by a named person, or an approved third-party verifier. "A copy" is not a source.
• The date. Verification must precede the establishment of the relationship, subject to the narrow timing allowance in reg 28(4) — which is an exception with conditions, not a habit.³
• The human. A name, not a username. Someone saw the client and the document together, or ran the check. That person should be findable three years later.
• The match. Photograph, signature, the live sighting. The part where the document and the person in front of you were connected, and someone recorded that they matched.

§ 02Why it hides in your best files

The finding rarely lands on the obvious risk case. It lands on the long-standing relationship — the conveyancing repeat client, the founder whose company your firm has acted for since 2016 — because onboarding happened when the firm's memory of the process was a handshake and a scan. Ongoing-relationship refresh is where the paperwork inherits its own origin story, and nobody re-opens it until a reviewer does.⁴

The second hiding place is delegation. Intake consultants, estate agents, accountants — and now onboarding-automation platforms that promise "frictionless KYC". The moment a verification is someone else's product, your file needs their evidence, dated and retrievable, not their badge on your form. In the AI Tools Index we score intake suites against exactly this: does a human verification record survive the workflow, or does the workflow absorb it? Most fail the question politely.

§ 03How we write the finding — because the format is the fix

A finding that says "verification inadequate" gets argued with. A finding in the format we deliver gets actioned, because every element is checkable:

Notice the last field. Regulation 45 expects remediation without pre-judging the outcome — but a file that documents its own gap, closes it and dates both, is read very differently by any reviewer than one where the gap is silently papered over. Fixing late with a record beats fixing never with a good feeling.⁵

§ 04The twelve-minute count

You do not need a consultancy to size this problem. Take the ten live highest-risk relationships in your practice. For each, answer four questions in writing, in under two minutes per file: source, date, human, match. If you cannot answer three of four from the file itself, you have your baseline — and it is the same baseline we keep finding.

Where the count comes back thin, two routes: work it yourself against our 20-point file self-check, free on the resources page, or send us three files and we will review them the way a reviewer would — £0, ~48 hours, and you keep the findings either way. If the pattern in three is uncomfortable, we will tell you what twenty would cost, and the number won't move after that.