UK Transaction Monitoring Rules and Laws for Retailers

A jewellery purchase paid for through several cash instalments presents different compliance questions from an ordinary card sale. For UK retailers, understanding transaction monitoring starts with knowing which rules apply to the business, how payments connect, and when unusual activity needs further review.

The legal position depends on the activities a retailer carries out. Some businesses fall within the UK’s regulated anti-money laundering sector; others do not. That distinction affects customer checks and ongoing monitoring, while financial sanctions and the criminal law can remain relevant beyond the regulated sector.

For retail leaders, the practical task is to connect the applicable requirements with everyday decisions at the till, online and across customer accounts.

Which Retailers Fall Within the Money Laundering Regulations

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, as amended, are commonly called the Money Laundering Regulations or MLRs. They apply to specified business activities. Selling an expensive product or accepting electronic payments does not, by itself, make every retailer subject to the full MLR regime.

High-value dealers are an important retail example. A business trading in goods can fall within this category when it makes or receives cash payments totalling at least £10,000 for a transaction, including several operations that appear linked. HMRC’s high-value dealer guidance confirms that this sterling threshold replaced €10,000 from 30 June 2026.

The cash element matters. A high-value card or bank-transfer purchase does not automatically meet this particular definition. Art market participants have separate rules: qualifying commercial art transactions or linked transactions of at least £10,000 can bring a business within scope regardless of whether payment is in cash. Retailers entering either category should check HMRC registration and supervision requirements before carrying on the relevant activity.

Retailers carrying out payment services, lending or other financial activities should assess those activities separately. The obligations of a retailer, its payment provider and a finance partner should not be assumed to be identical.

What the Ongoing Monitoring Duty Requires

For business relationships covered by the MLRs, Regulation 28 requires ongoing monitoring. This includes reviewing transactions throughout the relationship to assess whether they fit the business’s knowledge of the customer, their activities and risk profile. Where necessary, that review includes the source of funds. Customer due diligence information must also be kept up to date.

This is broader than flagging payments above a particular amount. A transaction may need attention because of its pattern, the people involved or a change in how the customer behaves.

The extent of monitoring should reflect risk. Regulation 33 requires enhanced due diligence and enhanced ongoing monitoring in specified circumstances. For an in-scope business, suspicion of money laundering or terrorist financing can also trigger customer due diligence requirements without the usual transaction threshold being reached.

How AML Checks Support Transaction Monitoring

AML checks help establish the context needed to interpret a payment. Depending on the applicable requirements, they can involve identifying and verifying the customer, establishing relevant beneficial ownership and assessing the purpose of the relationship or transaction.

Risk screening can add information about sanctions exposure, political exposure or relevant adverse media. These are different findings and need appropriate review. A possible name match needs to be resolved using available identifying details; it should not be treated as proof that the customer has committed an offence.

Monitoring then considers what the customer does over time. An identity check at onboarding cannot, on its own, explain later changes in payment patterns. Equally, a transaction alert is harder to assess if staff cannot see the customer information that gives it context.

For retailers within the MLRs, the aim is to keep customer knowledge and transaction review connected as the relationship develops.

What Meaningful Monitoring Looks Like in Retail

Consider a luxury retailer receiving several cash instalments for one order. Reviewing each receipt in isolation may hide the relationship between the payments. Staff need a way to recognise that the payments relate to the same purchase and assess them together.

The same operational issue can arise across branches or sales channels. If different teams hold parts of the order history, an investigator may struggle to understand the overall activity. Where relevant to the business’s obligations, monitoring should draw on the information needed to reconstruct the transaction and identify connections.

Other examples that may justify review include unexplained third-party funding, repeated high-value purchases inconsistent with the known customer profile or requests to redirect a refund to someone unrelated to the original purchase. These are prompts to investigate the circumstances, rather than evidence of money laundering by themselves.

A useful process records what was unusual, what staff checked and why they accepted the explanation or escalated the concern. An alert queue without sufficient investigation capacity will not provide that record.

Suspicious Activity Reporting and the Criminal Law

The Proceeds of Crime Act 2002 provides the principal money laundering offences and important disclosure duties. The Terrorism Act 2000 contains separate provisions concerning terrorist financing and terrorist property. Their relevance extends beyond simply deciding whether a retailer meets the high-value dealer definition.

In the regulated sector, the law can require disclosure where there is knowledge, suspicion or reasonable grounds for knowledge or suspicion. Staff should understand the applicable internal reporting route and the responsibilities of a nominated officer where one is appointed.

The NCA’s guidance on suspicious activity reports explains that SARs are submitted to the UK Financial Intelligence Unit within the National Crime Agency. A software alert does not automatically mean a SAR is required; it needs to be assessed in context against the relevant legal duties.

Reporting processes must also account for the offences relating to tipping off and prejudicing an investigation. Teams should follow their escalation procedures when communicating about a concern, rather than treating an investigation as an ordinary customer-service query.

Financial Sanctions Remain a Separate Requirement

A retailer outside the MLR regulated sector may still have financial sanctions obligations. UK financial sanctions apply within UK territory and to UK persons, including UK-established legal entities, wherever they operate. The specific restrictions depend on the relevant sanctions regime.

Screening customers and relevant counterparties can help identify possible exposure, but name checks alone may not resolve ownership or control issues. Businesses should assess how their checks address the parties involved in a transaction and the relevant sanctions restrictions.

There is also an important systems update to recognise. From 28 January 2026, the UK Sanctions List became the sole source for UK sanctions designations following closure of the OFSI Consolidated List. The government’s UK Sanctions List transition guidance explains what changed. Businesses relying on older data feeds should confirm that their screening arrangements reflect it.

Record Keeping and Customer Data

Monitoring needs records that explain the activity and the resulting decision. Under Regulation 40, specified customer due diligence and transaction records are generally retained for five years from completion of an occasional transaction or the end of a business relationship, as applicable. The regulation contains exceptions and a ten-year cap for certain transaction records.

Retailers should therefore set retention periods by record type and legal purpose. A blanket policy of keeping every piece of customer information indefinitely is not a substitute for understanding the relevant retention duties.

Personal data used for monitoring also needs an appropriate lawful basis and controls consistent with UK data protection law. Relevant considerations include collecting information that is necessary for the purpose, maintaining accuracy, restricting access and deleting information when it is no longer lawfully needed. Reporting and investigation records should be available to the staff who need them, with access properly controlled.

Where Transaction Monitoring Software Fits

There is no blanket requirement for every UK retailer to purchase a particular monitoring system. The business must first establish its legal scope and the controls needed for its risks. FCA financial crime guidance recognises credible manual monitoring procedures at some smaller firms; a more complex operation may need additional technology and resources.

When evaluating transaction monitoring software, retail teams should examine whether it can:

• Connect related payments, customers and orders across the relevant channels.
• Apply rules that reflect the business’s products, payment methods and risk assessment.
• Explain the information that caused an alert and identify missing data.
• Support investigation, escalation and a recorded decision.
• Preserve a usable history of changes to monitoring rules and case outcomes.

For example, Shufti’s AML transaction monitoring software brings verified identity, screening information and transaction behaviour into the same review process. Its published capabilities include configurable rules, testing against historical activity, case management and investigation records. Those functions can help a team examine the context behind an alert and retain evidence of its decision.

The evaluation should use realistic retail scenarios. Ask a provider to demonstrate linked instalments, an unusual payer, and a case requiring further information. Check how the system supports the investigation and which actions still require a staff decision. Selecting a platform does not transfer the retailer’s responsibilities to the vendor.

A Practical Starting Point for Retailers

Start by checking which activities bring the business within the MLRs, including the current cash and art-market thresholds. Then review whether customer records, order histories and payments provide the information needed for relevant AML checks and monitoring.

Assign responsibility for investigating concerns, confirm the reporting route and test the process with examples drawn from the business. The useful measure is whether staff can recognise relevant activity, assess it properly and explain what they did with the evidence.