Property Sourcing Compliance Guide UK

Before you open a single registration portal, there are groundwork decisions and documents you need lined up. Most sourcers skip this step and end up stalling half-way through an application chasing paperwork they didn't know they needed.

1. Decide Your Business Structure

Your business structure affects almost every compliance registration. The two most common options for UK sourcers are:

2. Information You'll Need Ready

Have all of the following prepared before you begin any registration:

What It Is

The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 require all businesses operating as estate agency businesses to register with HMRC for Anti-Money Laundering Supervision (AMLS). As a deal sourcer, you fall within this definition — regardless of whether you consider yourself an "agent".

What the Registration Involves

The application is made through HMRC's online portal. At a high level, you will need to:

• •Register your business as an 'Estate Agency Business' under the Money Laundering Regulations
• •Declare all 'beneficial owners, officers, and managers' (BOOMs) of the business
• •Confirm that all relevant individuals have passed fit and proper testing
• •Pay an annual supervision fee to HMRC (fee varies based on business size)
• •Demonstrate that documented AML policies and procedures are in place

What HMRC Expects From You Ongoing

Registration is not a one-time exercise. Once registered, HMRC expects you to:

• •Conduct Customer Due Diligence (CDD) on all clients — vendors and investors
• •Keep records of all CDD checks for a minimum of five years
• •Report suspicious activity to the National Crime Agency (NCA) via a Suspicious Activity Report (SAR) where required
• •Renew your registration annually and update HMRC if your business details change
• •Be ready for a compliance audit at any point — HMRC does carry these out

Common Pitfalls With AMLS Registration

• •Selecting the wrong business category during the application
• •Not declaring all relevant individuals as BOOMs
• •Having no AML policies in place at the point of application
• •Assuming a sole trader registration covers a limited company (or vice versa)
• •Not renewing annually — your registration lapses and you become non-compliant overnight

What These Are

Having the registrations in place is only half the story. You also need documented policies that govern how your business operates day-to-day. These are not bureaucratic tick-boxes — they are legal requirements that can be demanded by HMRC, investors, solicitors, and redress schemes at any point.

The Three Policy Documents You Need

Why Generic Templates Won't Work

The single most common mistake sourcers make in this area is downloading a generic AML or GDPR template from the internet and filing it away. These policies must reflect how your actual business operates. HMRC auditors and solicitors can spot a generic template immediately, and a policy that doesn't match your business practices can actually work against you.

Your policies need to be written in the name of your business, specific to deal sourcing, and updated as your business evolves.

What Good CDD Looks Like in Practice

When you take on a new vendor or investor, your CDD process should as a minimum include:

• •Collecting and verifying photographic ID (passport or driving licence)
• •Verifying proof of address (utility bill, bank statement — typically dated within 3 months)
• •Screening against sanctions lists and politically exposed persons (PEP) lists
• •Recording the source of funds, particularly for investors deploying significant capital
• •Documenting everything and storing it securely for a minimum of five years

What It Is

Professional Indemnity insurance protects you against claims made by clients who suffer a financial loss as a result of your professional advice, services, or actions. In the context of deal sourcing, this means protection if an investor claims your deal information was inaccurate, misleading, or negligently prepared.

What You Need to Understand About PI for Sourcers

PI insurance for property sourcers is a specialist product. Standard professional indemnity policies — the kind bought off the shelf by IT consultants or accountants — do not typically cover property deal sourcing activity. You need a policy that explicitly covers:

• •Property deal introduction and sourcing
• •Deal packaging and investment advice
• •The specific deal types you work with (HMO, BTL, commercial, etc.)
• •The fee levels involved in your transactions

Key Factors That Affect Your Policy

What It Is

The Information Commissioner's Office (ICO) is the UK's independent authority for data protection. Any organisation that processes personal data is legally required to register with the ICO under the UK GDPR and Data Protection Act 2018 — unless a specific exemption applies.

As a deal sourcer you process personal data from day one: vendor names and contact details, investor profiles, solicitor correspondence, and more. You must be registered.

What the Registration Covers

• •Confirms that your business is registered as a data controller with the ICO
• •Requires you to specify what types of personal data you process and why
• •Requires you to specify who you share data with (investors, solicitors, HMRC, etc.)
• •Costs £35–£100 per year depending on your organisation size
• •Must be renewed annually — failure to renew is an automatic breach

What It Is

The Enterprise Act 2013 requires all property agents in England — including deal sourcers — to be members of a government-approved property redress scheme. These schemes exist to give consumers (your vendors and investors) a formal, independent route to raise complaints if something goes wrong and you fail to resolve it directly.

What Membership Involves

• •Joining one of the two government-approved schemes: The Property Ombudsman (TPO) or the Property Redress Scheme (PRS)
• •Paying an annual membership fee (typically £100–£250 for individual agents)
• •Committing to follow the scheme's Code of Practice
• •Being listed on the scheme's public register of members
• •Being subject to the scheme's complaints and adjudication process

These are the slip-ups we see week in, week out — from brand-new sourcers to people who've been packaging deals for months without realising how exposed they are.

1. 1

   Starting without AMLS registration

   Even your first deal. Even if you don't complete it. The moment you begin operating as a sourcer you are required to be registered.

2. 2

   Using a generic AML template

   HMRC auditors recognise them immediately. A policy that doesn't reflect your business provides no protection and may actively harm you in a dispute.

3. 3

   Buying the wrong PI policy

   Most standard PI policies exclude property sourcing. Paying for a policy that doesn't cover your activity is the same as having no cover.

4. 4

   Not doing CDD on investors

   CDD applies to both sides of your transactions. Many sourcers check vendors carefully but skip proper checks on investors. This is a compliance failure.

5. 5

   Letting ICO registration lapse

   Unlike some registrations, ICO registration does not auto-renew. Missing the renewal date puts you in breach of data protection law from day one of the new period.

6. 6

   Mismatched business names across registrations

   If your AMLS registration says one name, your PI policy says another, and your redress scheme membership says a third, you have a problem. Investors and solicitors notice.

7. 7

   No process for storing CDD records

   It's not enough to check someone's ID — you need to record it, store it securely, and be able to produce it five years later. Most sourcers have no system for this.

8. 8

   Not updating HMRC when business details change

   If you change your address, add a business partner, or change your business structure, HMRC must be notified. Failing to do so can invalidate your AMLS registration.

9. 9

   Assuming compliance is a one-time task

   Every registration has an annual renewal. Your policies need to be reviewed and updated as your business grows. Compliance is ongoing, not a checkbox you tick once.

10. 10

    Not knowing what to do with a suspicious client

    You are legally required to submit a Suspicious Activity Report to the NCA in certain circumstances. Not knowing when or how to do this is a gap that HMRC will find in an audit.

Getting compliant is the starting gun, not the finish line. Here's what has to stay live once you're trading.

Annual Renewals

Every single compliance registration requires annual renewal. Miss any one of them and you drop back into non-compliance immediately.

CDD Record Keeping

Every client you work with — vendor or investor — requires a CDD check and a record of that check. You need a system for this from day one. The minimum retention period is five years from the end of the business relationship.

• •Store ID documents and proof of address securely (encrypted cloud storage or locked physical files)
• •Record the date checks were carried out and by whom
• •Record the outcome of any sanctions or PEP screening
• •Have a clear process for what happens when CDD cannot be completed

Policy Reviews

Your AML, CDD, and GDPR policies are not static documents. They need to be reviewed whenever:

• •Your business structure changes (e.g. moving from sole trader to limited company)
• •You add new deal types to your sourcing activity
• •There are changes to money laundering or data protection legislation
• •You take on staff, associates, or joint venture partners
• •You expand into new geographical markets or deal with overseas investors

Use this as your top-level tracker. All five areas need to be fully in place before you introduce, package, or sell a single deal.