The regulatory landscape for Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance has never moved faster. Across the UK, the Gulf Cooperation Council, and international markets, supervisory bodies are raising expectations — and the cost of falling short has never been higher.

For financial institutions, banks, and corporates operating across multiple jurisdictions, understanding where the bar is being set is not optional. It is a strategic imperative.

Why KYC and AML Are Converging

Historically, KYC and AML were treated as distinct disciplines. KYC sat within onboarding and client lifecycle management; AML lived in transaction monitoring and financial intelligence. That separation is dissolving.

Regulators now expect a unified, risk-based approach in which customer due diligence, beneficial ownership verification, and ongoing monitoring are woven into a single, coherent framework. The Financial Action Task Force (FATF) Recommendations — the global standard — have long pointed in this direction. What has changed is the pace at which national regulators are translating those recommendations into enforceable obligations.

In the UK, the Financial Conduct Authority's Dear CEO letters and thematic reviews have made clear that fragmented, siloed compliance programmes are no longer acceptable. In the GCC, the UAE's removal from the FATF grey list in 2024 marked a watershed moment — but it also raised the baseline expectation for every institution operating in the region.

The UK Regulatory Picture

The FCA's approach to financial crime supervision has shifted from reactive enforcement to proactive, data-led oversight. Firms should expect:

Enhanced Scrutiny of Beneficial Ownership

The Economic Crime and Corporate Transparency Act 2023 introduced significant changes to Companies House and beneficial ownership registers. Compliance teams must ensure their KYC frameworks are updated to reflect the new verification requirements — particularly for complex corporate structures and trusts.

Stronger Expectations on Politically Exposed Persons

PEP screening remains an area of persistent weakness across the industry. The FCA has been explicit: enhanced due diligence on PEPs must be proportionate, documented, and subject to senior management sign-off. Blanket de-risking — refusing to onboard PEPs without proper assessment — is itself a regulatory concern.

Transaction Monitoring Calibration

Firms are expected to demonstrate that their transaction monitoring systems are calibrated to their specific risk profile, not simply deployed out of the box. Scenario tuning, alert quality reviews, and regular model validation are now baseline expectations, not best practice.

The GCC Regulatory Picture

The Gulf states have made remarkable progress in aligning their AML/CFT frameworks with international standards. For institutions operating in the region, several developments warrant close attention.

UAE: Post-Grey List Obligations

The UAE's exit from the FATF grey list was a significant achievement, but it came with commitments. The Central Bank of the UAE and the Financial Intelligence Unit continue to issue guidance that raises the bar on customer risk classification, sanctions screening, and suspicious activity reporting. Institutions that treated grey-list removal as a signal to relax should recalibrate.

Saudi Arabia and the FATF Mutual Evaluation

Saudi Arabia's FATF mutual evaluation process has driven a comprehensive overhaul of its AML/CFT framework. The Saudi Central Bank (SAMA) and the Capital Market Authority have both issued updated guidance. Firms with Saudi operations or correspondent relationships need to ensure their frameworks reflect the current regulatory expectations, not those of two or three years ago.

Cross-Border Correspondent Banking

One of the most complex compliance challenges in the GCC remains correspondent banking. The risk of de-risking — where global banks withdraw from correspondent relationships due to perceived AML risk — continues to affect access to financial services across the region. Institutions need robust, documented frameworks for managing correspondent relationships, including periodic reviews and clear escalation procedures.

What a Modern KYC Framework Looks Like

A compliance programme that meets current regulatory expectations across both the UK and GCC jurisdictions will typically include:

Risk-Based Customer Segmentation — Customers are classified by risk tier based on a combination of factors: jurisdiction, industry, ownership structure, transaction profile, and adverse media. The segmentation drives the depth of due diligence applied at onboarding and throughout the relationship.

Dynamic Beneficial Ownership Verification — Static, point-in-time verification is insufficient. Frameworks must include triggers for re-verification: changes in ownership, new adverse media, sanctions hits, or changes in the customer's business profile.

Integrated Sanctions and PEP Screening — Screening must cover onboarding, ongoing monitoring, and payment processing. The screening lists used — OFAC, UN, EU, HMT — must be appropriate to the institution's geographic footprint and correspondent relationships.

Documented Risk Appetite — Regulators expect to see a written risk appetite statement that is genuinely embedded in decision-making, not a document that sits in a drawer. It should define the types of customers, products, and geographies the institution will and will not serve, and why.

Senior Management Accountability — Under the UK's Senior Managers and Certification Regime (SM&CR), accountability for financial crime compliance sits with named individuals. In the GCC, similar accountability frameworks are being introduced. Compliance programmes must be designed with clear ownership at the senior level.

The Role of Licensed Governance Frameworks

One of the most effective ways to accelerate compliance maturity — particularly for institutions operating across multiple jurisdictions — is to adopt a licensed governance framework rather than building from scratch.

A well-designed framework provides a structured, tested methodology that can be adapted to the specific risk profile and regulatory environment of each jurisdiction. It reduces the time and cost of building a compliant programme, provides a defensible audit trail, and ensures that the institution is working to a standard that has been validated against current regulatory expectations.

At Halli Whalli Global, our licensed frameworks — including our KYC Framework and AML Governance Suite — are designed precisely for this purpose. They are built on 20 years of advisory experience across the UK and GCC, and they are updated to reflect the current regulatory environment in both regions.

Understanding the full spectrum of financial crime risk is equally important. Our analysis of AML typologies and emerging threats in 2026 sets out the specific patterns — from trade-based money laundering to virtual asset exploitation — that compliance teams need to address alongside their KYC frameworks. For institutions operating in the GCC, sanctions compliance is a closely related discipline that requires parallel attention. For firms where conduct risk and accountability frameworks intersect with financial crime obligations, our piece on conduct risk and organisational culture provides relevant context on how senior manager accountability applies in practice.

Looking Ahead

The direction of travel is clear. Regulators are moving towards:

• Real-time monitoring — the expectation that transaction monitoring will move closer to real-time, reducing the window in which suspicious activity goes undetected
• Artificial intelligence and machine learning — growing regulatory interest in how firms are using AI in their compliance programmes, and what governance frameworks are in place to manage model risk
• Climate and ESG risk — early signals from the FCA and international bodies that environmental and social risk factors will increasingly be integrated into customer risk assessments
• Crypto-asset compliance — as digital assets become more mainstream, AML obligations for crypto-asset service providers are being brought into line with those for traditional financial institutions

Institutions that invest now in robust, adaptable KYC and AML frameworks will be better positioned to absorb these changes without the disruption — and cost — of reactive remediation.

Conclusion

KYC and AML compliance in 2026 demands more than a tick-box approach. It requires a genuine understanding of the regulatory environment, a risk-based framework that is proportionate and documented, and senior leadership that takes accountability seriously.

Whether you are building a compliance programme from the ground up, reviewing an existing framework, or navigating a specific regulatory challenge, the starting point is the same: a clear-eyed assessment of where you are and where the regulator expects you to be.

If you would like to discuss your compliance programme or explore how our advisory services can support your organisation, contact our team at [email protected].