A KYC/CDD file holds the customer data a firm collects for due diligence. MLR 2017 reg 27 sets when those checks are due. Reg 28 sets the measures: identify the customer, verify from a reliable independent source, and identify the beneficial owner. anonym.plus removes names, identifiers, and owner details from a sample profile on your device.
When this applies
MLR 2017 treats a holding of more than 25% of the shares or voting rights as beneficial ownership of a company. A firm also has to flag a discrepancy against the Companies House register of people with significant control, kept under CA 2006 Part 21A. An auditor testing your onboarding flow needs that shape, not the person.
How anonym.plus handles it
- Open the profile in anonym.plus on your device.
- Local OCR reads scanned ID documents in it.
- The tool flags names, identifiers, and owner details.
- Keep the risk band and product fields.
- Swap each identifier for a label.
- Save the clean profile locally.
What you need to provide
- The KYC profile (PDF, DOCX, or scan).
- An operator (Replace keeps the structure readable).
- Optional batch for many sample profiles.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | Lena Ohm → [CUSTOMER] |
| Identifiers | UK_NINO | QQ 88 42 11 A → [NINO] |
| Financial | IBAN_CODE | GB29 NWBK 6016 → [IBAN] |
| Owner | PERSON | UBO H. Ohm → [OWNER] |
| Dates | DATE_TIME | DOB 1988 → [DOB] |
| Location | LOCATION | 12 Pine Road, Bristol → [ADDRESS] |
Compliance achieved
- MLR 2017 reg 27 sets when due diligence is due; reg 28 sets the measures themselves.
- The 25% shares-or-votes test in MLR 2017 is why beneficial owners are flagged beside the customer.
- MLR 2017 reg 41 confines this data to money-laundering and terrorist-financing purposes.
- MLR 2017 reg 40 keeps the full profile for five years after the relationship ends.
- Batch up to 20 profiles in one local run.
Anonymise KYC/CDD files offline — see plans & start free →
Limitations & cautions
The firm must retain the full profile for the reg 40 period. Share only a cleaned sample. A unique ownership chain can re-identify a customer, so review the residual fields before you pass it on.
Frequently asked questions
Can I delete the real KYC file by redacting it?
No. Reg 40 keeps the full record on file for five years. Redaction makes a safe sample for testing or audit, not a replacement.
Are beneficial owners flagged too?
Yes. Reg 28 makes identifying the beneficial owner part of due diligence, and MLR 2017 sets that at more than 25% of the shares or voting rights.
What if due diligence cannot be completed?
MLR 2017 reg 31 requires the firm to stop the transaction or end the relationship, and to consider a report. Redaction has no bearing on that decision.