The recommended starting scope gives the vendor access to approved evidence and a route to recommend outcomes. The UK firm approves alert dispositions, decides customer action and retains substantive suspicious-activity reporting decisions. A contract expanding the supplier's authority requires a fresh assessment of regulatory permissions and any necessary changes to operating procedures and system access.
Executive Summary
- UK AML duties remain with the regulated firm. Its senior management approves the controls, and its nominated officer considers disclosures against relevant information available to the firm. Outsourcing does not transfer that responsibility. (Money Laundering Regulations 2017, SI 2017/692, regs. 19, 21 and 39(7)–(8).)
- Routine alert closure, account restrictions and statutory reporting are separate decisions. A supplier may receive bounded closure authority under approved procedures; it cannot replace the retained nominated officer's statutory assessment. (MLRs, regs. 19(2)(b), 21(5); Proceeds of Crime Act 2002, s. 331.)
- The vendor needs its own Kenyan perimeter assessment. Kenya's payment-services definition expressly reaches certain businesses that process or store data for payment providers or their users. (National Payment System Act 2011, ss. 2 and 12.)
- Kenyan access to UK-held personal data requires a UK transfer route. Returning information to the UK and using overseas model providers require separate Kenyan analysis. (UK GDPR, arts. 44A and 46; Kenya Data Protection Act 2019, ss. 48–51.)
- Production approval should depend on documented delegation, supplier evidence, validation, escalation and exit arrangements. The FCA's transaction-monitoring guidance specifically addresses AI used to triage existing alerts. (FCA Financial Crime Guide, FCG 3.2.5A G.)
Define the supplier's role before granting access
Supplier-operated investigation forms part of the fintech's monitoring process. The service description should distinguish the alert generator, AI ranking, analyst investigation, closure, reporting and customer action. Each step needs an owner, permitted inputs and an enforceable limit on system privileges.
The proposed alert-to-decision workflow is:
- The fintech supplies an alert and the minimum approved customer and transaction evidence. Its compliance team owns the monitoring policy and escalation criteria.
- The AI proposes priority and a summary linked to the underlying records. It identifies missing information and conflicting evidence. Its score does not establish whether the statutory reporting threshold is met.
- A trained supplier analyst checks the source material, corrects the summary and records an investigation recommendation. Suspected criminal activity and urgent cases pass directly to the firm's designated escalation route.
- An authorised UK reviewer approves ordinary closure or further investigation under the firm's policy. Disclosures requiring the nominated officer's assessment reach that officer without a supplier manager's veto.
- The nominated officer determines the reporting response. A separately authorised UK decision-maker controls any payment restriction, account exit or customer communication. The system records who decided, the evidence considered and the action taken.
This allocation implements the firm's monitoring and internal-control duties. The recommended UK approval of ordinary closures is an initial operating control, rather than a universal requirement for the nominated officer to sign every alert. (MLRs, regs. 19, 21(5) and 28(11).)
The Kenyan business must also examine its own activity. Section 2 of Kenya's National Payment System Act includes within the payment-service-provider definition a person processing or storing data for payment service providers or their users. Section 12 prohibits conducting that business in Kenya without authorisation. A managed service for a UK payments business therefore needs a specific Kenyan classification assessment, including the foreign-client connection. Resolve whether the service requires its own authorisation or can operate under a lawful agency or outsourcing arrangement, and complete the applicable Central Bank of Kenya requirements before it starts. The National Payment System Regulations 2014 recognise agency and outsourcing, but their applicability to this foreign-client arrangement must be established. (NPS Regulations, regs. 14 and 23.) Incorporation and the customer's UK permission do not satisfy that requirement.
On the UK side, supplying analysis does not itself amount to providing payment services. If the supplier begins initiating payments, accessing accounts as an account-information service or providing another regulated service, reassess its own permission or registered-agent route before enabling that function. The technical-services exclusion has limits and does not cover payment-initiation or account-information services merely because the provider never holds funds. (Payment Services Regulations 2017, SI 2017/752, Sch. 1, Part 2, para. 2(j); FCA PERG 15.5, Q39.)
Keep AML accountability and decision authority with the right people
The fintech remains responsible for its risk assessment, effective monitoring, staff controls and records. Senior management must approve its AML policies. Where appropriate to its size and nature, the firm must appoint a board or senior-management compliance officer and establish an independent audit function. Payment service providers and e-money issuers also have the specific compliance-management duty in regulation 21(7). These roles must have the information and authority needed to supervise the supplier. (MLRs, regs. 18, 19(2), 21(1), (7) and 28(11).)
Outsourcing differs from statutory reliance on another regulated business's customer due diligence. Regulation 39(7)–(8) permits delivery through an agent or outsourcing service provider while leaving the relevant person liable. The narrower reliance route in regulation 39(1) does not include ongoing monitoring under regulation 28(11). A supplier's claim to have completed its own checks cannot replace the fintech's monitoring responsibility.
The firm's regulatory category determines the additional outsourcing requirements. An authorised payment institution must notify the FCA of its intention to outsource any operational function relating to payment services. An authorised electronic money institution has the corresponding duty for its relevant operations. Important functions attract further conditions protecting internal controls, supervision and retained management responsibility. Assess importance by the consequences of failure; a human final decision does not make the dependency immaterial. These are statutory notification and control requirements, rather than a general FCA approval scheme for AI. (PSRs, reg. 25; Electronic Money Regulations 2011, SI 2011/99, reg. 26.)
Banks and investment firms need the FCA assessment applicable to their own category, including the relevant SYSC outsourcing rules. PRA-regulated firms also need the applicable PRA assessment. (PRA SS2/21, November 2024, paras. 1.1–1.3.) The new FCA material-third-party reporting requirements take effect on 18 March 2027. Current notification duties continue to apply before that date. (FCA Handbook, SYSC 8.1 and applicable scope provisions; FCA PS26/2.)
Routine false-positive closure can later be delegated within a documented policy. The firm should approve the eligible alert types, required evidence, excluded cases, reopening rights and review controls. The product must prevent a closure instruction from suppressing an internal suspicion report. Purely automated closure requires a separate assessment of monitoring effectiveness and any customer consequences.
Reporting has a different legal basis. The nominated officer must consider a disclosure against relevant information available to the firm. Where the conditions in section 331 of the Proceeds of Crime Act are met, the officer must make the required disclosure to the National Crime Agency as soon as practicable. The supplier may prepare material or provide administrative assistance, but its conclusion cannot displace that assessment. A backlog, service-level deadline or low AI score does not alter the statutory test. Terrorist-financing reporting must follow its separate requirements. (MLRs, reg. 21(5); POCA, ss. 330–331; Terrorism Act 2000, s. 21A.)
A suspicious activity report does not automatically authorise freezing, refusing or terminating a customer's service. Record the applicable statutory and contractual basis for each action and the required communication, including any lawful restriction on disclosure. Payment-instrument blocking, payment refusal and framework-contract termination have distinct rules. Keep those decisions outside the vendor's initial authority. (PSRs, regs. 51–51D, 71 and 82.)
Make overseas access and confidential reporting lawful
The fintech will ordinarily determine the AML purpose and act as controller. The supplier processes the approved case material on its behalf. Their written terms must cover instructions, confidentiality, security, subprocessors, assistance, audit and deletion or return. Separate supplier reuse for training or product improvement requires a fresh purpose and role assessment. (UK GDPR, arts. 4(7)–(8), 5 and 28.)
The firm's necessary compliance processing can rely on its legal obligations, but that does not authorise every proposed data use. Allegations of offending engage the criminal-offence-data rules. Any special-category information requires an additional Article 9 condition. Record the applicable Data Protection Act condition and appropriate policy document where required; do not treat the label "AML" as a blanket exemption. (UK GDPR, arts. 6(1)(c), 9 and 10; Data Protection Act 2018, ss. 10–11 and Sch. 1, paras. 5, 10 and 12.)
A UK server does not remove the transfer issue. Access by staff of the separate Kenyan supplier makes the information available overseas. Kenya is not covered by the UK's current adequacy arrangements. For the proposed recurring service, put an appropriate Article 46 safeguard in place, normally the UK International Data Transfer Agreement or the UK Addendum with the EU standard contractual clauses. The EU clauses alone are insufficient for the UK route.
The firm must also satisfy the current data protection test, assessing the transfer reasonably and proportionately. The contractual and other protections after transfer must not be materially lower than the UK standard. Examine Kenyan legal requirements, enforceability, onward recipients and the actual technical controls. If the proposed protections cannot meet the test, stop the affected access or redesign the service. (UK GDPR, arts. 44A and 46(1A), (2), (6)–(8); ICO, international-transfer guidance.)
Kenyan law applies to processing in Kenya by a Kenyan-established processor even where the customers are in the UK. Confirm the vendor's registration position with the Office of the Data Protection Commissioner and document its instructions, security and retention controls. High-risk processing requires a Kenyan data protection impact assessment; the statutory submission requirement is sixty days before processing. Build that period into the launch plan where the requirement applies. (Kenya Data Protection Act, ss. 4, 18, 31 and 41–42.)
The data map must cover investigation results sent back to the UK, foreign cloud or model services and overseas support. Kenya's sections 48–49 govern these outbound activities. Sensitive personal data processed outside Kenya attracts the consent and safeguards requirement in section 49(1), subject to a substantiated applicable exemption. Kenya's sensitive-data definition includes property details, so review the actual financial fields against that wider definition.
An AML purpose does not automatically establish the necessity of exporting every field or a public-interest exemption. Document the specific section 51 basis if relied upon. General Regulations 55–56 recognise a public-interest route for appropriate action concerning suspected unlawful activity or serious misconduct. Section 51(1) preserves lawful processing, minimisation, data quality and security. (Data Protection (General) Regulations 2021, Legal Notice 263, regs. 55–56.) If the necessary consent, safeguards or exemption cannot be established, keep the affected data outside the outsourced workflow and have the UK firm perform that work. Merely locating the server in the UK does not resolve Kenyan access and outbound-processing obligations. Check separately whether a covered strategic-interest purpose requires Kenyan processing or a local serving copy. (Kenya Data Protection Act, ss. 2, 48–51; General Regulations, reg. 26.)
Customer restrictions also require the current automated-decision analysis. Since 5 February 2026, UK GDPR Articles 22A–22D govern significant decisions taken solely through automated processing. Article 22C requires information, representations, human intervention and a contest route. Article 22B imposes additional restrictions for special-category processing and decisions relying on recognised legitimate interests. Internal ranking is not automatically a significant decision; account restrictions can be. A reviewer must actually assess and be able to change the outcome. Kenya's section 35 requires a separate assessment. (Data (Use and Access) Act 2025, s. 80; SI 2026/82, regs. 2(j) and 5.)
Complete the required impact assessments before the relevant processing begins, including UK prior consultation if unmitigated high risk remains. The parties can scope the data map, impact assessments and supplier terms through data protection for AI. (UK GDPR, arts. 35–36.)
Confidentiality controls must distinguish the investigation evidence from the existence and content of a report. POCA section 333A and Terrorism Act section 21D prohibit specified disclosures likely to prejudice an investigation, subject to their statutory conditions and exceptions. Sharing necessary investigation material with a supplier is not automatically tipping off, but a confidentiality agreement does not establish a lawful disclosure exception.
Limit access to report material, prohibit unapproved customer contact, and route disclosure requests through the firm's designated officers. Preserve any mandatory reporting duty that applies independently to the supplier. Apply privacy exemptions only to the extent their conditions are met; the UK crime exemption depends on likely prejudice and does not suspend data protection generally. (POCA, ss. 333A–333D; Terrorism Act, ss. 21D–21G; Data Protection Act 2018, Sch. 2, para. 2.)
Test what the triage misses and preserve the decision record
The compliance team should approve validation criteria before a live pilot. Test against independently reviewed cases and the firm's relevant risk patterns. Review low-ranked, closed and escalated alerts, including cases where the model omitted evidence or summarised it incorrectly. Testing only the supplier's escalations cannot establish what its triage missed.
Measure missed suspicion, inappropriate closure, unresolved backlogs, summary accuracy, reviewer overrides and performance across relevant customer groups. Set acceptance levels from the firm's risks and the consequences of error. A reduced false-positive count is insufficient if suspicious cases disappear from review. The fintech must separately test monitoring coverage before alerts enter the supplier's queue.
These are proposed controls for effective monitoring. FCA guidance supports piloting, understanding limitations, testing outcomes and documenting threshold rationales; it does not prescribe one universal false-negative percentage. Repeat the relevant evaluation after material changes to models, prompts, data feeds or closure rules. Give the firm a working stop mechanism and a staffed fallback. (MLRs, regs. 19 and 28(11); FCG 3.2.5–3.2.5A G.)
Each case record should identify its source evidence, model and configuration, original output, analyst changes, escalation, final decision and reasons. Preserve the distinction between a generated statement and a verified fact. A summary must remain traceable to material the UK reviewer can retrieve.
Set retention by record category and the applicable legal trigger. The MLR regime generally requires the specified due-diligence and transaction records for five years after the relationship ends or the occasional transaction completes, with statutory qualifications. That is not a rule to delete every investigation log five years after alert closure. Payment and e-money regulatory records may have separate periods. Reconcile these duties with data minimisation, legal holds and secure deletion. (MLRs, reg. 40; PSRs, reg. 31; EMRs, reg. 27; UK GDPR, art. 5(1)(e).)
Put the production conditions into the service contract
Before approving the supplier, the fintech should obtain evidence that matches the proposed work:
- The legal entities, Kenyan permission and registration analysis, and named operational and escalation owners.
- The full data flow, processing locations, model providers, subprocessors and support-access countries.
- Analyst competence, screening, confidentiality commitments and training in the firm's escalation procedures.
- Validation results, missed-case analysis, change records and evidence that the firm can override outcomes.
- Security testing, access logs, incident handling, continuity arrangements and a demonstrated export of usable case records.
The master agreement and statement of work should define every permitted action. Reserve policy changes, customer restrictions and substantive reporting decisions to the identified UK roles. Make later closure delegation a controlled amendment requiring approved criteria, evidence and access changes. Separate availability commitments from investigation quality and require escalation without delay under the approved process.
Data terms should prohibit unapproved training and reuse across prompts, source records, summaries, feedback and logs. Approve the downstream chain and require notice and review of material changes. Specify immediate operational escalation of serious incidents, with information early enough for each party to meet its own legal notification duties. A UK processor's statutory breach-notification standard is without undue delay; Kenyan duties need their own allocation. (UK GDPR, arts. 28 and 33; Kenya Data Protection Act, ss. 42–43.)
Audit terms must give the firm, its authorised auditors and relevant regulators effective access to necessary records and personnel. Protect confidential technology without allowing an intellectual-property clause to defeat supervision. Termination provisions should cover persistent control failure, unlawful access, loss of permission and supplier failure, with continuing escalation, record export and transition assistance. Liability caps, insurance and any enhanced remedies require an express commercial decision; they cannot transfer statutory responsibility.
Licentium's AI supplier contract review covers the customer agreement, data terms, model dependencies and procurement evidence. For this service, the documents should culminate in a written production decision by the fintech's accountable management. Live work can begin only when the relevant permissions and notifications, lawful data flows, required assessments, tested controls and signed agreements are in place.
Map the AML outsourcing boundary
Licentium can review the proposed alert workflow, decision-authority schedule, data flows and supplier terms, then identify the documents and operating changes needed for the intended service. Map the AML outsourcing boundary.