Keep compliance on track long after onboarding.
Be ready when HMRC asks. A customer’s circumstances can change long after the initial checks. Your team needs to know when a fresh review is due.
Relevant changes and deadlines prompt follow-up, with a record of how your team handled them.
Harbour & Finch Ltd
Virtual office · Northgate House, Manchester
- Overview
- People
- Documents
- Tasks
- History
- 3 FebApplication received for virtual office, Manchester
- 5 FebDocuments complete after two automatic remindersComplete
- 6 FebReviewed and approved by Priya ShahApproved
- 6 FebActivated · mail instructions: scan and forward weekly
- Today2 letters logged and scanned · customer notified
- 12 AugScheduled review dueUpcoming
Automate the repetitive. Put judgement where it belongs.
Your team should not have to remember every reminder or rebuild the same customer record for every task.
Every plan includes a compliance calendar, so reviews, renewals and training deadlines don’t live in someone’s head.
How reviews work
Whoeverly handles routine coordination in the background, with clear review points when something needs attention. Your policies, permissions and approval responsibilities remain part of the process.
Part of Protect
A result needs context.
Keep check results with the evidence needed to assess them. Keep the reasoning alongside the result.
Investigate before deciding
A reviewer can investigate a possible match and request more information before making or escalating a decision.
Decisions should leave a record.
The platform records relevant changes, actions and approvals so authorised colleagues can understand what happened and why.
Responsibility stays clear
Exceptions, risk decisions and approvals still need the appropriate human oversight. Role-based review and escalation are built in.
Handing it over doesn’t hand over the risk.
In the UK, providing a registered office, business or correspondence address as a business makes you a trust or company service provider under the Money Laundering Regulations.
That means registering with HMRC, checking every customer and keeping records you can show when asked. Giving half the revenue to someone else won’t necessarily take those duties off your plate, and HMRC does fine businesses that get it wrong.
A plain-English summary, not legal advice. Whether and how the rules apply depends on how your service is set up.
Recent fines in this sector
From HMRC’s published list of penalties, April to September 2025
Two coworking sites run by the same operator
Didn’t register in time
£3,300 and £5,720
A company service provider
Gaps in risk assessments and policies, and HMRC not told of changes
£18,436
Another service provider
Didn’t register in time
£20,800
Source: HMRC, businesses that have not complied with the money laundering regulations. HMRC notes that businesses on the list may since have changed how they work.
Using an aggregator? You may still need your own AML registration.
If you provide virtual office or registered office address services through an intermediary, their AML registration doesn’t automatically cover your business.
HMRC’s July 2026 guidance makes clear that providing a registered office, business or correspondence address to companies and other legal entities can be regulated trust or company service provider (TCSP) activity. A business carrying out that activity needs appropriate AML supervision before it provides the service. That means registering with HMRC and being approved, unless the FCA or a qualifying professional body already supervises the business.
What if an aggregator brings you the customers?
HMRC recognises arrangements where you supply an address to an intermediary, who makes it available to their own customers. That creates a TCSP supply chain, and being part of one doesn’t remove your responsibility to work out whether your own business needs AML supervision.
HMRC also expects TCSPs in a supply chain to understand who the end users are, establish who their customers are, carry out appropriate due diligence and assess the extra risks.
If you handle mail or deal directly with the intermediary’s customers, you may also have a business relationship with those end customers, with more due diligence to do.
Can you rely on the intermediary’s checks?
In certain circumstances, yes. Formal reliance has specific legal requirements, and you remain responsible for any failure in customer due diligence.
An intermediary’s registration, a contractual assurance or a statement that checks have been done isn’t enough on its own to show compliant reliance.
Before offering the service, check:
- Does my business provide address services that fall within the TCSP definition?
- Do I have the appropriate AML supervision for those activities?
- Have I identified any aggregators, resellers or intermediaries in my supply chain?
- Do I understand who the end customers are, and whether they are also my customers for AML purposes?
- Have I documented who carries out due diligence, and whether any reliance arrangement meets the regulatory requirements?
- Have I assessed supply chain risks in my business-wide risk assessment?
Already using an intermediary? Review your arrangements now. Don’t assume another business’s registration or compliance process meets your own obligations.
General information only. Take advice on your own set-up. Sources: HMRC’s guidance for trust or company service providers, HMRC’s registration check for TCSPs and regulation 39 of the Money Laundering Regulations 2017.
The spreadsheet says “approved”. Nobody remembers why.
When an auditor, a regulator or your own head office asks about a customer, the answer shouldn’t depend on who still works here.
The old way
The Whoeverly way
- Approved by Priya Shah12 March, 10.42 · Compliance reviewer
- Evidence attachedID, proof of address and company documents
- Reason recordedWritten by the reviewer at the time
- Policy versionCustomer onboarding procedure v4
Whoeverly keeps the decision, the evidence and the reasoning together, so the record can answer the question later.
Important information deserves a serious approach.
Customer identity records, business details and compliance decisions need careful handling. Whoeverly is built around clear access responsibilities, operator data separation and traceable activity.
Access should follow responsibility.
Role- and location-based permissions are part of the architecture, including restricted access to sensitive compliance information.
Customer information needs clear boundaries.
Separation between operators’ records is a core design requirement. Sensitive compliance material should not quietly become marketing input.
Procurement questions deserve specific answers.
Ask us for details on hosting, subprocessors, retention, access controls, testing and operational arrangements. Send us your security questionnaire early.
Your team has enough tabs open.
Moving the same information between systems costs time and creates room for mistakes. With Enterprise, Whoeverly connects customer information, verification results and service events with the systems your business uses.
When a connection doesn’t match
A connection also needs to be understandable when an update fails or a record does not match. Each one shows its status and how to put things right. Tell us what you use and we’ll confirm what’s possible for your set-up.
Part of Protect · advanced integrations with Enterprise
- Workspace systemsCustomer and service changes
- Business informationSupported registry data
- Verification and screeningCheck results in context
Customer record
Harbour & Finch Ltd
- Service updated Synced
- Company details Up to date
- Record mismatch Needs review
Sometimes you need a person who knows the detail.
Flex AML, founded by Whoeverly co-founder Francesca Dixon, provides separately scoped specialist support for operators who need hands-on help: reviewing your current approach, improving procedures, preparing teams and helping organise operational change.
Specialist consultancy is separate from a Whoeverly subscription. Services, fees and responsibilities are agreed separately.