Regulations

What you are required to do

One page per regulation: what the law requires, who it binds, and which part of the work satisfies each obligation. Product-neutral, and useful whether or not you ever use StackGo.

Every regulation here is filed three ways — the jurisdiction it applies in, who it binds, and the kind of obligation it creates. A regulated business rarely faces one of these at a time, and the three kinds below pull against each other: the anti-money-laundering rules tell you to keep a record for years, and the privacy rules govern what that record may contain and who may see it.

Anti-money laundering

Know who your client is, check them against sanctions, PEP and adverse-media sources, rate the risk, and keep the record. These are the obligations that make a firm a reporting entity.

  • Australia

    AML/CTF Act, Tranche 2 reforms

    AUSTRAC · In force 1 July 2026

    Applies to Accounting and advisory · Legal · Real estate · Conveyancing · Trust and company service providers · Precious metals and stones

    Read the requirements →
  • United Kingdom Coming

    Money Laundering Regulations 2017

    HMRC and the professional body supervisors · In force

    Applies to Accounting and advisory · Legal · Estate agency · Trust and company service providers

Identity verification

Rules prescribing how a person’s identity must be established for a particular transaction, separately from any anti-money-laundering duty.

Privacy and personal information

What you may collect, where it may be held, how long you may keep it, and who may see it. These pull against the AML retention duties, and reconciling the two is the part firms find hardest.

  • Australia Coming

    Privacy Act 1988 and the Australian Privacy Principles

    OAIC · In force

    Applies to Any business handling personal information that meets the turnover threshold or operates in a prescribed sector

    Our guide in the meantime: The 13 Australian Privacy Principles explained

  • United Kingdom Coming

    UK GDPR and the Data Protection Act 2018

    ICO · In force

    Applies to Any business processing the personal data of people in the UK

  • European Union Coming

    General Data Protection Regulation

    National data protection authorities · In force

    Applies to Any business processing the personal data of people in the EU, wherever that business itself is established

Ready to make onboarding minutes, not hours?

Start free and run your first check today, or book a demo and we will walk you through it.