How to Build a Document Compliance Program from Scratch

A document compliance program is not a single policy or a software purchase. It is a structured system of policies, controls, training and oversight that ensures every document your business collects, verifies and retains meets the requirements of applicable law. In the United Kingdom, those requirements derive primarily from the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017), the UK GDPR and the Data Protection Act 2018, and sector-specific rules issued by the FCA, HMRC and the Solicitors Regulation Authority. The FCA's 2024/25 enforcement data shows 23 cases where weaknesses in document-based controls contributed to regulatory action, with penalties exceeding GBP 38 million in aggregate (FCA Enforcement Annual Performance Account 2024/25).

This guide sets out a five-step methodology for building a document compliance program from the ground up, together with a maturity model that allows you to benchmark your current position and prioritise investment.

This article is for informational purposes only and does not constitute legal, financial, or regulatory advice.

Why a Structured Program Matters

Document verification sits at the intersection of multiple regulatory obligations: anti-money laundering (AML), know-your-customer (KYC), data protection, employment law and tax compliance. Without a formalised program, organisations face three categories of risk.

Regulatory risk. MLR 2017, Regulation 19 requires relevant persons to establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing. The Joint Money Laundering Steering Group (JMLSG) Guidance, Part I, Chapter 4 specifies that these policies must cover customer due diligence, record-keeping and internal controls (JMLSG Guidance). Failure to maintain adequate systems is a criminal offence under Regulation 86.

Operational risk. Ad hoc processes produce inconsistent outcomes. A missing document delays onboarding by an average of 7 to 12 working days. Duplicate checks waste analyst time. Incomplete audit trails leave the firm unable to demonstrate compliance during regulatory visits.

Reputational risk. Correspondent banks, payment partners and institutional clients conduct due diligence on your compliance framework before establishing a relationship. A weak document compliance program can result in de-risking. For an in-depth review of the regulatory landscape, see our document compliance guide.

The 5-Level Maturity Model

Before building a plan, assess where you stand. The table below defines five maturity levels, from ad hoc to optimised, with observable characteristics and priority actions at each stage.

An organisation may sit at different levels for different processes. A fintech may be at Level 4 for customer onboarding but Level 1 for supplier due diligence. The assessment should be conducted per domain to identify the most critical gaps.

Step 1: Map Obligations and Documents

The foundation of any compliance program is a clear understanding of what you are required to do and which documents are involved.

Identify applicable regulations

For UK businesses, the primary sources of document-related obligations include:

• MLR 2017 (as amended 2022, 2023): customer due diligence, enhanced due diligence for high-risk situations, record-keeping for five years after the end of the business relationship
• UK GDPR and Data Protection Act 2018: data minimisation, purpose limitation, storage limitation, subject access rights
• Employment law: right-to-work checks under the Immigration, Asylum and Nationality Act 2006
• Companies Act 2006: statutory record-keeping for corporate documents
• Tax legislation: retention of financial records under HMRC requirements

For detailed AML obligations, see our AML compliance guide. GDPR-specific requirements for document management are covered in our GDPR guide.

Build a document register

For each business process, list every document collected, its legal basis, its retention period and the person responsible for verification. This register becomes the single source of truth for the entire program. It should be accessible to all relevant stakeholders and reviewed at least annually.

Step 2: Define Policies and Procedures

Obligations must be translated into operational rules that staff can follow consistently.

The document compliance policy

This is the master document that sets out the governing principles: which documents are accepted, which formats are valid (originals, certified copies, digital documents), retention periods and destruction conditions. It should be approved by senior management and disseminated to all relevant personnel. The JMLSG Guidance recommends that this policy be proportionate to the nature, size and complexity of the business.

Operational procedures

Each process (customer onboarding, employee hiring, supplier due diligence) needs a detailed procedure specifying collection steps, verification checkpoints, acceptance and rejection criteria, and escalation paths for anomalies. KYC dossiers, for example, require specific checks detailed in our KYC guide.

Responsibility matrices

Who collects, who verifies, who approves, who archives. A RACI matrix (Responsible, Accountable, Consulted, Informed) applied to each document process eliminates ambiguity and prevents gaps or overlaps in control coverage.

Step 3: Implement Controls

Document controls should operate at three distinct levels, consistent with the three lines of defence model endorsed by the Institute of Internal Auditors.

First line: operational controls

These are performed by the person processing the file: completeness checks, visual inspection of identity documents, cross-referencing of data between documents. This level can be substantially automated using document validation tools that detect inconsistencies, expired documents and forgeries.

Second line: compliance oversight

The compliance function reviews a sample of processed files to verify that procedures are being followed correctly. Findings feed a corrective action plan. The sample size should be risk-based, with higher coverage for higher-risk processes.

Third line: independent assurance

Internal audit or an external firm periodically evaluates the overall effectiveness of the program. Conclusions are reported to the board or audit committee.

Step 4: Train and Embed

A compliance program is only as strong as the people who operate it. Training must address three dimensions.

Regulatory awareness explains the legal obligations, the consequences of non-compliance and the rationale behind each control. Staff should understand why they collect specific documents and why certain checks matter.

Procedural competence covers the practical skills: how to verify the authenticity of an identity document, how to detect inconsistencies between a payslip and a tax return, when to escalate a suspicious case. Real-world case studies drawn from the firm's own operations reinforce learning.

Tool proficiency ensures staff can use the verification software, workflow systems and dashboards effectively. An underused tool delivers no benefit.

Training should not be a one-off event. The JMLSG Guidance recommends at least annual training, with targeted updates when regulations or procedures change. New joiners should complete training before handling regulated documents.

Step 5: Monitor, Measure and Improve

Key performance indicators

A document compliance program must be governed by objective, measurable indicators:

• First-time completeness rate of submitted files (target: above 85%)
• Average processing time for a complete file (target: under 48 hours)
• Anomaly detection rate at first-line controls
• Non-conformity count from second and third-line reviews
• Training completion rate (target: 100% of relevant staff trained annually)

Periodic review

The program should undergo a formal review at least annually, covering the adequacy of procedures against current obligations, analysis of incidents and non-conformities, relevance of KPIs, and regulatory changes to incorporate. This review produces an action plan that drives the next improvement cycle.

Automation as a maturity accelerator

The transition from Level 3 to Level 4 depends heavily on automation. AI-powered document verification solutions can process high volumes with a consistency that manual review alone cannot achieve. CheckFile.ai provides validation tools designed for regulated businesses. For a cost-benefit perspective, see our pricing page.

Frequently Asked Questions

How long does it take to build a document compliance program?

The timeline depends on the starting maturity level and organisational complexity. An organisation starting from Level 1 (ad hoc) should expect 6 to 12 months to reach Level 3 (defined), with a dedicated project lead and a phased approach by business domain. Reaching Level 4 (managed) typically requires an additional 12 to 18 months, including the deployment of automated tools.

What are the penalties for inadequate document compliance in the UK?

Under MLR 2017, the FCA can impose unlimited fines, public censure, and restriction or cancellation of permissions. Regulation 86 creates a criminal offence for failure to comply with requirements, carrying up to two years' imprisonment. Under UK GDPR, the ICO can fine up to GBP 17.5 million or 4% of global annual turnover for serious infringements. Senior managers may face personal liability under the Senior Managers and Certification Regime (SM&CR).

Do we need a dedicated compliance officer for document compliance?

MLR 2017, Regulation 21 requires relevant persons to appoint a nominated officer responsible for receiving and assessing internal suspicious activity reports. Beyond this statutory requirement, appointing a program owner for document compliance, whether within the compliance function, legal department or operations, is essential for maintaining coherence and driving accountability across the organisation.

Can we outsource document compliance activities?

Operational tasks such as scanning, data extraction and first-line verification can be outsourced, but the firm retains full regulatory responsibility. The FCA's Finalised Guidance FG16/5 on outsourcing states that firms cannot delegate their regulatory obligations. The outsourcing contract must specify service levels, access rights, audit provisions and data protection safeguards.

How do we balance document compliance with data protection?

The compliance program must integrate UK GDPR requirements from the design stage. This means collecting only the documents strictly necessary for the stated purpose (data minimisation), defining proportionate retention periods, securing access and transfers, and implementing procedures to respond to data subject requests (access, rectification, erasure). Our GDPR guide covers these requirements in detail.