Investigative research on companies and people is lawful, but it is not unconstrained. Three frameworks govern it — data protection, the money laundering regulations, and sanctions — and one of them changed recently in a way that makes most published screening advice wrong: the OFSI consolidated list closed on 28 January 2026. The UK Sanctions List is now the only source.
The sanctions point, first
If you take one thing from this guide, take this. The gov.uk position is explicit: "The UK Sanctions List is now the only source for all UK sanctions designations. The OFSI Consolidated List of Asset Freeze Targets closed on Wednesday 28 January 2026 and is no longer being updated."
The UK Sanctions List is published and maintained by the FCDO, covering people, entities and ships designated or specified under regulations made under the Sanctions and Anti-Money Laundering Act 2018, in searchable and bulk formats. Any screening process still pointing at the OFSI consolidated list has been checking a static file for eight months.
Be precise about what the law actually requires, though. The statutory prohibitions are on dealing: do not deal with frozen funds or economic resources belonging to or owned, held or controlled by a designated person; do not make funds or economic resources available directly or indirectly to or for the benefit of a designated person; and do not act to circumvent the prohibitions. Screening is how a firm avoids breaching those and meets its reporting duty — it is not itself a freestanding statutory duty.
And accountancy firms are in scope
The reporting obligation is the part professional firms most often assume applies to banks alone. Taking the Russia regulations as representative of the regimes, a relevant firm must inform the Treasury as soon as practicable if it knows or has reasonable cause to suspect that a person is a designated person, or has committed an offence under the financial sanctions provisions, where that knowledge or suspicion arose in the course of its business.
The report must state the information on which the suspicion is based, any information by which the person can be identified, and where they are a customer, the nature and amount of any funds or economic resources held for them. There is also an annual reporting requirement, on holdings as at 30 September, reported by 30 November.
"Relevant firm" expressly includes firms providing accountancy services and tax advice, alongside auditors, legal and notarial services, company and trust service providers, estate agents, insolvency practitioners, art market participants and cryptoasset firms. Failure to comply is an offence carrying up to seven years' imprisonment on indictment, or a fine.
Enhanced due diligence: when research becomes mandatory
Regulation 33 of the Money Laundering Regulations 2017 requires enhanced due diligence and enhanced ongoing monitoring in defined cases:
- Cases identified as high risk by the firm or in information made available to it;
- Business relationships or transactions with a person established in a country on the FATF High-Risk Jurisdictions Call for Action list;
- Correspondent relationships with a credit or financial institution;
- Where the customer is a politically exposed person, or a family member or known close associate of one;
- Where the customer has provided false or stolen identification and the relationship is continued;
- Transactions that are unusually complex or unusually large, follow an unusual pattern, or have no apparent economic or legal purpose;
- Any other case which by its nature presents a higher risk.
For the complex or large transaction cases the measures must include examining the background and purpose of the transaction and increasing monitoring to determine whether it is suspicious. Further available measures include seeking additional independent verification sources, further background investigation, and verifying that the transaction is consistent with the relationship.
So investigative research is not merely permitted in these cases — it is the substance of what the regulations require. Our guide to financial crime compliance covers the wider obligations, and suspicious activity reporting what follows a suspicion.
Data protection: getting the basis right
Research on individuals is processing of personal data, and it needs a lawful basis. Legitimate interests is the usual candidate, and it requires the ICO's three-part test: identify a legitimate interest, show the use of personal information is necessary to achieve it, and balance it against the interests, rights and freedoms of the person. Keep a record of the legitimate interests assessment — the ICO publishes a template and expects you to be able to demonstrate compliance.
One honest caveat. The ICO's legitimate interests guidance gives examples such as IT security, direct marketing, intra-group transmissions and client or employee information. It does not list due diligence, fraud prevention or business screening. So the defensible position is that legitimate interests is capable of supporting due diligence research, subject to a documented assessment and the balancing test — not that the ICO endorses it as an example.
Two stronger anchors exist where the research touches criminal-offence or special category data. The Data Protection Act 2018 provides conditions for:
- Preventing or detecting unlawful acts — where processing is necessary for the prevention, investigation or detection of an unlawful act, must be carried out without the data subject's consent so as not to prejudice those purposes, and is necessary for reasons of substantial public interest;
- Regulatory requirements — where processing is necessary to comply with, or assist others to comply with, a regulatory requirement involving investigation of unlawful acts or dishonesty, and consent cannot reasonably be obtained;
- Preventing fraud — where processing is necessary for preventing fraud and consists of disclosure by a member of an anti-fraud organisation, or processing of data so disclosed.
Those three, rather than the general legitimate interests guidance, are the real legal backbone for investigative work of this kind. Note that the unlawful-acts condition generally requires an appropriate policy document to be in place — so the policy is part of the compliance, not an optional extra.
There is also a newer route: the Data (Use and Access) Act 2025 inserted a "recognised legitimate interest" basis into the UK GDPR, whose listed conditions include crime — processing necessary for "detecting, investigating or preventing crime, or apprehending or prosecuting offenders". Whether relying on it removes the balancing test is widely asserted but is not something we will state, because the statutory text does not say so.
Running it properly
Four things separate defensible investigative work from exposure.
Know which framework you are in. Regulation 33 work is mandatory and its scope is set by the trigger. Commercial counterparty research is discretionary and needs its own lawful basis and assessment.
Document the basis before the research, not after. A legitimate interests assessment written retrospectively to justify a file is worth very little.
Screen against the right list. The UK Sanctions List, refreshed — and with a process that distinguishes a name match from a target match rather than blocking on every similar name.
Know your own reporting duty. If you provide accountancy services or tax advice, the sanctions reporting obligation is yours, and it runs as soon as practicable rather than at a convenient point in the engagement.
Acumon supports firms on due diligence, screening and investigations through AML audit, anti-fraud and forensic accounting work, with financial due diligence on transactions. If your screening procedure names the OFSI consolidated list, that is the document to update this week.