Property Sourcing Compliance: Redress, AML and ICO

If you introduce property buyers and sellers in the UK, you're generally doing estate agency work, and the rules that apply to estate agents apply to you. Getting compliance right protects sellers and investors, keeps you out of trouble, and is one of the things serious investors check first. Here are the main areas, in plain English.

1. Redress scheme membership

The Consumers, Estate Agents and Redress Act 2007 requires anyone doing estate agency work to belong to a government-approved redress scheme. There are two: The Property Ombudsman (TPO) and the Property Redress Scheme (PRS). If a seller or buyer has a complaint you can't resolve, the scheme can investigate and award compensation.

• Join before you start working with sellers or buyers.
• Follow the scheme's code of practice, and have a written complaints procedure.
• Show your membership on your website, landing page and deal packs.

2. Anti-money laundering (AML)

Estate agency businesses are covered by the Money Laundering Regulations 2017. In practice, that means:

• Supervision: you must be registered with an AML supervisor before you trade. For most sourcers that's HMRC. Search GOV.UK for "register with HMRC for money laundering supervision". HMRC also checks the people who own and manage the business.
• A written risk assessment of how your business could be used for money laundering, and policies and procedures to manage those risks.
• Customer due diligence: identify and verify your customers before you act for them, which for estate agency work includes both the seller and the buyer. Understand where the buyer's money is coming from, and do more checks where the risk is higher (for example politically exposed persons, complex company structures or cash purchases).
• Records: keep due diligence records, generally for at least five years after the business relationship ends.
• Reporting: if you know or suspect money laundering, report it to the National Crime Agency through a suspicious activity report, and don't tip the person off.
• Training: make sure anyone working for you understands their responsibilities.

Store ID documents securely and only for as long as you need them. Many sourcers keep the documents in their AML system and record the status and reference in their CRM.

3. Data protection (UK GDPR)

You'll handle names, phone numbers, addresses and financial details of sellers and investors. Under UK GDPR and the Data Protection Act 2018:

• ICO fee: most businesses that process personal data must pay the data protection fee to the Information Commissioner's Office, unless they're exempt. Check on the ICO's website.
• Privacy notice: tell people what you collect, why, how long you keep it and their rights, wherever you collect their details, including your website and landing page forms.
• Lawful basis and consent: have a valid reason for each use of personal data. Get consent for marketing, and stop when someone opts out.
• Rights requests: be ready to give someone a copy of their data (a subject access request) or delete it when the law requires, usually within one month.
• Security and retention: keep data secure, and don't keep it longer than you need.

4. Treating sellers and buyers fairly

• Consumer protection law bans misleading and aggressive practices: no pressure selling, false urgency or hiding important facts.
• Estate agency rules require you to disclose any personal interest (for example if you, a relative or a business partner might buy the property), and to give people the information they need to make decisions.
• Be clear about who pays you. Sellers should understand that you're paid by the investor, and investors should know your fee before they commit.
• Vulnerable sellers: many motivated sellers are going through bereavement, debt or divorce. Give them time, suggest independent advice, and never take advantage.

5. Stay clear of regulated investment activity

Introducing a property that an investor buys in their own name is very different from taking investors' money, pooling it, promising returns or arranging loans. Those activities can fall under financial services regulation and need FCA authorisation. If your model involves investors' money passing through you, joint ventures with promised returns, or lending, take specialist legal advice first.

6. Insurance, tax and records

• Professional indemnity insurance covers claims that your advice or information was wrong. It's often a requirement of redress scheme membership and investors expect it.
• Tax: register with HMRC as self-employed or set up a limited company, keep records of fees and costs, and register for VAT if your turnover goes over the threshold.
• Records: keep a clear history of every lead, conversation, introduction and agreement. It's your evidence if anything is ever questioned.

A quick checklist

• Redress scheme joined, and membership shown on your materials
• Registered for AML supervision, with a risk assessment and procedures written
• Customer due diligence done on sellers and buyers, with records kept
• ICO fee paid and privacy notice published
• Professional indemnity insurance in place
• Written sourcing agreements and a complaints procedure

How Dealcraft helps

Dealcraft has UK GDPR tools built in (subject access exports, erasure that keeps anonymised deal history, marketing opt-outs and retention reviews), optional AML due-diligence fields on each contact (ID verification status, risk rating, review date and evidence reference), an audit trail of who changed what, and a privacy notice template for your landing page. It helps you keep good records. It doesn't replace your own compliance procedures.