If you're building a fintech in the UK and haven't thought seriously about your AML policy yet, you're not alone — but you're running a real risk.

Here's what I see repeatedly from pre-revenue firms preparing for FCA authorisation:

1. They copy a generic template

Google "AML policy template" and you'll find dozens. The problem? They're written for established firms with mature control environments. An early-stage EMI applicant copying a policy designed for a Tier 1 bank is a red flag, not a shortcut.

2. They overclaim their controls

Stating you have "ongoing transaction monitoring" when you haven't processed a single payment yet doesn't just look bad — it creates a gap between your policy and reality that regulators will catch.

3. They treat it as a checkbox

Your AML policy isn't just documentation for the application. It's the foundation of your compliance programme. If it doesn't reflect your actual business model, customer risk profile, and operational stage, it's worse than useless.

What to do instead:

• Draft a policy that reflects where you actually are — pre-launch, limited customers, specific business model

• Be honest about which controls are in place vs. planned

• Structure it around your actual customer types and transaction flows

• Keep it specific to UK regulatory expectations (MLR 2017, JMLSG guidance)

That's exactly what we built Sebast.io to do. A short questionnaire about your firm, and you get a tailored first-pass AML policy that actually matches your business — not someone else's.

£79. No templates. No fluff.