AI Transparency Obligations Now Apply

The transparency obligations under article 50 of the EU's AI Act are now live. Basically, the aim is to identify AI-generated or manipulated content. Subject to certain exceptions, users must be informed when they are interacting with an interactive AI system, such as a chatbot; deepfakes must be clearly labelled, as must AI-generated or manipulated text that is published on matters of public interest. There is 4 month transitional period for machine-readable marking by AI systems first made available in the EU market before 2 August 2026. This post is for information purposes only. If you need advice, please let me know.

Meaning of 'Provider' and 'Deployer' etc

A ‘provider’ is:

a natural or legal person, public authority, agency or other body that: 

develops an AI system or a general-purpose AI model or 

has an AI system or a general-purpose AI model developed 

and 

places it on the market or  

puts the AI system into service under its own name or trademark, 

whether for payment or free of charge; 

A 'deployer' is: 

"a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity;"

‘AI system’ means: 

"a machine-based system that is 

designed to operate with varying levels of autonomy and

that may exhibit adaptiveness after deployment, and 

that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments;"

'general-purpose AI model’ means: 

an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that 

displays significant generality and 

is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and 

that can be integrated into a variety of downstream systems or applications,

except AI models that are used for research, development or prototyping activities before they are placed on the market; 

What Must Providers and Deployers Do? 

There are certain useful carve-outs or exceptions, but generally:

Providers must:

design AI systems that interact directly with individuals (including chatbots) to disclose that users are engaging with an AI system. 

mark AI-generated or manipulated audio, image, video or text in a machine-readable format, using effective, interoperable, robust and reliable technical solutions for detection. 

Deployers must:

inform individuals when they are subject to emotion recognition or biometric categorisation. 

disclose when some content (deep fakes or text on matters of public interest) has been artificially generated or manipulated.

'deep fake’ means AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful;

EU Voluntary Code

Provides and deployers can sign up to an EU voluntary code that has more guidance on achieving and assessing AI transparency here. 

This post is for information purposes only. If you need advice, please let me know.

Registration-only Firms Face Closer FCA Scrutiny For AML Compliance

It takes more than a bank to launder money, so a wide range of businesses are required to comply with the UK's anti-money laundering (AML) regime. The scrutiny of these businesses has been increasing, particularly since Russia's invasion of Ukraine and the sanctions (and sanctions evasion) that followed. Various misadventures in crypto and Iran have also raised the stakes. The Financial Conduct Authority is the latest regulator to up the ante for the firms it supervises. This post is for information purposes only. If you would like advice on whether you need to register or other aspects of AML, please let me know.

What's involved in AML compliance?

Basically, AML compliance involves the relevant service provider registering with a supervisory authority; conducting certain 'customer due diligence' on clients; and monitoring the business relationship with clients in order to detect and report any suspicious activity to the National Crime Agency. There are also related laws that require a firm to screen clients against sanctions lists, avoid handling proceeds of crime or 'tipping off' those under investigation, provide information on transactions, establish client's source of funds/wealth and so on. 

To meet these regulatory obligations, each 'relevant person' that is covered by the regime must maintain policies and procedures that also involve appointing a 'money laundering reporting officer', assessing the risk of money laundering and terrorist financing for the business as a whole, as well as each product and client; and taking a risk-based approach to deploying resources in their compliance efforts. 

The consequences of getting any of this wrong can be very serious indeed, including jail time, fines and the firm having to cease doing business unless/until the right policies, procedures and controls are in place.

Non-financial businesses that must register and comply

The types of business activities that trigger registration when carried out in the UK are listed in Chapter 1 of the UK's money laundering regulations (MLRs).

The Gambling Commission is obviously the supervisory authority for gambling operators, while HMRC is the supervisory authority for the other non-financial business covered by the regime:

• money service businesses not supervised by the Financial Conduct Authority (FCA) 
• high value dealers handling cash payments for goods totalling 10,000 euros or more on a single transaction or linked transactions
• trust or company service providers not supervised by the FCA or a professional body 
• accountancy service providers not supervised by a professional body 
• estate agency businesses 
• bill payment service providers not supervised by the FCA 
• telecommunications, digital and IT payment service providers not supervised by the FCA 
• art market participants buying or selling of works of art where the transaction value (or a series of linked transactions) is 10,000 euros or more 
• letting agency businesses renting property or land valued at the equivalent of 10,000 euros or more a month

It is typically quite straightforward for these firms to register with HMRC. Money service businesses and trust or company service providers must be registered first before they do any business. The others can trade while their application is being assessed, but run the risk of their application being unsuccessful and having to cease the relevant activity. Otherwise, it's basically a crime not to be registered where you should be, and the sanctions are explained here.

Financial services businesses that must register, even if not FCA authorised.

Certain financial services providers are covered by the AML regime if they carry out financial activities listed in Annex 1 of the MLRs as a business in the UK, even if those activities don't require the firm to be otherwise 'authorised' by the FCA (e.g. under the Financial Services and Markets Act 2000). Such firms must still register with the Financial Conduct Authority (FCA) and otherwise comply with the AML regime. It used to be quick to register, but the FCA has just announced that it will increase its scrutiny of these firms and take longer to register them.

Cryptoasset service providers are not mentioned in Annex 1 of the MLRs, but have their own listing and detailed qualifying criteria set out in Chapter 1 - basically, they are caught by the regime where they undertake cryptoasset exchange or custodian wallet activity (separately from the new cryptoasset regulations).  The FCA already takes considerably longer to register cryptoasset service providers than other businesses.

Are there any exclusions?

Yes, there is a range of exclusions under the MLRs (as well as the initial 'gating' factors of whether an activity is 'carried out as a business' in its own right and 'in the UK', which should not be overlooked).

One area of potential confusion is whether an entity is acting as a 'special purpose vehicle' (SPV). An SPV is a company or other legal entity which is established exclusively for the purpose of simply holding the legal or beneficial (equitable) title or interest in an asset of some kind -  typically a loan, lease or other type of funding agreement. They are common in securitisation (asset-backed bond issuance), but there are also more private arrangements. The financial asset is agreed or 'originated' and funded by some other entity before the legal or beneficial ownership (and the right to receive payments or 'receivables') are transferred (sometimes automatically or almost immediately) to the SPV to be simply held pending expiry or transfer elsewhere. Accordingly, the SPV has no operations, staff or systems of its own because a range of related agreements provide for the 'servicing' of the assets and collection of receivables by either the originator or a third party servicer. The point is that AML compliance obligations should already have been carried out by the entity which originated or created the instrument so it would be 'overkill' to require the SPV to gear up just to carry out AML compliance obligations. Sometimes, people confuse the role of the originator (which must comply with AML requirements) with the role of the SPV (which does not), especially where the originator transfers the asset to the SPV straight away and itself plays no further role in relation to the asset. 

This post is for information purposes only. If you would like advice on whether you need to register or other aspects of AML, please let me know.