Business Compliance Tools
Find a tool

See what each tool is based on.

Every released tool identifies the official source, jurisdiction, version status and review date used for its supported checks.

Browse all toolsAbout Business Compliance Tools

Our publication standard

  1. Use the primary sourceStart with legislation, regulator guidance, official forms or official datasets rather than third-party summaries.
  2. Record the versionKeep the source title, publisher, jurisdiction, canonical link, publication or version date and review date.
  3. Define the supported checkState what the tool can test mechanically and which questions remain for the user.
  4. Reject unsupported casesDo not approximate a result when the selected jurisdiction, document or scenario is outside the supported scope.
  5. Review changesRecheck the mapping when an official source changes and identify which tool outputs may be affected.

What a source record means

A source record lets you inspect the basis of a supported check. It does not mean that the tool provides legal advice, certifies compliance or replaces review of the official material for your circumstances.

Unsupported guidance sets are left unavailable rather than filled with approximate answers.

Review status

Rule-pack version
2026.07.31
Last reviewed
31 July 2026
Next scheduled review
31 October 2026

The published rule pack is inside its scheduled review period.

Sources used by each released tool

Open a product record to inspect only the official materials that its supported checks and outputs use.

UK complaints procedure and evidence pack

United Kingdom complaint acknowledgement and evidence route

Open tool
Data Protection Act 2018, section 164AUK Parliament · Complaints by data subjects to controllersIn forceReviewed 31 July 2026Data (Use and Access) Act 2025, section 103UK Parliament · Complaints by data subjectsIn forceReviewed 31 July 2026How to deal with data protection complaintsInformation Commissioner’s OfficeCurrent guidanceReviewed 31 July 2026Bank holidays JSON datasetGOV.UKDynamic official datasetReviewed 31 July 2026

Personal data breach 72-hour triage and evidence pack

United Kingdom and European Union personal data breach triage, notification and record routes

Open tool
UK GDPR, Article 33UK Parliament · Notification of a personal data breach to the supervisory authorityIn forceReviewed 7 August 2026UK GDPR, Article 34UK Parliament · Communication of a personal data breach to the data subjectIn forceReviewed 7 August 2026Personal data breaches: a guideInformation Commissioner’s OfficeCurrent guidanceReviewed 7 August 202672 hours: how to respond to a personal data breachInformation Commissioner’s OfficeGuidance marked under reviewReviewed 7 August 2026General Data Protection Regulation, Article 33Publications Office of the European Union · Controller notification to the competent supervisory authority and processor notification to the controllerIn forceReviewed 7 August 2026General Data Protection Regulation, Article 34Publications Office of the European Union · Communication of a personal data breach to the data subjectIn forceReviewed 7 August 2026Guidelines 9/2022 on personal data breach notification under GDPREuropean Data Protection BoardFinal guidelinesReviewed 7 August 2026

DPIA screening, assessment and review pack

United Kingdom and European Union DPIA screening, assessment and prior-consultation routes

Open tool
UK GDPR, Article 35UK Parliament · Data protection impact assessmentIn forceReviewed 7 August 2026UK GDPR, Article 36UK Parliament · Prior consultationIn forceReviewed 7 August 2026When do we need to do a DPIA?Information Commissioner’s OfficeCurrent guidanceReviewed 7 August 2026How do we do a DPIA?Information Commissioner’s OfficeGuidance marked under reviewReviewed 7 August 2026General Data Protection Regulation, Article 35Publications Office of the European Union · DPIA duty, minimum content and national supervisory-authority listsIn forceReviewed 7 August 2026General Data Protection Regulation, Article 36Publications Office of the European Union · Prior consultation with the competent supervisory authorityIn forceReviewed 7 August 2026Data protection impact assessments: high-risk processingEuropean Data Protection Board · WP248 rev.01, endorsed by the EDPBEndorsed guidelinesReviewed 7 August 2026DPIA lists of processing activitiesEuropean Data Protection Board · Register of Article 35(4) mandatory and Article 35(5) no-DPIA listsCurrent registerReviewed 7 August 2026

UK international transfer route, TRA and IDTA or Addendum pack

United Kingdom restricted-transfer, adequacy, safeguard and transfer-risk assessment route

Open tool
Are we making a restricted transfer?Information Commissioner’s Office · Restricted-transfer three-step testOfficial sourceReviewed 7 August 2026What are the rules on appropriate safeguards?Information Commissioner’s Office · UK GDPR Article 46 safeguards and data protection testOfficial sourceReviewed 7 August 2026What are standard data protection clauses (the UK IDTA and the Addendum)?Information Commissioner’s Office · IDTA and Addendum completion guidanceOfficial sourceReviewed 7 August 2026Completing a transfer risk assessmentInformation Commissioner’s Office · Transfer risk assessment and data protection testOfficial sourceReviewed 7 August 2026Is the restricted transfer covered by adequacy regulations?Information Commissioner’s Office · UK adequacy regulationsOfficial sourceReviewed 7 August 2026

Privacy notice and transparency gap checker

United Kingdom and European Union Article 13 and Article 14 transparency subjects

Open tool
UK GDPR, Article 13UK Parliament · Information where personal data are collected from the data subjectIn forceReviewed 7 August 2026UK GDPR, Article 14UK Parliament · Information where personal data have not been obtained from the data subjectIn forceReviewed 7 August 2026Right to be informedInformation Commissioner’s OfficeCurrent guidanceReviewed 7 August 2026General Data Protection Regulation, Article 13Publications Office of the European Union · Information where personal data are collected from the data subjectIn forceReviewed 7 August 2026General Data Protection Regulation, Article 14Publications Office of the European Union · Information where personal data have not been obtained from the data subjectIn forceReviewed 7 August 2026Guidelines on transparency under Regulation 2016/679European Data Protection Board · WP260 rev.01, endorsed by the EDPBEndorsed guidelinesReviewed 7 August 2026

PECR direct-marketing campaign preflight

United Kingdom PECR electronic-mail permission and message controls

Open tool
Privacy and Electronic Communications Regulations 2003, regulation 22UK Parliament · Use of electronic mail for direct marketing purposesIn force as amendedReviewed 7 August 2026Privacy and Electronic Communications Regulations 2003, regulation 23UK Parliament · Information to be provided for electronic mail marketingIn force as amendedReviewed 7 August 2026Guidance on direct marketing using electronic mailInformation Commissioner’s OfficeOfficial sourceReviewed 7 August 2026Business-to-business marketingInformation Commissioner’s OfficeGuidance marked under reviewReviewed 7 August 2026

ROPA spreadsheet validator and converter

United Kingdom and European Union Article 30 field checks

Open tool
UK GDPR, Article 30UK Parliament · Records of processing activitiesIn forceReviewed 31 July 2026What do we need to document under Article 30?Information Commissioner’s OfficeGuidance marked under reviewReviewed 31 July 2026Regulation (EU) 2016/679, Article 30European Union · Records of processing activitiesIn forceReviewed 31 July 2026Position paper on Article 30(5) derogationsEuropean Data Protection BoardWP29 position endorsed by EDPBReviewed 31 July 2026

DPA clause-coverage validator

United Kingdom and European Union Article 28 clause-subject checks

Open tool
UK GDPR, Article 28UK Parliament · Processor contractsIn forceReviewed 31 July 2026What needs to be included in the contract?Information Commissioner’s OfficeGuidance marked under reviewReviewed 31 July 2026Regulation (EU) 2016/679, Article 28European Union · Processor contractsIn forceReviewed 31 July 2026Guidelines 07/2020 on controller and processor conceptsEuropean Data Protection BoardFinal guidanceReviewed 31 July 2026Commission Implementing Decision (EU) 2021/915European Commission · Article 28 standard contractual clausesIn forceReviewed 31 July 2026

Rights-request clock and single-case pack

Supported United Kingdom, European Union and US state request clocks

Open tool
UK GDPR, Article 12UK Parliament · Exercise of data-subject rightsIn forceReviewed 31 July 2026Data (Use and Access) Act 2025, section 76UK Parliament · Time limits for respondingIn force for new requestsReviewed 31 July 2026A guide to subject accessInformation Commissioner’s OfficeCurrent guidanceReviewed 31 July 2026Bank holidays JSON datasetGOV.UKDynamic official datasetReviewed 31 July 2026Regulation (EU) 2016/679, Article 12European Union · Transparent information and exercise of rightsIn forceReviewed 31 July 2026Regulation (EEC, Euratom) No 1182/71European Union · Rules applicable to periods, dates and time limitsIn forceReviewed 31 July 2026Guidelines 01/2022 on data subject rights: Right of accessEuropean Data Protection BoardFinal guidanceReviewed 31 July 2026California Consumer Privacy Act FAQsCalifornia Privacy Protection AgencyEnacted broad state privacy lawReviewed 31 July 2026Colorado Revised Statutes, Title 6Colorado General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Connecticut Data Privacy ActConnecticut Attorney GeneralEnacted broad state privacy lawReviewed 31 July 2026Virginia Code, Title 59.1 Chapter 53Virginia General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Utah Code section 13-61-203Utah State LegislatureEnacted broad state privacy lawReviewed 31 July 2026Florida Statutes, Chapter 501Florida LegislatureEnacted broad state privacy lawReviewed 31 July 2026Oregon Revised Statutes, Chapter 646AOregon LegislatureEnacted broad state privacy lawReviewed 31 July 2026Texas HB 4 final textTexas LegislatureEnacted broad state privacy lawReviewed 31 July 2026Montana Code section 30-14-2808Montana LegislatureEnacted broad state privacy lawReviewed 31 July 2026Delaware Code, Title 6 Chapter 12DDelaware General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Iowa Code, Chapter 715DIowa LegislatureEnacted broad state privacy lawReviewed 31 July 2026Nebraska Revised Statutes section 87-1108Nebraska LegislatureEnacted broad state privacy lawReviewed 31 July 2026New Hampshire RSA 507-HNew Hampshire General CourtEnacted broad state privacy lawReviewed 31 July 2026New Jersey P.L. 2023, c.266New Jersey LegislatureEnacted broad state privacy lawReviewed 31 July 2026Tennessee Public Chapter 408Tennessee General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Minnesota controller obligationsMinnesota Attorney GeneralEnacted broad state privacy lawReviewed 31 July 2026Maryland Code section 14-4705Maryland General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Indiana Code, Title 24 Article 15Indiana General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Kentucky HB 15 final textKentucky General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Rhode Island section 6-48.1-6Rhode Island General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Oklahoma SB 546 enrolledOklahoma LegislatureEnacted broad state privacy lawReviewed 31 July 2026Louisiana Act 502Louisiana State LegislatureEnacted broad state privacy lawReviewed 31 July 2026Alabama HB 351 enrolledAlabama LegislatureEnacted broad state privacy lawReviewed 31 July 2026Vermont Act 145Vermont General AssemblyEnacted broad state privacy lawReviewed 31 July 2026

CCPA privacy-risk-assessment preflight

California privacy risk-assessment field preflight

Open tool
CCPA updates, cybersecurity audits, risk assessments, ADMT and insurance regulationsCalifornia Privacy Protection AgencyFinal regulationsReviewed 31 July 2026Approved text of CCPA regulationsCalifornia Privacy Protection Agency · Risk assessmentsApproved and filed final textReviewed 31 July 2026New regulations approved by Office of Administrative LawCalifornia Privacy Protection AgencyOfficial compliance-date announcementReviewed 31 July 2026

EU Article 50 Transparency Implementation Verifier

European Union Article 50 transparency implementation evidence checks

Open tool
Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligenceEUR-Lex · Article 50Official sourceReviewed 2 August 2026Guidelines on transparency obligations for providers and deployers of AI systemsEuropean Commission · Article 50 guidanceOfficial sourceReviewed 2 August 2026Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689EUR-Lex · Article 113(4)Official sourceReviewed 2 August 2026Transparency obligations under Article 50 of the AI ActEuropean Commission · Article 50 questions and answersOfficial sourceReviewed 2 August 2026Commission Opinion on the Code of Practice on Transparency of AI-generated contentEuropean Commission · Articles 50(2), 50(4) and 50(5)Official sourceReviewed 2 August 2026

California DROP readiness preflight

California data broker DROP operational readiness evidence

Open tool
Delete Request and Opt-out Platform final regulationsCalifornia Privacy Protection Agency · California Code of Regulations, title 11, sections 7600 to 7616Official sourceReviewed 31 July 2026Data Broker Registration Law and Delete Act statutory compilationCalifornia Privacy Protection Agency · Civil Code sections 1798.99.80 to 1798.99.89Official sourceReviewed 31 July 2026Data brokers and the Delete Request and Opt-out PlatformCalifornia Privacy Protection AgencyOfficial sourceReviewed 31 July 2026

AI system inventory and governance register

Supported United Kingdom, European Union and United States AI system governance evidence record

Open tool
Artificial Intelligence Risk Management Framework (AI RMF 1.0)National Institute of Standards and Technology · Govern, Map, Measure and Manage functionsVoluntary governance baseline used by this toolReviewed 7 August 2026NIST AI Risk Management Framework PlaybookNational Institute of Standards and Technology · Suggested actions for Govern, Map, Measure and ManageVoluntary governance baseline used by this toolReviewed 7 August 2026Code of Practice for the Cyber Security of AIDepartment for Science, Innovation and Technology · Principles 1 to 13Jurisdiction context only. Applicability must be assessed separately.Reviewed 7 August 2026Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligenceEUR-Lex · Articles 5, 9, 17, 26 and 27Jurisdiction context only. Applicability must be assessed separately.Reviewed 7 August 2026

AI vendor due-diligence and contract evidence pack

Supported United Kingdom, European Union and United States AI supplier and contract evidence review

Open tool
Guidelines for AI procurementUK Government · Procurement, data assessment, risk and supplier management guidanceJurisdiction context only. Applicability must be assessed separately.Reviewed 7 August 2026Code of Practice for the Cyber Security of AIDepartment for Science, Innovation and Technology · Principles 1 to 13Jurisdiction context only. Applicability must be assessed separately.Reviewed 7 August 2026Guidelines for secure AI system developmentNational Cyber Security Centre · Secure design, development, deployment and operationJurisdiction context only. Applicability must be assessed separately.Reviewed 7 August 2026Artificial Intelligence Risk Management Framework (AI RMF 1.0)National Institute of Standards and Technology · Govern, Map, Measure and Manage functionsVoluntary governance baseline used by this toolReviewed 7 August 2026NIST AI Risk Management Framework PlaybookNational Institute of Standards and Technology · Suggested actions for Govern, Map, Measure and ManageVoluntary governance baseline used by this toolReviewed 7 August 2026Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligenceEUR-Lex · Articles 5, 9, 17, 26 and 27Jurisdiction context only. Applicability must be assessed separately.Reviewed 7 August 2026

EU prohibited AI practices preflight

European Union AI Act Article 5 prohibited-practices factual preflight

Open tool
Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligenceEUR-Lex · Articles 5, 9, 17, 26 and 27Official sourceReviewed 7 August 2026Guidelines on prohibited artificial intelligence practices established by the AI ActEuropean Commission · Article 5 guidance and examplesOfficial sourceReviewed 7 August 2026Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689EUR-Lex · Article 113(4)Official sourceReviewed 2 August 2026

UK AI cyber-security code self-assessment

United Kingdom voluntary AI cyber-security code evidence self-assessment

Open tool
Code of Practice for the Cyber Security of AIDepartment for Science, Innovation and Technology · Principles 1 to 13Voluntary code of practiceReviewed 7 August 2026Implementation Guide for the AI Cyber Security Code of PracticeDepartment for Science, Innovation and Technology · Implementation measures and evidence examplesVoluntary implementation guidanceReviewed 7 August 2026Guidelines for secure AI system developmentNational Cyber Security Centre · Secure design, development, deployment and operationOfficial cyber-security guidanceReviewed 7 August 2026

UK 2026 AML policy and business-wide risk-assessment clause validator

United Kingdom 2026 AML policy and business-wide risk-assessment clause checks

Open tool
Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017UK Legislation · Regulations 18, 18A, 19, 21, 27 to 40 and 46Official sourceReviewed 31 July 2026Money Laundering and Terrorist Financing (Amendment) Regulations 2026UK Legislation · SI 2026/621Most provisions commenced 30 June 2026. Regulations 20 and 36(b) commence 1 February 2027. Regulation 37 is staged.Reviewed 31 July 2026Guidance for all sectors: IntroductionHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Business risk assessmentHM Revenue & Customs · Regulations 18 and 18AOfficial sourceReviewed 31 July 2026Policies, controls and proceduresHM Revenue & Customs · Regulation 19Official sourceReviewed 31 July 2026Customer due diligenceHM Revenue & Customs · Regulations 27 to 32Official sourceReviewed 31 July 2026Enhanced due diligenceHM Revenue & Customs · Regulations 33 and 35Official sourceReviewed 31 July 2026Suspicious activity reportsHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Record keepingHM Revenue & Customs · Regulation 40Official sourceReviewed 31 July 2026TrainingHM Revenue & Customs · Regulation 21Official sourceReviewed 31 July 2026

UK 2026 Money Laundering Regulations change-impact self-assessment

United Kingdom 2026 Money Laundering Regulations change-impact record

Open tool
Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017UK Legislation · Regulations 18, 18A, 19, 21, 27 to 40 and 46Official sourceReviewed 31 July 2026Money Laundering and Terrorist Financing (Amendment) Regulations 2026UK Legislation · SI 2026/621Most provisions commenced 30 June 2026. Regulations 20 and 36(b) commence 1 February 2027. Regulation 37 is staged.Reviewed 31 July 2026

KYC remediation spreadsheet validator

Supported United Kingdom, European Union and United States KYC remediation field checks

Open tool
Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017UK Legislation · Regulations 18, 18A, 19, 21, 27 to 40 and 46Official sourceReviewed 31 July 2026Money Laundering and Terrorist Financing (Amendment) Regulations 2026UK Legislation · SI 2026/621Most provisions commenced 30 June 2026. Regulations 20 and 36(b) commence 1 February 2027. Regulation 37 is staged.Reviewed 31 July 2026Customer due diligenceHM Revenue & Customs · Regulations 27 to 32Official sourceReviewed 31 July 2026Enhanced due diligenceHM Revenue & Customs · Regulations 33 and 35Official sourceReviewed 31 July 2026Record keepingHM Revenue & Customs · Regulation 40Official sourceReviewed 31 July 2026Directive (EU) 2015/849 on preventing use of the financial system for money laundering or terrorist financingEUR-Lex · Articles 13, 18 and 40Directive baseline only. Member State implementing law, competent-authority guidance and sector rules must be checked separately.Reviewed 31 July 2026Information on complying with the Customer Due Diligence Final RuleFinancial Crimes Enforcement Network · 31 CFR 1010.230 and applicable programme rulesApplies only to covered financial institutions and remains subject to FinCEN relief, exceptions and programme-specific rules.Reviewed 31 July 2026CDD Rule consolidated FAQsFinancial Crimes Enforcement NetworkReflects the 13 February 2026 exceptive relief described by FinCEN. Coverage and use of the relief remain user decisions.Reviewed 31 July 2026

UK accountancy and tax AML starter pack

United Kingdom accountancy and tax AML starter records

Open tool
Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017UK Legislation · Regulations 18, 18A, 19, 21, 27 to 40 and 46Official sourceReviewed 31 July 2026Money Laundering and Terrorist Financing (Amendment) Regulations 2026UK Legislation · SI 2026/621Most provisions commenced 30 June 2026. Regulations 20 and 36(b) commence 1 February 2027. Regulation 37 is staged.Reviewed 31 July 2026Guidance for all sectors: IntroductionHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Business risk assessmentHM Revenue & Customs · Regulations 18 and 18AOfficial sourceReviewed 31 July 2026Policies, controls and proceduresHM Revenue & Customs · Regulation 19Official sourceReviewed 31 July 2026Customer due diligenceHM Revenue & Customs · Regulations 27 to 32Official sourceReviewed 31 July 2026Enhanced due diligenceHM Revenue & Customs · Regulations 33 and 35Official sourceReviewed 31 July 2026Suspicious activity reportsHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Record keepingHM Revenue & Customs · Regulation 40Official sourceReviewed 31 July 2026TrainingHM Revenue & Customs · Regulation 21Official sourceReviewed 31 July 2026Risks common to accountancy service providersHM Revenue & CustomsOfficial sourceReviewed 31 July 2026

UK estate and letting agency AML starter pack

United Kingdom estate and letting agency AML starter records

Open tool
Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017UK Legislation · Regulations 18, 18A, 19, 21, 27 to 40 and 46Official sourceReviewed 31 July 2026Money Laundering and Terrorist Financing (Amendment) Regulations 2026UK Legislation · SI 2026/621Most provisions commenced 30 June 2026. Regulations 20 and 36(b) commence 1 February 2027. Regulation 37 is staged.Reviewed 31 July 2026Guidance for all sectors: IntroductionHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Business risk assessmentHM Revenue & Customs · Regulations 18 and 18AOfficial sourceReviewed 31 July 2026Policies, controls and proceduresHM Revenue & Customs · Regulation 19Official sourceReviewed 31 July 2026Customer due diligenceHM Revenue & Customs · Regulations 27 to 32Official sourceReviewed 31 July 2026Enhanced due diligenceHM Revenue & Customs · Regulations 33 and 35Official sourceReviewed 31 July 2026Suspicious activity reportsHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Record keepingHM Revenue & Customs · Regulation 40Official sourceReviewed 31 July 2026TrainingHM Revenue & Customs · Regulation 21Official sourceReviewed 31 July 2026Estate agent business guidanceHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Letting agent business guidanceHM Revenue & CustomsOfficial sourceReviewed 31 July 2026

UK MSB and hawala AML starter pack

United Kingdom money service business and hawala AML starter records

Open tool
Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017UK Legislation · Regulations 18, 18A, 19, 21, 27 to 40 and 46Official sourceReviewed 31 July 2026Money Laundering and Terrorist Financing (Amendment) Regulations 2026UK Legislation · SI 2026/621Most provisions commenced 30 June 2026. Regulations 20 and 36(b) commence 1 February 2027. Regulation 37 is staged.Reviewed 31 July 2026Guidance for all sectors: IntroductionHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Business risk assessmentHM Revenue & Customs · Regulations 18 and 18AOfficial sourceReviewed 31 July 2026Policies, controls and proceduresHM Revenue & Customs · Regulation 19Official sourceReviewed 31 July 2026Customer due diligenceHM Revenue & Customs · Regulations 27 to 32Official sourceReviewed 31 July 2026Enhanced due diligenceHM Revenue & Customs · Regulations 33 and 35Official sourceReviewed 31 July 2026Suspicious activity reportsHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Record keepingHM Revenue & Customs · Regulation 40Official sourceReviewed 31 July 2026TrainingHM Revenue & Customs · Regulation 21Official sourceReviewed 31 July 2026Money service business guidanceHM Revenue & CustomsOfficial sourceReviewed 31 July 2026

UK trust or company service provider AML starter pack

United Kingdom trust or company service provider AML starter records

Open tool
Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017UK Legislation · Regulations 18, 18A, 19, 21, 27 to 40 and 46Official sourceReviewed 31 July 2026Money Laundering and Terrorist Financing (Amendment) Regulations 2026UK Legislation · SI 2026/621Most provisions commenced 30 June 2026. Regulations 20 and 36(b) commence 1 February 2027. Regulation 37 is staged.Reviewed 31 July 2026Guidance for all sectors: IntroductionHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Business risk assessmentHM Revenue & Customs · Regulations 18 and 18AOfficial sourceReviewed 31 July 2026Policies, controls and proceduresHM Revenue & Customs · Regulation 19Official sourceReviewed 31 July 2026Customer due diligenceHM Revenue & Customs · Regulations 27 to 32Official sourceReviewed 31 July 2026Enhanced due diligenceHM Revenue & Customs · Regulations 33 and 35Official sourceReviewed 31 July 2026Suspicious activity reportsHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Record keepingHM Revenue & Customs · Regulation 40Official sourceReviewed 31 July 2026TrainingHM Revenue & Customs · Regulation 21Official sourceReviewed 31 July 2026Trust or company service provider guidanceHM Revenue & CustomsOfficial sourceReviewed 31 July 2026

Official sanctions-list normaliser and source-hashed change-diff

Supported United Kingdom, European Union and United States official sanctions-list normalisation

Open tool
The UK Sanctions ListForeign, Commonwealth & Development OfficeThe UK Sanctions List is the single source for UK designations from 28 January 2026.Reviewed 31 July 2026Format guide for the UK Sanctions ListForeign, Commonwealth & Development OfficeOfficial sourceReviewed 31 July 2026Consolidated list of persons, groups and organisations subject to EU financial sanctionsEuropean Commission, DG FISMAThe consolidated list reflects officially adopted texts published in the Official Journal of the European Union.Reviewed 31 July 2026EU consolidated electronic list XML file guidanceEuropean CommissionOfficial sourceReviewed 31 July 2026Sanctions List Service and sanctions list data filesUS Department of the Treasury, Office of Foreign Assets ControlOfficial sourceReviewed 31 July 2026Frequently asked questions on the Advanced Sanctions List StandardUS Department of the Treasury, Office of Foreign Assets ControlConfirms that OFAC continues to support its legacy fixed-width and CSV data files alongside the advanced XML products.Reviewed 7 August 2026Hash values for OFAC sanctions list filesUS Department of the Treasury, Office of Foreign Assets ControlOfficial sourceReviewed 31 July 2026

UK high-value dealer AML starter pack

United Kingdom high-value dealer AML starter records

Open tool
Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017UK Legislation · Regulations 18, 18A, 19, 21, 27 to 40 and 46Official sourceReviewed 31 July 2026Money Laundering and Terrorist Financing (Amendment) Regulations 2026UK Legislation · SI 2026/621Most provisions commenced 30 June 2026. Regulations 20 and 36(b) commence 1 February 2027. Regulation 37 is staged.Reviewed 31 July 2026Guidance for all sectors: IntroductionHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Business risk assessmentHM Revenue & Customs · Regulations 18 and 18AOfficial sourceReviewed 31 July 2026Policies, controls and proceduresHM Revenue & Customs · Regulation 19Official sourceReviewed 31 July 2026Customer due diligenceHM Revenue & Customs · Regulations 27 to 32Official sourceReviewed 31 July 2026Enhanced due diligenceHM Revenue & Customs · Regulations 33 and 35Official sourceReviewed 31 July 2026Suspicious activity reportsHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Record keepingHM Revenue & Customs · Regulation 40Official sourceReviewed 31 July 2026TrainingHM Revenue & Customs · Regulation 21Official sourceReviewed 31 July 2026High value dealer guidanceHM Revenue & CustomsOfficial sourceReviewed 31 July 2026

UK art-market participant AML starter pack

United Kingdom art-market participant AML starter records

Open tool
Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017UK Legislation · Regulations 18, 18A, 19, 21, 27 to 40 and 46Official sourceReviewed 31 July 2026Money Laundering and Terrorist Financing (Amendment) Regulations 2026UK Legislation · SI 2026/621Most provisions commenced 30 June 2026. Regulations 20 and 36(b) commence 1 February 2027. Regulation 37 is staged.Reviewed 31 July 2026Guidance for all sectors: IntroductionHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Business risk assessmentHM Revenue & Customs · Regulations 18 and 18AOfficial sourceReviewed 31 July 2026Policies, controls and proceduresHM Revenue & Customs · Regulation 19Official sourceReviewed 31 July 2026Customer due diligenceHM Revenue & Customs · Regulations 27 to 32Official sourceReviewed 31 July 2026Enhanced due diligenceHM Revenue & Customs · Regulations 33 and 35Official sourceReviewed 31 July 2026Suspicious activity reportsHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Record keepingHM Revenue & Customs · Regulation 40Official sourceReviewed 31 July 2026TrainingHM Revenue & Customs · Regulation 21Official sourceReviewed 31 July 2026Art market participant guidanceHM Revenue & CustomsOfficial sourceReviewed 31 July 2026

UK SAR quality preflight and internal decision record

Ordinary United Kingdom POCA or TACT SAR quality and internal decision record

Open tool
SARs guidance: Chapter 2, submitting a SARNational Crime Agency, UK Financial Intelligence UnitOrdinary POCA and TACT submission guidance. DAML and DATF requests are outside the supported route.Reviewed 7 August 2026Suspicious activity reportsHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Proceeds of Crime Act 2002UK Legislation · Sections 330 and 331Official sourceReviewed 7 August 2026Terrorism Act 2000UK Legislation · Sections 19 and 21AOfficial sourceReviewed 7 August 2026Money laundering: confidentiality and sensitivity of SARs and the identity of those who make themHome Office · Home Office circular 022/2015Official sourceReviewed 7 August 2026

Public source register

Official records used by released tools, grouped by jurisdiction. Proposed changes are not treated as current law.

United Kingdom60 official records
Data Protection Act 2018, section 164AUK Parliament · Complaints by data subjects to controllersIn forceReviewed 31 July 2026Data (Use and Access) Act 2025, section 103UK Parliament · Complaints by data subjectsIn forceReviewed 31 July 2026How to deal with data protection complaintsInformation Commissioner’s OfficeCurrent guidanceReviewed 31 July 2026Bank holidays JSON datasetGOV.UKDynamic official datasetReviewed 31 July 2026UK GDPR, Article 33UK Parliament · Notification of a personal data breach to the supervisory authorityIn forceReviewed 7 August 2026UK GDPR, Article 34UK Parliament · Communication of a personal data breach to the data subjectIn forceReviewed 7 August 2026Personal data breaches: a guideInformation Commissioner’s OfficeCurrent guidanceReviewed 7 August 202672 hours: how to respond to a personal data breachInformation Commissioner’s OfficeGuidance marked under reviewReviewed 7 August 2026UK GDPR, Article 35UK Parliament · Data protection impact assessmentIn forceReviewed 7 August 2026UK GDPR, Article 36UK Parliament · Prior consultationIn forceReviewed 7 August 2026When do we need to do a DPIA?Information Commissioner’s OfficeCurrent guidanceReviewed 7 August 2026How do we do a DPIA?Information Commissioner’s OfficeGuidance marked under reviewReviewed 7 August 2026Are we making a restricted transfer?Information Commissioner’s Office · Restricted-transfer three-step testOfficial sourceReviewed 7 August 2026What are the rules on appropriate safeguards?Information Commissioner’s Office · UK GDPR Article 46 safeguards and data protection testOfficial sourceReviewed 7 August 2026What are standard data protection clauses (the UK IDTA and the Addendum)?Information Commissioner’s Office · IDTA and Addendum completion guidanceOfficial sourceReviewed 7 August 2026Completing a transfer risk assessmentInformation Commissioner’s Office · Transfer risk assessment and data protection testOfficial sourceReviewed 7 August 2026Is the restricted transfer covered by adequacy regulations?Information Commissioner’s Office · UK adequacy regulationsOfficial sourceReviewed 7 August 2026UK GDPR, Article 13UK Parliament · Information where personal data are collected from the data subjectIn forceReviewed 7 August 2026UK GDPR, Article 14UK Parliament · Information where personal data have not been obtained from the data subjectIn forceReviewed 7 August 2026Right to be informedInformation Commissioner’s OfficeCurrent guidanceReviewed 7 August 2026Privacy and Electronic Communications Regulations 2003, regulation 22UK Parliament · Use of electronic mail for direct marketing purposesIn force as amendedReviewed 7 August 2026Privacy and Electronic Communications Regulations 2003, regulation 23UK Parliament · Information to be provided for electronic mail marketingIn force as amendedReviewed 7 August 2026Guidance on direct marketing using electronic mailInformation Commissioner’s OfficeOfficial sourceReviewed 7 August 2026Business-to-business marketingInformation Commissioner’s OfficeGuidance marked under reviewReviewed 7 August 2026UK GDPR, Article 30UK Parliament · Records of processing activitiesIn forceReviewed 31 July 2026What do we need to document under Article 30?Information Commissioner’s OfficeGuidance marked under reviewReviewed 31 July 2026UK GDPR, Article 28UK Parliament · Processor contractsIn forceReviewed 31 July 2026What needs to be included in the contract?Information Commissioner’s OfficeGuidance marked under reviewReviewed 31 July 2026UK GDPR, Article 12UK Parliament · Exercise of data-subject rightsIn forceReviewed 31 July 2026Data (Use and Access) Act 2025, section 76UK Parliament · Time limits for respondingIn force for new requestsReviewed 31 July 2026A guide to subject accessInformation Commissioner’s OfficeCurrent guidanceReviewed 31 July 2026Code of Practice for the Cyber Security of AIDepartment for Science, Innovation and Technology · Principles 1 to 13Jurisdiction context only. Applicability must be assessed separately.Reviewed 7 August 2026Guidelines for AI procurementUK Government · Procurement, data assessment, risk and supplier management guidanceJurisdiction context only. Applicability must be assessed separately.Reviewed 7 August 2026Guidelines for secure AI system developmentNational Cyber Security Centre · Secure design, development, deployment and operationJurisdiction context only. Applicability must be assessed separately.Reviewed 7 August 2026Implementation Guide for the AI Cyber Security Code of PracticeDepartment for Science, Innovation and Technology · Implementation measures and evidence examplesVoluntary implementation guidanceReviewed 7 August 2026Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017UK Legislation · Regulations 18, 18A, 19, 21, 27 to 40 and 46Official sourceReviewed 31 July 2026Money Laundering and Terrorist Financing (Amendment) Regulations 2026UK Legislation · SI 2026/621Most provisions commenced 30 June 2026. Regulations 20 and 36(b) commence 1 February 2027. Regulation 37 is staged.Reviewed 31 July 2026Guidance for all sectors: IntroductionHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Business risk assessmentHM Revenue & Customs · Regulations 18 and 18AOfficial sourceReviewed 31 July 2026Policies, controls and proceduresHM Revenue & Customs · Regulation 19Official sourceReviewed 31 July 2026Customer due diligenceHM Revenue & Customs · Regulations 27 to 32Official sourceReviewed 31 July 2026Enhanced due diligenceHM Revenue & Customs · Regulations 33 and 35Official sourceReviewed 31 July 2026Suspicious activity reportsHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Record keepingHM Revenue & Customs · Regulation 40Official sourceReviewed 31 July 2026TrainingHM Revenue & Customs · Regulation 21Official sourceReviewed 31 July 2026Risks common to accountancy service providersHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Estate agent business guidanceHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Letting agent business guidanceHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Money service business guidanceHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Trust or company service provider guidanceHM Revenue & CustomsOfficial sourceReviewed 31 July 2026The UK Sanctions ListForeign, Commonwealth & Development OfficeThe UK Sanctions List is the single source for UK designations from 28 January 2026.Reviewed 31 July 2026Format guide for the UK Sanctions ListForeign, Commonwealth & Development OfficeOfficial sourceReviewed 31 July 2026High value dealer guidanceHM Revenue & CustomsOfficial sourceReviewed 31 July 2026Firm-wide risk assessmentsSolicitors Regulation Authority · Regulations 18 and 18AOfficial sourceReviewed 31 July 2026Client and matter risk assessmentsSolicitors Regulation AuthorityOfficial sourceReviewed 31 July 2026Art market participant guidanceHM Revenue & CustomsOfficial sourceReviewed 31 July 2026SARs guidance: Chapter 2, submitting a SARNational Crime Agency, UK Financial Intelligence UnitOrdinary POCA and TACT submission guidance. DAML and DATF requests are outside the supported route.Reviewed 7 August 2026Proceeds of Crime Act 2002UK Legislation · Sections 330 and 331Official sourceReviewed 7 August 2026Terrorism Act 2000UK Legislation · Sections 19 and 21AOfficial sourceReviewed 7 August 2026Money laundering: confidentiality and sensitivity of SARs and the identity of those who make themHome Office · Home Office circular 022/2015Official sourceReviewed 7 August 2026
European Union31 official records
General Data Protection Regulation, Article 33Publications Office of the European Union · Controller notification to the competent supervisory authority and processor notification to the controllerIn forceReviewed 7 August 2026General Data Protection Regulation, Article 34Publications Office of the European Union · Communication of a personal data breach to the data subjectIn forceReviewed 7 August 2026Guidelines 9/2022 on personal data breach notification under GDPREuropean Data Protection BoardFinal guidelinesReviewed 7 August 2026General Data Protection Regulation, Article 35Publications Office of the European Union · DPIA duty, minimum content and national supervisory-authority listsIn forceReviewed 7 August 2026General Data Protection Regulation, Article 36Publications Office of the European Union · Prior consultation with the competent supervisory authorityIn forceReviewed 7 August 2026Data protection impact assessments: high-risk processingEuropean Data Protection Board · WP248 rev.01, endorsed by the EDPBEndorsed guidelinesReviewed 7 August 2026DPIA lists of processing activitiesEuropean Data Protection Board · Register of Article 35(4) mandatory and Article 35(5) no-DPIA listsCurrent registerReviewed 7 August 2026General Data Protection Regulation, Article 13Publications Office of the European Union · Information where personal data are collected from the data subjectIn forceReviewed 7 August 2026General Data Protection Regulation, Article 14Publications Office of the European Union · Information where personal data have not been obtained from the data subjectIn forceReviewed 7 August 2026Guidelines on transparency under Regulation 2016/679European Data Protection Board · WP260 rev.01, endorsed by the EDPBEndorsed guidelinesReviewed 7 August 2026Regulation (EU) 2016/679, Article 30European Union · Records of processing activitiesIn forceReviewed 31 July 2026Position paper on Article 30(5) derogationsEuropean Data Protection BoardWP29 position endorsed by EDPBReviewed 31 July 2026Regulation (EU) 2016/679, Article 28European Union · Processor contractsIn forceReviewed 31 July 2026Guidelines 07/2020 on controller and processor conceptsEuropean Data Protection BoardFinal guidanceReviewed 31 July 2026Commission Implementing Decision (EU) 2021/915European Commission · Article 28 standard contractual clausesIn forceReviewed 31 July 2026Regulation (EU) 2016/679, Article 12European Union · Transparent information and exercise of rightsIn forceReviewed 31 July 2026Regulation (EEC, Euratom) No 1182/71European Union · Rules applicable to periods, dates and time limitsIn forceReviewed 31 July 2026Guidelines 01/2022 on data subject rights: Right of accessEuropean Data Protection BoardFinal guidanceReviewed 31 July 2026Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligenceEUR-Lex · Article 50Official sourceReviewed 2 August 2026Guidelines on transparency obligations for providers and deployers of AI systemsEuropean Commission · Article 50 guidanceOfficial sourceReviewed 2 August 2026Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689EUR-Lex · Article 113(4)Official sourceReviewed 2 August 2026Transparency obligations under Article 50 of the AI ActEuropean Commission · Article 50 questions and answersOfficial sourceReviewed 2 August 2026Commission Opinion on the Code of Practice on Transparency of AI-generated contentEuropean Commission · Articles 50(2), 50(4) and 50(5)Official sourceReviewed 2 August 2026Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689EUR-Lex · Article 4(1)Official sourceReviewed 2 August 2026AI literacy questions and answersEuropean Commission · Article 4 practical guidanceOfficial sourceReviewed 2 August 2026Repository of AI literacy practicesEuropean CommissionOfficial sourceReviewed 2 August 2026Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligenceEUR-Lex · Articles 5, 9, 17, 26 and 27Jurisdiction context only. Applicability must be assessed separately.Reviewed 7 August 2026Guidelines on prohibited artificial intelligence practices established by the AI ActEuropean Commission · Article 5 guidance and examplesOfficial sourceReviewed 7 August 2026Directive (EU) 2015/849 on preventing use of the financial system for money laundering or terrorist financingEUR-Lex · Articles 13, 18 and 40Directive baseline only. Member State implementing law, competent-authority guidance and sector rules must be checked separately.Reviewed 31 July 2026Consolidated list of persons, groups and organisations subject to EU financial sanctionsEuropean Commission, DG FISMAThe consolidated list reflects officially adopted texts published in the Official Journal of the European Union.Reviewed 31 July 2026EU consolidated electronic list XML file guidanceEuropean CommissionOfficial sourceReviewed 31 July 2026
United States37 official records
California Consumer Privacy Act FAQsCalifornia Privacy Protection AgencyEnacted broad state privacy lawReviewed 31 July 2026Colorado Revised Statutes, Title 6Colorado General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Connecticut Data Privacy ActConnecticut Attorney GeneralEnacted broad state privacy lawReviewed 31 July 2026Virginia Code, Title 59.1 Chapter 53Virginia General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Utah Code section 13-61-203Utah State LegislatureEnacted broad state privacy lawReviewed 31 July 2026Florida Statutes, Chapter 501Florida LegislatureEnacted broad state privacy lawReviewed 31 July 2026Oregon Revised Statutes, Chapter 646AOregon LegislatureEnacted broad state privacy lawReviewed 31 July 2026Texas HB 4 final textTexas LegislatureEnacted broad state privacy lawReviewed 31 July 2026Montana Code section 30-14-2808Montana LegislatureEnacted broad state privacy lawReviewed 31 July 2026Delaware Code, Title 6 Chapter 12DDelaware General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Iowa Code, Chapter 715DIowa LegislatureEnacted broad state privacy lawReviewed 31 July 2026Nebraska Revised Statutes section 87-1108Nebraska LegislatureEnacted broad state privacy lawReviewed 31 July 2026New Hampshire RSA 507-HNew Hampshire General CourtEnacted broad state privacy lawReviewed 31 July 2026New Jersey P.L. 2023, c.266New Jersey LegislatureEnacted broad state privacy lawReviewed 31 July 2026Tennessee Public Chapter 408Tennessee General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Minnesota controller obligationsMinnesota Attorney GeneralEnacted broad state privacy lawReviewed 31 July 2026Maryland Code section 14-4705Maryland General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Indiana Code, Title 24 Article 15Indiana General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Kentucky HB 15 final textKentucky General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Rhode Island section 6-48.1-6Rhode Island General AssemblyEnacted broad state privacy lawReviewed 31 July 2026Oklahoma SB 546 enrolledOklahoma LegislatureEnacted broad state privacy lawReviewed 31 July 2026Louisiana Act 502Louisiana State LegislatureEnacted broad state privacy lawReviewed 31 July 2026Alabama HB 351 enrolledAlabama LegislatureEnacted broad state privacy lawReviewed 31 July 2026Vermont Act 145Vermont General AssemblyEnacted broad state privacy lawReviewed 31 July 2026CCPA updates, cybersecurity audits, risk assessments, ADMT and insurance regulationsCalifornia Privacy Protection AgencyFinal regulationsReviewed 31 July 2026Approved text of CCPA regulationsCalifornia Privacy Protection Agency · Risk assessmentsApproved and filed final textReviewed 31 July 2026New regulations approved by Office of Administrative LawCalifornia Privacy Protection AgencyOfficial compliance-date announcementReviewed 31 July 2026Delete Request and Opt-out Platform final regulationsCalifornia Privacy Protection Agency · California Code of Regulations, title 11, sections 7600 to 7616Official sourceReviewed 31 July 2026Data Broker Registration Law and Delete Act statutory compilationCalifornia Privacy Protection Agency · Civil Code sections 1798.99.80 to 1798.99.89Official sourceReviewed 31 July 2026Data brokers and the Delete Request and Opt-out PlatformCalifornia Privacy Protection AgencyOfficial sourceReviewed 31 July 2026Artificial Intelligence Risk Management Framework (AI RMF 1.0)National Institute of Standards and Technology · Govern, Map, Measure and Manage functionsVoluntary governance baseline used by this toolReviewed 7 August 2026NIST AI Risk Management Framework PlaybookNational Institute of Standards and Technology · Suggested actions for Govern, Map, Measure and ManageVoluntary governance baseline used by this toolReviewed 7 August 2026Information on complying with the Customer Due Diligence Final RuleFinancial Crimes Enforcement Network · 31 CFR 1010.230 and applicable programme rulesApplies only to covered financial institutions and remains subject to FinCEN relief, exceptions and programme-specific rules.Reviewed 31 July 2026CDD Rule consolidated FAQsFinancial Crimes Enforcement NetworkReflects the 13 February 2026 exceptive relief described by FinCEN. Coverage and use of the relief remain user decisions.Reviewed 31 July 2026Sanctions List Service and sanctions list data filesUS Department of the Treasury, Office of Foreign Assets ControlOfficial sourceReviewed 31 July 2026Frequently asked questions on the Advanced Sanctions List StandardUS Department of the Treasury, Office of Foreign Assets ControlConfirms that OFAC continues to support its legacy fixed-width and CSV data files alongside the advanced XML products.Reviewed 7 August 2026Hash values for OFAC sanctions list filesUS Department of the Treasury, Office of Foreign Assets ControlOfficial sourceReviewed 31 July 2026

Change history

  1. Rule pack 2026.07.31

    Initial public review of the official sources used by the five released privacy tools.

Start with the exact task.

Find the right tool