The Keyfob Economy: Sanctions Diligence in Britain's Self-Storage Sector

A self-storage site is an unusual kind of institution. It issues no statements, files no suspicious activity reports as a matter of routine, and rarely knows what is behind its own doors. A tenant signs up online, pays by card or at a kiosk, receives a keyfob and a gate code, and thereafter interacts with the operator mainly through a direct debit mandate. The contents of the unit — company books, stock, wine, tools, furniture, occasionally paintings — are, by design, none of the operator's business.

That discretion is the product. It is also the reason the sector sits awkwardly against the UK's financial-crime architecture in 2026. Storage units are a low-profile form of custody: not a bank account, not a safe deposit box in a monitored vault, not a warehouse with customs oversight. For a designated person, or for a company acting on their behalf, a unit in an industrial estate is an inexpensive way to hold value, records and goods out of sight.

A Regulated Sector That Isn't

It is worth being precise about the legal position, because the gap is statutory rather than merely cultural. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 set out a closed list of regulated activities. Estate agency, trust or company service provision, accountancy, legal services, cryptoasset exchange and — since 2020 — art market participation all feature. General self-storage does not.

The art point is instructive. The regulations capture firms trading in art, and they also reach the storage of art in a freeport, where customs relief and a degree of physical separation combine to create a recognised risk. That carve-out is narrow. Art held in a conventional self-storage unit in, say, Trafford or Tilbury falls outside it, even though the underlying risk — high-value, portable, hard-to-value assets held under a name nobody has verified — is materially the same.

The consequence is that self-storage operators are not 'relevant firms' for the purposes of the sanctions regime in the Sanctions and Anti-Money Laundering Act 2018, and not in the regulated sector under Schedule 9 to the Proceeds of Crime Act 2002. They have no statutory obligation to screen tenants, no obligation to report suspected sanctions breaches to the Office of Financial Sanctions Implementation, and no automatic route into the suspicious activity reporting regime.

What Onboarding Actually Looks Like

In practice, tenant due diligence across the sector ranges from the diligent to the nominal. Larger operators have invested in identity verification at the point of online booking, and many now run a basic check against a commercial screening database. Smaller independent sites, which make up a substantial share of the estate, frequently rely on a utility bill, a card authorisation and a signature.

Three weaknesses recur.

The name on the agreement is not the only name that matters. A unit rented by a UK-incorporated company tells the operator nothing about who controls it. Where an operator collects no beneficial ownership information and does no corporate screening, a designated individual's wholly owned vehicle can hold a tenancy in complete obscurity.

Purpose is rarely declared, and never verified. Most agreements record contents in the vaguest terms — 'household goods', 'business stock', 'documents'. Where a tenant declares that a unit will hold company records, the operator has no practical means of testing that claim, and no incentive to try.

Ongoing monitoring is thin. Sanctions designations change weekly. An operator that screened a tenant in 2019 and has not re-run the check since is relying on a snapshot that may bear no relation to the current list.

The Cash at the Kiosk

Payment method is where the audit trail most often breaks. Card and direct debit payments leave a trace tied to a named account. Cash deposited at a site office, or paid in advance for a year, leaves only a receipt and an entry in a ledger that may never be reviewed by anyone outside the business.

Cash handling also creates a structural blind spot around the person actually transacting. A relative, an employee or a 'friend of the tenant' paying monthly in notes is not unusual in this market, particularly for older or overseas tenants. Each of those arrangements is innocuous in isolation and cumulatively corrosive to any attempt to establish who is behind a unit.

Remote access compounds the problem. Twenty-four-hour fob entry, unmanned sites and gate codes shared between several individuals mean that the person physically visiting a unit — loading goods, retrieving files, dropping off a package — need never have appeared on the tenancy at all.

Where Sanctions Liability Actually Bites

It is tempting to treat this as an AML supervision question with a sanctions footnote. The reverse is closer to the truth. Sanctions are strict liability: a person who makes funds or economic resources available to a designated person, directly or indirectly, breaches the prohibition whether or not they knew the designation existed. Goods in a storage unit can constitute economic resources. So can a company's books, a vehicle, plant equipment or a consignment of stock.

OFSI's guidance on ownership and control extends the analysis beyond the named tenant. A unit rented by an entity that a designated person owns or controls — including through a chain of intermediate companies — engages the prohibitions just as squarely as one rented in the designated person's own name.

A Proportionate Model

A workable compliance model for the sector does not require operators to act as banks. It requires them to know who their tenant is and to keep knowing.

• Risk-tier the tenancy, not the customer segment. Residential-scale units holding household goods warrant light-touch verification. Business tenancies, units above a defined size, annual prepayment and any declared storage of art, wine, records or high-value stock warrant enhanced checks, including corporate beneficial ownership screening.
• Screen the entity and its controllers at onboarding, against both the UK consolidated sanctions list and OFSI's consolidated list, and record the result with a date stamp.
• Re-screen on a defined cycle and on trigger events — a designation in the news, a change of signatory, a change of payment method, a request to add a keyholder.
• Set a cash threshold. Above a modest figure, require a bank payment or evidence of source. Below it, record the payer's identity.
• Ask what is in the unit and record the answer, however imprecise. A declaration that later proves false is itself useful intelligence.
• Log access anomalies — repeated out-of-hours visits, multiple keyholders, requests to transfer a tenancy between parties.

Operators that find themselves holding a suspicion have no statutory reporting duty, but they are not without options. Voluntary disclosure to the National Crime Agency, a report to OFSI, or a conversation with a trade body's compliance lead are all open to them, and all preferable to silence.

The Supervisory Question

None of this is currently anyone's job to enforce. Self-storage has no designated supervisor, no sectoral guidance from the Financial Conduct Authority or HMRC, and no accreditation standard that addresses financial crime. The industry's own trade bodies have done useful work on safety and security; sanctions and money laundering have not featured prominently.

That is likely to change. As the regulated perimeter tightens elsewhere — identity verification at Companies House, reform of the enabler professions, closer scrutiny of the art market — value and paperwork tend to migrate to the least supervised custody option available. A storage unit with a keyfob and a direct debit is, for now, exactly that. The question for policymakers is not whether the sector needs a supervisor, but how light that supervision can be while still closing a door that currently stands open.