AML client due diligence means identifying and verifying each new client, identifying beneficial owners holding more than 25%, and understanding the purpose and expected nature of the relationship before work starts. UK accountants must apply enhanced checks for higher-risk clients, monitor relationships as they continue, and keep records for five years after the relationship ends. If checks cannot be completed, you must not proceed.
Key takeaways
- Due diligence must be done when a business relationship is established, not after the first set of accounts.
- A beneficial owner of a company is anyone holding more than 25% of the shares or voting rights, or otherwise controlling it.
- Clients you do not meet in person, politically exposed persons and links to high-risk third countries call for enhanced due diligence.
- Companies House identity verification is a register requirement; it does not replace your own customer due diligence.
- If you cannot complete due diligence, regulation 31 says you must not take the client on and must consider a report.
- Keep due diligence records for five years from the end of the relationship.
What do the Money Laundering Regulations require before you start work?
Every UK accountant, bookkeeper and tax adviser providing services by way of business falls under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. You must be supervised for anti-money laundering purposes, either by a professional body such as ICAEW or ACCA or, if you are not a member of one, by HMRC. The GOV.UK page on accountancy service provider registration sets out who registers with HMRC.
Supervision brings a set of duties, and customer due diligence (CDD) sits at the centre. HMRC’s guidance on your responsibilities under the Regulations says you must apply CDD when you establish a business relationship, when you suspect money laundering or terrorist financing, when you doubt identification information you already hold, and for existing clients when their circumstances change.
In practice, CDD has three parts:
- Identify and verify the client: for an individual, name, residential address and date of birth, checked against reliable documents or sources.
- Identify the beneficial owners behind a company, partnership or trust, and take reasonable steps to verify them.
- Understand the relationship: its purpose, intended nature and the activity you expect to see.
The order matters. These checks come before you start chargeable work, which is why they belong in onboarding rather than in the first month of the job.
Who counts as a beneficial owner?
For a company, regulation 5 defines a beneficial owner as an individual who holds, directly or indirectly, more than 25% of the shares or voting rights, or who otherwise exercises ownership or control. "More than 25%" means exactly 25% does not qualify, which matters for four equal shareholders.
Three situations catch practices out:
- Layered ownership. If a holding company owns 60% of your client, you look through it to the individuals who own the holding company.
- Control without shares. A person who can appoint the board or direct decisions can be a beneficial owner with no shareholding at all.
- No qualifying individual. Where nobody meets the test, follow your supervisor’s guidance on whom to record instead, and note on the file why no individual qualified.
The people with significant control (PSC) register at Companies House is a useful starting point, but treat it as a lead to check, not a conclusion. If what the client tells you differs from the register, find out why before you proceed.
Standard or enhanced: how should you rate client risk?
The Regulations are risk-based. You need a firm-wide risk assessment, and each client needs a risk rating that decides how much due diligence you apply. HMRC’s guidance lists situations calling for enhanced due diligence (EDD), including clients not physically present for identity checks, politically exposed persons and their family and close associates, transactions involving a high-risk third country, and any other higher-risk situation.
A simple scoring table makes the rating consistent across staff:
| Factor | Low (0) | Medium (1) | High (2) |
|---|---|---|---|
| Client type | Employed individual, salary only | Sole trader or simple limited company | Trust, complex group or overseas structure |
| How you met | In person or reliable referral | Remote, ID verified electronically | Remote with no independent verification |
| Sector | Professional services | Retail or hospitality | Cash-intensive or high-value goods |
| Geography | UK only | Links to other countries | Links to a high-risk third country |
| PEP status | None | — | PEP, family member or close associate |
Add the scores. As an illustrative policy, 0–2 is standard due diligence, 3–4 standard with closer monitoring, and 5 or more, or any PEP, is enhanced. For PEPs, HMRC’s guidance requires senior management approval, establishing source of wealth and funds, and stricter ongoing monitoring. Set your own thresholds in your policy and apply them the same way each time.
Worked example: three new clients in one week
A three-partner practice in Leeds takes on three clients in the same week. Using the table above:
- Priya, a self-employed physiotherapist, comes by referral and meets a partner in person. Client type 1, meeting 0, sector 0, UK only 0, no PEP. Score 1: standard. Passport and a recent utility bill verified; purpose recorded as Self Assessment and bookkeeping.
- Harbour Kitchens Ltd, a restaurant group, is onboarded remotely. Two directors each own 30%; a third holds 40% through a family holding company. Client type 2 (layered), meeting 1, sector 1 (hospitality), UK only 0. Score 4: standard with closer monitoring. The practice looks through the holding company, verifies all three individuals and notes expected cash takings for later comparison.
- Mr D, a new private client, mentions he was a minister in another country until last year. PEP status means enhanced regardless of score. A partner signs off the relationship, source of wealth is documented from his employment history and property sale, and monitoring is set to six months.
Total extra time for the enhanced file is perhaps two hours. That is small compared with the cost of explaining to a supervisor why a PEP was onboarded on a passport scan alone.
Does Companies House identity verification replace your checks?
No. Since 18 November 2025, directors and people with significant control have had to verify their identity with Companies House, with a 12-month transition for existing companies that is now ending. GOV.UK’s guidance on when you need to verify your identity for Companies House explains the deadlines, which for many existing directors are tied to the company’s confirmation statement date.
That verification is a requirement for the register. It does not satisfy your duties under the Money Laundering Regulations, because your CDD has to cover things Companies House does not: the purpose of the relationship, the expected activity, the client’s risk rating and, where needed, source of funds. A verified status on the register is a helpful data point, and a mismatch between the register and what the client tells you is a reason to ask more questions.
What order should the onboarding steps follow?
Most CDD gaps come from doing the right checks in the wrong order: the engagement letter goes out on day one, work starts on day three, and the passport arrives in week five. A fixed sequence prevents that.
- Enquiry logged. Record who the client is, who referred them and what service they want.
- Ownership mapped. For entities, draw the structure down to individuals and compare it with the PSC register.
- Documents requested. Ask for identity evidence for the client and each beneficial owner in one request, not in instalments.
- Questionnaire completed. Purpose of the relationship, expected activity, sources of income or funds, overseas links and PEP status.
- Risk scored and approved. Apply the table, record the rating, and get partner sign-off where your policy requires it.
- Engagement letter issued. Only now, with the scope matching what the client told you in step 4.
- Refresh date set. Diary the next review according to the rating.
Each step should leave something on the file: a note, a document, a score or a signature. If a supervisor reviews the file two years later, the sequence and its dates tell the story without anyone having to remember it.
How should ongoing monitoring and record-keeping work?
CDD is not a one-off. HMRC’s guidance expects you to keep client information up to date, revisit the risk assessment when circumstances change, such as a big change in activity or ownership, and carry out further due diligence where needed. In practice, that means two triggers:
- Event triggers: a new shareholder, a move abroad, a sudden jump in turnover or cash, a request for an unusual service. Any of these restarts the relevant part of CDD.
- Time triggers: a scheduled refresh by risk rating, for example every three years for standard clients, annually for closer monitoring and every six months for enhanced. These intervals are your policy choice; write them down.
Records must be kept for five years from the date the business relationship ends, or the date an occasional transaction is completed. That covers identification documents, risk assessments, the evidence you relied on and staff training records. Scanned and electronic copies are acceptable. Set a deletion review at the five-year point, because keeping personal data longer than needed creates its own data protection problem. For how this fits into collecting tax documents, see our Self Assessment document collection plan.
What if you cannot complete due diligence?
Regulation 31 is blunt. If you cannot apply CDD as required, you must not establish the business relationship or carry out the transaction, you must terminate any existing relationship, and you must consider whether a disclosure is required under the Proceeds of Crime Act 2002 or the Terrorism Act 2000.
A client who will not provide identification, or whose ownership structure cannot be explained, is therefore not a client you can quietly start work for "while the paperwork catches up". Set a firm rule: no engagement letter is countersigned and no chargeable work begins until CDD is marked complete by the person responsible.
Where you have a suspicion, report it to your firm’s nominated officer, who decides whether a suspicious activity report goes to the National Crime Agency. Be careful what you say to the client afterwards, because tipping-off offences can apply. If you are unsure how to handle a specific case, speak to your supervisory body’s helpline.
How Zaquil handles AML client due diligence
Zaquil does not decide your risk ratings for you, and it is not an identity verification service. What it does is make sure every step of your CDD policy happens, in order, with evidence on file.
Each new client starts as a job from a template with your CDD steps as a checklist: identity documents received, beneficial owners identified, purpose recorded, risk score set, partner approval for enhanced files. The engagement letter step sits after CDD on the same checklist, so no one sends it early.
In the secure client portal, the client sees a short list of what you need, uploads identity documents and completes your onboarding questionnaire on ownership, source of funds and expected activity. Once you are satisfied, they e-sign the engagement letter in the same place and receive a signed PDF with a signing certificate.
Your scheduled refreshes become recurring jobs with deadlines set by risk rating, and automations create the task and send the client a request when one falls due. The CDD file and your notes sit in firm-only folders in the Documents hub, so clients never see internal risk assessments.
The accounting and tax setup includes onboarding templates you can adapt to your own policy. The pricing page has a 14-day free trial with no card required.
Frequently asked questions
Do all UK accountants need to carry out customer due diligence?
Yes, if they provide accountancy, bookkeeping, tax advice or audit services by way of business. They fall under the Money Laundering Regulations 2017 and must be supervised for anti-money laundering purposes, by a professional body such as ICAEW or ACCA or, otherwise, by HMRC. Customer due diligence is a core duty under that supervision.
When must customer due diligence be carried out?
When you establish a business relationship, when you suspect money laundering or terrorist financing, when you doubt identification information already held, and for existing clients when their circumstances change. For new clients, that means completing the checks before chargeable work begins, not after the first set of accounts or the first tax return.
What is a beneficial owner for AML purposes?
For a company, it is an individual who holds, directly or indirectly, more than 25% of the shares or voting rights, or who otherwise exercises ownership or control. You must look through holding companies to the individuals behind them. Someone with no shares can still be a beneficial owner if they control the company in practice.
What documents can accountants use to verify identity?
HMRC guidance refers to obtaining the client’s name, photograph on an official document, residential address and date of birth, using documents such as a passport, utility bills or bank statements. Many practices also use electronic verification. Whatever you rely on, record what you checked, when and by whom, and keep copies for five years after the relationship ends.
When is enhanced due diligence required?
HMRC guidance lists clients who are not physically present for identity checks, politically exposed persons and their family members and close associates, transactions involving a high-risk third country, and any other situation presenting a higher risk. Enhanced measures include extra identity checks, establishing where funds come from and, for PEPs, senior management approval and stricter monitoring.
Who is a politically exposed person?
A politically exposed person is someone entrusted with a prominent public function, such as a head of state or government, a minister or a member of parliament, in the UK or abroad. Their family members and known close associates are treated in the same way. Being a PEP is not wrongdoing, but it requires enhanced due diligence and senior approval.
Does Companies House identity verification count as customer due diligence?
No. Companies House verification is a requirement for directors and people with significant control on the public register. Your CDD under the Money Laundering Regulations must also cover the purpose of the relationship, expected activity, risk rating and, where needed, source of funds. Treat a verified status as useful information, not a substitute for your own checks.
How long must accountants keep AML records?
Five years from the date the business relationship ends, or from completion of an occasional transaction. This covers customer due diligence records, identification documents, risk assessments and training records. Electronic and scanned copies are acceptable. After five years, review whether you still need the records, because keeping personal data longer than necessary can breach data protection rules.
What happens if a client refuses to provide ID?
You cannot take them on. Regulation 31 says that if you cannot apply customer due diligence, you must not establish the business relationship or carry out the transaction, must end any existing relationship, and must consider whether a disclosure is required under the Proceeds of Crime Act 2002 or the Terrorism Act 2000. Speak to your nominated officer.
How often should client due diligence be refreshed?
Whenever circumstances change, such as new owners, a move abroad or a big change in activity, and on a schedule set by risk in your own policy. Many firms refresh standard-risk clients every few years and higher-risk clients annually or more often. Write the intervals into your policy and track them as dated tasks.
Do accountants need a firm-wide AML risk assessment?
Yes. Supervised firms must assess the money laundering and terrorist financing risks they face, taking into account their clients, services, delivery channels and geography, and keep that assessment documented and up to date. It informs the policies, controls and client risk ratings you apply, and your supervisor can ask to see it.
Who should staff tell if they suspect money laundering?
They should report internally to the firm’s nominated officer, who decides whether to submit a suspicious activity report to the National Crime Agency. Staff should not alert the client to the suspicion or to any report, because tipping-off offences can apply. Train all relevant staff on how and when to make an internal report.
Run this part of your business in one place
Zaquil puts every email, document, approval, invoice, call and automation for your accounting and tax setup in a single workspace — set up for UK practices on day one.
- Client portal with document requests, organisers, e-signatures and online payment
- Jobs with templates, checklists and recurring work; invoices and unbilled time
- One inbox for email, chat, SMS, WhatsApp and calls across every brand