AML Checks Virtual Service AssistsPractice admin for UK accountants
Menu
Book a consultation
Compliance and regulatory

AML checks for accountants in the UK, run to your own policy

We collect the ID, run the screening in your AML tool, chase source of funds and keep the monitoring diary moving. Your MLRO makes the risk call and decides whether the client comes on board.

Book a consultation
What we run

The six jobs inside every CDD file

Most AML files stall on admin: a passport photo that never arrives, a screening result nobody has cleared, a review date that passed in March. These are the parts we take on.

Each job follows the procedure your MLRO has already written. If your policy says two documents for address, we collect two. If it says a fresh electronic check at every annual review, that is what goes in the diary.

  1. Identity verification

    Collecting ID for the client, and for company clients the directors and beneficial owners, then running the electronic or document check your policy specifies.

  2. Address verification

    Matching proof of address to the person, checking dates against your acceptance rules and recording anything that does not reconcile.

  3. PEP and sanctions screening

    Running the screen in your AML tool and setting out every possible match with the details your MLRO needs to clear or escalate it.

  4. Source of funds and wealth

    Requesting bank statements, completion statements, payslips or sale documents when your policy or a risk flag calls for them, and chasing until the file is complete.

  5. Ownership and register checks

    Pulling the Companies House record, mapping who owns or controls the company, and flagging any difference between what the client told you and the public register.

  6. Ongoing monitoring diary

    Diarising each client's next review on the cycle your risk rating sets, refreshing expired documents and re-screening before the review reaches your desk.

CDD checklist

Simplified, standard and enhanced due diligence compared

A working checklist for a typical practice. The level for each client comes from your firm-wide risk assessment and your MLRO's judgement on that client, so the final column matters most.

Summary of Money Laundering Regulations 2017 requirements as they usually apply to an accountancy practice. Your own policy may set stricter rules; where it does, we follow your policy.
ItemSimplified (SDD)Standard CDDEnhanced (EDD)Who decides
When it appliesClient assessed as low risk, using your firm-wide risk assessment (reg. 37)The default for every new client and occasional transaction (reg. 27 and 28)Higher risk, PEPs, high-risk countries, unusually complex or large transactions (reg. 33 and 35)Your MLRO or nominated partner
Identity of the clientStill identified and verified, with the extent adjusted to the low riskVerified from a reliable, independent source: passport, photocard licence or electronic checkVerified, plus the extra checks your policy sets, such as a second document or certified copiesVSA collects and runs the check; your practice accepts it
Beneficial ownersIdentified, with reasonable measures to verifyAnyone owning or controlling more than 25% identified and verified; ownership structure understood (reg. 5 and 28)As standard, with layered or overseas structures traced and evidencedVSA maps it; your practice signs it off
Proof of addressAs your policy requiresRecent utility bill, bank or council tax statement, or electronic matchAs standard, often with a second sourceVSA collects and checks dates
PEP and sanctions screeningScreened at onboarding and reviewScreened at onboarding and reviewScreened, with enhanced ongoing monitoringVSA screens; your MLRO clears any match
Purpose and nature of the workRecorded brieflyRecorded on the file (reg. 28(2)(c))Recorded in detail with the client's explanationYour engagement partner
Source of funds or wealthNot usually requestedRequested where monitoring or your policy calls for it (reg. 28(11))Required for PEPs and their family or close associates (reg. 35(5))VSA requests and chases; your MLRO judges adequacy
Senior management approvalNot requiredNot required by the regulationsRequired to start or continue a relationship with a PEP (reg. 35(5))Your senior management only
Ongoing monitoringEnough to spot unusual or suspicious activity (reg. 37(2))Records kept up to date on the cycle your policy setsMore frequent reviews and closer scrutinyVSA runs the diary; your practice reviews
Record keepingCDD records kept for five years from the end of the business relationship (reg. 40)Held in your systems

Sources: The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 on legislation.gov.uk, regulations 5, 27, 28, 33, 35, 37 and 40. Since January 2024, regulation 35(3A) treats domestic PEPs as lower risk than non-domestic PEPs as a starting point. The table is a working summary and does not replace your supervisor's guidance.

Who stays responsible

Your firm owns the AML decision

Regulation 39(7) of the MLR 2017 lets a firm carry out due diligence through an outsourcing provider, provided the firm remains liable for any failure. That is how we set up every engagement.

We handle

  • Sending ID and address requests in your template and chasing replies
  • Running electronic ID checks and screening in your AML tool
  • Preparing a match summary for every PEP, sanctions or adverse media hit
  • Requesting and indexing source of funds evidence
  • Comparing the client's ownership details with the Companies House register
  • Keeping the monitoring diary and refreshing expired documents

Your practice keeps

  • The firm-wide risk assessment and your written AML policy
  • Each client's risk rating and the SDD, CDD or EDD decision
  • Clearing or escalating screening matches
  • Accepting, declining or exiting a client
  • Any suspicious activity report, made by your MLRO
  • Reporting register discrepancies to Companies House under reg. 30A

Source: MLR 2017 regulation 39 (reliance and outsourcing) and regulation 30A (reporting discrepancies in registers), legislation.gov.uk. We work on the practice's own instructions and do not give AML advice. For a fuller comparison, read AML checks for accountants: in-house vs outsourced.

How a file moves

From engagement enquiry to a file your supervisor can read

Every file follows the same order, so a reviewer from your supervisory body can see what was checked, when and by whom.

  1. We build the pack

    Requests go out the day the enquiry is logged. Documents are checked against your rules, screening is run and results are saved to the client record with the date and the tool used.

  2. Your MLRO reviews

    You receive a short summary: what was verified, any matches, any gaps, and the risk factors we noticed. Your MLRO rates the client and approves, asks for more, or declines.

  3. The diary takes over

    Once the client is accepted, the next review date goes into the monitoring diary. Before it falls due we refresh documents and re-screen, so the review starts with current information.

Supervisors

Built for practices supervised by ICAEW, ACCA, AAT or HMRC

Every UK accountancy service provider must be supervised for money laundering purposes. Members of a professional body such as ICAEW, ACCA or AAT are usually supervised by that body. Firms with no professional body supervisor register with HMRC.

Supervisors expect to see a risk-based approach applied consistently and a file that shows the evidence. Our part is making sure the evidence is there, dated and filed the same way every time, using your templates and your naming conventions.

  • Inside your AML tool. We run checks through the subscription your practice already pays for, under a login you issue and can remove.
  • Records stay with you. Evidence is saved in your practice management system or document store, where your reviewers and supervisor expect to find it.
  • Same-day attention on urgent files. If a client needs to be onboarded quickly, tell us in the morning and the requests go out that day.

Source: GOV.UK, Check if you need to register for money laundering supervision if you're an accountancy service provider; MLR 2017 Schedule 1 (professional body supervisors).

Questions

AML checks for accountants: common questions

Can accountants outsource AML checks?

Yes. Regulation 39(7) of the Money Laundering Regulations 2017 allows a firm to apply customer due diligence through an outsourcing service provider, as long as the arrangement leaves the firm liable for any failure. In practice that means the provider collects and checks evidence, and the firm's MLRO still rates the risk and decides whether to act.

What ID documents do accountants need for client due diligence?

For an individual, most practice policies ask for photo ID such as a passport or photocard driving licence, plus a recent proof of address, or an electronic check that verifies both. For a company, you also need the company's registration details and the identity of anyone owning or controlling more than 25%. Your own policy sets the exact list.

How often should AML checks be refreshed?

The regulations require ongoing monitoring and up-to-date records, without fixing a single interval. Most practices set the cycle by risk rating, reviewing higher-risk clients more often and refreshing checks whenever something changes, such as new owners, a new service or unusual transactions. We diarise whatever cycle your policy sets.

Who supervises AML for accountants in the UK?

Accountants who belong to a professional body, such as ICAEW, ACCA or AAT, are normally supervised by that body. Accountancy service providers with no professional body supervisor must register with HMRC for money laundering supervision. Either way, the supervisor will expect your practice to show a documented risk assessment, written policies and complete client files when it reviews you.

When is enhanced due diligence required?

Regulation 33 requires EDD where the risk is higher, including clients who are politically exposed persons or their family or close associates, links to high-risk third countries, and unusually complex or large transactions with no obvious purpose. For PEPs you also need senior management approval and adequate measures to establish source of wealth and funds.

How long must AML records be kept?

Five years from the date the business relationship ends, or from completion of an occasional transaction, under regulation 40. After that, personal data should be deleted unless another legal basis applies. Because we work inside your systems, the records stay in your practice's storage throughout.

Related services

Client onboarding

Engagement letters, authorisations and system set-up, run alongside the CDD pack. See our onboarding checklist.

HMRC and Companies House portal admin

Agent authorisations, confirmation statements and identity verification tracking for directors and PSCs.

Client inquiry support

First-line replies when clients ask why you need their passport or bank statements.

Hand over the chasing, keep the judgement

Send us your AML policy and we will show you how your next ten client files would run.

Book a consultation