The evidence is gathered, checked and recorded before anyone needs to make a decision, and every judgement the regulations reserve for the practice stays with your people.
Onboarding is slow, manual and among the riskiest work a practice does. Customer due diligence has to be complete before the engagement begins, so the speed of the checks decides when the fees start.
Every check, decision and approval is logged with who, what and when, so the evidence pack is one export away when your AML supervisor asks for it.
Illustrative. Built around your firm, your clients and the systems you already run.
Five phases, from the first enquiry to the end of the retention period five years after a client leaves. What follows sets out what each phase covers and where the judgement sits. The detailed design, and which parts are worth building for your practice, is what discovery produces.
Everything the practice needs to know about the entity, its people and its ownership, gathered once instead of across a fortnight of emails: company filings, officers, group structure and the register extracts the rules require before a relationship begins.
Register data is only a starting point. The regulations are explicit that a firm cannot meet its beneficial ownership duties by relying solely on the register of people with significant control or the Register of Overseas Entities, so the system treats both as evidence to be corroborated.
Identity evidence is requested from the client, read, and checked for consistency, both internally and against independent sources. Where a document is weaker than the guidance prefers, the file says so and records why it was accepted.
The sector guidance says digital identity checks should use a service on the government’s register of certified digital verification services. Where a service is not on the register, the firm should verify identity from documents instead. Getting that distinction right is the difference between a check that stands up and one that does not.
Sanctions, politically exposed persons and adverse media, checked at onboarding and then monitored for the life of the relationship. Possible matches arrive with the evidence already assembled.
Sanctions are the part practices most often treat as a one-off check. Unlike the rest of AML, they are not risk-based: you cannot deal with funds a designated person owns or controls, even where your client is not named on the UK Sanctions List, and OFSI can impose penalties on a strict liability basis. So the system screens the whole ownership chain as well as the client.
Whether the practice is satisfied as to identity, what the client’s risk rating is and why, whether enhanced due diligence applies, whether an explanation of the source of funds holds up, whether to act, and whether anything needs to be reported.
Each of these is reserved for the firm, and any report is a decision for your MLRO. The system assembles what is needed to decide, holds the file until someone does, and records the decision against a name. It proposes nothing it cannot evidence.
Acceptance is recorded, the engagement is sequenced so work cannot begin before the checks are finished, and the audit trail is built as the work happens instead of being reconstructed when somebody asks for it.
Records must be kept for five years after a relationship ends. After that, personal data must be deleted unless the law, legal proceedings or the client’s consent allow it to be kept. Few practices have a working process for the deletion duty, yet it is straightforward for a system that has tracked each relationship from the first day.
References throughout are to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, as amended, and to the CCAB Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector (July 2026).
Under the Money Laundering Regulations those decisions belong to the practice, and the sector guidance is explicit: how much evidence to ask for and what to verify are matters for the judgement of the firm. The judgement stays where it belongs, and the system takes on the work around it.
Qualified people are not paid to retype a passport, look up a filing history or notice that a sanctions list changed on Tuesday. They are paid for the decision at the end of it. That is the division of labour the guidance itself assumes: technology can help with verification, screening and record keeping, but the firm remains responsible for every judgement.
Every possible match is presented with its evidence and waits for a person. Wrongly clearing a match is the failure that ends careers, so the system is designed never to be the one that makes that call.
Acceptance is recorded against a person, with what they saw and when they saw it. If nobody approved it, it was not approved, and the file does not move.
Synthetic documents and manipulated video are cheap and getting cheaper, and remote checks are the target. The Financial Action Task Force’s 2025 horizon scan on AI and deepfakes stresses the continued importance of human expertise alongside automated checks, to catch what those systems miss.
A check that fails stops the file, instead of letting it drift through as verified. Every action is logged with who, what, when and why, so the audit trail answers your supervisor’s questions instead of raising new ones.
“…the business seeking to rely on a third party remains liable for any CDD failings irrespective of the terms of the CDD agreement.”
The same applies to outsourcing: the regulations allow due diligence work to be outsourced only on terms that leave the practice liable for any failure. Buying a tool transfers convenience, not responsibility. None of this argues against software. It argues for keeping the system inside the practice, for five reasons.
Supervisors look for policies and risk assessments tailored to the firm and linked to the controls it actually applies. A product encodes a generic process, and the gap between that process and how your practice works is exactly where findings arise.
Records must be kept for five years after a relationship ends, and you must be able to answer enquiries from the authorities fully and rapidly. If the subscription lapses, the price rises, the data model changes or the vendor closes, that duty stays with you. You cannot show your supervisor a system you no longer have access to.
After five years, personal data must be deleted unless there is a lawful reason to keep it. Very few products are built to forget on a schedule you set, and fewer still let you prove that they did.
Onboarding differs by client mix, by partner and by the software already in use, and a bespoke system is shaped around all three. A product asks the practice to work its way, and every workaround becomes another step that nobody has written down.
Documented, handed over and yours to keep running. As the practice grows, the system grows with it, without being renegotiated, repriced or replaced. Parting company with a supplier should never mean losing your onboarding process.
To be clear, because the opposite is often implied: no system makes a practice compliant. Your practice makes every compliance judgement, and your MLRO, a named individual, makes every reporting decision. What a system does is make sure the process is followed the same way every time, and that the paperwork is never what is missing.
The first conversation is free. We will talk through where your team’s time is going and tell you plainly whether we can help.
Last updated 14 October 2026
