The manual half of client due diligence is carried end to end, and every judgement the regulations reserve for the practice stays with the practice.
Onboarding is slow, manual, and the riskiest work a practice does. Due diligence has to be complete before the engagement begins, so the speed of the checks sets the start date.
One in five practices was found non-compliant at its AML monitoring review, most commonly for diligence that had not been kept current (ICAEW AML Supervision Report 2024/25).
Every check, decision and approval is logged with who, what and when, so the evidence pack is one export away when your regulator asks.
Five phases, from the first enquiry to the retention clock running out five years after a client leaves. What follows describes the ground each phase covers and where the judgement sits. The step-by-step design, and which parts are worth building for your practice, is what the Audit produces.
Everything the practice needs to know about the entity, its people and its ownership, gathered once rather than across a fortnight of emails. Company filings, officers, group structure and the register excerpts the rules require before a relationship begins.
Registry data is a starting point rather than an answer. The regulations are explicit that a firm may not rely solely on Companies House or the Register of Overseas Entities to identify or verify beneficial owners, so the system treats those sources as evidence to be corroborated.
Identity evidence requested from the client, read, and checked for consistency against itself and against the independent sources. Where a document is weaker than the guidance prefers, the file says so and says why it was accepted.
Digital verification is permitted, but only through a service on the government’s certified register; anything else and paper documents are required instead. Knowing that distinction is the difference between a check that stands up and one that does not.
Sanctions, politically exposed persons and adverse media, run at onboarding and then kept running for the life of the relationship. Possible matches arrive as an evidence pack rather than a red flag with nothing behind it.
Sanctions are the part practices most often treat as a one-off check. The prohibition is absolute rather than risk-based, the list changes constantly, and funds controlled by a designated person are caught even where your client is not named, so ownership chains are screened rather than just the engagement.
Whether the practice is satisfied as to identity, what the client’s risk rating is and why, whether enhanced diligence applies, whether an explanation of funds holds up, whether to act, and whether anything needs reporting.
Each of these is reserved for the firm. The system assembles what is needed to decide, holds the file until someone does, and records the decision against a name. It proposes nothing it cannot evidence.
Acceptance recorded, the engagement sequenced so work cannot begin before the checks are finished, and an audit trail built as the work happens rather than reconstructed when somebody asks for it.
Records have to be produced immediately on request and kept for five years after a relationship ends, then destroyed unless there is a reason to keep them. That deletion duty is the one almost nobody operates, and it is straightforward for a system that has held the clock since the first day.
References throughout are to the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 and to the CCAB Anti-Money Laundering Guidance for the Accountancy Sector.
Under the Money Laundering Regulations those decisions belong to the practice, and the sector guidance is explicit about it: how much evidence to seek and what to verify are matters for the judgement of the firm. So the judgement stays where it belongs, and the system takes the work around it.
Qualified people are not paid to retype a passport, look up a filing history or notice that a screening list changed on Tuesday. They are paid for the call at the end of it. That is the division of labour, and it is the one the profession’s own training describes: technology helps with verification, screening and record keeping, but it does not replace your judgement, and you remain responsible.
Every possible match is surfaced with its evidence and waits for a person. A false negative here is the failure that ends careers, so the system is built so that it cannot be the one to make that mistake.
Acceptance is recorded against a person, with what they saw and when they saw it. If nobody approved it, it was not approved, and the file does not move.
Synthetic documents and manipulated video are cheap and getting cheaper, and remote checks are the target. The Financial Action Task Force has said as much, and recommends human validation behind automated checks rather than in place of them.
A check that errors stops the file rather than letting it drift into verified. Every action is logged with who, what, when and why, so the audit trail answers a regulator instead of raising questions for them.
“The business seeking to rely on a third party remains liable for any CDD failings irrespective of the terms of the CDD agreement.”
The same holds for outsourcing: the regulations permit it only on terms under which the practice remains liable. Buying a tool transfers convenience and nothing else. That is not an argument against software, it is an argument about where the system should live, and there are five reasons it should live inside the practice.
An off-the-shelf template not tailored to the firm is itself a supervisory finding, as is a risk assessment with weak linkage to the controls actually applied. A product encodes a generic process, and the gap between that and how your practice really works is exactly where non-compliance lives.
Records must be produced immediately on request and kept for five years after a relationship ends. If the subscription lapses, the price moves, the data model changes or the vendor closes, that duty does not move with it. You cannot show a regulator a system you no longer have access to.
After five years, absent a reason to keep them, records must be destroyed. Very few products are built to forget on a schedule you set, and fewer still let you prove that they did.
Onboarding differs by client mix, by partner, and by the software already in use. A bespoke system is shaped around all three. A product asks the practice to work its way, and every workaround becomes another undocumented step nobody wrote down.
Documented, handed over, and yours to keep running. As the practice grows, the system grows with it rather than being renegotiated, re-priced or replaced. Parting company with a supplier should never mean losing your onboarding process.
To be explicit, because the opposite is often implied: no system makes a practice compliant. The practice remains the MLRO and makes every compliance judgement. What a system does is make sure the process is followed the same way every time, and that the paperwork is never the thing that is missing.
A 30-minute call to talk through how your practice runs this work today, and whether an Audit is worth doing. If it is not, we will say so.
Last updated 29 September 2026
