What do I still need before I take this client on?

The client due diligence checklist this client's shape calls for, traced to the current Regulations and July 2026 accountancy-sector guidance. Free, no sign-up. No names, no numbers, nothing leaves your browser.

Step 1 of 6

  • AnsweredSupervisor
  • AnsweredServices
  • AnsweredClient
  • AnsweredOwnership
  • AnsweredRisk factors
  • AnsweredWhat's on file

Nothing you answer here is sent anywhere. There is no field on this page for a name, a date of birth or a reference number.

Who supervises this practice for money laundering?

HMRC supervises accountancy service providers that must register and are not already supervised by a professional body. Check registration scope and exceptions; a practising certificate or licence may identify a professional-body route.
Not a body you recognise? Tell us so anyway, and we'll show the general item list without naming a guidance edition we can't confirm.

More than one body can supervise a practice, and regulation 7(2) lets those authorities agree that one of them acts. Until you know whether they have, we name no body and no code. The item list is the same either way, and confirming your lead authority joins the things this checklist cannot settle.

Which sector?

Let's test that. Tell us what you'll be doing for this client.

What will you be doing for this client?

Tick everything you'll actually be doing. It changes what has to be on file.
  • Recording, reviewing, analysing, calculating or reporting financial information for someone else, other than as their employee.
  • Any material aid, assistance or advice on someone's tax affairs - including completing a return, saying whether something is taxable, or saying how much is due.
  • Running payroll software for a client isn't enough on its own. Preparing or analysing the figures is.
  • Forming a company, selling an off-the-shelf one, providing a registered office or correspondence address, or acting as or arranging a director, secretary, partner, trustee or nominee shareholder.

What kind of client is this?

  • A charity set up as a limited company is a limited company here. This option is for a CIO, a chartered body or a registered society - incorporated, but not a company.
Where was this client set up?
Where the entity itself was formed, not where its owners live and not where the money is. An owner abroad is a question in step 5.
Is it listed?
Is this UK company subject to the people-with-significant-control requirements in Part 21A of the Companies Act 2006?
This is separate from the listed-market question. Part 21A has its own exclusions. If you have not established whether it applies, choose We don't know yet and we'll keep the register excerpt out of the checklist.
Is this trust registered with HMRC's Trust Registration Service, or does it have to be?
Part 5 of the Regulations decides which trusts have to register. If you haven't established that yet, say so - we'll put it on the list of things this checklist can't settle rather than guess it for you.
Is this entity on the Register of Overseas Entities, or does it have to be?
Part 1 of the Economic Crime (Transparency and Enforcement) Act 2022 decides which overseas entities have to register. Same as the trust question: if it isn't settled, say so.

Who owns and controls this client?

Listed on a regulated market, so regulation 28(5) narrows this: you don't have to establish the ownership and control structure or the beneficial owners. The separate Part 21A answer decides whether the company register excerpt applies.

Does anyone meet the threshold?
For a company, more than 25% of the shares or of the voting rights. For a partnership, more than 25% of the capital, the profits or the voting rights. More than - a flat 25% doesn't meet this limb on its own.
Anything else about the structure?
How do you know?
Anything else we should record?

Which of these are present? Tell us what's there, not what you think it means.

  • We don't hold the FATF list and won't tell you who's on it. It moves, and a checklist that memorised it would be wrong within months. Open it here. Open the FATF list
  • Regulation 28(11)(a) asks you to scrutinise transactions so that they are consistent with what you know of the client, their business and their risk profile. This is that gap, not the size of the payment.

What have you actually got?

This is a worked example, not your client.

    Insolvency appointments have their own supplementary appendix to the sector guidance, which this tool doesn't cover. What's below is the general item list.

    That's a lot of factors at once. Speak to your nominated officer, or use the direct reporting route if you're a sole practitioner with no employees or associates. It isn't a score.

    0still to get

    No outstanding items among the ones this tool can check from your answers.

    Not a checklist decision 0

    Yours to decide, with the reference attached

      Nothing outstanding among the items this tool can check.

      Outstanding 0

      You told us this isn't on file

        Nothing outstanding among the items this tool can check.

        Recorded 0

        Your answer, not something we verified

          Nothing outstanding among the items this tool can check.

          Client acceptance

          A different basis: this is your professional body's ethical code and your own firm policy, not the money laundering regulations.

            Built from AMLGAS July 2026, published 5 August 2026, and the Money Laundering Regulations 2017 as amended to 30 June 2026. Both checked 24 August 2026.

            Turned off while the example is loaded. Start your own run first.

            The routing needs JavaScript. Below is the whole item map instead of the part that applies to your client, grouped by when each item applies. It prints.

            Always, on every run where at least one defined service is provided

            • Whether the identity evidence on your file is genuineBasis: MLR reg 28(18); AMLGAS 5.5.3, 5.5.6. Guidance edition: AMLGAS July 2026
            • Whether what you hold is adequate for this client's riskBasis: MLR reg 28(12), 28(16); AMLGAS 5.3.1. Guidance edition: AMLGAS July 2026
            • Any sanctions, PEP or adverse-media screeningBasis: AMLGAS 5.3.14, 5.3.32; the UK Sanctions List. Guidance edition: AMLGAS July 2026
            • Any register lookup, and whether a register entry is correctBasis: MLR reg 30A; AMLGAS 5.7.1 to 5.7.5. Guidance edition: AMLGAS July 2026
            • The client and matter risk rating itselfBasis: MLR reg 28(12), 28(13); AMLGAS 5.1.10. Guidance edition: AMLGAS July 2026
            • Whether your practice's own firm-level obligations are in placeBasis: MLR regs 18, 19, 21, 24. Guidance edition: AMLGAS July 2026
            • Whether the guidance edition shown here is still the current oneBasis: AMLGAS 1.1.5. Guidance edition: AMLGAS July 2026
            • A completed money laundering checklist is not a sanctions check. The UK Sanctions List is published by the FCDO. Use the cross-government breach-reporting service to reach the correct authority: OFSI handles financial-sanctions reports, while other sanctions can have different reporting routes. This is separate from any report to the NCABasis: AMLGAS 5.3.32, 5.3.33; the UK Sanctions List. Guidance edition: AMLGAS July 2026
            • Purpose and intended nature of the engagementBasis: MLR reg 28(2)(c); AMLGAS 5.1.4. Guidance edition: AMLGAS July 2026
            • The client identifiedBasis: MLR reg 28(2)(a); AMLGAS 5.1.9. Guidance edition: AMLGAS July 2026
            • The client's identity verified from a reliable, independent sourceBasis: MLR reg 28(2)(b), 28(18), 28(19); AMLGAS 5.5.3. Guidance edition: AMLGAS July 2026
            • The risk assessment for this client recorded, with its reasonsBasis: MLR reg 28(12), 28(13); AMLGAS 5.1.10. Guidance edition: AMLGAS July 2026
            • Due diligence completed before the relationship was establishedBasis: MLR reg 30(2); AMLGAS 5.2.1, 5.6.5. Guidance edition: AMLGAS July 2026
            • Records kept for the applicable five-year period, then personal data deleted unless regulation 40(5) permits continued retention for another legal requirement, court proceedings, consent or reasonably anticipated legal proceedingsBasis: MLR reg 40(3), 40(4), 40(5); AMLGAS 7.1.1 to 7.1.3, 7.7.1. Guidance edition: AMLGAS July 2026
            • An arrangement for keeping this under review after acceptanceBasis: MLR reg 28(11); AMLGAS 5.2.5 to 5.2.8. Guidance edition: AMLGAS July 2026
            • The risk rating for this client, and the reasons behind itBasis: MLR reg 28(12), 28(13); AMLGAS 5.1.10. Guidance edition: AMLGAS July 2026
            • Whether to accept this client at allBasis: ICAEW Code of Ethics 2026 R320.4. Guidance edition: AMLGAS July 2026
            • Anything touching the reporting duty. In a firm with a nominated officer, internal reports go to that officer, who decides whether an external report goes to the NCA. A sole practitioner with no employees or associates uses the direct NCA reporting route. This page has no view on whether a report is needed and will not help you decideBasis: MLR reg 21(3), 21(5), 21(6); POCA s.330; AMLGAS 3.3, 6.1.1, 6.1.2. Guidance edition: AMLGAS July 2026

            If more than one body supervises the practice and no lead has been agreed

            • Which authority acts as the supervisory authority for this practice, where more than one supervises it. Regulation 7(2) lets the supervisory authorities agree that one of them will act; where they have agreed, regulation 7(3) puts the duty to notify you or publish the agreement on that authority, and where they have not, regulation 7(4) requires them to co-operateBasis: MLR reg 7(2), 7(3), 7(4). Guidance edition: AMLGAS July 2026

            If the client is a UK limited company and the Part 21A position is not settled yet

            • Whether this UK company is subject to the people-with-significant-control requirements in Part 21A of the Companies Act 2006Basis: MLR reg 30A(1)(a); Companies Act 2006 s 790B. Guidance edition: AMLGAS July 2026

            If the client is a trust and the Trust Registration Service position is not settled yet

            • Whether this trust is one that Part 5 of the Regulations requires to be registeredBasis: MLR reg 30A(1)(e). Guidance edition: AMLGAS July 2026

            If the client was set up outside the UK and the Register of Overseas Entities position is not settled yet

            • Whether this entity is one that Part 1 of the Economic Crime (Transparency and Enforcement) Act 2022 requires to be registeredBasis: MLR reg 30A(1)(f). Guidance edition: AMLGAS July 2026

            If the client is an individual or a sole trader

            • Full name, date of birth and residential address for the individualBasis: AMLGAS 5.1.9. Guidance edition: AMLGAS July 2026

            If the client is a limited company, a limited liability partnership or another body corporate

            • Name, company or registration number, registered office and, if different, principal place of business - obtained AND verifiedBasis: MLR reg 28(3)(a). Guidance edition: AMLGAS July 2026

            If the client is a body corporate and its securities are not listed on a regulated market

            • Reasonable measures on the law it is subject to and its constitution, and the full names of the board (or equivalent) and the senior people responsible for operationsBasis: MLR reg 28(3)(b). Guidance edition: AMLGAS July 2026
            • The 25% test for a body corporate: more than 25% of the shares or of the voting rights, held or controlled directly or indirectlyBasis: MLR reg 5(1)(b); AMLGAS 5.1.16 table. Guidance edition: AMLGAS July 2026

            If the client is not an individual or a sole trader, and is not listed on a regulated market

            • Reasonable measures to understand the ownership and control structureBasis: MLR reg 28(3A); AMLGAS 5.1.4. Guidance edition: AMLGAS July 2026
            • Beneficial owners identified, and reasonable measures taken to verify themBasis: MLR reg 28(4). Guidance edition: AMLGAS July 2026

            If the client is a partnership

            • The partnership test: more than 25% of the capital, of the profits or of the voting rights; for a limited partnership the general partner; for a Scottish partnership, significant influenceBasis: MLR reg 5(3); AMLGAS 5.1.16 table. Guidance edition: AMLGAS July 2026

            If the client is a trust

            • For a trust, all of: the settlor or settlors, the trustees, the beneficiaries (including a class), and anyone with control such as a protectorBasis: MLR reg 6(1); AMLGAS 5.1.16 table. Guidance edition: AMLGAS July 2026

            If the client is the estate of someone who has died

            • For an estate, the executor or administrator; in Scotland, the executorBasis: MLR reg 6(6); AMLGAS 5.1.16 table. Guidance edition: AMLGAS July 2026

            If the client is an unincorporated association, club or society, or something else

            • For another legal entity or arrangement, anyone who benefits from its property, the class where no individual beneficiary is identified, and anyone who exercises control over itBasis: MLR reg 6(7), 6(8), 6(9); AMLGAS 5.1.16 table. Guidance edition: AMLGAS July 2026

            If the client is a company whose securities are listed on a regulated market

            • A company listed on a regulated market: reg 28(5) disapplies the structure and beneficial-owner steps. Regulation 28(5) does not itself decide whether a separate register-excerpt duty appliesBasis: MLR reg 28(5); AMLGAS 5.1.16 table. Guidance edition: AMLGAS July 2026

            If the client is a body corporate and you do not know yet whether anyone holds more than 25%

            • Where every possible means of identifying the beneficial owner has been exhausted: written records of everything you did, reasonable steps to verify the senior person responsible for managing the body corporate, and written records of that and of any difficultiesBasis: MLR reg 28(6), 28(7), 28(8); AMLGAS 5.1.16 table. Guidance edition: AMLGAS July 2026

            If someone other than the client will instruct you or sign for them

            • Anyone acting on the client's behalf: verify their authority, identify them, and verify their identity from a source independent of both them and the clientBasis: MLR reg 28(10). Guidance edition: AMLGAS July 2026

            If someone controls the client without owning much of it

            • Control without ownership still makes someone a beneficial owner, and there is no percentage attached to itBasis: MLR reg 5(1)(a), 5(1)(c); AMLGAS 5.1.17. Guidance edition: AMLGAS July 2026

            If there is a company or other entity in the ownership chain

            • Follow the ownership through each layer; indirect holdings aggregateBasis: MLR reg 5(1)(b); AMLGAS 5.1.18. Guidance edition: AMLGAS July 2026

            If the structure was described to you rather than documented

            • Where the structure has been described to you rather than documented, record what you gathered and why you are satisfiedBasis: AMLGAS 5.1.16, 5.1.17. Guidance edition: AMLGAS July 2026

            If the client was set up in the UK and is a company subject to Part 21A, a limited liability partnership, or an eligible Scottish partnership

            • Before the relationship is established, and again when customer due diligence is updated or ongoing monitoring is performed after it is established, for a company subject to the people-with-significant-control requirements of Part 21A of the Companies Act 2006, or a limited liability partnership or eligible Scottish partnership subject to the equivalent regulations, an excerpt of the register, or an inspection establishing there is nothing on itBasis: MLR reg 30A(1)(a) to (d), 30A(1A), 30A(2A); Companies Act 2006 s 790B; AMLGAS 5.7.1, 5.7.4. Guidance edition: AMLGAS July 2026

            If the client is a trust that is registered with the Trust Registration Service, or has to be

            • Before the relationship is established, and again when customer due diligence is updated or ongoing monitoring is performed after it is established, for a trust subject to registration under Part 5 of the Regulations, an excerpt of the Trust Registration Service entry, obtained via the agent or trusteeBasis: MLR reg 30A(1)(e), 30A(2A); AMLGAS 5.7.2, 5.7.4. Guidance edition: AMLGAS July 2026

            If the client was set up outside the UK and is on the Register of Overseas Entities, or has to be

            • Before the relationship is established, and again when customer due diligence is updated or ongoing monitoring is performed after it is established, for an overseas entity subject to registration under Part 1 of the Economic Crime (Transparency and Enforcement) Act 2022, an excerpt of the Register of Overseas EntitiesBasis: MLR reg 30A(1)(f), 30A(1A)(b), 30A(2A); AMLGAS 5.7.3, 5.7.4. Guidance edition: AMLGAS July 2026

            If a register excerpt applies to this client

            • The excerpt compared against what you gathered yourselfBasis: MLR reg 30A(2), 30A(2B); AMLGAS 5.7.6. Guidance edition: AMLGAS July 2026
            • A register entry is not enough on its own to satisfy the beneficial-owner dutyBasis: MLR reg 28(9). Guidance edition: AMLGAS July 2026
            • Whether a discrepancy against the register is material, and reporting it. A material discrepancy is one that by its nature may reasonably be linked to money laundering or terrorist financing, or to concealing the client's business; report it as soon as reasonably practicable after you establish that it exists, normally within 15 working days, to Companies House or, for a trust, HMRC. If it is resolved before submission, no report is needed; bulk periodic reporting is not permittedBasis: MLR reg 30A(2), 30A(2B), 30A(3); AMLGAS 5.7.6, 5.7.7, 5.7.10 to 5.7.14; Companies House PSC discrepancy guidance. Guidance edition: AMLGAS July 2026

            If the client is established in a country on the FATF Call for Action list, or a party to a relevant transaction is established there

            • Enhanced due diligence is mandatory for a business relationship with a person established in a country on the FATF Call for Action list, or a relevant transaction where either party is established there, unless the customer is a branch or majority-owned subsidiary of an entity established in a third country and all three conditions in regulation 33(2) are met: the parent is subject to equivalent requirements and supervision, the branch or subsidiary fully complies with equivalent group procedures and policies, and your risk-based assessment concludes that enhanced due diligence is unnecessaryBasis: MLR reg 33(1)(b), 33(2), 33(3)(a), 33(3)(c); AMLGAS 4.6.17, 5.3.7, Appendix D. Guidance edition: AMLGAS July 2026
            • Where the regulation 33(2) exception does not apply, the six measures that go with the Call for Action country trigger: more information on the client and its beneficial owners; more on the intended nature of the relationship; source of wealth AND source of funds for the client and its beneficial owners; the reasons for any transaction; senior-management approval; and more monitoring, by number and by timingBasis: MLR reg 33(2), 33(3A); AMLGAS 5.3.9. Guidance edition: AMLGAS July 2026

            If a country you have assessed as higher risk for another reason is involved

            • A country you have assessed as higher risk for another reason: record what you relied onBasis: MLR reg 33(6)(c); AMLGAS 4.6.17, Appendix D. Guidance edition: AMLGAS July 2026

            If the client or a beneficial owner is a politically exposed person, a family member or a known close associate

            • A politically exposed person, a family member or a known close associate: senior-management approval, adequate measures to establish source of wealth and source of funds, and enhanced ongoing monitoringBasis: MLR reg 35(5); AMLGAS 5.3.26. Guidance edition: AMLGAS July 2026
            • A domestic PEP starts lower: where no enhanced risk factor other than the status itself is present, less extensive measures than for a non-domestic PEPBasis: MLR reg 35(3A), 35(12)(d) to (f); AMLGAS 5.3.23, 5.3.24. Guidance edition: AMLGAS July 2026
            • Treatment continues for at least 12 months after the person ceases to hold the function, and longer if you judge the risk to require it. It does not continue for family members or known close associates once the PEP ceases to hold the functionBasis: MLR reg 35(9), 35(11); AMLGAS 5.3.27, 5.3.28. Guidance edition: AMLGAS July 2026
            • Being a PEP is not a reason to refuse: manage the risk, and refuse only where it cannot be managedBasis: AMLGAS 5.3.16. Guidance edition: AMLGAS July 2026

            If a transaction is unusually complex or unusually large given its nature, transactions form an unusual pattern, or the transaction or transactions have no apparent economic or legal purpose

            • A transaction that is unusually complex or unusually large in each case given the nature of the transaction, an unusual pattern of transactions, or a transaction or transactions with no apparent economic or legal purpose: examine the background and purpose as far as reasonably possible, and increase monitoringBasis: MLR reg 33(1)(f), 33(4); AMLGAS 5.3.7. Guidance edition: AMLGAS July 2026

            If you have not met them and there is no other safeguard such as an electronic identification process meeting regulation 28(19)

            • A relationship conducted without meeting and without certain safeguards is a listed risk factor. An electronic identification process meeting regulation 28(19) is one example of a safeguard. A digital verification service used for identity verification must be on the GOV.UK register of services certified against the UK digital verification services trust frameworkBasis: MLR reg 33(6)(b)(iii), 28(19); AMLGAS 5.5.12, 5.5.13. Guidance edition: AMLGAS July 2026

            If money is coming from an unknown or unassociated third party

            • Payments from unknown or unassociated third parties are a listed risk factorBasis: MLR reg 33(6)(b)(iv); AMLGAS Appendix D. Guidance edition: AMLGAS July 2026

            If the client's business is cash intensive

            • A cash-intensive business is a listed customer risk factorBasis: MLR reg 33(6)(a)(v); AMLGAS Appendix D. Guidance edition: AMLGAS July 2026

            If there is a nominee arrangement, or the structure looks more complicated than the business needs

            • An unusual or excessively complex structure, nominee shareholders, bearer shares, or a vehicle for holding personal assets are listed customer risk factorsBasis: MLR reg 33(6)(a)(iii), (iv), (vi); AMLGAS Appendix D. Guidance edition: AMLGAS July 2026

            If identification you were given has turned out to be false or stolen and you propose to continue

            • Where false or stolen identification has been provided and you propose to continue, enhanced due diligence is requiredBasis: MLR reg 33(1)(e); AMLGAS 5.3.7. Guidance edition: AMLGAS July 2026

            If the instructions fall outside the work this practice normally does

            • A relationship conducted in unusual circumstances, and instructions outside your normal work, are risk factors - and the guidance asks you to be clear why this client chose youBasis: MLR reg 33(6)(a)(i); AMLGAS 5.1.11. Guidance edition: AMLGAS July 2026

            If a payment or transaction does not match what you know about this client or their business

            • Source-of-funds enquiries under ongoing monitoring are needed when a transaction looks inconsistent with what you know of the client. This is a different thing from the source-of-funds work enhanced due diligence requiresBasis: MLR reg 28(11)(a); AMLGAS 5.2.9, 5.2.10. Guidance edition: AMLGAS July 2026

            If you are applying simplified due diligence

            • Simplified due diligence adjusts the extent, timing or type of the measures. It does not remove them, and monitoring for unusual or suspicious transactions is still requiredBasis: MLR reg 37(2); AMLGAS 5.3.4. Guidance edition: AMLGAS July 2026
            • It must be set aside if you doubt the documents or information, if you no longer consider the risk low, if a suspicion arises, or if any enhanced-due-diligence condition appliesBasis: MLR reg 37(8); AMLGAS 5.3.6. Guidance edition: AMLGAS July 2026

            If an enhanced due diligence route that requires senior-management approval applies

            • Senior-management approval, where an enhanced-due-diligence route requires itBasis: MLR reg 33(3A)(e), 35(5)(a); AMLGAS 3.4.2. Guidance edition: AMLGAS July 2026

            If you cannot complete the required due diligence because they have not given you what you need

            • Where required due diligence cannot be completed: do not establish the relationship or proceed with the transaction, terminate an existing relationship, and consider whether a report is required. Regulation 31(3) disapplies those consequences for a qualifying professional adviser who is ascertaining a client's legal position or defending or representing the client in, or concerning, legal proceedings, including advice on instituting or avoiding proceedings. Regulation 31(5) also has a narrow exception for a court-appointed administrator or liquidator who has taken all reasonable steps and whose resignation would prejudice creditors. The decision is not a checklist'sBasis: MLR reg 31(1), 31(3), 31(4), 31(5); AMLGAS 5.6.14. Guidance edition: AMLGAS July 2026

            If they want it done urgently and you cannot pin down why

            • Whether the urgency justifies starting before verification is complete, and approving that extensionBasis: MLR reg 30(3); AMLGAS 5.6.3, 5.6.6 to 5.6.13. Guidance edition: AMLGAS July 2026

            If the previous adviser has not been named, or you have been asked not to contact them

            • Whether the previous adviser can be contacted, and what to do if the client says noBasis: ICAEW Code of Ethics 2026 R320.5, R320.6, R320.7A. Guidance edition: AMLGAS July 2026

            If you are relying on another firm for part of the due diligence

            • Where you rely on another party for due diligence: liability stays with you, and you need a written agreementBasis: MLR reg 39; AMLGAS 5.4.3, 5.4.5, 5.4.6. Guidance edition: AMLGAS July 2026

            Client acceptance

            • Seek to contact the existing or predecessor accountant, unless the client gives acceptable reasons why they cannot be informedBasis: ICAEW Code of Ethics 2026 R320.5
            • Where you cannot reach them, take other reasonable steps to find out about possible threatsBasis: ICAEW Code of Ethics 2026 R320.6
            • Decide whether there is any reason not to accept the engagementBasis: ICAEW Code of Ethics 2026 R320.4
            • Competence and capacity: understanding of the client's operations, the requirements of the engagement, and the resources the fee assumesBasis: ICAEW Code of Ethics 2026 320.3 A3, 320.3 A4, 320.3 A5
            • Conflicts of interest, including acting for two clients whose interests conflict on the same matterBasis: ICAEW Code of Ethics 2026 R310.4, R310.5, 310.4 A1
            • The practice's own commercial risk appetiteBasis: Firm policy - no external basis, and this page says so

            The firm-level list

            • A practice-wide risk assessment kept in writingBasis: MLR reg 18(1), 18(4)
            • Written policies, controls and procedures approved by senior managementBasis: MLR reg 19(1), 19(2)
            • Where appropriate to size and nature, a board or senior-management member responsible for complianceBasis: MLR reg 21(1)(a)
            • A nominated officer, with the supervisor told within 14 days of either appointmentBasis: MLR reg 21(3), 21(4)
            • Relevant-employee screeningBasis: MLR reg 21(1)(b)
            • Training, and a written record of itBasis: MLR reg 24
            • An independent audit function where appropriateBasis: MLR reg 21(1)(c)
            • Current supervision or registrationBasis: HMRC accountancy service provider registration guidance
            A single path forking at a switch into one highlighted route, above three unequal trays labelled Not settled, Outstanding and Recorded, with short tethers running from the chips in each tray back up to the switch.
            One answer moves one chip. The trays stay unequal on purpose, and the fullest is always the left one: the things this checklist cannot settle.

            How the client due diligence checklist works

            Where the items come from

            Every item on this page names its source. Most come from the Regulations and the sector guidance. Reporting, sanctions, register and client-acceptance items also use the primary sources named beside them.

            The first is the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, as amended, most recently on 30 June 2026. The second is the Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector, July 2026, published by CCAB and approved by HM Treasury. That approval is why we build on it rather than on anything else. The guidance puts it plainly itself: the UK courts must take account of its contents when deciding whether a business subject to it has contravened a relevant requirement under the 2017 Regulations. Fifteen bodies have adopted it, and one of them is probably yours.

            Nothing here was written from memory or paraphrased from a blog. Where a rule is a number, we quote the regulation rather than round it. The beneficial-ownership threshold, the retention period, the minimum twelve months that former-PEP measures continue after the person leaves office: all of those come across as the regulation wrote them.

            Why your supervisor is the first question

            Schedule 1 names thirteen accountancy professional bodies, and HMRC is the public supervisor for accountancy service providers that must register and are not otherwise supervised. What you pick here identifies your supervisor and the link out. The item list uses the same July 2026 guidance edition for all fourteen routes. Only the ICAEW route has a sourced professional-ethics basis for the separate acceptance pane.

            More than one body can be your supervisory authority at once. Regulation 7 says so, and it lets those authorities agree that one of them will act. If they haven't agreed, or you don't know, say so. We name no body and no ethical code, the item list stays exactly the same, and finding out who acts for you goes on the list of things this checklist cannot settle.

            Supervision here follows your membership and your registration, not your postcode. The list HMRC publishes is one UK list, and the two bodies on it with a nation in their name sit inside that list rather than replacing it for their nation. So this page works the same way in Cardiff, Belfast, Inverness and Norwich.

            What "conditional" actually means

            A flat checklist shows every item to everybody, which teaches you to skim. This one runs the answers you gave through a set of applicability rules and shows you the items that came out, each with a line naming the answers that put it there.

            Tell us there's a company or other entity in the ownership chain and you get the layer item. Tell us the structure looks more complicated than the business needs and you get the structure item. Tell us the client itself is established abroad and subject to the Register of Overseas Entities, and the overseas-entity register route appears. Tell us the client is an individual paying their own bill and you get eight items and a short afternoon.

            What it will not do

            It won't tell you the file is finished. What comes out is not a score, and there's no tick anywhere in it. That isn't modesty. A page that told a small practice it was fine when it wasn't would be worse than no page at all, and the risk on this particular subject is not commercial.

            So the count of things this checklist cannot settle sits above the count of things it can, it's never zero, and the judgements that carry the liability go back to you with the reference attached.

            Who this is for

            You're a principal, a partner or a practice manager in an accountancy practice of between one and twenty people, with no compliance department to ask. In a practice that size, the person answering these questions is the one who signs the engagement, does the work, and would answer for the file.

            Use it when a new client has said yes and the work is about to start. Use it again when an existing client's service mix changes and the old file note no longer describes the engagement. And keep it to hand for the day a supervisor's review, a professional indemnity renewal question or a partner joining sends you back over an acceptance file you last looked at a year ago.

            Accountants' questions about client due diligence

            What checks do I have to do before I take on a new client?

            Identify them, verify that identity against something independent, work out who really owns and controls them, and record what the engagement is actually for. Then assess the risk and write down why you landed where you did. Regulation 28 sets the components, and chapter 5 of the July 2026 sector guidance walks through them. What changes between clients is not the list. It's how much is enough, and a company with layers abroad takes a good deal more than the sole trader down the road.

            Who supervises my practice for anti-money laundering?

            A professional body, if one supervises your firm. Schedule 1 names thirteen accountancy professional bodies. If none supervises you, HMRC is the public supervisor, but check the registration scope and exceptions before treating that route as automatic. If you can't answer this question, that's a finding in itself, and it's the first thing to fix. Your practising certificate or licence usually tells you. Your body's own anti-money laundering pages certainly will.

            What is the difference between source of funds and source of wealth?

            Source of funds is where this money came from. Source of wealth is how the person came to have money at all. They aren't interchangeable, and the sector guidance keeps them apart deliberately.

            Where the client is established in a country on the Financial Action Task Force's Call for Action list, or a party to a relevant transaction is established there, the mandatory measures cover both - for the client and for the beneficial owners. Regulation 33(2) is the exception to that, for a branch or majority-owned subsidiary that meets it. A political exposure route calls for both as well.

            And there's a quieter duty in regulation 28(11). During ongoing monitoring you look at source of funds where a transaction stops matching what you know about the client.

            Do the checks have to be finished before I start the work?

            Yes, as a rule. Regulation 30 says verification comes before the relationship is established. There's a narrow exception, where finishing later is necessary not to interrupt normal business and there is little risk.

            The sector guidance is strict about it. The delay has to be administrative or logistical, not the client dragging their feet. Each extension should be agreed individually with your MLRO. A commercial deadline on its own doesn't qualify. Nor does a filing deadline.

            Is a beneficial owner anyone with 25%?

            More than 25%, which isn't the same thing. Regulation 5 says "more than", so a flat 25% holding does not meet that limb on its own. And the percentage is only one route in. Someone who exercises ultimate control over the management of a company is a beneficial owner whatever they hold, and the sector guidance says outright that a person can be one by control with less than 25%.

            For a partnership the test runs on capital, profits or voting rights. For a trust it isn't a percentage at all. It's the settlors, the trustees, the beneficiaries and anyone with control, such as a protector.

            How long do I have to keep the records?

            Keep them for at least five years, beginning when you know, or have reasonable grounds to believe, the business relationship has ended or the occasional transaction is complete. Then you delete the personal data, unless another law requires you to keep it, a court case needs it, or the person has consented.

            That second half catches people out. A retention policy that says "keep everything forever" is not the safe option. It's a different problem, and the guidance is explicit that unless there is a basis for keeping records beyond the period, they must be destroyed.

            Is a KYC checklist the same thing as client due diligence?

            Same work, different vocabulary. "Know your customer" is banking language and it's what most people type into a search box. The UK regulated sector and its guidance say customer due diligence, or client due diligence, and if you're writing a file note or a policy, that's the term to use. Your supervisor's questions will be phrased that way.

            If I finish this checklist, is my file compliant?

            No, and we've built the page so that it cannot say otherwise. This is a self-check aid. It takes your word for everything. It can't see your file, your documents or your client. It can't verify an identity, screen a name, look at a register or judge whether what you hold is enough.

            And it doesn't rate the client's risk or decide whether to accept them, because those are yours. What it can do is make sure you're looking at the right list.

            AML client due diligence: what the regulations actually ask of accountants

            The obligation lands on you the moment you provide what the sector guidance calls a defined service, by way of business: audit, accountancy, tax advice, insolvency work, or trust and company services. Bookkeeping counts. So does completing a tax return, and so does telling a client whether something is liable to tax. Payroll counts when you prepare or analyse the financial information rather than just running the software. Management consultancy often does not, and neither does licensing software you don't interpret for the client. If you decide a service falls outside, the guidance asks you to write down why.

            From there the shape is the same for every practice and the depth isn't. You identify the client and verify that identity from a source independent of them. You establish who owns and controls them, which for a company means the people above 25% of the shares or the votes and anyone who controls it without owning much of it at all.

            Some clients bring a register with them. A UK company subject to Part 21A, a limited liability partnership, an eligible Scottish partnership, a registrable trust, an overseas entity subject to registration: for each of those you take an excerpt of the relevant register and compare it against what you gathered yourself. That happens before you establish the relationship, and again when you update customer due diligence or carry out ongoing monitoring afterwards. A register entry on its own does not discharge the beneficial-owner duty.

            Enhanced due diligence isn't a mood. It applies to a business relationship with a person established in a country on the Financial Action Task Force's Call for Action list. It also applies to a relevant transaction where either party is established there. Other triggers include a politically exposed person or their family or close associates, and false or stolen identification you are minded to work past. The transaction route covers a transaction that is unusually complex or unusually large given its nature, an unusual pattern of transactions, or one or more transactions with no apparent economic or legal purpose. The measures depend on why it applies. The six measures in regulation 33(3A), among them source of wealth, source of funds and senior-management approval, attach to the Call for Action country trigger, unless the regulation 33(2) exception for a branch or majority-owned subsidiary applies. Simplified due diligence, at the other end, adjusts how much you do and when. It never removes the requirement, and it has to be set aside the moment your view of the risk changes.

            Then there is the part small practices most often leave to memory. Five years of records from the end of the relationship, and deletion after that unless something else requires otherwise. An arrangement for keeping the file under review, because acceptance isn't the end of it. And a clear line between what a checklist settles and what a person decides. The risk judgement, whether to act at all, and anything touching the reporting duty, which goes to the nominated officer where the firm has one, or by the direct NCA route for a sole practitioner with no employees or associates. The checklist stops there.

            One last distinction worth having in writing. A completed money laundering checklist is not a sanctions check. Different regime, different list, different route, and the UK Sanctions List is published by the FCDO. The cross-government reporting service sends a suspected breach to the correct authority. OFSI is the route for financial sanctions, while other sanctions have other routes, and all of that is separate from any report to the National Crime Agency. Practices conflate the two more often than they think.

            Sources and last checked

            We compiled the item map on 24 August 2026, and 24 August 2026 is the date printed against the guidance edition in the result card and on every file note.

            Rows re-read since then carry their own dates: the legal sector's guidance on 25 August 2026, Companies Act 2006 Part 21A on 26 August 2026 and regulation 7 on 8 September 2026. The whole map also went through an independent fact-check against its primary sources on 3 September 2026.

            The Money Laundering Regulations 2017, as amended
            The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, amended most recently on 30 June 2026, read on legislation.gov.uk.
            The accountancy sector guidance, July 2026
            The Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector. Published by CCAB on 5 August 2026, based on the law as at 1 July 2026, and approved by HM Treasury.
            HMRC on money laundering supervision
            Its guidance for accountancy service providers on GOV.UK, for the supervision and registration routes.
            The Proceeds of Crime Act 2002, sections 330 and 333A
            For the reporting duty, and for tipping off.
            The ICAEW Code of Ethics 2026, sections 310 and 320
            For the client-acceptance pane.
            Companies House and the National Crime Agency
            Companies House guidance on reporting a discrepancy about a person with significant control, and the National Crime Agency's own suspicious activity reporting service.
            The UK Sanctions List and the FATF Call for Action list
            The FCDO publishes the first, the Financial Action Task Force the second. Both are linked, never copied. They move, and a checklist that memorised either would be wrong within months.

            Every item on the page names which of these it rests on, and where a rule is a number we quote the regulation rather than round it.

            More free tools from Legal Directorate

            Get your practice listed - free, and free to stay

            You came here because a new client needed checking before any work could start. Now turn that round. The practices that attract clients who arrive documented and straightforward are usually the ones a prospective client could look up first: who they are, what work they do and who supervises them, all before the first call.

            We list professionals for free, send the enquiries on for free, take no payment for placement and charge no referral fee. When the enquiry turns into work, the client pays you and nothing comes back to us.

            Browse the directory

            We don't offer an "AML verified" mark, and nothing here implies we have checked or endorsed a practice's compliance. This page is the last place such a mark could honestly exist.

            Bookmark it for the next new client. There's nothing to share out of a run, and that's deliberate: the answers describe one client, so the printed file note is the only copy and it belongs in that client's file.

            Back To Top